Re: [Pidloc] draft-nordmark-id-loc-privacy

[Tom Herbert <[e-mail]>]

On Fri, Oct 5, 2018 at 7:24 AM, Behcet Sarikaya <[e-mail]> wrote:
>
>
> On Thu, Oct 4, 2018 at 1:15 PM Tom Herbert <[e-mail]> wrote:
>>
>> On Thu, Oct 4, 2018 at 8:02 AM, Behcet Sarikaya <[e-mail]>
>> wrote:
>> > Hi Luigi, Dirk, all,
>> >
>> > So far we have a number of reviews on Erik's draft indicating some
>> > editorial
>> > issues and asking for clarification of some parts. All that is good.
>> >
>> > What I suggest is that we should also look into what he is saying in
>> > that
>> > draft, what is he suggesting as the future work to do?
>> >
>> > Here I am going to summary what I could find out:
>> >
>> > - We should concentrate on long-lived identifiers;
>> >
>> > - Worry not much on designing a privacy based unified mapping mapping
>> > system
>> > which we had concentrated in our previous activity. This is because only
>> > trusted devices can access the mappings  in an operator network
>> >
>> > - Instead worry about minimizing the privacy implication one can explore
>> > limiting to which peers and when the ID/ locator binding are exposed.
>> >
>> > The cases where ID/locator bindings are exposed (especially any mobile
>> > devices)
>> > - Family and friends for example where are parents sharing young
>> > children
>> > location
>>
>> I don't believe this case is relevant. There's already applications
>> that I can use to track my kids (like Life360). These use the GPS in
>> mobile devices and secure connections to trasmit location information;
>> it's far more accurate and secure than trying to deriving location
>> information from a few bits in an IP address.
>
>
> Yes, this has already  been alluded to in the draft:
>
> Today such location sharing happens at an application layer using GPS
>    coordinates.
>
>
>> I think it's a hard
>> requirement that Identifiers (IP addresses in general) must not expose
>> geo location or mobile devices, and it follows that identifier/locator
>> bindings should never be shared outside a network except LEA orders.
>>
>
> Here is the rest of the above paragraph I quoted from Erik's draft:
>
> But while such sharing is in effect, it wouldn't be
>    unreasonable to also consider sharing IP locators to make it more
>    efficient or more robust to e.g., route a video feed from one device
>    to another.
>
>
> What do you think?

Sure, it could be considered, but the benefits of exposing a third
party to identifier/locator mappings would have to be weighed against
the cost. The potential cost is weakened user privacy and security.
Locators will convey geo location in a mobile network, so if someone
knows identifier to locator mapping, then they know location of node
with that identifier. But more than that, knowledge of
identifier/locator mappings allow correlations to be made between
identifiers. For instance, if a device is using some number of
untrackable and uncorrelatable identifiers for privacy, knowledge of
identifier to locator mappings allows correlations to be made and the
identifiers that belong to the device can be deduced and the users can
be tracked.

Tom

>
>
> Behcet
>>
>> Tom
>>
>> > - In industrial IoT case, the devices belonging to the same company
>> > share
>> > ID/locator bindings but not share the ID/locator binding with third
>> > parties
>> >
>> > In Section 6, the draft points to some possibilities on how this
>> > limiting
>> > can be achieved:
>> >
>> > 1. pointing a locator for some fixed anchor point, like PGW or UPF
>> >
>> > 2. injecting routing prefixes for the ID prefixes into the normal
>> > routing
>> > system
>> >
>> > 3. not providing any stable locators across this boundary; only allow
>> > ephemeral IP addresses per session or otherwise limited exposure.
>> >
>> > In short, the draft is coming up with a lot work to do.
>> > We suggest that the group takes a close look into all these points and
>> > see
>> > what we can do :-)
>> > Regards,
>> > Behcet & Dirk
>> >
>> > --
>> > Pidloc mailing list
>> > [e-mail]
>> > https://www.ietf.org/mailman/listinfo/pidloc
>> >