Subject: Re: [Accord] ANN: drafts discussing Secure Content Delegation (aka "blind caches")

From: Natasha Rooney <[email-masked]>
Date: Thu, 31 Mar 2016 09:53:04 +0000

Hi ACCORD mailing list subscribers!

Please see the below mail from Julian re the Secure Content Delegation (aka "blind caches") draft. On investigation it seems many cellular operators use caching to both to improve user experience and to increase savings, although many of these techniques are transparent. New caching techniques may help improve user experience whilst keeping content encrypted. Julian et al are looking for feedback in IETF95.

Thanks!

Natasha

Natasha Rooney | Technologist, Web and Internet, W3C & IETF | GSMA | [email-masked]<mailto:[email-masked]> | +44 (0) 7730 219 765 | @thisNatasha | Skype: [email-masked]<mailto:[email-masked]>

On Mar 30, 2016, at 8:43 PM, Julian Reschke <[email-masked]<mailto:[email-masked]>> wrote:

Hi there!

In the past months, Martin, Göran, Salvatore, Christer, Zahed and myself have been working on a set of drafts about "Secure Content Delegation" -- in Martin's words:

"An architecture is described for content distribution via third-party content distribution networks with reduced privileges. This architecture allows an origin server to delegate the responsibility for delivery of the payload of an HTTP response to a third party. That party is unable to modify this content. The content is encrypted, which in some cases will prevent the third party from learning about the content."

The ideas behind this have been discussed since spring 2015; most of the times using the term "blind caches".

We have two new drafts out:

   https://tools.ietf.org/html/draft-thomson-http-scd-00 - "An Architecture for Secure Content Delegation using HTTP"

and

   https://tools.ietf.org/html/draft-thomson-http-bc-00 - "Caching Secure HTTP Content using Blind Caches"

and we'll use the github repo at <https://github.com/EricssonResearch/Blind-Cache-Drafts> to work on them.

The drafts build on lower level machinery defined in

1) https://tools.ietf.org/html/draft-reschke-http-oob-encoding-04 (<https://github.com/reschke/oobencoding>)

2) https://tools.ietf.org/html/draft-ietf-httpbis-encryption-encoding-01 (<https://github.com/httpwg/http-extensions>)

3) https://tools.ietf.org/html/draft-thomson-http-mice-00 (<https://github.com/martinthomson/http-mice>)

4) https://tools.ietf.org/html/draft-thomson-http-content-signature-00 (<https://github.com/martinthomson/content-signature>)

We'll be attending the IETF meeting in Buenos Aires and would love to get feedback on this; if there's sufficient interest we may be able to steal a few minutes to present in the HTTP WG meetings...

Note: to better understand the problem space and develop the mechanism, a prototype has been built using browser service workers to deliver DASH streaming video as well as other resource types. This is also used to gather performance insights.

Best regards, Julian & Göran

This email and its attachments are intended for the above named only and may be confidential. If they have come to you in error you must take no action based on them, nor must you copy or show them to anyone; please reply to this email or call +44 207 356 0600 and highlight the error.