Subject: Re: [lmap] incoming liaison statement from IEEE Project P802.16.3 - 2nd look

From: "STARK, BARBARA H" <[email-masked]>
Date: Mon, 8 Apr 2013 18:31:51 +0000

OK, I've taken another look at both the liaison and the IEEE draft at http://doc.wirelessman.org/16-12-0682-01. 
As before, I either don't agree with or don't fully understand what is mean by Private vs. Public. I'm not sure which. But let me suggest some other language that I do understand.

Back in February (and I think at the IETF meeting in March) there was some robust discussion around "domain". Elements that are all under the control/management of a single entity (be that entity a person, an ISP, the person's employer, a VoIP application provider supplying VoIP service to the person, etc.) are intra-domain, or all inside the same domain. And everything else is external to that domain. 

An MA is in some entity's domain. Let's say the end user has complete control over the MA, so it's in the end user's domain. If that MA does a test against one of the end user's other home networked devices (under the control of the end user), then the other endpoint of the test (is this the "Server" in the IEEE draft?) is in the same domain. If the MA does a test against some Internet site (not under the control of the end user) then that test endpoint is in a different domain (inter-domain test).
If the MA is under the control of an ISP and it does tests with another of the ISP's MAs, it's intra-domain to the ISP.
If the MA is under the control of the employer and it does tests to the employer's MA, it's intra-domain to the employer.
If the MA sends its data to a Data Collector owned by the same entity, that's intra-domain. If the MA sends data to someone else's Data Collector, that's inter-domain. 
In the context of a mobile device, I could easily imagine the wireless provider having a (possibly hidden) MA app to do testing. And for the end user to have downloaded an app on the same device to do testing under the user's control. And perhaps the employer allows the end user to access the employer's network and has supplied a MA app that the employer can control. Each MA is in a different domain.

Wherever there are inter-domain interfaces and communication, there can be privacy concerns. For example, an ISP may not want to provide competitors with detailed measurement data (or the ability to run measurements to get detailed measurement data) of ISP's internal network (privacy related to MAs in different domains or collected data provided to other domains). An ISP who collects end user data might be (legally or contractually) required to anonymize test data before providing it to others (privacy related to collected data provided to other domains). There are also often concerns about what an ISP might do with data it obtains from measurements run against endpoints inside the home network (privacy related to MAs in different domains or MAs that reside in a network or device that is controlled by a different domain).

Jérôme, is it possible for the IEEE term "Private" to be interpreted as "intra-domain" and "Public" as "inter-domain"? If so, this would clarify a lot.
I sensed that you were somewhat offended by my previous response. If so, I'm sorry. It was not my intention to offend you or sound condescending. I truly am struggling to understand the IEEE 802.16 draft's use of "Private" and "Public". These terms appear to be central to the IEEE draft, and they are central to my lack of understanding.
Barbara

> -----Original Message-----
> From: [email-masked] [mailto:[email-masked]] On Behalf Of
> Jérôme Benoit
> Sent: Friday, April 05, 2013 8:23 AM
> To: [email-masked]
> Subject: Re: [lmap] incoming liaison statement from IEEE Project P802.16.3
> 
> On Thu, 28 Mar 2013 08:17:46 +0000 in
> <9904FB1B0159DA42B0B887B7FA8119CA0BB87E@AZ-
> FFEXMB04.global.avaya.com>,
> Romascanu, Dan (Dan) "Romascanu, Dan (Dan)" <[email-masked]>
> wrote:
> 
> > Hi,
> Hello,
> > Please note the following incoming liaison statement from IEEE Project
> P802.16.3 concerning the LMAP activity.
> >
> > https://datatracker.ietf.org/liaison/1244/
> >
> > Comments and discussions are welcome.
> 
> There's no point in a private server to help anonymity. A cryptographic
> system is enough that can for example one time key pair with a timestamp as
> a pass-phrase- fire and forget crypto -. The main advantage of such a system
> is that you do not need to cypher the transmission, the cyphering is done at
> the payload level, the keys are deleted once the measurement session is
> done. The key exchange rate could be high (a downside). The server keep
> the private key of a session to de-cypher. I can dig the design if the LMAP
> WG is in a hurry but I will do it anyway later. I call this kind of cryptographic
> system "time based crypto".
> 
> I really would like the LMAP WG to not throw away the ISP's cheats on a
> measurement campaign, it 's not an coding issue, it's a design issue of the
> measurement by itself : if a measurement design can't cheat a DPI, it's just
> not a good measurement design.
> 
> Cheers.
> 
> --
> Jérôme Benoit aka fraggle
> La Météo du Net - http://grenouille.com
> OpenPGP Key ID : 9FE9161D
> Key fingerprint : 9CA4 0249 AF57 A35B 34B3 AC15 FAA0 CB50 9FE9 161D

---

From: Jérôme Benoit <[email-masked]>
Date: Mon, 8 Apr 2013 22:38:24 +0200

On Mon, 8 Apr 2013 18:31:51 +0000 in
<[email-masked]>,

> I sensed that you were somewhat offended by my previous response. If so, I'm sorry. It was not my intention to offend you or sound condescending. I truly am struggling to understand the IEEE 802.16…

Probably. But the IEEE standardization process is not a public
process. And I'm not an IEEE's member. 

My point on the measurement result level of privacy is still an
important point. And the current RFCs are not clear about that : 

* Where will be done the data obfuscation ? 
* How ? 
* What will be the default behaviour on privacy issue ? 

I raise the point on purpose, it's a key feature for people to
trust such a system. (Hey, I know that people give most their life
away to facebook but they at least choose it). 

Cheers.