Subject: [Ideas] Can identity directly link with IP address?

From: "Liubingyang (Bryan)" <[email-masked]>
Date: Thu, 27 Jul 2017 09:44:04 +0000

Hi all,

The current model seems like identity---identifier---locator, and identity is bound with ID/Loc protocols.
Do you think identity can directly link to IP address, i.e., identity---IP address, and be applied to the "legacy" IPv4/IPv6 without identifiers as intermediate?

Bingyang (Bryan)

---

From: Michael Menth <[email-masked]>
Date: Thu, 27 Jul 2017 12:11:11 +0200

Dear Bingyang, all,

good point! You essentially propose a more flexible mapping between
identity and identifiers. I think it generally makes sense that the new
mapping system with access control is not limited to the currently three
obvious layers identity-identifier-locator, but follows a more flexible
identifier->identifier mapping, whereby an identity is a special
identifier. There may be use cases where
identity->identity may make sense, e.g., mapping of a user to its devices.
This would also allow identity->locator which would be helpful to
support ID-networking w/ legacy IPv4/v6 but w/o loc/ID split.

Regards,

Michael

Am 27.07.2017 um 11:44 schrieb Liubingyang (Bryan):
> Do you think identity can directly link to IP address, i.e.,
> identity---IP address, and be applied to the “legacy” IPv4/IPv6 without
> identifiers as intermediate?
> 
>  
> 
> Bingyang (Bryan)
> 
> 
> 
> _______________________________________________
> Ideas mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ideas
> 

-- 
Prof. Dr. habil. Michael Menth
University of Tuebingen
Faculty of Science
Department of Computer Science
Chair of Communication Networks
Sand 13, 72076 Tuebingen, Germany
phone: (+49)-7071/29-70505
fax: (+49)-7071/29-5220
mailto:[email-masked]
http://kn.inf.uni-tuebingen.de

---

From: Alexander Clemm <[email-masked]>
Date: Thu, 27 Jul 2017 17:02:12 +0000

Yes, in principle possible.  

The question is only, who will actually know the identity.  In general, endpoints will be referred to by an identifier by other parties.  I would envision that other parties may "know" other endpoints by public identifiers, but not by their actual identity (by which they would be authenticated to GRIDS).  So, while a mapping system might be designed with flexibility for such queries in mind, I don't think supporting it would be a requirement - certainly not initially.  

I am not sure I would go to multiple tiers of identities.  It's a possibility, but it would raise additional issues if we were to get into the realm of personal identities (as opposed to endpoint identities).  So, IMHO we may want to stay clear of this.  

--- Alex

-----Original Message-----
From: Ideas [mailto:[email-masked]] On Behalf Of Michael Menth
Sent: Thursday, July 27, 2017 3:11 AM
To: Liubingyang (Bryan) <[email-masked]>
Cc: [email-masked]
Subject: Re: [Ideas] Can identity directly link with IP address?

Dear Bingyang, all,

good point! You essentially propose a more flexible mapping between identity and identifiers. I think it generally makes sense that the new mapping system with access control is not limited to the currently three obvious layers identity-identifier-locator, but follows a more flexible
identifier->identifier mapping, whereby an identity is a special
identifier. There may be use cases where
identity->identity may make sense, e.g., mapping of a user to its devices.
This would also allow identity->locator which would be helpful to support ID-networking w/ legacy IPv4/v6 but w/o loc/ID split.

Regards,

Michael

Am 27.07.2017 um 11:44 schrieb Liubingyang (Bryan):
> identity---IP address, and be applied to the "legacy" IPv4/IPv6 
> without identifiers as intermediate?
> 
>  
> 
> Bingyang (Bryan)
> 
> 
>

---

From: "Liubingyang (Bryan)" <[email-masked]>
Date: Thu, 27 Jul 2017 17:40:27 +0000

Hi Alex

Sorry I don't get it. Why what you "know" should be what you link with identity? And what if I just "know" your ip ?

----------------------------------------------Bingyang Liu
M: +86-15810795994
E: [email-masked]<mailto:[email-masked]>
2012 Laboratories-NG IP Network Laboratory,2012Labs

From: Alexander Clemm
To: Michael Menth<[email-masked]<mailto:[email-masked]>>;Liubingyang (Bryan)<[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: RE: [Ideas] Can identity directly link with IP address?
Time: 2017-07-28 01:02:24

--- Alex

-----Original Message-----
From: Ideas [mailto:[email-masked]] On Behalf Of Michael Menth
Sent: Thursday, July 27, 2017 3:11 AM
To: Liubingyang (Bryan) <[email-masked]>
Cc: [email-masked]
Subject: Re: [Ideas] Can identity directly link with IP address?

