Monday, October 31, 2011

[Geopriv] Fwd: I-D Action: draft-ietf-geopriv-relative-location-02.txt

We submitted a new version of relative location.

This version includes dynamic location TLVs and additions to conform to the extension mechanism in local-civic.

The authors believe this is ready for working group last call.

Brian

Begin forwarded message:

Subject: I-D Action: draft-ietf-geopriv-relative-location-02.txt
Date: October 31, 2011 7:01:08 PM EDT

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Geographic Location/Privacy Working Group of the IETF.

Title           : Relative Location Representation
Author(s)       : Martin Thomson
                         Brian Rosen
                         Dorothy Stanley
                         Gabor Bajko
                         Allan Thomson
Filename        : draft-ietf-geopriv-relative-location-02.txt
Pages           : 36
Date            : 2011-10-31

  This document defines an extension to PIDF-LO (RFC4119) for the
  expression of location information that is defined relative to a
  reference point.  The reference point may be expressed as a geodetic
  or civic location, and the relative offset may be one of several
  shapes.  Optionally, a reference to a secondary document (such as a
  map image) can be included, along with the relationship of the map
  coordinate system to the reference/offset coordinate system to allow
  display of the map with the reference point and the relative offset.
  Also included in this document is a Type/Length/Value (TLV)
  representation of the relative location for use in other protocols
  that use TLVs.


A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-geopriv-relative-location-02.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-geopriv-relative-location-02.txt
_______________________________________________
I-D-Announce mailing list
I-D-Announce@ietf.org
https://www.ietf.org/mailman/listinfo/i-d-announce
Internet-Draft directories: http://www.ietf.org/shadow.html
or ftp://ftp.ietf.org/ietf/1shadow-sites.txt

Re: [Geopriv] Expert review of location measurements

Hi Gabor,

You are absolutely right. Khalid did say that he didn't know a great deal about 802.11, and we did discuss the timing problems in particular.

