Subject: [Geopriv] Issue raised with Geolocation Policy

From: Hannes Tschofenig <[email-masked]>
Date: Fri, 21 Sep 2007 12:10:11 +0200

Hi all,

Sam Hartman, our Security AD, reviewed the Geolocation Policy document
(see http://tools.ietf.org/html/draft-ietf-geopriv-policy-12).

Here is the issue he identified:

"

I'm trying to think about the mechanisms in section 6 of the geopriv
document for reducing the granularity of location.  I'm wonder though
how effective these mechanisms are in cases where in addition to
getting one-time location information I'm also seeing transitions in
location information.

As an example if I see a transition from one building to a near by
building, I may well know much more about the civic location than
granularity.

Similarly, I'm wondering how much information monitoring transitions
in geodetic location would help me in discovering where someone is in
the best case.  I.E. where they are near a discontinuity in the
rounding.
"

Thanks to Sam for providing a detailed review of our document.

In had a discussion with Sam about this issue. I agreed that some 
information is disclosed when you cross the boundaries. More information 
is disclosed when the user picks small regions for the boundary (e.g., 
only room numbers are not shown). I believe it is useful to document 
this issue.

So, I would need feedback from the group.
a) Do you think that this is indeed a problem?
b) If yes, how should we document this aspect?

Ciao
Hannes

_______________________________________________
Geopriv mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/geopriv

---

From: Henning Schulzrinne <[email-masked]>
Date: Fri, 21 Sep 2007 19:13:46 +0200

There would be a way to address this: you add a random number to the  
position, with an absolute value of half the privacy region. That  
way, movement doesn't much matter.

On Sep 21, 2007, at 12:10 PM, Hannes Tschofenig wrote:

> information is disclosed when you cross the boundaries. More  
> information is disclosed when the user picks small regions for the  
> boundary (e.g., only room numbers are not shown). I believe it is  
> useful to document this issue.
>

---

From: Cullen Jennings <[email-masked]>
Date: Sat, 22 Sep 2007 09:39:50 -0700

Just thinking out loud here, no idea how to solve this yet ... If the  
random number was different each time you queried, then it seems like  
a bunch of quires would distribute across the regions and taking the  
average of them would give you a close estimate of the location. If  
the random number, once picked, was the same for all the queries  
until the target had moved enough that the answer was no long true,  
then something like that might be workable. It would be interesting  
to think about how much location information would be revealed by a a  
series of samples of someone driving on a highway across the country.

Cullen <with my individual hat on>

On Sep 21, 2007, at 10:13 AM, Henning Schulzrinne wrote:

> There would be a way to address this: you add a random number to  
> the position, with an absolute value of half the privacy region.  
> That way, movement doesn't much matter.

---

From: Henning Schulzrinne <[email-masked]>
Date: Sat, 22 Sep 2007 19:11:03 +0200

That's roughly what I was thinking of.

This doesn't work for civic locations, at least not without a lot of  
knowledge about proximate streets and cities, or a civic-to-geo+noise- 
to-civic mapping.

On Sep 22, 2007, at 6:39 PM, Cullen Jennings wrote:

>
> Just thinking out loud here, no idea how to solve this yet ... If  
> the random number was different each time you queried, then it  
> seems like a bunch of quires would distribute across the regions  
> and taking the average of them would give you a close estimate of  
> the location. If the random number, once picked, was the same for  
> all the queries until the target had moved enough that the answer  
> was no long true, then something like that might be workable. It  
> would be interesting to think about how much location information  
> would be revealed by a a series of samples of someone driving on a  
> highway across the country.
>