Dear Bingyang, all,

Regards,

Michael

Am 27.07.2017 um 11:44 schrieb Liubingyang (Bryan):
> identity---IP address, and be applied to the “legacy” IPv4/IPv6

---

From: Dino Farinacci <[email-masked]>
Date: Thu, 27 Jul 2017 11:22:12 -0700

> Do you think identity can directly link to IP address, i.e., identity---IP address, and be applied to the “legacy” IPv4/IPv6 without identifiers as intermediate?

Yes, because an IP address in today’s Internet is a locator.

Note, the LISP mapping system can support:

identity -> EID
identity -> RLOC
identity -> identity
EID      -> RLOC
EID      -> replication-list of RLOCs      (LCAF RLE)
EID      -> service-chain of EIDs or RLOCs (LCAF ELP)

Where identity and EID can come in many different address forms including JSON strings.

Dino

---

From: Alexander Clemm <[email-masked]>
Date: Thu, 27 Jul 2017 19:01:25 +0000

Hi Bingyang,

You need to be able to refer to another endpoint, so you need to know at least one of its identifiers in order to send it traffic.   But, I don't need to know your identity (in the narrower sense of IDEAS).  To use an analogy, I can send you an email using your identifier [email-masked]<mailto:[email-masked]>, but I don't need to know your birth certificate and passport number to assert your identity, nor would I expect providing those to send you email.

Cheers
--- Alex

From: Liubingyang (Bryan)
Sent: Thursday, July 27, 2017 10:40 AM
To: Alexander Clemm <[email-masked]>; Michael Menth <[email-masked]>
Cc: [email-masked]
Subject: Re: RE: [Ideas] Can identity directly link with IP address?

Hi Alex

--- Alex

-----Original Message-----
From: Ideas [mailto:[email-masked]] On Behalf Of Michael Menth
Sent: Thursday, July 27, 2017 3:11 AM
To: Liubingyang (Bryan) <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [Ideas] Can identity directly link with IP address?

Dear Bingyang, all,

Regards,

Michael

Am 27.07.2017 um 11:44 schrieb Liubingyang (Bryan):
> [email-masked]<mailto:[email-masked]>

_______________________________________________
Ideas mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/ideas

---

From: Padmadevi Pillay Esnault <[email-masked]>
Date: Thu, 27 Jul 2017 19:07:53 +0000

Alex and all

Just a comment here ...
These analogies tie to a person ....  I would rather say something like your contract# perhaps.

My 2 cts
Padma

From: Ideas [mailto:[email-masked]] On Behalf Of Alexander Clemm
Sent: Thursday, July 27, 2017 12:01 PM
To: Liubingyang (Bryan); Michael Menth
Cc: [email-masked]
Subject: Re: [Ideas] Can identity directly link with IP address?

Hi Bingyang,

Cheers
--- Alex

Hi Alex

--- Alex

-----Original Message-----
From: Ideas [mailto:[email-masked]] On Behalf Of Michael Menth
Sent: Thursday, July 27, 2017 3:11 AM
To: Liubingyang (Bryan) <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [Ideas] Can identity directly link with IP address?

Dear Bingyang, all,

Regards,

Michael

---

From: Tom Herbert <[email-masked]>
Date: Thu, 27 Jul 2017 13:01:38 -0700

On Thu, Jul 27, 2017 at 12:07 PM, Padmadevi Pillay Esnault
<[email-masked]> wrote:
> Alex and all
>
>
>
> Just a comment here …
>
> These analogies tie to a person ….  I would rather say something like your
> contract# perhaps.
>
>
>
> My 2 cts
>
> Padma
>
>
>
> You need to be able to refer to another endpoint, so you need to know at
> least one of its identifiers in order to send it traffic.   But, I don’t
> need to know your identity (in the narrower sense of IDEAS).  To use an
> analogy, I can send you an email using your identifier
> [email-masked], but I don’t need to know your birth certificate and
> passport number to assert your identity, nor would I expect providing those
> to send you email.
>
I think the email analogy is good, but it's more interesting to view
this from the sender perspective. I can easily set up a random email
account for the purposes of keeping my identify anonymous and yet
allowing for communications if I were to use that at the the reply
address. Similarly a host could be assigned a block of "random" IP
addresses (identifiers) and use a different one for each new
connection. The network just needs to know how to route these
addresses to the proper destination. That's what the mapping system
does in identifier->locator mapping. If the network wants to correlate
identifiers together as referring to the same identity for the
purposes of policy it can, but I don't see that being necessary to
facilitate communications nor protect privacy of users.

