Subject: [Ppm] trust model and extend scenarios of PPM

From: "[email-masked]" <[email-masked]>
Date: Mon, 18 Apr 2022 10:05:36 +0800

HI PPMers,

I've been thinking the trust model of PPM, which could be expressed in the red circle in the below figure based on system architecture in draft-gpew-priv-ppm-01. In my understanding, the Client trust the Leader and the Helper that they cannot conspire and leak the private information of measurement. Only based on this premise, the client can send message to leader and helper. So my suggestion about draft-gpew-priv-ppm-01 is that one section of trust model depict is necessary.
figure  1

And the extended trust model in PPM could be shown in the below. In this picture, there are two trust models, the first one is the same as the figure above. The second trust model has not been mentioned before. In the second trust mode, the collector trust the aggregator, which could be used in scenarios like data center. The current usage scenario in charter illustrates that the client could be a web browser which includes private data. While not only the user endpoint carries private data, the data center like cloud provider and network operator also maintains vast amount of data. This data should also be included in PPM. For example, the client is a data center which contains customers' communication data. The collector is the authority who have the right and obligation to investigate criminal clue. Of course the collector doesn't want the client to know what information it queries. In order to do this, the collector may want to use oblivious transfer to opaque query details. In this scenario, the collector and the aggregator comprise a trust domain. Further, the flaw of oblivious transfer function is that the client have to transfer mass of data to aggragator by network. One way to solve this problem is that we could use confidential computing to push the aggregator to the edge of client, restrict the transfer inside the client computing node. By doing so, the mass transfer will  occurs in the computing node instead of network, which could promote the efficiency of PPM in data center.  
figure 2

Figure 3 in the below shows the idea of PPM in data center. The client is the data center which maintains mass of customer data. The Collector is the authority which wants to measure certain private data in client. The CC Environment is a hardware base environment which could provide confidentiality and integrity for collector. In another word, the CC environment and the collector comprise a trust domain. And the CC environment is inside the Client's physical computing node, which could mitigate the flaw that the oblivious transfer function will cause bandwidth waste during querying. The protocol involved in this architecture are PPM, RATs, and TEEP, which are all IETF WG conceptions.
figure 3

To sum it up, my suggestion of PPM is to consider a more wide range of scenarios rather than only focus on user's endpoint. Data center also needs PPM. And I am trying to write a document about concept in figure3， if you are interested, welcome to provide any kinds of comments and even join to compile it together.

BR.
Penglin

---

From: Ben Schwartz <[email-masked]>
Date: Mon, 18 Apr 2022 11:08:22 -0400

Thanks for sharing your thoughts with the group, Penglin.

I'd like to remind everyone that IETF working groups operate within a
charter that describes the work to be undertaken.  You can see our charter
here [1].

A working group cannot take up work that is outside of its charter.
However, it can be appropriate and helpful to mention new and forthcoming
work on the mailing lists of related working groups.

--Ben Schwartz, PPM co-chair

[1] https://datatracker.ietf.org/doc/charter-ietf-ppm/

On Sun, Apr 17, 2022 at 10:06 PM [email-masked] <
[email-masked]> wrote:

> HI PPMers,
>
> I've been thinking the trust model of PPM, which could be expressed in the
> red circle in the below figure based on system architecture in
> draft-gpew-priv-ppm-01. In my understanding, the Client trust the Leader
> and the Helper that they cannot conspire and leak the private information
> of measurement. Only based on this premise, the client can send message to
> leader and helper. So my suggestion about draft-gpew-priv-ppm-01 is that
> one section of trust model depict is necessary.
> figure  1
>
> And the extended trust model in PPM could be shown in the below. In this
> picture, there are two trust models, the first one is the same as the
> figure above. The second trust model has not been mentioned before. In
> the second trust mode, the collector trust the aggregator, which could be
> used in scenarios like data center. The current usage scenario in charter
> illustrates that the client could be a web browser which includes private
> data. While not only the user endpoint carries private data, the data
> center like cloud provider and network operator also maintains vast amount
> of data. This data should also be included in PPM. For example, the
> client is a data center which contains customers' communication data. The
> collector is the authority who have the right and obligation to investigate
> criminal clue. Of course the collector doesn't want the client to know what
> information it queries. In order to do this, the collector may want to use
> oblivious transfer to opaque query details. In this scenario, the collector
> and the aggregator comprise a trust domain. Further, the flaw of oblivious
> transfer function is that the client have to transfer mass of data to
> aggragator by network. One way to solve this problem is that we could use
> confidential computing to push the aggregator to the edge of client,
> restrict the transfer inside the client computing node. By doing so, the
> mass transfer will  occurs in the computing node instead of network, which
> could promote the efficiency of PPM in data center.
> figure 2
>
> Figure 3 in the below shows the idea of PPM in data center. The client is
> the data center which maintains mass of customer data. The Collector is the
> authority which wants to measure certain private data in client. The CC
> Environment is a hardware base environment which could provide
> confidentiality and integrity for collector. In another word, the CC
> environment and the collector comprise a trust domain. And the CC
> environment is inside the Client's physical computing node, which could
> mitigate the flaw that the oblivious transfer function will cause bandwidth
> waste during querying. The protocol involved in this architecture are PPM,
> RATs, and TEEP, which are all IETF WG conceptions.
> figure 3
>
> To sum it up, my suggestion of PPM is to consider a more wide range of
> scenarios rather than only focus on user's endpoint. Data center also needs
> PPM. And I am trying to write a document about concept in figure3， if you
> are interested, welcome to provide any kinds of comments and even join to
> compile it together.
>
> BR.
> Penglin
>
> --
> Ppm mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ppm
>