[ppsp] 回复: 答复: ***SPAM*** 8.258 (5) 答复: 答复: tracker protocol review

Hi Lingli,
   To the best of my understanding, PPSP assumes a trustful content publisher and should identifies only the malicious PEERs. In other words, PPSP is not a complete system to satisfy the suer experience in p2p streaming. Rather it just addresses how to do the communications among peers and trackers and in the process avoiding malicious peers to do the attack/pollutions. The issue to ensure the content publisher trustful is a necessary problem to consider when running a practical p2p streaming system esp. when UGC contents are involved. We welcome contributions in BCP drafts on this issue. 

BR
yunfei

zhangyunfei

发件人： 邓灵莉/Lingli Deng
发送时间： 2012-11-06 01:41
收件人： 'Rui Cruz'; arno@cs.vu.nl
抄送： 'zhangyunfei'; 'Yingjie Gu\(yingjie\)'; 'ppsp'
主题： 答复: [ppsp] ***SPAM*** 8.258 (5) 答复: 答复: tracker protocol review
Hi all,

As Arno presented the security proposals in peer protocol, and stated that they meet the security part in the requirement document, I felt a concern with the status in PPSP scope in terms of security issues.
Since the content publishing is now out of scope of the discussion, the very root of trust for the content provided by a peering party to satisfy the user’s expectation is missing. 

This cannot be compensated by peer authentication or authorization mechanisms directly, I am afraid. 

BR
Lingli

发件人: Rui Cruz [mailto:rui.cruz@ieee-pt.org] 代表 Rui Cruz
发送时间: 2012年11月5日 8:24
收件人: 邓灵莉/Lingli Deng
抄送: Rui Cruz; 'zhangyunfei'; 'Yingjie Gu(yingjie)'; 'ppsp'
主题: Re: [ppsp] ***SPAM*** 8.258 (5) 答复: 答复: tracker protocol review

Hi Yunfei and Lingli,

In section 1.2.3 "Content Information Metadata" and 1.2.4 "Authentication, Confidentiality, Integrity", although informative in nature, the aspect on content integrity is somewhat raised, but not described. However, stating in the draft that "content information metadata used in PPSP may align with MPD formats, such as ISO/IEC 23009-1" means that content protection and integrity verification schemes can be distributed by including root fingerprints for each each video and audio groups described in the MPD of the content.

In Appendix B. Media Presentation Description (MPD) of draft-gu-ppsp-tracker-protocol-07, that situation was fairly described with examples, but that section was not transferred to the Base-Protocol draft, as suggested during discussions.

In my opinion, I hardly see the distribution of the fingerprints as a role of the tracker protocol as these schemes are related to the content, but I would strongly support not just channel-oriented security in the communication between peers and tracker but also authentication and authorization mechanisms for the peers.

Regards,

Rui Cruz
rui.cruz@ieee.org

IST/INESC-ID/INOV - Lisbon, Portugal
__________________________________________
ppsp mailing list
ppsp@ietf.org
https://www.ietf.org/mailman/listinfo/ppsp

On 05/11/2012, at 12:32, 邓灵莉/Lingli Deng <denglingli@chinamobile.com> wrote:

All right. I will discuss it with Yingjie and Rui today. See what to do about it.
Lingli
发件人: zhangyunfei [mailto:zhangyunfei@chinamobile.com] 
发送时间: 2012年11月5日 0:40
收件人: '邓灵莉'; Yingjie Gu(yingjie); 'Rui Cruz'
抄送: ppsp
主题: 回复: 答复: [ppsp] tracker protocol review

Yes, Lingli. I mean it would be good to write explicitly to say how to handle this in tracker protocol.

BR
Yunfei

zhangyunfei

发件人： 邓灵莉/Lingli Deng
发送时间： 2012-11-05 12:11
收件人： 'zhangyunfei'; 'Yingjie Gu\(yingjie\)'; 'Rui Cruz'
抄送： 'ppsp'
主题： 答复: [ppsp] tracker protocol review
Yunfei,
As for your comment asking for clarification for content integrity’s relation to tracker protocol, I would like to explain that as pointed out at the end of Section 9.2,  content pollution
can be detected by incorporating integrity verification schemes for published shared contents.  As content chunks are transferred independently and concurrently, a correspondent chunk-level integrity verification MUST be used, checked with signed fingerprints received from authentic origin.
In other words, these fingerprints MUST be signed by the authentic origin of the content, and MUST be distributed in a trustworthy manner against manipulation and forgery.
It would be reasonable to expect such distribution be handled by the tracker protocol in a security-enhanced sense.
BR
Lingli
发件人: ppsp-bounces@ietf.org [mailto:ppsp-bounces@ietf.org] 代表 zhangyunfei
发送时间: 2012年11月4日 22:29
收件人: Yingjie Gu(yingjie); 'Rui Cruz'
抄送: ppsp
主题: [ppsp] tracker protocol review

Hi Rui and Yingjie (Speaking individually) ,
    I have read the updated tracker protocol draft and have the following comments:
1) Encoding issue: It's good to mention that PPSP-TP is intended to support binary encoding in section 4. However in section 5, 7 and 8, http+XML is still in the main page. Is this just for example? Or a general semantics desperation is enough? I think much of section 7.1 in current version can be placed in Appendix A. Are you intending to use EXI for the binary encoding and do you still need http for the underlying transport?
2)  Check the section 10 for the XML descriptions. Do we need the update of this part?
3)Security part, section 9.2, how does the content integrity check related to the tracker protocol should be better explained.

BR
Yunfei

zhangyunfei
_______________________________________________
ppsp mailing list
ppsp@ietf.org
https://www.ietf.org/mailman/listinfo/ppsp