Tom

> Sorry I don't get it. Why what you "know" should be what you link with
> identity? And what if I just "know" your ip ?
>
>
> E: [email-masked]
> To: Michael Menth<[email-masked]>;Liubingyang
> (Bryan)<[email-masked]>
>
> Cc: [email-masked]
>
> The question is only, who will actually know the identity.  In general,
> endpoints will be referred to by an identifier by other parties.  I would
> envision that other parties may "know" other endpoints by public
> identifiers, but not by their actual identity (by which they would be
> authenticated to GRIDS).  So, while a mapping system might be designed with
> flexibility for such queries in mind, I don't think supporting it would be a
> requirement - certainly not initially.
>
> I am not sure I would go to multiple tiers of identities.  It's a
> possibility, but it would raise additional issues if we were to get into the
> realm of personal identities (as opposed to endpoint identities).  So, IMHO
> we may want to stay clear of this.
>
> --- Alex
>
> good point! You essentially propose a more flexible mapping between identity
> and identifiers. I think it generally makes sense that the new mapping
> system with access control is not limited to the currently three obvious
> layers identity-identifier-locator, but follows a more flexible
> This would also allow identity->locator which would be helpful to support
> ID-networking w/ legacy IPv4/v6 but w/o loc/ID split.
>
> Regards,
>
> Michael
>

---

From: Dino Farinacci <[email-masked]>
Date: Thu, 27 Jul 2017 13:42:51 -0700

> facilitate communications nor protect privacy of users.

This is exactly what is described in:

    https://datatracker.ietf.org/doc/draft-farinacci-lisp-eid-anonymity/

Dino

---

From: "Liubingyang (Bryan)" <[email-masked]>
Date: Fri, 28 Jul 2017 01:45:13 +0000

Now I get it. But maybe I just know your IP address (I don't want to mention DNS here :)) and communicate with you. In this case, if identity is still applicable, it may directly link with IP address, right?

Bingyang

From: Alexander Clemm
Sent: Friday, July 28, 2017 3:01 AM
To: Liubingyang (Bryan) <[email-masked]>; Michael Menth <[email-masked]>
Cc: [email-masked]
Subject: RE: RE: [Ideas] Can identity directly link with IP address?

Hi Bingyang,

Cheers
--- Alex

To: Alexander Clemm <[email-masked]<mailto:[email-masked]>>; Michael Menth <[email-masked]<mailto:[email-masked]>>

Hi Alex

--- Alex

-----Original Message-----
From: Ideas [mailto:[email-masked]] On Behalf Of Michael Menth
Sent: Thursday, July 27, 2017 3:11 AM
To: Liubingyang (Bryan) <[email-masked]<mailto:[email-masked]>>
Cc: [email-masked]<mailto:[email-masked]>
Subject: Re: [Ideas] Can identity directly link with IP address?

Dear Bingyang, all,

Regards,

Michael

---

From: Tom Herbert <[email-masked]>
Date: Thu, 27 Jul 2017 19:48:16 -0700

On Thu, Jul 27, 2017 at 6:45 PM, Liubingyang (Bryan)
<[email-masked]> wrote:
> Now I get it. But maybe I just know your IP address (I don’t want to mention
> DNS here J) and communicate with you. In this case, if identity is still
> applicable, it may directly link with IP address, right?
>
This question confuses me which I suppose it to say the notion of
identify related to IP addressing is still confusing. If two nodes are
able so successfully communicate using IP address then where does
identity come into play? If the applications need to verify whom
they're talking they'll using a mechanism like x.509 or TLS  and
should never rely on IP addresses as having any security properties.

Tom

---

From: "Liubingyang (Bryan)" <[email-masked]>
Date: Fri, 28 Jul 2017 03:45:03 +0000

Hi Tom, 

I see what you mean. But I don't think your concern is specific to IP address. Btw, I think certificate is just one way to bind identity with something, not the identity itself.  

Bingyang

-----Original Message-----
From: Tom Herbert [mailto:[email-masked]] 
Sent: Friday, July 28, 2017 10:48 AM
To: Liubingyang (Bryan) <[email-masked]>
Cc: Alexander Clemm <[email-masked]>; Michael Menth <[email-masked]>; [email-masked]
Subject: Re: [Ideas] Can identity directly link with IP address?

