Hash conversion Feature

Introduced in ASN 2.5: Attribute Hashing for Sensitive Metadata

Overview

ASN 2.5 introduces Attribute Hashing to protect personally identifiable information (PII) and other sensitive fields exported through Kafka. When enabled, sensitive subscriber identifiers and IP address fields are pseudonymized before export, ensuring that downstream consumers do not receive raw subscriber information.

Supported Hashing

Attribute Hashing supports pseudonymization of subscriber identifiers and network address fields using deterministic hashing. Identical input values always generate the same hashed output, enabling correlation across exported metadata without revealing the original value.

Supported Hashing Parameters

Flag	Hashes
imsi	IMSI (all streams)
imei	IMEI
msisdn	MSISDN
username	RADIUS/PFCP User-Name
network_element_ip	Tunnel-endpoint IPs (RAN, UPF, PGW, SGW, eNodeB, MME-GTPC)
cplane_ue_ip	UE IP in control records
assigned_ip	RADIUS Assigned/Framed IP (v4/v6)
uplane_ue_ip	UE IP in U-plane records
outer_ip	Outer (tunnel) src+dst IPs in U-plane records
inner_ip	Inner (packet) src+dst IPs in U-plane records

Default Behavior

By default, the feature is disabled.

cat /etc/asn/config.json | grep hash
        "attribute_hash_enable": "false",
        "attribute_hash_algo": "aes-cmac"

attribute_hash_enable = false

Enhanced Behavior

When Attribute Hashing is enabled:

• Configured sensitive attributes are exported as deterministic hash values instead of their original values.

• Attributes that are not configured for hashing continue to be exported in clear text.

• Identical subscriber identifiers and IP addresses always produce the same hashed value, allowing correlation across:

  • Control Session metadata

  • User Session metadata

  • RADIUS Session metadata

  • Diameter Session metadata

  • Other supported export types

Runtime Configuration

Attribute Hashing supports runtime configuration updates.

• Per-attribute hashing configuration can be updated dynamically

• Enabling or disabling the global Attribute Hashing feature (attribute_hash_enable) requires an ASN restart and handled by ONES Fabric

Benefits

• Protects sensitive subscriber information before Kafka export.

• Prevents exposure of raw subscriber identifiers and IP addresses.

• Maintains deterministic correlation across multiple exported session types.

• Ensures Kafka topic keys do not expose sensitive information.

• Supports runtime configuration updates for individual hashing policies.

• Minimizes performance impact through shared hash caching.