Subject: [Mip6] Re: Mip6] Review of draft-ietf-mip6-location-privacy-ps-00.txt

From: Qiu Ying <[email-masked]>
Date: Tue, 25 Oct 2005 23:42:29 +0800

Date: Tue, 25 Oct 2005 16:06:51 +0300
From: Jari Arkko <[email-masked]>
Subject: [Mip6] Review of draft-ietf-mip6-location-privacy-ps-00.txt
To: Mobile IPv6 Mailing List <[email-masked]>

Hi, Jari
Please see my opinions inline 

>Hi Rajeev,

>Thanks for writing a draft on this important issue.
>Here are some initial comments:

>>   This problem is
>>   particularly applicable to Mobile IP where the Home Address on a
>>   visited network can reveal device roaming and, together with a
>>   user identifier (such as an NAI), can reveal user roaming.  When
>>   roaming is revealed, it could lead to more targetted profiling.  Even
>>
>The part about user identifier comes somewhat out of the
>blue here. Are we talking about user identifier and NAI
>usage in general? This goes much, much beyond Mobile IPv6.
>Or are we talking about Mobile IPv6 use of NAIs? We'd have
>to look at the different usage types. One is within IKEv2/EAP
>and one is in the auth protocol. They have very different
>implications. Also, NAI usage in network access (and also
>in IKEv2) has typically a capability for pseudonym usage.

I guess Rajeev means that if one gets the IP address, it is can simply translate the IP to an easily understanding identity. In fact, the draft focus on how to hide the telephone number (i.e home addresses), not on how to translate a caller ID to a user name.

>>   Even
>>   when the binding between user identifier and the Home Address is
>>   unavailable, freely available tools on the Internet can map the Home
>>   Address to the owner of the Home Prefix, which can reveal that a user
>>   from a particular ISP has roamed. 
>>
>There seems to be two different problems, one is being
>able to see that someone (identified by a home address)
>is moving with a specific pattern. The other problem is
>identifying that this someone is John Smith or that he is
>a customer of Joe's Broadband.

It is true they are different issues. Let’s consider a scenario, if an eavesdropper get an Ericsson IP address aa:bb:cc:xx and he does not know who owns the IP. But the eavesdropper profiles the IP aa:bb:cc:xx appears in IETF62 and IETF63, now it appears again in IETF64 Vancouver. Then the eavesdropper bets the aa:bb:cc:xx belongs to Jari because Jari works for Ericsson and always attends IETF. 

>>In addition, a user may not wish to reveal roaming to correspondent(s).
>>
>It may be worthile to add some discussion about the
>different participants. Presumably we can't avoid revealing
>information to our home network (or can we?), 

In some special scenarios, such as MN always is the initiator and never a responder in the communications and HA would like to provide looser authentication, we can conceal MN’s information to the home network. We will discuss this issue in mibopts, Vancover.  

>but most
>definately want to avoid revealing information to outsiders,
>and probably also in many cases to correspondent nodes.
>There may also be different types of outsiders. Complete
>strangers (e.g. open 802.11) vs. local access network owners.

To conceal the information to outsiders is much easier than conceal to CN because we much keep the continuous communication with CN. In order to hide the information from an on-looker, we can just break the relationship between CoA and HoA.

>(Some discussion of this appears later in the document,
>but I'm not sure it provides a full discussion.)

>>   2.1. Disclosing the Care of Address
>>
>>The fact that you do not need to reveal care-of address
>>to correspondent nodes in Mobile IPv6 could perhaps be
>>mentioned already here.

>>The assumption here is that the
>>   correspondent somehow knows the Home Address of the MN. For instance,
>>   a correspondent may obtain it from DNS, which may contain the Home
>>   Address or the IP address of an agent to which the user identifier
>>  
>Hmm... in Mobile IPv6 the home address is always known
>to the correspondent. Can you clarify what you mean here?

If the correspondent is a public server, such as Yahoo, it does not care who are connecting to it. Hence the real HoA is not necessary to reveal to CN. Even in some case, the CN must know whom it is talking with, the MN may not like to reveal its current location to the CN.  Therefore, we should consider how to hide the CoA to CN.

Regards
Qiu Ying

>>When equipped with an ability to inspect
>>   packets ``on the wire'', an on-looker can determine that the MN has
>>   roamed and could possibly also determine that the user has roamed.
>>
>I'm not sure I understand teh MN-user distinction.
>
>--Jari

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6