Subject: [nmrg] I-D Action: draft-irtf-nmrg-location-ipfix-04.txt

From: [email-masked]
Date: Mon, 06 Jul 2015 12:04:16 -0700

A New Internet-Draft is available from the on-line Internet-Drafts directories.
 This draft is a work item of the Network Management Working Group of the IETF.

        Title           : Extending IP Flow-Based Network Monitoring with Location Information
        Authors         : Olivier Festor
                          Abdelkader Lahmadi
                          Rick Hofstede
                          Aiko Pras
	Filename        : draft-irtf-nmrg-location-ipfix-04.txt
	Pages           : 22
	Date            : 2015-07-06

Abstract:
   IP Flow-based monitoring lacks a mechanism to associate measured IP
   Flow information with the geographic location of the device where the
   IP Flows have been observed. This document defines a set of
   guidelines and best practices to extend IP Flow monitoring protocols
   with location information of the device (both fixed and mobile) that
   acts as an IP Flow metering process.

The IETF datatracker status page for this draft is:
https://datatracker.ietf.org/doc/draft-irtf-nmrg-location-ipfix/

There's also a htmlized version available at:
https://tools.ietf.org/html/draft-irtf-nmrg-location-ipfix-04

A diff from the previous version is available at:
https://www.ietf.org/rfcdiff?url2=draft-irtf-nmrg-location-ipfix-04

Please note that it may take a couple of minutes from the time of submission
until the htmlized version and diff are available at tools.ietf.org.

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

---

From: Abdelkader Lahmadi <[email-masked]>
Date: Wed, 22 Jul 2015 16:11:43 +0200 (CEST)

Dear all,
This draft has been recently updated according to some feedback from the last NMRG meeting (Ottawa, Canada, May 2015). 
Please feel free to provide more comments and feedback.
Best regards

----- Mail transféré -----
> De: [email-masked]
> À: [email-masked]
> Cc: [email-masked]
> Envoyé: Lundi 6 Juillet 2015 21:04:16
> Objet: [nmrg] I-D Action: draft-irtf-nmrg-location-ipfix-04.txt
> 
> 
> _______________________________________________
> nmrg mailing list
> [email-masked]
> https://www.irtf.org/mailman/listinfo/nmrg
>

---

From: Juergen Schoenwaelder <[email-masked]>
Date: Wed, 22 Jul 2015 16:34:33 +0200

> Please feel free to provide more comments and feedback.

Looking at the diff, I see the attempt to write something about
privacy aspects. I am not sure, though, the text really got it to the
point.

   Addressing security and privacy requirements for the IPFIX protocol -
   especially in the case where location information is conveyed - is
   beyond the scope of this document. We note that preserving the
   privacy of users SHOULD be addressed by applications using collected
   monitoring data. This document only specifies best practices and
   guidelines to extend IP Flow export protocols, such as IPFIX, with
   location information. Otherwise, the same security considerations as
   those defined for the IPFIX protocol and the IPFIX information model
   apply.

I think you should discuss the privacy aspects associated with
information elements that carry location information in this
document. The first sentence above does a trick to first expand the
scope to IPFIX and then to declare this expanded scope is out of scope
of this document.  This is not really helpful. The second sentence is
useful. The third sentence is not since the document should actually
document the best practices people should consider that carry location
information in IPFIX information elements.

In other words, I think you should have text that

- clearly recognizes the privacy sensitivity of information elements
  carrying location information,
- strongly suggests that IPFIX transports (say which ones) are used
  that protect information elements during the transmission,
- keep the statement that receiving applications must be able to
  properly protect privacy sensitive information elements,
- perhaps consider adding text that collecting and exporting location
  information associated with information that is able to identify
  humans (such as IP addresses) may be illegal or require special
  clearance in certain jurisdictions.

/js

-- 
Juergen Schoenwaelder           Jacobs University Bremen gGmbH
Phone: +49 421 200 3587         Campus Ring 1 | 28759 Bremen | Germany
Fax:   +49 421 200 3103         <http://www.jacobs-university.de/>

---

From: Abdelkader Lahmadi <[email-masked]>
Date: Thu, 23 Jul 2015 10:09:44 +0200 (CEST)

Hi Juergen,
Thank you for the feedback. I agree with your comments, and we will update the draft to clarify the point related to the privacy aspects.
Best
/Abdelkader

----- Mail original -----
> De: "Juergen Schoenwaelder" <[email-masked]>
> À: "Abdelkader Lahmadi" <[email-masked]>
> Cc: "nmrg" <[email-masked]>
> Envoyé: Mercredi 22 Juillet 2015 16:34:33
> Objet: Re: [nmrg] Fwd:  I-D Action: draft-irtf-nmrg-location-ipfix-04.txt
> 
> > This draft has been recently updated according to some feedback from the
> > last NMRG meeting (Ottawa, Canada, May 2015).