Re: [Geopriv] Security Considerations:draft-thomson-geopriv-held-measurements-02.txt

The point on random checks probably needs consideration.

I think that on the point of depending on the more accurate location information, perhaps that is something to be explored in one of the many location trust documents.  I'd be happy to explore it further in here as well.

What do you see as the privacy issues beyond what is already discussed in the draft?

Cheers,
Martin

> -----Original Message-----
> From: Eric Rescorla [mailto:ekr@networkresonance.com]
> Sent: Friday, 1 August 2008 4:00 AM
> To: Thomson, Martin
> Cc: Eric Rescorla; geopriv@ietf.org
> Subject: Re: [Geopriv] Security Considerations:draft-thomson-geopriv-
> held-measurements-02.txt
> 
> At Thu, 31 Jul 2008 09:02:30 -0500,
> Thomson, Martin wrote:
> > For the purposes of outright lying, some elements of information can
> > be directly verified by the LIS.  For these pieces of information,
> > the device provides value only by reducing the overall effort
> > expended by the LIS in generating location information.  The LIS is
> > able to authenticate this information by acquiring the information
> > using its own means.  In many cases checking that the information is
> > correct is far less costly than generating it in the first place.
> > This is certainly true for the scenarios my company has been looking
> > at in the past 18 months.  Even if this is not the case, the LIS can
> > check on random requests and the check can be made parallel to the
> > continuing processing of the request.
> 
> Hmm... So, say the check comes up mismatched. What then?  Random
> checks only works well if it's coupled with some sort of punishment...
> 
> 
> > The other case is obviously far more interesting.  There are parts
> > of the measurement information that cannot be validated by the LIS
> > are quite clearly open to lying.  However, you need to look at the
> > goals of this draft.  The point is to make available, to the LIS,
> > information that can be used to improve the accuracy of the
> > information that it provides.  We have to assume that the LIS is
> > able to determine the location of the device using some means,
> > however coarse that is.  The impact of a lie on the final result
> > that is produced can be constrained.  If for instance a device lies
> > about its RTT measurements for WiMAX in such a way that the LIS is
> > still able to use them, the result that is produced can be no
> > further from the real location of the device than the uncertainty on
> > the location information that the LIS is able to determine on its
> > own.
> >
> > With this view in mind, it's easier to understand the impact of the
> > lie.  The LIS is able to take the spoofed measurement information
> > and either check it entirely, or it is able to constrain the impact
> > of the lie.
> >
> > We have product that implements these mechanisms already in the
> > cellular wireless space.  Our SMLC, SAS and SUPL servers do this for
> > A-GPS.  We use the cell-based location to check the A-GPS location
> > information.  If the A-GPS position differs excessively from the
> > cell-based one we are able to reject (or just log) the result.
> 
> Well, I see your point here, but if the relying party cares
> about positions within the margin of error, then lying becomes
> serious.
> 
> And of course, this doesn't address the privacy issues...
> 
> -Ekr
> 

------------------------------------------------------------------------------------------------
This message is for the designated recipient only and may
contain privileged, proprietary, or otherwise private information.  
If you have received it in error, please notify the sender
immediately and delete the original.  Any unauthorized use of
this email is prohibited.
------------------------------------------------------------------------------------------------
[mf2]
_______________________________________________
Geopriv mailing list
Geopriv@ietf.org
https://www.ietf.org/mailman/listinfo/geopriv