On Thu, Jul 27, 2017 at 6:45 PM, Liubingyang (Bryan) <[email-masked]> wrote:
> Now I get it. But maybe I just know your IP address (I don’t want to 
> mention DNS here J) and communicate with you. In this case, if 
> identity is still applicable, it may directly link with IP address, right?
>
This question confuses me which I suppose it to say the notion of identify related to IP addressing is still confusing. If two nodes are able so successfully communicate using IP address then where does identity come into play? If the applications need to verify whom they're talking they'll using a mechanism like x.509 or TLS  and should never rely on IP addresses as having any security properties.

Tom

> need to know your identity (in the narrower sense of IDEAS).  To use 
> an analogy, I can send you an email using your identifier 
> [email-masked], but I don’t need to know your birth 
> certificate and passport number to assert your identity, nor would I 
> expect providing those to send you email.
>
>
>
> Cheers
>
> --- Alex
>
>
>
> The question is only, who will actually know the identity.  In 
> general, endpoints will be referred to by an identifier by other 
> parties.  I would envision that other parties may "know" other 
> endpoints by public identifiers, but not by their actual identity (by 
> which they would be authenticated to GRIDS).  So, while a mapping 
> system might be designed with flexibility for such queries in mind, I 
> don't think supporting it would be a requirement - certainly not initially.
>
> possibility, but it would raise additional issues if we were to get 
> into the realm of personal identities (as opposed to endpoint 
> identities).  So, IMHO we may want to stay clear of this.
>
> --- Alex
>
> identity and identifiers. I think it generally makes sense that the 
> new mapping system with access control is not limited to the currently 
> three obvious layers identity-identifier-locator, but follows a more 
> flexible

---

From: Tom Herbert <[email-masked]>
Date: Fri, 28 Jul 2017 08:12:04 -0700

> I see what you mean. But I don't think your concern is specific to IP address. Btw, I think certificate is just one way to bind identity with something, not the identity itself.
Bingyang,

I think one difference is that certificate can be signed by a trusted
third party whereas IP addresses aren't. The third party involvement
is important since the signing authority is not in the data path for
the communication which keeps a separation of functions and is
stronger for privacy. In the case of a network provider it's both the
authority and in the data path for IP addresses-- this is probably
necessary but lessens the possibility of making IP addresses secure
mechanisms.

Tom

---

From: Alexander Clemm <[email-masked]>
Date: Fri, 28 Jul 2017 16:44:37 +0000

Yes, exactly.  
And likewise, GRIDS will not be in the data path.  
To communicate successfully, a node will need to merely know the identifier of who it wants to talk to (and which can be resolved to a locator).  Identity is needed so that you can e.g. easily associate multiple identifiers with the same endpoint (for example, so you can easier apply anonymization schemes such as was mentioned by Dino), and so it is easier to administer the overall system (such as, firewall rules, which would be nice if you could avoid having to update them every time an endpoint's IP address changes).  
--- Alex

-----Original Message-----
From: Tom Herbert [mailto:[email-masked]] 
Sent: Friday, July 28, 2017 8:12 AM
To: Liubingyang (Bryan) <[email-masked]>
Cc: Alexander Clemm <[email-masked]>; Michael Menth <[email-masked]>; [email-masked]
Subject: Re: [Ideas] Can identity directly link with IP address?

Bingyang,

I think one difference is that certificate can be signed by a trusted third party whereas IP addresses aren't. The third party involvement is important since the signing authority is not in the data path for the communication which keeps a separation of functions and is stronger for privacy. In the case of a network provider it's both the authority and in the data path for IP addresses-- this is probably necessary but lessens the possibility of making IP addresses secure mechanisms.

Tom

>> Sorry I don't get it. Why what you "know" should be what you link 
>> with identity? And what if I just "know" your ip ?
>>
>>
>> new mapping system with access control is not limited to the 
>> currently three obvious layers identity-identifier-locator, but 
>> follows a more flexible

---

From: Tom Herbert <[email-masked]>
Date: Fri, 28 Jul 2017 10:06:56 -0700

> To communicate successfully, a node will need to merely know the identifier of who it wants to talk to (and which can be resolved to a locator).  Identity is needed so that you can e.g. easily asso…

Alex,

I understand the administrative benefits for grouping together a set
of related identifiers so that their common location can be moved in
the mapping system in one step. But that doesn't affect the mapping
system function, it's job is still to map identifiers to locators.
Firewalls rules, however, are more invasive-- these would be on the
datapath. If the intent is that firewall rules are now based on
identity then this does introduce the notion of identity to be
critical in the data path? Extrapolating further, if identity becomes
essential to data path operations, then what will it mean if identity
of a user is compromised? For example, if the network provider
maintains identities of its users but their database is compromised
would this put user at risk?

