Subject: Re: [Geopriv] [FW: draft-anjum-pana-location-requirements-00.txt]

From: "Anjum, Farooq" <[email-masked]>
Date: Fri, 3 Mar 2006 18:37:05 -0500

Jim

   We are looking at scenarios which base authorization on identity
and/or location information.  The identity here could correspond to
whatever the system already uses (group identifiers, temporary
identifiers, anonymous identifiers etc).  Thus, in this ID no element of
user identity, beyond what is already revealed by the cryptographic
credentials, will be known to the authentication infrastructure.
Further, the draft intentionally defers to RFC 3693 for rules regarding
the privacy of the location information since this is out of scope for
this draft.  

In fact while this ID does not concern itself with location
verification, it (verification) would be needed to make the whole thing
work.  In such a case, the location verification can be done by a
separate entity and the identity verification by a separate entity. Both
of these decisions could be combined at an entity trusted while
following the user policies.  Thus, we do not have to violate the
privacy requirements as specified by the user. Other possibilities which
do not violate the user privacy policies also exist. 

farooq

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv