Subject: [icnrg] (no subject)

From: Konstantinos Katsaros <[email-masked]>
Date: Thu, 7 Apr 2016 15:40:04 +0300

Hi,

I am not in the authors list, but the text in Section 2.2 belongs to a
contribution I made back in 2013 (managed by Kostas Pentikousis). I can
provide a short update of the section based on Nikos' recommendation, but I
think it would be better to arrange this offline. Is still Kostas or maybe
Borje managing this (?)

Kind regards,
Dinos

On 29 March 2016 at 14:31, Dirk Kutscher <[email-masked]> wrote:

> Thanks, Nikos.
>
> Let's hear the authors on this.
>
> --
> Best regards,
> Dirk
>
>
> Am 29.03.2016 um 12:35 schrieb Nikos Fotiou <[email-masked]>:
>
> Hi all,
> In ICN 2014 (Paris) there was a paper titled "Analyzing Cacheable Traffic
> in ISP Access Networks for Micro CDN Applications via Content-Centric
> Networking" (http://conferences2.sigcomm.org/acm-icn/2014/papers/p57.pdf).
> I believe the content of the paper fits in section 2.2 ( disclaimer, I am
> not affiliated with this paper).
>
> Moreover, in section 3.2 there is the following text:
> "An authorization
>  delegation scheme has been proposed [ACDICN] but this requires access
>  to a server controlled by the publisher to obtain an access token
>  making it essentially just an out-of-band key distribution system"
>
> Being the main author of [ACDICN] I would say that this statement is not
> accurate. The access token is not delivered out of band, neither is used as
> an encryption key. Moreover, the access control provider (i.e., the
> "server" mentioned in the text) is not controlled by the publisher but it
> is trusted by the publisher; in terms of currently used architectures, a
> publisher can be any user, the access control provider can be facebook, and
> the access control mechanism would be an enhanced version of facebook
> connect. The goal of the scheme is to allow a semi-trusted entity (e.g., a
> cache, a CDN node) to evaluate if a subscriber is authorized to access a
> publication, without having access to the user management system of the
> publisher. Therefore, encryption of the publication is orthogonal to this
> scheme.
>
> If you want, a more accurate description of [ACDICN] is the following:
> An authorization delegation scheme has been proposed [ACDICN]. This scheme
> allows semi-trusted entities (such as caches, CDN nodes) to delegate access
> control decisions to 3rd party access control providers that are trusted by
> the content publisher. The former entities have no access to subscriber
> related information and should respect the decisions of the access control
> providers.
>
> Finally, in the same section there is the following text
> "One possible technique that could allow for providing access control
>  to heterogeneous groups and still allow for a single encrypted object
>  representation that remains cacheable is Attribute Based Encryption
>  (ABE). A first proposal for this is presented in [ABE]"
>
> I believe this statement is not very accurate. With Attribute Based
> Encryption , all attributes (and the corresponding cryptographic keys) must
> be derived by the same entity. Therefore, the group of users cannot be
> heterogeneous, instead users should belong to the same administrative
> domain (e.g., users of the same social network). Moreover, although
> probably out of the scope of this draft, it should be kept in mind that
> Attribute Based Encryption suffers from key escrow problems and key
> revocation posses non-negligible overhead.
>
> Best,
> Nikos
>
>
> On 21 March 2016 at 15:14, Dirk Kutscher <[email-masked]> wrote:
>
>> Let's do another RG last call for this.
>>
>> Please let us know of any comments until Monday, March 28th, 23:59 PST.
>>
>> Best regards,
>> Dirk
>>
>>
>> > -----Original Message-----
>> > From: icnrg [mailto:[email-masked]] On Behalf Of internet-
>> > [email-masked]
>> > Sent: Montag, 21. März 2016 13:05
>> > To: [email-masked]
>> > Cc: [email-masked]
>> > Subject: [icnrg] I-D Action:
>> draft-irtf-icnrg-evaluation-methodology-04.txt
>> >
>> >
>> > A New Internet-Draft is available from the on-line Internet-Drafts
>> directories.
>> > This draft is a work item of the Information-Centric Networking of the
>> IETF.
>> >
>> >         Title           : Information-centric Networking: Evaluation
>> and Security
>> > Considerations
>> >         Authors         : Kostas Pentikousis
>> >                           Borje Ohlman
>> >                           Elwyn Davies
>> >                           Spiros Spirou
>> >                           Gennaro Boggia
>> >       Filename        : draft-irtf-icnrg-evaluation-methodology-04.txt
>> >       Pages           : 34
>> >       Date            : 2016-03-11
>> >
>> > Abstract:
>> >    This document presents a number of considerations regarding
>> >    evaluating Information-centric Networking (ICN) and sheds some light
>> >    on the impact of ICN on network security. It also surveys the
>> >    evaluation tools currently available to researchers in the ICN area
>> >    and provides suggestions regarding methodology and metrics.
>> >
>> >
>> >
>> > The IETF datatracker status page for this draft is:
>> >
>> https://datatracker.ietf.org/doc/draft-irtf-icnrg-evaluation-methodology/
>> >
>> > There's also a htmlized version available at:
>> > https://tools.ietf.org/html/draft-irtf-icnrg-evaluation-methodology-04
>> >
>> > A diff from the previous version is available at:
>> >
>> https://www.ietf.org/rfcdiff?url2=draft-irtf-icnrg-evaluation-methodology-04
>> >
>> >
>> > Please note that it may take a couple of minutes from the time of
>> submission
>> > until the htmlized version and diff are available at tools.ietf.org.
>> >
>> > Internet-Drafts are also available by anonymous FTP at:
>> > ftp://ftp.ietf.org/internet-drafts/
>> >
>> > _______________________________________________
>> > icnrg mailing list
>> > [email-masked]
>> > https://www.irtf.org/mailman/listinfo/icnrg
>>
>> _______________________________________________
>> icnrg mailing list
>> [email-masked]
>> https://www.irtf.org/mailman/listinfo/icnrg
>>
>
>
> _______________________________________________
> icnrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/icnrg
>
>

