Subject: [Geopriv] Shared location URIs

From: "Thomson, Martin" <[email-masked]>
Date: Fri, 21 Nov 2008 15:01:47 -0600

This issue came up in my review of the dhcp lbyr draft, but I think that it's worth discussing the implications of shared location URIs.  This also applies in other URI cases.

A shared location URI is one that results in the same location information.  A shared location URI might be used where there is a NAT/router device.  The LIS/DHCP server might provide a shared URI that is used by all hosts inside the network served by the NAT/router.

Shared URIs only work where all attributes are equal.  This includes location AND authorization.

HELD uses possession model by default.  This means that the authorization is the same for all URIs it serves.  Location URIs served using the possession model can be shared.

One attribute of the access control authorization model is that the location URI can be made public.  This is a desirable property, relied upon in sip-retransmission and no doubt other places.  I can publish such a URI to facebook and rely on the access control to prevent unauthorized access to my location information.  However, a shared URI that is made public by its users provides a linkage between those users.  This leaks information - namely that the targets sharing the URI are at the same location - even if that location is not explicitly known.

It is unclear which model is used in DHCP lbyr.  It seems to suggest that it uses an access control authorization model.  In this model, location URIs cannot be shared because each Target that is represented by the URI potentially has a different set of Rule Makers.

My suggestion is that DHCP lbyr uses the possession model.  Without an effective channel for conveying rules to the LS, this is the only feasible model.  Also, given the documented mechanism for relaying information through a NAT/router to multiple clients, sharing is explicitly allowed.  Changing to use the access control authorization model would be difficult and would require more protocol mechanism than necessary.

Regards,
Martin
------------------------------------------------------------------------------------------------
This message is for the designated recipient only and may
contain privileged, proprietary, or otherwise private information.  
If you have received it in error, please notify the sender
immediately and delete the original.  Any unauthorized use of
this email is prohibited.
------------------------------------------------------------------------------------------------
[mf2]
_______________________________________________
Geopriv mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/geopriv