Subject: Re: [lmap] security considerations for LMAP

From: <[email-masked]>
Date: Tue, 5 Mar 2013 15:20:28 +0000

Dan,
my take is that cases 1 & 3 below are beyond the proposed initial charter - they're about what happens to the data after it's reached the Collector. 
I agree with all the concerns you raise, about authorisation to access the data etc. In principle an additional issue might be round requests from the 3rd party to run a particular test (since this is about what happens before the Controller builds the Schedule, hence again I think it's beyond the proposed initial charter)

on case 2, I agree it's important for lmap to think about the privacy and security implications - especially of Measurement Agents sitting in customer premises. The current deployments are small scale and so can have an explicit agreement with the broadband consumers. is this viable for embedded lmap capability in all edge & end devices? Operators are allowed to do stuff for normal network operation, I have no idea to what extent lmap would be covered by this (and how "stuff" varies by country). seems something prospective wg needs to investigate.

best wishes
phil

-----Original Message-----
From: [email-masked] [mailto:[email-masked]] On Behalf Of Romascanu, Dan (Dan)
Sent: 27 February 2013 18:27
To: [email-masked]
Subject: [lmap] security considerations for LMAP

Hi,

I would like to raise one issue which I believe needs more discussions and clarifications as we prepare for the LMAP BOF and this is related to the security aspects of the use cases and the security requirements that we shall need to place on solutions. The use cases I-D (draft-linsner-lmap-use-cases-02) has a void Security Considerations section, and so does draft-boucadair-lmap-considerations-00. This is fine at this point in time but obviously can't stay like this. Only draft-eardley-lmap-framework-01 deals with part of the security aspects but more from the perspective of protecting the measurement information and storage. 

The use cases however seem to raise a few potential concerns related to the information that is being accessed by different entities, who is authorized to collect and what in large-scale measurements. I can see three possible interfaces that can raise such concerns: 

1. The ISP and Multi-Provider use cases mention the need of one provider having visibility and access into the measurements of another provider - to debug specific performance problems, to realize benchmarking and competitor insight, etc. This can be problematic and needs to put in place proper mechanisms of authorization, as different providers may be in different type of relations, they would like to control what information is made available to competitors and none would accept full visibility of its own internal data 2. The ISP-customer use case: Understanding the quality experienced by customers requires deployment of either software or in some scenarios hardware probes at the customers sites or on the edge. This raises similar problems of visibility as in the previous phase, as well as issues related to privacy protection which may be subject to local or regional (for example European) laws and regulations on privacy. 
3. The regulator case: Having regulators gather, store and process broadband traffic information in domains owned by ISPs raises also issues of authorization of access to such information. Hopefully development and enforcement of broadband policies will become part of the regulation and legislation and these details will be worked eventually out, but until they do and even afterwards proper mechanisms need to be in place in order to control authorization and protect information of the different levels of providers. 

Thoughts? Opinions? 

Regards,

Dan

_______________________________________________
lmap mailing list
[email-masked]
https://www.ietf.org/mailman/listinfo/lmap