Subject: RE: [nemo] Re: location privacy (was: Re:aboutdraft-ietf-nemo-requirements-00.txt)

From: "Pascal Thubert (pthubert)" <[email-masked]>
Date: Tue, 11 Mar 2003 12:13:41 -0000

>
> I am not sure if i understand this issue correctly, are you 
> talking about RA announced through the ingress interface or 
> through the egress interface? In the case of the ingress 
> interface, are you assuming that this is a wireless link?, 
> perhaps  this is assuming too much? As Greg said, i would say 
> that in this particular case, particular solutions like L2 
> encryption should be be considered, more than general solutions.
>  
> In the case of the egress interface, RA advertised by the MR 
> does have to contain location information? I mean if all 
> traffic flows tunneled to the HA, the MR does not have to 
> announce the mobile network prefix in the foreign link, right?  
> 
> 
I believe that the MR should not send RAs on the egress interfaces. We
had that discussion that the MR is a host on the roaming (egress)
interface and a router on the ingress interfaces, and it iseemde thye
simplest and mostl reasonable approach.

So I meantingress, where as you mentioned, the RAs are sent that
identify the MR. 
Sure there are deployments were you want totally controlled L2 access.
But in general, do you want that limitation? 

On the contrary, you may want to accept VMNs that you do not "know", in
order to help them reach the infrastructure, but you would want to make
sure they won't arm you, and you would want to keep private from each
other. 

What I'm saying is that if we can avoid assumptions on the service that
will be delivered, it's better. 
Here's a samll chat with Alper:
"
> If a host gains legitimate access to NEMO, it'll eventually
> learn the perfix information and deduce whatever information 
> it can from that prefix. Are you suggesting both the host and 
> the NEMO should be anonymous to each other even when host is 
> getting service from the network?

Yes... Since the Access Router is in my car and tells where my car is.
They both should dialog with a tier party that says that this visit is
authorized, but should not know each other. It is easy for the visitor
to hide himself (RFC 3041 + ESP) but the protection and the privacy of
the visited party should be considered as well. 

Note that even if my visitor is not ill-willing, since the careOf is
based on my prefix, it is easy for someone at his home to figure out
that I was where he was.
"

> > 2) If my home is my ISP, I may not want them to know where I am, 
> > either. As you mention, my CareOf gives that away to them, 
> even if the 
> > MIP protocol is encrypted.
> > 
> 
> I would guess that nodes within the home network are included 
> among the unauthorized parties along the path between the MR 
> and the HA, or do you think that they deserve special 
> consideration? I mean do they have a special advantage that 
> other nodes along the path do not?
> 
On the HA, you can dump the binding cache and get the CareOf. Other
parties on the Home Net may not know you're roaming at all, unless they
monitor the Link layer addresses. I can not say if it is important to
hide the location from the HA, I guess it's the MR's owner decision. You
may not be using privacy proxies every day, yet they exist.