Thanks,
Tom

---

From: Alexander Clemm <[email-masked]>
Date: Fri, 28 Jul 2017 21:30:33 +0000

Hi Tom,

I would certainly think that we would want firewall rules to not just be based on locators.  So, it will make sense to apply them on a per-identifier basis.  

Whether we would like to apply them on the basis of the underlying identity is something that we as working group should discuss.  It is possible, but in that case the firewall would certainly have a dependency on the identity services plane.  In essence the firewall would need to be able to specify a rule "apply this rule to the endpoint whose identity is tied to this identifier", and then as one possibility have the firewall interact with the identity services to apply the rules against other identifiers are associated with the same endpoint/identity.  I don't think identity should be carried on the data path nor would that be necessary.  

--- Alex

-----Original Message-----
From: Tom Herbert [mailto:[email-masked]] 
Sent: Friday, July 28, 2017 10:07 AM
To: Alexander Clemm <[email-masked]>
Cc: Liubingyang (Bryan) <[email-masked]>; Michael Menth <[email-masked]>; [email-masked]
Subject: Re: [Ideas] Can identity directly link with IP address?

Alex,

I understand the administrative benefits for grouping together a set of related identifiers so that their common location can be moved in the mapping system in one step. But that doesn't affect the mapping system function, it's job is still to map identifiers to locators.
Firewalls rules, however, are more invasive-- these would be on the datapath. If the intent is that firewall rules are now based on identity then this does introduce the notion of identity to be critical in the data path? Extrapolating further, if identity becomes essential to data path operations, then what will it mean if identity of a user is compromised? For example, if the network provider maintains identities of its users but their database is compromised would this put user at risk?

Thanks,
Tom

>>> endpoints by public identifiers, but not by their actual identity 
>>> (by which they would be authenticated to GRIDS).  So, while a 
>>> mapping system might be designed with flexibility for such queries 
>>> in mind, I don't think supporting it would be a requirement - certainly not initially.
>>>

---

From: Tom Herbert <[email-masked]>
Date: Fri, 28 Jul 2017 15:03:41 -0700

> Whether we would like to apply them on the basis of the underlying identity is something that we as working group should discuss.  It is possible, but in that case the firewall would certainly have…
Agreed.

Another question I would ask concerning introducing identity at the IP
layer is how this will relate to other forms of identity that already
exist. For instance, how would this relate to the subscriber identity
of a mobile device (e.g. SIM). Would the IP layer identity be derived
from these, or is IP identity somehow independent of these?

Thinking about how mobility might play out in a mobile network, I
think it's likely that the mobility manager will want to populate the
identifier/locator mapping table with the proper entries. In the case
that devices are get a set of addresses for obfuscation purposes, it
makes sense that the addresses are group together so that the mobility
manager can change the common locator for the set in one shot. That
seems straightforward, but the question that I'm struggling with is
whether the mapping system (or rest of network) should or must infer
additional semantics on this grouping which I suppose constitutes an
identity (of the device or subscriber in mobile case). Identity is
obviously sensitive data especially if it is PII, so minimizing
exposure and dissemination is important.

Tom

---

From: Uma Chunduri <[email-masked]>
Date: Fri, 28 Jul 2017 22:11:12 +0000

> Identity is needed so that you can e.g. easily associate multiple identifiers with the same endpoint (for example, so you can easier apply anonymization schemes such as was mentioned by Dino), 
> and so it is easier to administer the overall system (such as, firewall rules, which would be nice if you could avoid having to update them every time an endpoint's IP address changes).  

+1

Just to add a bit more:

1. Identity is entry point to the system (GRIDS) and mainly for authentication (mutual authentication perhaps)
	- we can choose multiple AUTH methods (not necessarily restricted X.509) which suits for the entity (low-power/high-power  IOT, vehicular node etc..)
2. Identity is not in the data plane and peer wouldn't know. Peer knows only one of the (long-lived) identifier like EID/HIT and the same would be used to LOC resolution.
3. Identity will have life cycle (can be changed with overhead of moving the rules)

--
Uma C.

