Subject: Re: [netlmm] #146: Location privacy goal motivation is unclear

From: netlmm <[email-masked]>
Date: Fri, 06 Oct 2006 21:38:21 -0000

#146: Location privacy goal motivation is unclear
-------------------------------------------+--------------------------------
  Reporter:  [email-masked]      |       Owner:  [email-masked]
      Type:  defect                        |      Status:  closed                  
  Priority:  major                         |   Milestone:  milestone4              
 Component:  draft-ietf-netlmm-nohost-req  |     Version:  2.0                     
Resolution:  fixed                         |    Keywords:  REQ draft               
-------------------------------------------+--------------------------------
Comment (by [email-masked]):

 After reviewing the above text, Ted says:

 I don't think you're really starting from the right place.  First,
 describe
 what the threat is.  I think you are starting from the presumption that
 the threat is "an attacker can determine the physical location of a
 network node".  Starting from there, as the geopriv folks do, can
 give you quite a bit more clarity on what the attack is you are trying
 to thwart.  As it is, that is assumed/buried in the text.

 >In a standard IP access network deployment, different IP subnets cover
 different geographical subregions across the geographical coverage area of
 the network. The granularity of the mapping between IP subnet prefix and
 geographical subregion varies. In a large granularity deployment, IP
 subnet prefixes may cover a metropolitan region; while in a very small
 granularity deployment, IP subnet prefixes may cover a single floor in a
 building. If the access network is a wireless network, the granularity may
 depend on the geographical footprint of the wireless cells. Cells in
 cellular type networks typically provide large geographical footprints and
 therefore IP subnets cover large geographical areas. In contrast, wireless
 LAN networks typically provide small geographical footprints, so IP subnet
 geographical mapping granularity is usually smaller.

 I believe that you are asserting something here that is phrased in a way
 that may be confusing.  Let's take an example from Comcast, my local
 cable provider here.  It assigns IP addresses out of multiple subnets
 within
 the same cable head-end; at home we have a 5-IP contract where the IPs are
 assigned by DHCP.  Rarely are more than two in the same subnet.  Over the
 past week, I have gotten IPs from 7 different networks announced by
 Comcast.
 Within a particular span of time, each one of those subnets
 may be limited to a single cable head-end, but it also may be shared
 across
 head-ends within a much larger region.  Your statement above covers
 that case, but the way it is phrased seems to miss the operator's role.
 An operator may choose to assign subnet coverage in a way that is
 tightly bound to geography (at some timescale) or it may choose to
 assign it in ways in which the threat (of someone finding you physically
 based on your IP) is smaller.  You are basically arguing below that NETLMM
 is a tool in the operators' toolkit that allows them to undercut that
 tie between geography and topology.

 Put another way, there is no real "natural deployment granularity"; it is
 a function of how the operator has set up their routing and address
 assignment.
 Putting NetLMM into that picture shows how its mechanism (allowing
 the L2 attachment and L3 address to be less tightly bound) fits into a
 larger landscape.

 >An attacker can collect information about what IP subnet prefixes map to
 what particular geographical subregions, and thereby develop a map that
 allows the attacker to determine the location of a corresponding node by
 simply looking at the source address of packets coming from the
 correspondent. The attacker can later use this map to track a mobile node
 in real time, since the victim mobile node must change its IP address as
 it moves from one subnet to another through the covered geographical
 subregions. If the granularity of the mapping between the IP subnets and
 geographical subregion is small for the particular link type in use, the
 attacker can potentially assemble enough information to find the victim in
 real time. This represents a compromise to the location privacy of mobile
 nodes using the network.
 >
 >In order to reduce the risk from location privacy compromises as a result
 of IP address changes, the goal for NETLMM is to remove the need to change
 IP address as a mobile node moves across links in an access network.
 Keeping the IP address fixed over a large geographical region fuzzes out
 the resolution of the mapping between the IP subnets and geographical
 area, regardless of how small the natural deployment granularity may be.
 This reduces the chance that the attacker can deduce the precise
 geographic location of the mobile node without the user's authorization.

 As a nit, I don't think you need "without the user's authorization" phrase
 at the end
 here and I think it is further confusing.  The decision to reveal physical
 location
 would not be made by association of IP to that location.
 regards,

-- 
Ticket URL: <http://tools.ietf.org/wg/netlmm/trac/ticket/146>
netlmm <http://tools.ietf.org/wg/netlmm/>
_______________________________________________
netlmm mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/netlmm

---

From: netlmm <[email-masked]>
Date: Fri, 06 Oct 2006 21:40:21 -0000

In response to Ted's comment, I've modified the text to the following:

      In any IP network, there is a threat that an attacker can determine
      the physical location of a network node from the node's topological
      location. Depending on how an operator deploys their network, an
      operator may choose to assign subnet coverage in a way that is
      tightly bound to geography at some timescale or it may choose to
      assign it in ways in which the threat of someone finding a node
      physically  based  on  its  IP  address  is  smaller. Allowing
      the L2 attachment and L3 address to be less tightly bound is one
      tool for reducing this threat to location privacy.

      Mobility introduces an additional threat. An attacker can track a
      mobile node's geographical location in real time, if the victim
      mobile node must change its IP address as it moves from one subnet
      to  another  through  the  covered  geographical  area.  If  the
      granularity of the mapping between the IP subnets and geographical
      area is small for the particular link type in use, the attacker can
      potentially assemble enough information to find the victim in real
      time.

      In order to reduce the risk from location privacy compromises as a
      result of IP address changes, the goal for NETLMM is to remove the
      need to change IP address as a mobile node moves across links in an
      access  network.  Keeping  the  IP  address  fixed  over  a  large
      geographical region fuzzes out the resolution of the mapping
      between the IP subnets and geographical area, regardless of how
      small the natural deployment granularity may be. This reduces the
      chance that the attacker can deduce the precise geographic location
      of the mobile node.