Subject: RE: [nemo] Re: location privacy (was: Re: aboutdraft-ietf-nemo-requirements-00.txt)

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Mon, 10 Mar 2003 16:46:26 -0000

> -----Original Message-----
> From: marcelo bagnulo [mailto:[email-masked]] 
> Sent: lundi 10 mars 2003 16:10
> To: Alexandru Petrescu
> Cc: Thierry Ernst; [email-masked]
> Subject: Re: [nemo] Re: location privacy (was: Re: 
> aboutdraft-ietf-nemo-requirements-00.txt)
> 
> 
> Hi Alexander, Thierry
> 
> Really interesting comments, and also unexpected.
> 
> When i read the draft, my interpretation of location privacy 
> was that the MR wanted to hide its location from an 
> unauthorized listener in the path between the HA and the MR. 
> As you see it is really different from what Thierry meant.
> 
> I think that the approach proposed by Alexander is very good.
> 
> Let's try to answer these questions. I think we should change 
> the order, though :-)
> 
> I guess that we could start by clarifying who is not supposed 
> to know the location of the MR. So, I would say that location 
> privacy capabilities prevent unauthorized parties to have 
> knowledge about the actual location of a mobile network. 
> Since a mobile network is permanently identified by the 
> mobile network prefix and/or its MR Home Address, and the 
> mobile network current location is identified by the CoA 
> assigned to the MR, location privacy is obtained by avoiding 
> the disclosure of the information about the current binding 
> between the mobile prefix (and/or the MR HoA) and MR CoA. 
> Potential unauthorized parties include the CNs of 
> communications maintained by the MNNs and any other party 
> along the communication path between the MNN and the CN that 
> can eavesdrop the communication.
> 
> In the basic solution, CN is never aware of the current 
> location of the MNN since all traffic is coursed through the 
> HA which is fixed in the home network. The only location 
> privacy concerns remaining refer to the eavesdroping of 
> packets exchanged by the HA and the MR. A mobile network 
> solution should provide the functions needed to conceal 
> location information contained in these packets. This 
> requirement is included in the requirement R13.4.
> 
> In the extended solution, MNNs are capable to interact 
> directly with CNs without including the HA in the 
> communication, exposing its location to the CN. However, the 
> usage of route optimization should always be the MNN choice. 
> In this case, unknown CN always reach the MNN through the HA, 
> using the MNN permanent address. Once the communication is in 
> place and that the MNN is aware of the CN, the MNN may choose 
> to make use of the Route Optimization capabilities provided 
> by the extended solution. In this case, the MNN is benefiting 
> from more optimal path but it is also disclosing its location 
> to the CN. 
> Other location privacy concerns refer to the disclosure of 
> location information to eavesdroppers along the communication 
> path. As long that the communication flows through the HA, 
> the basic scenario applies. In the case that RO is being 
> used, the conceal of location information implies the usage 
> of encryption between the MNN and the CN. I do not know if we 
> want to go there.  
> 
> I have tried to summarize the previous exchange, do you think 
> this is it?
> 
> 

I agree totally with the approach. As of the possible intrusions, there
may more to look at.

1) If people around me can listen to my RAs then they hear the prefixes
I advertises. For instance, fixed antennas listening to passerbys can
know who has been around. On the other hand, crypting the RAs limits
nested solutions. 

2) If my home is my ISP, I may not want them to know where I am, either.
As you mention, my CareOf gives that away to them, even if the MIP
protocol is encrypted.

> Regards, marcelo 
> 
> 
> On Mon, 2003-03-10 at 13:45, Alexandru Petrescu wrote:
> > Salut Thierry,
> > 
> > Thierry Ernst wrote:
> > > I mean, section 4 presents our "wishes". Location privacy 
> is one of  
> > > them.
> > 
> > I think it is good to say that location privacy is one wish, but I 
> > also think that we should detail more what kind of location 
> privacy we 
> > want.  And also see whether Mobile IPv6 will probably provide an 
> > inherent location privacy and so no need to develop new location 
> > privacy in NEMO.
> > 
> > > Since the basic solution is to set up a tunnel and no routing
> > > optimization, location privacy to the CN is enforced from a 
> > > Mobility point of view: the MR's CoA will never be present in 
> > > packets sent to the CN.
> > 
> > Yes, exactly.
> > 
> > > But, from a general point of view, the permanent address still
> > > tells that the MNN is in the home network, which does not strickly
> > >  speaking provide the MNN with full privacy. Does it ?
> > > 
> > > e.g CN knows that my prefix p_car/60 belongs to network "home/48"
> > > but it doesn't that p_car/60 is now in network road/48.
> > 
> > Yes, exactly.  So do you think we should worry about CN 
> knowing that 
> > p_car/60 belongs to network home/48?
> > 
> > > If you can draft us some words that would allow to explain this
> > > clearly, in a sentence, that would be welcome.
> > 
> > I think that text should clearly answer this:
> > -is Mobile IPv6 going to provide location privacy to MR?  
> If yes, how
> >   will NEMO use it?
> > -what entity tries to hide its location, is it MR?  Is it 
> LFN? -what 
> > is the "location" information that that entity tries to hide?
> >   Is it an address?  Is it a prefix?  Is it a corelation HoA-CoA? 
> > -what is the entity that must not get knowledge of that location
> >   information?  Is it CN?  Is it HA?  Is it an attacker listening?
> > 
> > For example, I've seen the following description: attackers 
> that might 
> > intercept packets containing both HoA and CoA, so attacker can know 
> > that that HoA is at that CoA.  In this specific case, the entity 
> > trying to hide its location is MH, the information to hide 
> is both HoA 
> > and CoA and the attacker is someone intercepting packets (not 
> > necessarily CN).
> > 
> > What you seem to describe above is: entity hiding its 
> location is MR, 
> > location info to be protected is the corelation (MR's prefix - MR's 
> > home  prefix) and the attacker is CN.
> -- 
> marcelo bagnulo <[email-masked]>
> uc3m
> 
>

