Re: [Pidloc] draft-nordmark-id-loc-privacy

[Behcet Sarikaya <[e-mail]>]

Hi Tom,


On Mon, Oct 8, 2018 at 10:01 AM <[e-mail]> wrote:

> See below …
>
> Thanks and BR, Dirk
>
> On Fri, Oct 5, 2018 at 9:54 AM Tom Herbert <[e-mail]> wrote:
>
> On Fri, Oct 5, 2018 at 7:24 AM, Behcet Sarikaya <[e-mail]>
> wrote:
> >
> >
> > On Thu, Oct 4, 2018 at 1:15 PM Tom Herbert <[e-mail]> wrote:
> >>
> >> On Thu, Oct 4, 2018 at 8:02 AM, Behcet Sarikaya <[e-mail]
> >
> >> wrote:
> >> > Hi Luigi, Dirk, all,
> >> >
> >> > So far we have a number of reviews on Erik's draft indicating some
> >> > editorial
> >> > issues and asking for clarification of some parts. All that is good.
> >> >
> >> > What I suggest is that we should also look into what he is saying in
> >> > that
> >> > draft, what is he suggesting as the future work to do?
> >> >
> >> > Here I am going to summary what I could find out:
> >> >
> >> > - We should concentrate on long-lived identifiers;
> >> >
> >> > - Worry not much on designing a privacy based unified mapping mapping
> >> > system
> >> > which we had concentrated in our previous activity. This is because
> only
> >> > trusted devices can access the mappings  in an operator network
> >> >
> >> > - Instead worry about minimizing the privacy implication one can
> explore
> >> > limiting to which peers and when the ID/ locator binding are exposed.
> >> >
> >> > The cases where ID/locator bindings are exposed (especially any mobile
> >> > devices)
> >> > - Family and friends for example where are parents sharing young
> >> > children
> >> > location
> >>
> >> I don't believe this case is relevant. There's already applications
> >> that I can use to track my kids (like Life360). These use the GPS in
> >> mobile devices and secure connections to trasmit location information;
> >> it's far more accurate and secure than trying to deriving location
> >> information from a few bits in an IP address.
> >
> >
> > Yes, this has already  been alluded to in the draft:
> >
> > Today such location sharing happens at an application layer using GPS
> >    coordinates.
> >
> >
> >> I think it's a hard
> >> requirement that Identifiers (IP addresses in general) must not expose
> >> geo location or mobile devices, and it follows that identifier/locator
> >> bindings should never be shared outside a network except LEA orders.
> >>
> >
> > Here is the rest of the above paragraph I quoted from Erik's draft:
> >
> > But while such sharing is in effect, it wouldn't be
> >    unreasonable to also consider sharing IP locators to make it more
> >    efficient or more robust to e.g., route a video feed from one device
> >    to another.
> >
> >
> > What do you think?
>
> Sure, it could be considered, but the benefits of exposing a third
> party to identifier/locator mappings would have to be weighed against
> the cost. The potential cost is weakened user privacy and security.
> Locators will convey geo location in a mobile network, so if someone
> knows identifier to locator mapping, then they know location of node
> with that identifier.
>
>

> But more than that, knowledge of
> identifier/locator mappings allow correlations to be made between
> identifiers. For instance, if a device is using some number of
> untrackable and uncorrelatable identifiers for privacy, knowledge of
> identifier to locator mappings allows correlations to be made and the
> identifiers that belong to the device can be deduced and the users can
> be tracked.
>
>
>
So you are saying that there is a cost for allowing Id/Loc mappings.
Do you think that letting family and friends or Industrial IoT devices that
belong to my company know my locator also
poses similar cost or issue? What should we do?
How could this effect, e.g. ILA?

Behcet




> Absolutely.
>
>
>
> One reason why I posted this mail was to encourage the discussion of
> solution approaches in different
>
> IdLoc protocols.
>
> How could we treat each of cases of Family and Friends, Industrial IoT,
> etc. in ILA, ILNP, and LISP?
>
> What about the three points in Section 6?
>
>
>
> Behcet
>
>
>
> DH> I think we have to differentiate here between IP Locator mentioned
> above and geolocation. While the first used for end point routing may be
> statically correlated to a trackable geographic position and thus allow for
> privacy related tracking there should be measures to obfuscate this mapping
> to the outside world as the one between name or Identity to current
> location.
>
> As such measures could serve the choices how to handle ID/locator mapping
> mentioned by Erik in sect. 6:
>
> -   still using an ID/locator system but pointing a locator for some fixed
> anchor point,
>
> - injecting routing prefixes for the ID prefixes into the normal routing
> system
>
> - not providing any stable locators across the boundary between Id/Loc
> domain and rest of world …
>
>
>
> I have no preference for the time being
>
>