Subject: [netlmm] #146: Location privacy goal motivation is unclear

From: netlmm <[email-masked]>
Date: Fri, 29 Sep 2006 22:09:08 -0000

#146: Location privacy goal motivation is unclear
------------------------------------------+---------------------------------
 Reporter:  [email-masked]      |       Owner:  [email-masked]
     Type:  defect                        |      Status:  new                     
 Priority:  major                         |   Milestone:  milestone4              
Component:  draft-ietf-netlmm-nohost-req  |     Version:  2.0                     
 Keywords:  REQ draft                     |  
------------------------------------------+---------------------------------
 Ted Hardie, Applications AD, filed this DISCUSS comment:

 > I think the whole section on location privacy needs extensive work.
 Some
 > of the threats described
 > therein have nothing to do with geography, and the assumptions on which
 > the geographic threats are
 >  based are not clearly stated.
 >
 > The GeoPRIV folks have worked in the area of geolocation privacy for
 some
 > time, and they may well be able to
 > provide help in how to clearly describe these issues.

-- 
Ticket URL: <http://tools.ietf.org/wg/netlmm/trac/ticket/146>
netlmm <http://tools.ietf.org/wg/netlmm/>
_______________________________________________
netlmm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/netlmm

---

From: netlmm <[email-masked]>
Date: Fri, 29 Sep 2006 22:14:44 -0000

#146: Location privacy goal motivation is unclear
-------------------------------------------+--------------------------------
  Reporter:  [email-masked]      |       Owner:  [email-masked]
      Type:  defect                        |      Status:  closed                  
  Priority:  major                         |   Milestone:  milestone4              
 Component:  draft-ietf-netlmm-nohost-req  |     Version:  2.0                     
Resolution:  fixed                         |    Keywords:  REQ draft               
-------------------------------------------+--------------------------------
Changes (by [email-masked]):

  * resolution:  => fixed
  * status:  new => closed

Comment:

 I rewrote the section as below:

 In a standard IP access network deployment, different IP subnets cover
 different geographical subregions across the geographical coverage area of
 the network. The granularity of the mapping between IP subnet prefix and
 geographical subregion varies. In a large granularity deployment, IP
 subnet prefixes may cover a metropolitan region; while in a very small
 granularity deployment, IP subnet prefixes may cover a single floor in a
 building. If the access network is a wireless network, the granularity may
 depend on the geographical footprint of the wireless cells. Cells in
 cellular type networks typically provide large geographical footprints and
 therefore IP subnets cover large geographical areas. In contrast, wireless
 LAN networks typically provide small geographical footprints, so IP subnet
 granularity is usually smaller.

 An attacker can collect information about what IP subnet prefixes map to
 what particular geographical subregions, and thereby develop a map that
 allows the attacker to determine the location of a corresponding node by
 simply looking at the source address of packets coming from the
 correspondent. The attacker can later use this map to track a mobile node
 in real time. If the granularity of the mapping between the IP subnets and
 geographical subregion is small for the particular link type in use, the
 attacker can potentially assemble enough information to find the victim in
 real time. This represents a compromise to the location privacy of mobile
 nodes using the network.

 In order to reduce the risk from location privacy compromises as a result
 of IP address changes, the goal for NETLMM is to remove the need to change
 IP address as mobile node moves across links in an access network. Keeping
 the IP address fixed over a large geographical region, fuzzes out the
 resolution of the mapping between the IP subnets and geographical area,
 regardless of how small the natural deployment granularity may be. This
 reduces the chance that the attacker can deduce the precise geographic
 location of the mobile node without the user's authorization.

---

From: netlmm <[email-masked]>
Date: Fri, 29 Sep 2006 22:29:51 -0000

Comment (by [email-masked]):

 Slightly modified text below:

 geographical mapping granularity is usually smaller.

 An attacker can collect information about what IP subnet prefixes map to
 what particular geographical subregions, and thereby develop a map that
 allows the attacker to determine the location of a corresponding node by
 simply looking at the source address of packets coming from the
 correspondent. The attacker can later use this map to track a mobile node
 in real time, since the victim mobile node must change its IP address as
 it moves from one subnet to another through the covered geographical
 subregions. If the granularity of the mapping between the IP subnets and
 geographical subregion is small for the particular link type in use, the
 attacker can potentially assemble enough information to find the victim in
 real time. This represents a compromise to the location privacy of mobile
 nodes using the network.

 In order to reduce the risk from location privacy compromises as a result
 of IP address changes, the goal for NETLMM is to remove the need to change
 IP address as a mobile node moves across links in an access network.
 Keeping the IP address fixed over a large geographical region fuzzes out
 the resolution of the mapping between the IP subnets and geographical
 area, regardless of how small the natural deployment granularity may be.
 This reduces the chance that the attacker can deduce the precise
 geographic location of the mobile node without the user's authorization.