-----Original Message-----
From: Ideas [mailto:[email-masked]] On Behalf Of Alexander Clemm
Sent: Friday, July 28, 2017 9:45 AM
To: Tom Herbert <[email-masked]>; Liubingyang (Bryan) <[email-masked]>
Cc: [email-masked]; Michael Menth <[email-masked]>
Subject: Re: [Ideas] Can identity directly link with IP address?

Yes, exactly.  

-----Original Message-----
From: Tom Herbert [mailto:[email-masked]]
Sent: Friday, July 28, 2017 8:12 AM
To: Liubingyang (Bryan) <[email-masked]>
Cc: Alexander Clemm <[email-masked]>; Michael Menth <[email-masked]>; [email-masked]
Subject: Re: [Ideas] Can identity directly link with IP address?

Bingyang,

Tom

---

From: "Liubingyang (Bryan)" <[email-masked]>
Date: Sat, 29 Jul 2017 00:57:08 +0000

RPKI is for 3rd-party authority to certify some identity owns some IP addresses/prefixes. I think certificates are general enough to support any Internet number resources from the technical perspective. It is just that for each class of resources there should be an appropriate authoritative root. 

Bingyang

-----Original Message-----
From: Tom Herbert [mailto:[email-masked]] 
Sent: Friday, July 28, 2017 11:12 PM
To: Liubingyang (Bryan) <[email-masked]>
Cc: Alexander Clemm <[email-masked]>; Michael Menth <[email-masked]>; [email-masked]
Subject: Re: [Ideas] Can identity directly link with IP address?

Bingyang,

Tom

---

From: Tom Herbert <[email-masked]>
Date: Sat, 29 Jul 2017 10:44:55 -0700

Uma,

>> and so it is easier to administer the overall system (such as, firewall rules, which would be nice if you could avoid having to update them every time an endpoint's IP address changes).
Yes, this makes it easier to manage the system, but also makes it
potentially easier to attack. If someone were to consider enabling a
new general possibly, global identity in my the network then the first
question I'd ask is what are the ramifications if the users'
identities are compromised.

>         - we can choose multiple AUTH methods (not necessarily restricted X.509) which suits for the entity (low-power/high-power  IOT, vehicular node etc..)

Who needs to authenticate whom? Updating the mapping system would
obviously require strong credentials so security is needing there, but
that is part of the control protocol between the mapping system and
the network manager (e.g. MME probably in 3gpp). Devices already have
identities at layer 2 that are used when joining the network (e.g. EAP
in Ethernet, SIM).

> 2. Identity is not in the data plane and peer wouldn't know. Peer knows only one of the (long-lived) identifier like EID/HIT and the same would be used to LOC resolution.

Yes, that's the essence of identifier/locator protocols. The fact that
identity is not part of the existing identifier/locator protocols is a
good property.

> 3. Identity will have life cycle (can be changed with overhead of moving the rules)
That's complexity that needs to be justified by the value we get from
introducing identity in IP networking.

Tom

---

From: william manning <[email-masked]>
Date: Sat, 29 Jul 2017 14:11:36 -0700

Isn't part of the problem that we are still agreeing to be bound to the
locator/identifier split (as outlined in the ilnp and lisp work) and
harkening back to the ideas documented by Saltzer in 1982 and published as
RFC 1498. not to add a new wrinkle at this stage, but it seems that when
all you have is a locator and an identifier, we won't get very far. A few
years back, I proposed adding an additional element as the tie breaker.
Would there be interest in talking about that idea at this time?

/Wm

On Sat, Jul 29, 2017 at 10:44 AM, Tom Herbert <[email-masked]> wrote:

> >> Identity is needed so that you can e.g. easily associate multiple
> identifiers with the same endpoint (for example, so you can easier apply
> anonymization schemes such as was mentioned by Dino),
> >> and so it is easier to administer the overall system (such as, firewall
> rules, which would be nice if you could avoid having to update them every
> time an endpoint's IP address changes).
> >
> > 1. Identity is entry point to the system (GRIDS) and mainly for
> authentication (mutual authentication perhaps)
> >         - we can choose multiple AUTH methods (not necessarily
> restricted X.509) which suits for the entity (low-power/high-power  IOT,
> vehicular node etc..)
>
> > 2. Identity is not in the data plane and peer wouldn't know. Peer knows
> only one of the (long-lived) identifier like EID/HIT and the same would be
> used to LOC resolution.
>