Re: [ppsp] ***SPAM*** 8.158 (5) 答复: ***SPAM*** 8.258 (5) 答复: 答复: tracker protocol review

Hi Lingli,

In fact, that was the basic idea, having the hashprints of content at the MPD, not requiring involvement of the tracker protocol.
A few words in security sections, as well as in sections 1.2.3 "Content Information Metadata" and 1.2.4 "Authentication, Confidentiality, Integrity", would make this clearer.

Regards,

Rui Cruz
rui.cruz@ieee.org

IST/INESC-ID/INOV - Lisbon, Portugal
__________________________________________
ppsp mailing list
ppsp@ietf.org
https://www.ietf.org/mailman/listinfo/ppsp

On 05/11/2012, at 17:41, 邓灵莉/Lingli Deng <denglingli@chinamobile.com> wrote:

> Hi Rui,
>  
> MPD seems fine to me. Shall we add a few words in the security section to clarify that the integrity problem can be solved by including the hashprints of the content (be it chunk-level or content-level) into  content information metadata. For instance, as in MPD format. However, this can also be done through maybe a web portal without tracker’s involvement.
>  
> What do you think?
>  
> BR
> Lingli
>  
> 发件人: Rui Cruz [mailto:rui.cruz@ieee-pt.org] 代表 Rui Cruz
> 发送时间: 2012年11月5日 8:24
> 收件人: 邓灵莉/Lingli Deng
> 抄送: Rui Cruz; 'zhangyunfei'; 'Yingjie Gu(yingjie)'; 'ppsp'
>  
> 
> 主题: Re: [ppsp] ***SPAM*** 8.258 (5) 答复: 答复: tracker protocol review
>  
> Hi Yunfei and Lingli,
>  
> In section 1.2.3 "Content Information Metadata" and 1.2.4 "Authentication, Confidentiality, Integrity", although informative in nature, the aspect on content integrity is somewhat raised, but not described. However, stating in the draft that "content information metadata used in PPSP may align with MPD formats, such as ISO/IEC 23009-1" means that content protection and integrity verification schemes can be distributed by including root fingerprints for each each video and audio groups described in the MPD of the content.
>  
> In Appendix B. Media Presentation Description (MPD) of draft-gu-ppsp-tracker-protocol-07, that situation was fairly described with examples, but that section was not transferred to the Base-Protocol draft, as suggested during discussions.
>  
> In my opinion, I hardly see the distribution of the fingerprints as a role of the tracker protocol as these schemes are related to the content, but I would strongly support not just channel-oriented security in the communication between peers and tracker but also authentication and authorization mechanisms for the peers.
> 
> Regards,
>  
> Rui Cruz
> rui.cruz@ieee.org
>  
> IST/INESC-ID/INOV - Lisbon, Portugal
> __________________________________________
> ppsp mailing list
> ppsp@ietf.org
> https://www.ietf.org/mailman/listinfo/ppsp
>  
> On 05/11/2012, at 12:32, 邓灵莉/Lingli Deng <denglingli@chinamobile.com> wrote:
> 
> 
> All right. I will discuss it with Yingjie and Rui today. See what to do about it.
> Lingli
> 发件人: zhangyunfei [mailto:zhangyunfei@chinamobile.com] 
> 发送时间: 2012年11月5日 0:40
> 收件人: '邓灵莉'; Yingjie Gu(yingjie); 'Rui Cruz'
> 抄送: ppsp
> 主题: 回复: 答复: [ppsp] tracker protocol review
>  
> Yes, Lingli. I mean it would be good to write explicitly to say how to handle this in tracker protocol.
>  
> BR
> Yunfei
> zhangyunfei
>  
> 发件人： 邓灵莉/Lingli Deng
> 发送时间： 2012-11-05 12:11
> 收件人： 'zhangyunfei'; 'Yingjie Gu\(yingjie\)'; 'Rui Cruz'
> 抄送： 'ppsp'
> 主题： 答复: [ppsp] tracker protocol review
> Yunfei,
> As for your comment asking for clarification for content integrity’s relation to tracker protocol, I would like to explain that as pointed out at the end of Section 9.2,  content pollution
> can be detected by incorporating integrity verification schemes for published shared contents.  As content chunks are transferred independently and concurrently, a correspondent chunk-level integrity verification MUST be used, checked with signed fingerprints received from authentic origin.
> In other words, these fingerprints MUST be signed by the authentic origin of the content, and MUST be distributed in a trustworthy manner against manipulation and forgery.
> It would be reasonable to expect such distribution be handled by the tracker protocol in a security-enhanced sense.
> BR
> Lingli
> 发件人: ppsp-bounces@ietf.org [mailto:ppsp-bounces@ietf.org] 代表 zhangyunfei
> 发送时间: 2012年11月4日 22:29
> 收件人: Yingjie Gu(yingjie); 'Rui Cruz'
> 抄送: ppsp
> 主题: [ppsp] tracker protocol review
>  
> Hi Rui and Yingjie (Speaking individually) ,
>     I have read the updated tracker protocol draft and have the following comments:
> 1) Encoding issue: It's good to mention that PPSP-TP is intended to support binary encoding in section 4. However in section 5, 7 and 8, http+XML is still in the main page. Is this just for example? Or a general semantics desperation is enough? I think much of section 7.1 in current version can be placed in Appendix A. Are you intending to use EXI for the binary encoding and do you still need http for the underlying transport?
> 2)  Check the section 10 for the XML descriptions. Do we need the update of this part?
> 3)Security part, section 9.2, how does the content integrity check related to the tracker protocol should be better explained.
>  
> BR
> Yunfei
>  
> zhangyunfei
> _______________________________________________
> ppsp mailing list
> ppsp@ietf.org
> https://www.ietf.org/mailman/listinfo/ppsp
>  
> _______________________________________________
> ppsp mailing list
> ppsp@ietf.org
> https://www.ietf.org/mailman/listinfo/ppsp