---

From: Kostas Pentikousis <[email-masked]>
Date: Thu, 7 Apr 2016 15:23:00 +0200 (CEST)

Many thanks to Dinos and Nikos for bringing this up. 

Given the document status, I guess it would be better to send the update to the list as well, so that we can converge fast at the RG level and add it to the current working version which we would like to upload in a couple of days or so.

Classic format would be best:

OLD

Old text from -04

NEW

New text for -05

Best regards,

Kostas

From: Konstantinos Katsaros [mailto:[email-masked]] 
Sent: Thursday, 7 April, 2016 2:40 PM
To: Dirk Kutscher <[email-masked]>
Cc: [email-masked]; Nikos Fotiou <[email-masked]>
Subject: [icnrg] (no subject)

Hi,

I am not in the authors list, but the text in Section 2.2 belongs to a contribution I made back in 2013 (managed by Kostas Pentikousis). I can provide a short update of the section based on Nikos' recommendation, but I think it would be better to arrange this offline. Is still Kostas or maybe Borje managing this (?)

Kind regards,

Dinos

On 29 March 2016 at 14:31, Dirk Kutscher <[email-masked] <mailto:[email-masked]> > wrote:

Thanks, Nikos.

--

Best regards,

Dirk

Am 29.03.2016 um 12:35 schrieb Nikos Fotiou <[email-masked] <mailto:[email-masked]> >:

Hi all,

In ICN 2014 (Paris) there was a paper titled "Analyzing Cacheable Traffic in ISP Access Networks for Micro CDN Applications via Content-Centric Networking" (http://conferences2.sigcomm.org/acm-icn/2014/papers/p57.pdf). I believe the content of the paper fits in section 2.2 ( disclaimer, I am not affiliated with this paper).

Being the main author of [ACDICN] I would say that this statement is not accurate. The access token is not delivered out of band, neither is used as an encryption key. Moreover, the access control provider (i.e., the "server" mentioned in the text) is not controlled by the publisher but it is trusted by the publisher; in terms of currently used architectures, a publisher can be any user, the access control provider can be facebook, and the access control mechanism would be an enhanced version of facebook connect. The goal of the scheme is to allow a semi-trusted entity (e.g., a cache, a CDN node) to evaluate if a subscriber is authorized to access a publication, without having access to the user management system of the publisher. Therefore, encryption of the publication is orthogonal to this scheme. 

If you want, a more accurate description of [ACDICN] is the following:
An authorization delegation scheme has been proposed [ACDICN]. This scheme allows semi-trusted entities (such as caches, CDN nodes) to delegate access control decisions to 3rd party access control providers that are trusted by the content publisher. The former entities have no access to subscriber related information and should respect the decisions of the access control providers. 

I believe this statement is not very accurate. With Attribute Based Encryption , all attributes (and the corresponding cryptographic keys) must be derived by the same entity. Therefore, the group of users cannot be heterogeneous, instead users should belong to the same administrative domain (e.g., users of the same social network). Moreover, although probably out of the scope of this draft, it should be kept in mind that Attribute Based Encryption suffers from key escrow problems and key revocation posses non-negligible overhead. 

