Subject: Re: [5gangip] Security & Identity Protection

From: "FIGURELLE, TERRY F" <[email-masked]>
Date: Wed, 18 Apr 2018 01:59:19 +0000

Actually we allocated a /56 to  the UE and support prefix delegation. The lower 64 bits are always randomized by the UE. While that is a huge volume of addresses this is what the standard requires and it can make Wi-Fi hotspot more interesting. The mobile network itself takes steps to prevent tracking.

You would never see the MAC address from the UE and we can hide the mobile IP address too. Similar to today's private IPv4 addresses you would only see the IPv6 address and MAC address from the edge device(s). This MAC would typically be a layer3 firewall (sandwich) where the aggregated routes pass thru and the IPv6 addresses of the transparent IPv6 proxy. Given the sheer volume of mobiles that go thru any proxy instance and the short duration of associations within the proxy it makes tracking a challenge. You would need other information and today's browsers can help or hinder that effort. A simply question to ask yourself is how do the companies I select make their money. Choose wisely!

If you've pissed off the Chinese government there is nothing mere mortals can do to protect you. If you're stupid none of us can protect you.

There is a feature that can be added if the user wants to act as a server on the Internet where they get a static Global Unique IPv6 and/or IPv4 public address from their HSS record. They could also opt for dynamic DNS where the IP address is persistent with the session but they have a static DNS FQDN. Users agree to the risks when they select these features.

We've offer this for public IPv4 addresses for a long time but we had to increase the price to discourage everyone from requesting that feature due to the sheer volume of public iPv4 addresses it would require. Global Unique IPv6 offers a new opportunity to support many more users of these features at reasonable costs. But most users don't need an externally visible IP address and may be better off without one.

We actually take identity protection and security quite seriously and the IPS solutions block many things. At our scale its impressive to think we scan every messaging object that we process and for standard protocols for email that use our relays and servers. Obviously if the user configures external email servers they are responsible for selecting ones that encrypt the transmissions and those external email providers should scan for malware.  At some point the end user must make smart choices and understand the implications of those choices.

If a user is concerned about tracking they might want to read about some large third parties and what they can do with your information and how they can track you. I hope laws in this area get stronger worldwide. Facebook just became the public "face" for this but they are only one of many companies that get value out of your information. Any company in that business has a conflict of interest with their users. But there are some notable large companies that do take this seriously and I am happy I work for one of those.

For the most part standards take too long to deal with new security and identity threats and mobile/network operators have a responsibility and an opportunity to add value by protecting subscriber information and dealing with new threats.

Terry Figurelle

Lead Member of Technical Staff

Wireless Network Arch. & Design

Mobility Core

AT&T Services

[email-masked]

cell - (206)601-5157

-----Original Message-----
From: 5gangip [mailto:[email-masked]] On Behalf Of Alexandre Petrescu
Sent: Wednesday, February 07, 2018 7:37 AM
To: [email-masked]
Subject: Re: [5gangip] Identifier size

Le 01/02/2018 à 18:42, Saleem Bhatti a écrit :

> Tom;

>> On 01 Feb 2018, at 16:50, Tom Herbert <[email-masked]

>> <mailto:[email-masked]>> wrote:

[...]

>> Use SLAAC to get a /64 to use with application where privacy is not a

>> concern. Provide DHCPv6 to get single untrackable addresses

If we want the addresses or prefixes to be untrackable then SLAAC may be

a recommendation, instead of DHCPv6, but.

Much of the trackability in 4G networks comes from the fact that the

link to UE is a point-to-point link.  There is a single prefix for this

ptp link, be it with SLAAC or DHCP.

So my question is whether someone works on making the 5G links to the UE

be more like shared links like in WiFi.  Many UEs already make the link

to the network look more like a WiFi link than a ptp link: it has a MAC

address, etc.  But the PGW still considers it as a ptp link.

terry>

I don't see value in that approach.

It's better to simply not expose UE information outside the mobility network. Besides you can't send unsolicited traffic to most consumer wireless solutions in the market today even for less sophisticated smaller mobile operators. It's typical to only allow  responses to requests the mobile makes and this is a standard  feature in PGW's today and GGSN's before that. The PGW is flow aware even without PCRF involvement. Packets that don't belong to an existing flow are simply discarded unless the subscriber has an option for Internet sourced traffic flows and even when those are enable they are typically of specific scope. Not all mobile operators allow end users to make that choice but the defaults are always selected to best protect the UE in vendor products.

We do test this stuff.

Even mobile-to-mobile traffic is blocked unless an explicit policy is enabled and those rules are specific as they can be. Often only for a single IP address and port combination(s). Plus all of the PGW vendors support looping traffic thru external security systems like firewalls even when both mobiles are within the same gateway and subnet. It's common to have multiple security systems in flow to protect and the TDF's have application specific security.

It's goof to consider security and identity protection within standards but we must allow for vendors and mobile operators to add value. Plus some threats are better dealt with at the edge where the threat comes from.

Alex

  for

>> privacy-sensitive or anonymous communications, Identifier locator

>> split needs to support both models.

> RFC8064 (PS) / RFC7217 (PS) has your second sentence covered, without

> needing a DHCPv6 server. (Avoids the DHCPv6 server becoming the tracking

> device.)

> As far as I can tell, the options for generating the Identifier value

> are for an ID/LOC system which conforms to RFC8200 (S) for a /64 Locator

> are:

> - SLAAC: where identity privacy or verifiable identity is not a concern.

> - RFC3972 (PS): where a cryptographically-verifiable identity is required.

> - RFC8064 (PS): where identity privacy is required.

> Possibly, there are other options.

> Cheers,

> --/Saleem

>> Tom

>> _______________________________________________

>> 5gangip mailing list

>> [email-masked]<mailto:[email-masked]> <mailto:[email-masked]>

>> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_5gangip&d=DwIF-g&c=LFYZ-o9_HUMeMTSQicvjIg&r=tO_sNxa2NTxwl2paJIf4zw&m=MNCBOQXnj4eMmRgjddLNhgkyJ9aH7jGodV2QCOBnXpQ&s=93X8fFfm_lQFThCNUtTSHNHDzrfpdzDQOuXxc7NYySk&e=

> _______________________________________________

> 5gangip mailing list

> [email-masked]<mailto:[email-masked]>

> https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_5gangip&d=DwIF-g&c=LFYZ-o9_HUMeMTSQicvjIg&r=tO_sNxa2NTxwl2paJIf4zw&m=MNCBOQXnj4eMmRgjddLNhgkyJ9aH7jGodV2QCOBnXpQ&s=93X8fFfm_lQFThCNUtTSHNHDzrfpdzDQOuXxc7NYySk&e=

_______________________________________________

5gangip mailing list

[email-masked]<mailto:[email-masked]>

https://urldefense.proofpoint.com/v2/url?u=https-3A__www.ietf.org_mailman_listinfo_5gangip&d=DwIF-g&c=LFYZ-o9_HUMeMTSQicvjIg&r=tO_sNxa2NTxwl2paJIf4zw&m=MNCBOQXnj4eMmRgjddLNhgkyJ9aH7jGodV2QCOBnXpQ&s=93X8fFfm_lQFThCNUtTSHNHDzrfpdzDQOuXxc7NYySk&e=