Re: [Ideas] Comments on draft-ccm-ideas-identity-use-cases-02

[Uma Chunduri <[e-mail]>]

Coming back to the IDEAS work, one of the goals is to create a standardized mapping system with various ID services (mobility, access security, pub/sub,  grouping etc). 
There are various enterprise deployments where these services are needed and the ability to authorize  who can update mapping and who can request mapping is critical for deploying some of  these services. 
For ILA or  for DC VM mobility some of the services may not be needed or Identity is an overhead (but I saw from your responses earlier, you need authorization on who can update in a multi tenenant environments) 
and that can be made optional if not needed.  But, I see you are arguing on both sides.  If you have a better solution to address the above needs please share it.

--
Uma C.

-----Original Message-----
From: Tom Herbert [mailto:[e-mail]] 
Sent: Monday, October 16, 2017 6:25 PM
To: Uma Chunduri <[e-mail]>
Cc: [e-mail]
Subject: Re: [Ideas] Comments on draft-ccm-ideas-identity-use-cases-02
...

	>This problem I highlighted would only exist on public networks where end user devices are not under complete control of the
	>infrastructure-- i.e. smart phones on a public carrier network.

	> In a private data center for instance, where all hosts can be controlled, there is no issue in running identifier-locator on hosts and that in fact is a common deployment of network virtualization.
[Uma]: Sure, agree. And you need a mapping system with standardized interfaces and a control protocol to interact to addressing this space.

	>The exploit I'm conjecturing would work like this:
	>* Suppose that a UE (e.g. a smartphone) participating in an identifier/locator protocols is hacked.
[Uma]: There are so many cases, where  things need to be handled, which includes not only hacked but lost/stolen devices etc. There is something called revocation or disabling the device based on the auth. method used in the device by the provider.

                ...

	>* Efforts to obfuscate or rotate identifiers does not help much here.
	>Obfuscation complicates routing in the network such that translations need to happen anyway. Periodic rotation of locators is defeated if there are enough devices doing the mapping to keep the maps up to date.
[Uma]: Obfuscation obviously doesn't solve all the evils. It has its own place and if we truly care use end to end encryption where ever is needed.
                Again, data plane constructs and mechanisms for protection are under the purview of the underlying ID/LOC protocol in question. IDEAS can only help augment some of the features needed for these protocols.

	>It's true this may be orthogonal to the design of a mapping system..
[Uma]: Yes, it's mostly orthogonal  to IDEAS.

                > Anyone who works at companies like Apple and Google that regularly collect device geo-location can vouch that it is among the most sensitive of all the PII they collect. 
	>Accordingly, they implement extremely strong access controls to the point that even that only a tiny number of employees can directly access the data.

[Uma]: You are right. This is exactly  what we have been arguing as well.  Any data that is sensitive will have strong access controls and not publicly exposed. 
 	Also, I am not understanding the above logic fully  - because all sorts of PII is collected in various applications or just because of the fact that you are on your cellular device your provider can track you (or how these are protected today). 
	Privacy seems more of a misnomer sometimes (from the apps, to browser to the cellular devices and this  only further proliferates with all sorts of  devices doing M2M would be on various networks soon).