Subject: [IPFIX] Review of draft-irtf-nmrg-location-ipfix-07.txt

From: Zhoutianran <[email-masked]>
Date: Wed, 23 Nov 2016 02:33:08 +0000

Hi,

Though IPFIX is concluded, could the IPFIX experts in this mailing list please help to provide comments for this I-D?
https://datatracker.ietf.org/doc/draft-irtf-nmrg-location-ipfix

It seems this work has a long history. Your help will push this work a step forward.

Thanks,
Tianran

---

From: Stewart Bryant <[email-masked]>
Date: Wed, 23 Nov 2016 11:02:31 +0000

Collecting this data is not particularly difficult, but protecting the 
privacy is much harder and will, I imagine be subject to significant 
scrutiny as the draft progresses.

It seems to me that there are security and privacy issues concerning 
both the traffic and the collector itself. The privacy of the user is a 
widely understood concept and will I am sure be thoroughly examined in 
review. In the case of the collector I am not convinced that it is wise 
to reveal the precise location of the network infrastructure since this 
could result in it being subject to physical attack.

An approach that you do not seem to explore is encrypting the location 
record so that this can only be understood by those that are authorised 
to see it. Indeed there is a case for something analogous to the 
selective availability system in GPS whereby the location is provided 
with different degrees of precision depending on the authority of the user.

- Stewart

On 23/11/2016 02:33, Zhoutianran wrote:
> _______________________________________________
> IPFIX mailing list
> [email-masked]
> https://www.ietf.org/mailman/listinfo/ipfix

---

From: Abdelkader Lahmadi <[email-masked]>
Date: Thu, 24 Nov 2016 15:43:22 +0100

Hi,
Thank you for the feedback. please see comments inline, I hope that they help make things clear.
> On 23 Nov 2016, at 12:02, Stewart Bryant <[email-masked]> wrote:
> 
> 
> Collecting this data is not particularly difficult, but protecting the privacy is much harder and will, I imagine be subject to significant scrutiny as the draft progresses.

The core subject of the draft is far from providing solutions of privacy issues when collecting sensitive data. We have clearly mentioned the privacy issue in our draft in section ’Security and Privacy Considerations’. In the section we have referenced existing RFCs that have addressed this issue for location information : [RFC3694], [RFC3693] and also Flow record anonymization [RFC6235].

> 
> It seems to me that there are security and privacy issues concerning both the traffic and the collector itself. The privacy of the user is a widely understood concept and will I am sure be thoroughly examined in review. In the case of the collector I am not convinced that it is wise to reveal the precise location of the network infrastructure since this could result in it being subject to physical attack.

In my opinion, we can also imagine another scenario where location information will help operators to identify that their equipments have not be moved or stolen, so associating IP flows to the location of the device is helpful in this case.

> 
> An approach that you do not seem to explore is encrypting the location record so that this can only be understood by those that are authorised to see it.

We have mentioned in the section ’Security and privacy Consideration’ that location information SHOULD be signed and encrypted as specified in [RFC7011].

> Indeed there is a case for something analogous to the selective availability system in GPS whereby the location is provided with different degrees of precision depending on the authority of the user.
> 
In section ‘Enabling Location Extensions’, we have mentioned that the metering process selects a location method when many are available with different degrees of precision. Yes, we can make it more clear by also mentioning that the selection depends on the authority of the user.
Best regards,

---

From: Stewart Bryant <[email-masked]>
Date: Thu, 24 Nov 2016 15:36:04 +0000

> The core subject of the draft is far from providing solutions of privacy issues when collecting sensitive data. We have clearly mentioned the privacy issue in our draft in section ’Security and Pri…
I guess we will see what happens during the review process.

> In my opinion, we can also imagine another scenario where location information will help operators to identify that their equipments have not be moved or stolen, so associating IP flows to the loca…

If you just want to know where the kit is, I am sure there are better 
way that than put it in IPFIX records. I am however wary of providing 
such detailed information on where an equipment is other than on a need 
to know basis. We live in very turbulent times and physical security is 
just as important as information security.

> We have mentioned in the section ’Security and privacy Consideration’ that location information SHOULD be signed and encrypted as specified in [RFC7011].

That text does not go beyond saying use industry best practice.

> In section ‘Enabling Location Extensions’, we have mentioned that the metering process selects a location method when many are available with different degrees of precision. Yes, we can make it mor…

Maybe. My point was that different users of the information have a right 
to different degrees of precision. So for example whilst many people 
might be satisfied with "London", and others might need to know 
"Westminister", few would need to know "in the top right draw of the 
Prime Minister's desk", but you can imagine why some people might be 
worried. My example is of course fanciful, but serves to illustrate that 
we need to be very sensitive to need-to-know when it comes to precision 
location of infrastructure, and the operator of the metering process may 
not fully appreciate the sensitivity.

- Stewart