Subject: Re: [Ideas] Can identity directly link with IP address?

From: Alexander Clemm <[email-masked]>
Date: Wed, 2 Aug 2017 23:21:29 +0000

Hello William,

Sure, this is an excellent time to talk about it:-)

Clearly the notion is that something is needed in addition to the locator/identifier split.  Hence the proposal for the identity/identifier split, to add a notion of identity that transcends the use of a simple identifier, which may be ephemeral, fleeting, and non-exclusive.  If you have other elements that you feel would be useful, I’d love to hear about them.

Thanks
--- Alex

From: william manning [mailto:[email-masked]]
Sent: Saturday, July 29, 2017 2:12 PM
To: Tom Herbert <[email-masked]>
Cc: Uma Chunduri <[email-masked]>; [email-masked]; Alexander Clemm <[email-masked]>; Liubingyang (Bryan) <[email-masked]>; Michael Menth <[email-masked]>
Subject: Re: [Ideas] Can identity directly link with IP address?

Isn't part of the problem that we are still agreeing to be bound to the locator/identifier split (as outlined in the ilnp and lisp work) and harkening back to the ideas documented by Saltzer in 1982 and published as RFC 1498. not to add a new wrinkle at this stage, but it seems that when all you have is a locator and an identifier, we won't get very far. A few years back, I proposed adding an additional element as the tie breaker.
Would there be interest in talking about that idea at this time?

/Wm

On Sat, Jul 29, 2017 at 10:44 AM, Tom Herbert <[email-masked]<mailto:[email-masked]>> wrote:
Uma,

On Fri, Jul 28, 2017 at 3:11 PM, Uma Chunduri <[email-masked]<mailto:[email-masked]>> wrote:
>> Identity is needed so that you can e.g. easily associate multiple identifiers with the same endpoint (for example, so you can easier apply anonymization schemes such as was mentioned by Dino),
>> and so it is easier to administer the overall system (such as, firewall rules, which would be nice if you could avoid having to update them every time an endpoint's IP address changes).
>
Yes, this makes it easier to manage the system, but also makes it
potentially easier to attack. If someone were to consider enabling a
new general possibly, global identity in my the network then the first
question I'd ask is what are the ramifications if the users'
identities are compromised.

> +1
>
> Just to add a bit more:
>
> 1. Identity is entry point to the system (GRIDS) and mainly for authentication (mutual authentication perhaps)
>         - we can choose multiple AUTH methods (not necessarily restricted X.509) which suits for the entity (low-power/high-power  IOT, vehicular node etc..)

Who needs to authenticate whom? Updating the mapping system would
obviously require strong credentials so security is needing there, but
that is part of the control protocol between the mapping system and
the network manager (e.g. MME probably in 3gpp). Devices already have
identities at layer 2 that are used when joining the network (e.g. EAP
in Ethernet, SIM).

> 2. Identity is not in the data plane and peer wouldn't know. Peer knows only one of the (long-lived) identifier like EID/HIT and the same would be used to LOC resolution.

Yes, that's the essence of identifier/locator protocols. The fact that
identity is not part of the existing identifier/locator protocols is a
good property.

> 3. Identity will have life cycle (can be changed with overhead of moving the rules)
>
That's complexity that needs to be justified by the value we get from
introducing identity in IP networking.

Tom

_______________________________________________
Ideas mailing list
[email-masked]<mailto:[email-masked]>
https://www.ietf.org/mailman/listinfo/ideas

---

From: Padma Pillay-Esnault <[email-masked]>
Date: Wed, 2 Aug 2017 18:44:22 -0700

Dear William

Absolutely.
Do you have pointers to documents you can share with us?

Thanks
Padma 

Sent from my iPhone

> On Jul 29, 2017, at 14:11, william manning <[email-masked]> wrote:
> 
>> On Sat, Jul 29, 2017 at 10:44 AM, Tom Herbert <[email-masked]> wrote:
>> Uma,
>> 
>> On Fri, Jul 28, 2017 at 3:11 PM, Uma Chunduri <[email-masked]> wrote:
>> [email-masked]
> [email-masked]