Subject: [Geopriv] draft-barnes-geopriv-lo-sec-05 - Privacy Rules

From: "Hannes Tschofenig" <[email-masked]>
Date: Sat, 14 Mar 2009 22:03:34 +0200

A few comments on the Privacy Rules section in
http://tools.ietf.org/html/draft-barnes-geopriv-lo-sec-05#section-3.2.1

3.2.1. Privacy Rules

   The following are examples of Privacy Rules governing location
   distribution:

   o  Retransmit location when requested from example.com

   o  Retransmit location when requested by a specific group of
      requesters

   o  Retransmit only geodetic location

   o  Retransmit location accurate within 100 meters

   o  Retransmit location only to the first three recipients who request
      it

   o  Retransmit location only before midnight on December 31, 2009

I think that these rules could be clarified a bit. I assume that these rules
have to be considered of what we have developed in GEOPRIV rather than what
could theoretically be specified. 

We don't really support the concepts of "groups" in Common Policy unless the
group is a list of individuals. If the group of people relates to a specific
domain then this is possible to express. If the list of persons is
enumerable then this possible as well. So, what specific usage was
envisioned here. 

The policy "Retransmit only geodetic location" might not make a lot of sense
although it is possible to formulate such a policy. 
It would make more sense to say "Alice grants access to civic location for
requests from unknown requestors at country level granularity."

In Common Policy/Geolocation Policy we don't really have a way to express a
policy like "Retransmit location only to the first three recipients who
request it". This is only functionality offered by the HELD context
mechanism and there the usage was more meant to provide one-time vs.
multiple times. 

The other policies might be better re-worded as: 

  o Alice grants access to her current location when the request came from
her co-workers at from the domain "example.com"
  
  o Alice grants Bob access to her location fuzzied with a 100 meter radius.

  o Alice grants workshop participants access to her location information
during the duration of the workshop. 

   Location Servers enforce Privacy Rules in two ways: by denying
   requests for location, or by transforming the location information
   before retransmitting it.  Some Rules will only be enforceable
   through denial.  For example, if the entire Rule set for a particular
   Target consisted of the first Rule listed above, then a Location
   Server would be required to deny all requests for the Target's
   location from any recipients other than example.com.  On the other
   hand, the second rule above could be enforced either by rejecting
   requests for civic location or by stripping out all civic location
   from a LO received from an LG before retransmitting the LO to any LR
   that requests it.
   
I would shorten this paragraph to the first sentence. 

   Location Servers may also receive Rules governing location retention,
   such as:

   o  Retain location only for 24 hours

   o  Retain location only until December 31, 2009

   These Rules are simply directives about how long the Target's
   location information can be retained.

One might want to state that this functionality can be expressed as part of
the transformations. 
Section 6.2. "Set Retention-Expiry" of
http://tools.ietf.org/html/draft-ietf-geopriv-policy-20 does not allow the
second statement to be expressed. 

Terminology again: Local Rules vs. Forwarded Rules. It may be useful to
introduce terminology. I wonder whether "Access Control Policies" and
"Sticky Policies" aren't better term given that the term sticky policy is
IMHO known in the privacy community already.

Suppose Alice provides the following Local Rules to
   a Location Server:

   o  The LS may retain location only for 24 hours

   o  The LS may retransmit Alice's precise location to Bob, who in turn
      is permitted to retain the location information for one month

   o  The LS may retransmit Alice's city, state, and country to Steve,
      who in turn is permitted to retain the location information for
      one hour

   o  The LS may retransmit Alice's country to a photo-sharing website,
      which in turn is permitted to retain the location information
      indefinitely and retransmit it to any requesters

We don't have a way to express the first rule. 

There are interestingly no examples in our documents how to express the last
rule but here is an example: 

   <?xml version="1.0" encoding="UTF-8"?>
   <ruleset xmlns="urn:ietf:params:xml:ns:common-policy"
     xmlns:gp="urn:ietf:params:xml:ns:geolocation-policy"
     xmlns:lp="urn:ietf:params:xml:ns:basic-location-profiles">

       <rule id="f3g44r1">
           <conditions>
               <identity>
                   <one id="http:www.phone-share.example.com"/>
               </identity>
           </conditions>
           <actions/>
           <transformations>
		     <gp:set-retransmission-allowed>true
             </gp:set-retransmission-allowed>
			 <gp:set-retention-expiry>4294967295
			 </gp:set-retention-expiry>
             <gp:set-note-well xml:lang="en">
			    My privacy policy goes in here.
             </gp:set-note-well>
             <gp:keep-rule-reference>false
             </gp:keep-rule-reference>
			 <gp:provide-location
               profile="civic-transformation">
               <lp:provide-civic>country</lp:provide-civic>
             </gp:provide-location>
		   </transformation>
       </rule>

   </ruleset>

I noticed that we don't have a way to express infinity with the
<set-retention-expiry> element. 
But the currently allowed values would keep the information fairly long...

Ciao
Hannes