Best,

Nikos

On 21 March 2016 at 15:14, Dirk Kutscher <[email-masked] <mailto:[email-masked]> > wrote:

Best regards,
Dirk

> From: icnrg [mailto:[email-masked] <mailto:[email-masked]> ] On Behalf Of internet-
> [email-masked] <mailto:[email-masked]> 
> To: [email-masked] <mailto:[email-masked]> 
> Cc: [email-masked] <mailto:[email-masked]> 
> Subject: [icnrg] I-D Action: draft-irtf-icnrg-evaluation-methodology-04.txt
>
>
> A New Internet-Draft is available from the on-line Internet-Drafts directories.
> This draft is a work item of the Information-Centric Networking of the IETF.
>
>         Title           : Information-centric Networking: Evaluation and Security
> Considerations
> Please note that it may take a couple of minutes from the time of submission
> until the htmlized version and diff are available at tools.ietf.org <http://tools.ietf.org> .
>
> [email-masked] <mailto:[email-masked]> 

_______________________________________________
icnrg mailing list
[email-masked] <mailto:[email-masked]> 
https://www.irtf.org/mailman/listinfo/icnrg

_______________________________________________
icnrg mailing list
[email-masked] <mailto:[email-masked]> 
https://www.irtf.org/mailman/listinfo/icnrg

---

From: Konstantinos Katsaros <[email-masked]>
Date: Fri, 8 Apr 2016 14:45:41 +0300

Hi again,

Please find below the promised short update. I have not updated Table II on
purpose as, to the best of my knowledge (please correct me if I'm wrong),
the study does not distinguish between VoD and non-VoD traffic as the table
does.

Feel free to adjust if needed.

Kind regards,
Dinos

--------------------------------------------------------------------------------------------------------
*OLD*

   where the sum is obtained considering all values of j, 1 <= j <= M.

   A variation of the Zipf distribution, termed the Mandelbrot-Zipf
   distribution ...

*NEW*

   where the sum is obtained considering all values of j, 1 <= j <= M.

*   A recent analysis of HTTP traffic showed that content *
*   popularity is better reflected by a trimodal distribution model in *
*   which the head and tail of a Zipf distribution (with slope value *
*   0.84) are replaced by two discrete Weibull distributions with shape *
*   parameter values 0.5 and 0.24 respectively **[IMB2014]**.*

   A variation of the Zipf distribution, termed the Mandelbrot-Zipf
   distribution ...

--------------------------------------------------------------------------------------------------------
 Also the following reference must be added:

*[IMB2014]  C. Imbrenda, L. Muscariello, and D. Rossi,"Analyzing *
* Cacheable Traffic in ISP Access Networks for Micro CDN *
*   Applications via Content-Centric Networking," In Proc. of *
*   ACM ICN, 2014.*
--------------------------------------------------------------------------------------------------------

On 7 April 2016 at 16:23, Kostas Pentikousis <[email-masked]>
wrote:

> Given the document status, I guess it would be better to send the update
> to the list as well, so that we can converge fast at the RG level and add
> it to the current working version which we would like to upload in a couple
> of days or so.
>
>
>
> *From:* Konstantinos Katsaros [mailto:[email-masked]]
> *Sent:* Thursday, 7 April, 2016 2:40 PM
> *To:* Dirk Kutscher <[email-masked]>
> *Cc:* [email-masked]; Nikos Fotiou <[email-masked]>
> *Subject:* [icnrg] (no subject)
>
>
>
> Hi,
>

---

From: Nikos Fotiou <[email-masked]>
Date: Fri, 8 Apr 2016 16:38:38 +0300

I think Kontastinos addition is fine.

Best,
Nikos

On 8 April 2016 at 14:45, Konstantinos Katsaros <
[email-masked]> wrote:

> Hi again,
>
> Please find below the promised short update. I have not updated Table II
> on purpose as, to the best of my knowledge (please correct me if I'm
> wrong), the study does not distinguish between VoD and non-VoD traffic as
> the table does.
>
> On 7 April 2016 at 16:23, Kostas Pentikousis <[email-masked]
> > wrote:
>
>> An authorization delegation scheme has been proposed [ACDICN]. This
>> scheme allows semi-trusted entities (such as caches, CDN nodes) to delegate
>> access control decisions to 3rd party access control providers that are
>> trusted by the content publisher. The former entities have no access to
>> subscriber related information and should respect the decisions of the
>> access control providers.
>>