---

From: Alexandru Petrescu<[email-masked]>
Date: Mon, 10 Mar 2003 19:30:21 +0100

Pascal Thubert (pthubert) wrote:
> I agree totally with the approach. As of the possible intrusions, 
> there may more to look at.
> 
> 1) If people around me can listen to my RAs then they hear the 
> prefixes I advertises. For instance, fixed antennas listening to 
> passerbys can know who has been around. On the other hand, crypting
>  the RAs limits nested solutions.

Yes, that sounds more like access control, right?

> 2) If my home is my ISP, I may not want them to know where I am, 
> either. As you mention, my CareOf gives that away to them, even if 
> the MIP protocol is encrypted.

Stated that way is still incomprehensible.  How can one avoid telling
home where s/he is and still ask home to forward packets to current
location.

Or maybe we don't want reachability at a permanent home address, and
avoid telling home the current location, no need of Mobile IP at all 
in that case.

---

From: Greg Daley <[email-masked]>
Date: Tue, 11 Mar 2003 10:29:52 +1100

Hi Pascal,

Just a quick comment

Pascal Thubert (pthubert) wrote:
[previous context removed]
> know who has been around. On the other hand, crypting the RAs limits

While this is a security issue, I'm not sure that it is really
a location privacy issue, since to receive the RA you need to be able
to receive radiation/sound from the NEMO.  This in most situations
requires that the eavesdropper is present at the location.

Also, as an example, in wireless LAN, link-layer encryption solves this
issue, except for the L2 Identity of the access points.  Link Access
controls who gains access to more sensitive information.
(Of course, I'm not saying that all WLAN encryption systems are secure
for this purpose).

> As you mention, my CareOf gives that away to them, even if the MIP

If the MNN can get a CoA on the visited fixed network, maybe they
can get a HMIPv6 regional CoA, which they can use to provide some
location privacy from the HA.

Greg

---

From: Alexandru Petrescu<[email-masked]>
Date: Tue, 11 Mar 2003 01:55:33 +0100

Greg Daley wrote:
>> either. As you mention, my CareOf gives that away to them, even 
>> if the MIP protocol is encrypted.
> 
> 

So one ends up revealing more approximate information about one's
location, than the precise CoA, which can be considered as a gain in
privacy.

But that is still a Mobile IPv6 issue, not very much related to NEMO,
in my oppinion humble.  Isn't it?

-- 
Message Classification: GBU

---

From: Greg Daley <[email-masked]>
Date: Tue, 11 Mar 2003 11:13:15 +1100

Hi Alex,

Alexandru Petrescu wrote:
>> If the MNN can get a CoA on the visited fixed network, maybe they can 
>> get a HMIPv6 regional CoA, which they can use to provide some location 
>> privacy from the HA.
> 
> 

But they get near optimal routing performance ;)

The tradeoffs are almost the same as in MIPv6,
when the MNN has a CoA from the visited fixed network.

> in my oppinion humble.  Isn't it?

Indeed.

Let's leave host privacy up to the host mobility people,
if we can.

Greg.

---

From: marcelo bagnulo <[email-masked]>
Date: 11 Mar 2003 11:46:38 +0100

Hi Pascal,

> know who has been around. On the other hand, crypting the RAs limits

I am not sure if i understand this issue correctly, are you talking
about RA announced through the ingress interface or through the egress
interface?
In the case of the ingress interface, are you assuming that this is a
wireless link?, perhaps  this is assuming too much?
As Greg said, i would say that in this particular case, particular
solutions like L2 encryption should be be considered, more than general
solutions.
 
In the case of the egress interface, RA advertised by the MR does have
to contain location information? I mean if all traffic flows tunneled to
the HA, the MR does not have to announce the mobile network prefix in
the foreign link, right?  

> As you mention, my CareOf gives that away to them, even if the MIP

I would guess that nodes within the home network are included among the
unauthorized parties along the path between the MR and the HA, or do you
think that they deserve special consideration? I mean do they have a
special advantage that other nodes along the path do not?

Thanks, marcelo

---

From: marcelo bagnulo <[email-masked]>
Date: 11 Mar 2003 12:32:00 +0100

> home where s/he is and still ask home to forward packets to current

Yes, but in order to provide location privacy features this information
should only be available to the HA and no other node in the home
network.

Regards, macrelo

---

From: Erik Nordmark <[email-masked]>
Date: Tue, 11 Mar 2003 16:07:51 +0100 (CET)

> Let's leave host privacy up to the host mobility people,

Agreed.
Presumably Nemo only needs to think about location privacy for
the MR (and the LFNs that move with the MR) - location privacy for
MNNs is a MIPv6 issue.

When there is no RO only nodes on the path between the LFN-MR-HA
can snoop the packets to see the HoA/CoA relationship.
And using ESP tunnels between MR-HA removes that capability for that
part of the path.

  Erik