Subject: Re: [Mip6] some comments on draft-ietf-mip6-location-privacy-ps

From: QIU Ying <[email-masked]>
Date: Wed, 05 Jul 2006 02:37:23 +0800

Hi, Jari

My 2 cents inline.

> Date: Sun, 02 Jul 2006 23:01:27 +0300
> From: Jari Arkko <[email-masked]>
> Subject: [Mip6] some comments on draft-ietf-mip6-location-privacy-ps

>>    Location privacy may be compromised if an on-looker is present on
>>    the MN - HA path (when bidirectional tunneling is used), or when the
>>    on-looker is present on the MN and CN path (when route optimization
>>    is used).
>
> This needs to be explained in more detail. From what I can see,
> location privacy is always revealed on the mn-ha path, given the
> location of the various options and headers in the binding updates.

More than that, such as SPI, seq#, lifetime, also the mentioned MAC.

>>    The above description is valid regardless of whether a Home Address
>>    is static or is dynamically allocated.
>
> Hmm... this seems to need more explanation or perhaps a more in-depth
> treatment. Getting a dynamically allocated home address is similar to
> running RFC 3041. If you do that, and employ different care-of addresses
> for your different communications, it seems that you will be able
> provide better location privacy protection, no?

It should be able to provide better location privacy protection if different 
care-of address is used for different communications. The more random 
information reveal to an eavesdropper, the more difficult to be profiled the 
MN's activities by the eavesdropper. The question: is it worth to do that 
since the CoA might already change very frequently?

>>    Finally, it is also worthwhile to note that both the Home Address
>>    and the Care of Address could be subject to profiling, just as
>>    any other user traffic.  However, applying existing techniques to
>>    thwart profiling may have implications to Mobile IPv6 signaling
>>    performance.  For instance, changing the Care of Address often would
>>    cause additional Return Routability and binding management signaling.
>>    And, changing the Home Address often has implications on IPSec
>>    security association management.  These issues need to be addressed
>>    in the solutions.
>
> Need to be? Perhaps the conclusion is a bit too quick. Changing
> care of addresses "often" for privacy reasons would probably be
> either much less often that a fast moving mobile node makes handovers,
> or at least fairly infrequent, so is there need for optimizing the 
> process?

I think current frequency is enough, as often as the handovers or 7 minutes 
as RR.

> The specific issue with IPsec SA management probably needs to
> be spelled out too. For instance, if you used the same IKE SA for
> everything, it would be kind of silly to worry about privacy. So
> that implies multiple IKE SAs.

We could use the same SA for a while but change its SPI, since the cost of 
negotiating the session keys is considerable.

Regards
Qiu Ying

>
> Missing stuff: I would have expected a good summary of conditions under
> which location privacy is not a problem and a set of recommendations
> on how networks and policies should be set up to prevent location
> disclosure.
>
> --Jari
>
>
>

------------ Institute For Infocomm Research - Disclaimer -------------
This email is confidential and may be privileged.  If you are not the intended recipient, please delete it and notify us immediately. Please do not copy or use it for any purpose, or disclose its contents to any other person. Thank you.
--------------------------------------------------------

_______________________________________________
Mip6 mailing list
[email-masked]
https://www1.ietf.org/mailman/listinfo/mip6