Subject: [rrg] Privacy

From: "Tschofenig, Hannes (NSN - FI/Espoo)" <[email-masked]>
Date: Mon, 16 Aug 2010 15:06:09 +0300

Hi all, 

I was pointed to a mailing list exchange about privacy (namely
http://www.ietf.org/mail-archive/web/rrg/current/msg07169.html) and I
got a bit confused by what has been written. 

There has been prior work on mobility & privacy described in RFC 5726.
There are tussels everywhere in protocol design, not only regarding
privacy, but that does not mean that you cannot provide any form of
privacy protection when having mobility support. 

Btw, using the same terminology often helps in discussion. For this
purpose we have recently published a terminology document
https://wiki.tools.ietf.org/html/draft-hansen-privacy-terminology-01.
Feedback is appreciated. 

Ciao
Hannes

---

From: Tony Li <[email-masked]>
Date: Mon, 16 Aug 2010 15:57:26 -0700

Hi Hannes,

> I was pointed to a mailing list exchange about privacy (namely http://www.ietf.org/mail-archive/web/rrg/current/msg07169.html) and I got a bit confused by what has been written.
> 
> There has been prior work on mobility & privacy described in RFC 5726. There are tussels everywhere in protocol design, not only regarding privacy, but that does not mean that you cannot provide any form of privacy protection when having mobility support.

Well, in a native identifier/locator split architecture, there are even more issues.  ;-)

If I can briefly summarize: each host would be associated with an identifier at a given point in time.  An identifier can have global or local scope.

A host can be 'mobile' within the scope of the identifier that it is using, and this includes transport session continuity when its correspondents also support the architecture.  Note that 'mobile' in this case implies that it is relocating itself topologically and changing its locator(s).  This is orthogonal to any virtual topologies, such as are created by Mobile IP.

> Btw, using the same terminology often helps in discussion. For this purpose we have recently published a terminology document https://wiki.tools.ietf.org/html/draft-hansen-privacy-terminology-01. Feedback is appreciated.

If I can (ab)use your terminology, the issue that we run into is the desire for anonymity and unlinkability in this architecture.  It is clearly somewhat challenging to provide anonymity when a node is using a global identifier.  ;-)

Ergo, the architecture specifically makes a provision for hosts to also change identifiers when they roam.

I think that the existence of the RFC and this draft are sufficient to make the point that there is in fact, a requirement for privacy.

Regards,
Tony

---

From: "Hanka, Oliver" <[email-masked]>
Date: Tue, 17 Aug 2010 09:48:13 +0200

Am 16.08.2010 um 14:06 schrieb Tschofenig, Hannes (NSN - FI/Espoo):

> <ATT00002..c>

Hi Hannes,

in my opinion, there is no such thing as full privacy. In that way I do agree with RJ Atkinson from your above link. Someone has to know where you are in order to send you packets. What you can do is, to limit the number of people knowing where you are, in terms of location privacy. Therefore, being partially anonymous. This, for example, can be realized through some sort of proxy.
Of course, the proxy solution comes at a cost. But the person in need for privacy may be willing to pay for it (money, latency, etc.). Other nodes, e.g., servers may not need privacy and shouldn't suffer from the costs of the privacy mechanism.

There are two proxy based privacy solution I am aware of. The first is a privacy location framework for HIP. The second one is my solution.

@inproceedings{1186716,
 author = {Matos, Alfredo and Santos, Justino and Sargento, Susana and Aguiar, Rui and Gir\,{a}o, Jo\,{a}o and Liebsch, Marco},
 title = {HIP location privacy framework},
 booktitle = {MobiArch '06: Proceedings of first ACM/IEEE international workshop on Mobility in the evolving internet architecture},
 year = {2006},
 isbn = {1-59593-566-5},
 pages = {57--62},
 location = {San Francisco, California},
 doi = {http://doi.acm.org/10.1145/1186699.1186716},
 publisher = {ACM},
 address = {New York, NY, USA},
 }

@INPROCEEDINGS{LK2010-556,
author = "Oliver Hanka",
title = "A Privacy Service for Locator/Identifier-Split Architectures Based on Mobile {IP} Mechanisms",
booktitle = "Proceedings of The Second International Conference on Advances in Future Internet",
month = "7",
year = "2010",
address = "Venice/Mestre, Italy",
doi = {10.1109/AFIN.2010.9}
}
(It's not listed in IEEE Xplore yet. You can find a HTML version via scholar.google.com and the DOI. Please contact me if you have further questions regarding the paper)

Regards,
Oliver