Re: [lmap] LMAP regulator use case

[<[e-mail]>]

James,

I agree that privacy (of the end user who has the MA) is important - in the ISP use case as well as the regulator one

http://tools.ietf.org/html/draft-ietf-lmap-framework-01#section-8 discusses privacy (data protection). It would be great to get your feedback on this section. One idea that's been raised is a Group-ID (section 8.7) - would be very interested to hear your opinion and also other ideas for improving privacy (personally am not convinced by the Group-ID, as seems a direct trade-off with security)

thanks
phil


From: James Miller [mailto:[e-mail]]
Sent: 06 November 2013 06:47
To: Nieminen Klaus
Cc: Eardley,PL,Philip,TUB8 R; [e-mail]; [e-mail]; Marc Linsner; Henning Schulzrinne
Subject: Re: [lmap] LMAP regulator use case

I would propose adding in section 2 or 4 some text describing a regulators need to ensure that policies intended to protect the privacy interests of a potential tester can be enforced using features available in the system.  Recognizing that http://www.ietf.org/id/draft-folks-lmap-framework-00.txt and in the lists there's a view that a single entity will be overseeing a large scale measurement, there is a clear need for a test infrastructure to include tools to enforce the privacy policies of the managing entity and coordinate collaborative activity.  A desire to protect the privacy of testers contributing to our mobile measurement effort lead our work on the project, and our decision to adopt changes to our fixed technical infrastructure and data model to support a totally anonymous collection at the MA and communications between controllers, and through the collectors and the test results collected.  I understand there has been discussion on this point in the past and we had included this in the Section 7 Security Considerations of our original I-D.  In any event I think the regulator use case benefits from calling the point out specifically.
http://tools.ietf.org/id/draft-schulzrinne-lmap-requirements-00.txt

Proposed addition in Section 2.2:
:: Regulators role in the development and enforcement of broadband Internet access service policies also require that the measurement approaches meet a high level of verifiability, accuracy and provider-independence to support valid and meaningful comparisons of Internet access service performance.   Regulators also require that policies intended to protect the privacy interests of potential testers can be enforced using features available in the system.

...