--Martin

On 2011-11-01 at 07:01:03, Gabor.Bajko@nokia.com wrote:
> I don't necessarily agree with all the comments. Specifically:
>
> band: The frequency band for the radio, in gigahertz (GHz). 802.11
> [IEEE.80211] specifies PHY layers that use 2.4, 3.7 and 5
> gigahertz frequency bands.
> I think it is not so useful, again, for other than RF finger printing
> matching.
>
> <Gabor> wifi coverage depends on the band. There is a significant
> difference when the STA sees a beacon from an AP in 5GHz band vs a
> 2.4GHz band. In 5G the STA must be much closer to the AP to see the
> beacon than it could in 2.4G. Same goes for network type, as 11a works
> in 5G, while 11b in 2.4G
>
>
> channel: The channel number (frequency) that the access point
> operates on.
> Correct, but probably with limited usefulness. Maybe useful for RF
> signature matching location techniques, but channel number is
> changeable by the user, though it very seldom occurs.
>
> <Gabor> In managed networks, APs change dynamically their operating
> channel to avoid overlapping BSS operations.
>
>
> flightTime: Flight time is the difference between the time of
> departure (TOD) of signal from a transmitting station and time of
> arrival (TOA) of signal at a receiving station, as defined in
> [IEEE.80211V]. Measurement of this value requires that stations
> synchronize their clocks. This value can be measured by access
> point or Device; because the flight time is assumed to be the
> same
> in either direction - aside from measurement errors - only a
> single element is provided. This element includes optional
> "rmsError" and "samples" attributes. RMS error might be derived
> from the reported RMS error in TOD and TOA.
> I think this field could be very useful if it was possible to measure
> it accurately, which I think it is not possible. In order use the
> Flight Time for range determination, both the transmitting and
> receiving ends should be synchronized to within 50nsec. This is not
> possible if the device and AP don't have access to a common reference
> time, such as GPS time. NTP sync won't achieve such accuracy, as far
> as I know. However, a more robust measurement would be Total Flight
> Time, or Round Trip Time. With such measurement, the device would
> loop back a signal, like a ping message for example, to the AP and the
> AP measures the round trip time. Time synchronization is not
> necessary in this case. Furthermore, there are ways to make this more
> accurate, similar to LTE, where the Device can send to the AP the
> Tx-to-Rx time difference in the device in order to compensate for the
> Rx-to-Tx path delay within the device. Lastly, it is implied that
> both the device and the AP have time t agging capability that has
> 50nsec resolution, which may be impractical, but I don't know that for
> sure and can research it if needed.
>
> <Gabor> STA and AP do not need a common reference time, as the STA
> syncs its clock to the AP's clock, before measuring the flight time.
> The accuracy of 50ns is desirable and it depends on how accurately can
> the wifi chips timestamp the messages. According to some chipset
> vendors, they are getting close to that number.
>
> -Gabor
>
> -----Original Message-----
> From: geopriv-bounces@ietf.org [mailto:geopriv-bounces@ietf.org] On
> Behalf Of ext Thomson, Martin
> Sent: Thursday, October 27, 2011 3:44 PM
> To: GEOPRIV
> Subject: [Geopriv] Expert review of location measurements
>
> The following is a review of draft-ietf-geopriv-held-measurements-03
> by Khalid Al Mufti, one of the location experts working for Commscope.
> I asked Khalid to provide a critique of Section 5.3, particularly with
> respect to the usefulness of the parameters for location.
>
> I'll correct the mistakes Khalid noticed in the next revision.
>
> --Martin
> ----
>
> 5.3. 802.11 WLAN Measurements
>
>
> In WiFi, or 802.11 [IEEE.80211], networks a Device might be able to
> provide information about the access point (AP) that it is attached
> to, or other WiFi points it is able to see. This is provided using
> the "wifi" element, as shown in Figure 6, which shows a single
> complete measurement for a single access point.
>
> [MT: snipped example]
>
> Figure 6: 802.11 WLAN Measurement Example
>
> A wifi element is made up of one or more access points, and an
> optional "nicType" element. Each access point is described using
> the
> "ap" element, which is comprised of the following fields:
>
> bssid: The basic service set identifier. In an Infrastructure BSS
> network, the bssid is the 48 bit MAC address of the access point.
>
> The "verified" attribute of this element describes whether the
> device has verified the MAC address or it authenticated the
> access
> point or the network operating the access point (for example, a
> captive portal accessed through the access point has been
> authenticated). This attributes defaults to a value of "false"
> when omitted.
>
> ssid: The service set identifier (SSID) for the wireless network
> served by the access point.
>
> The SSID is a 32-octet identifier that is commonly represented as
> a ASCII [RFC0020] or UTF-8 [RFC3629] encoded string. To
> represent
> octets that cannot be directly included in an XML element,
> escaping is used. Sequences of octets that do not represent a
> valid UTF-8 encoding can be escaped using a backslash ('\')
> followed by two case-insensitive hexadecimal digits representing
> the value of a single octet.
>
> The canonical or value-space form of an SSID is a sequence of up
> to 32 octets that is produced from the concatenation of UTF-8
> encoded sequences of unescaped characters and octets derived from
> escaped components.
> From what I can tell this is correct. It is useful, especially for
> location determination based on searching databases of SSID-Location.
>
> channel: The channel number (frequency) that the access point
> operates on.
> Correct, but probably with limited usefulness. Maybe useful for RF
> signature matching location techniques, but channel number is
> changeable by the user, though it very seldom occurs.
>
> location: The location of the access point, as reported by the
> access point. This element contains any valid location, using
> the
> rules for a "location-info" element, as described in [RFC5491].
> Really useful, but sounds like operator entered info (like street
> address), therefore it is useful, especially if it is augmented by the
> SSID-location database matching techniques.
>
> type: The network type for the network access. This element
> includes the alphabetic suffix of the 802.11 specification that
> introducted the radio interface, or PHY; e.g. "a", "b", "g", or
> "n".
> Other than for pattern matching techniques, I think it is not so
> useful.
>
> band: The frequency band for the radio, in gigahertz (GHz). 802.11
> [IEEE.80211] specifies PHY layers that use 2.4, 3.7 and 5
> gigahertz frequency bands.
> I think it is not so useful, again, for other than RF finger printing
> matching.
>
>
> regclass: The regulatory domain and class. The "country" attribute
> optionally includes the applicable two character country
> identifier (dot11CountryString), which can be followed by an 'O',
> 'I' or 'X'. The element text content includes the value of the
> regulatory class: an 8-bit integer in decimal form.
> If I understood this field correctly, I think it may depend on the
> ISP, which may be located far from the AP, thus have a country string
> it is a continent away. That's probably rare, but not impossible. If
> so, then it's not useful, in my opinion.
>
>
> antenna: The antenna identifier for the antenna that the access
> point is using to transmit the measured signals.
> From what I know, most APs have a single antenna, or two antenna's for
> MIMO type communication. But the antennas are very closely spaced, so
> identifying which antenna is used for Tx/Rx is not helpful for
> location. Unless there's an antenna in each floor in a building for
> the same AP (a configuration which I am not familiar with) then maybe
> identifying which Antenna the device is connecting to the AP through
> helps identify in what floor the device is located. So in such
> scenarios this field is useful, otherwise it is useless from what I
> can tell.
>
> flightTime: Flight time is the difference between the time of
> departure (TOD) of signal from a transmitting station and time of
> arrival (TOA) of signal at a receiving station, as defined in
> [IEEE.80211V]. Measurement of this value requires that stations
> synchronize their clocks. This value can be measured by access
> point or Device; because the flight time is assumed to be the
> same
> in either direction - aside from measurement errors - only a
> single element is provided. This element includes optional
> "rmsError" and "samples" attributes. RMS error might be derived
> from the reported RMS error in TOD and TOA.
> I think this field could be very useful if it was possible to measure
> it accurately, which I think it is not possible. In order use the
> Flight Time for range determination, both the transmitting and
> receiving ends should be synchronized to within 50nsec. This is not
> possible if the device and AP don't have access to a common reference
> time, such as GPS time. NTP sync won't achieve such accuracy, as far
> as I know. However, a more robust measurement would be Total Flight
> Time, or Round Trip Time. With such measurement, the device would
> loop back a signal, like a ping message for example, to the AP and the
> AP measures the round trip time. Time synchronization is not
> necessary in this case. Furthermore, there are ways to make this more
> accurate, similar to LTE, where the Device can send to the AP the
> Tx-to-Rx time difference in the device in order to compensate for the
> Rx-to-Tx path delay within the device. Lastly, it is implied that
> both the device and the AP have time t agging capability that has
> 50nsec resolution, which may be impractical, but I don't know that for
> sure and can research it if needed.
>
> apSignal: Measurement information for the signal transmitted by the
> access point, as observed by the Device. Some of these values
> are
> derived from 802.11v [IEEE.80211V] messages exchanged between
> Device and access point. The contents of this element include:
>
> transmit: The transmit power reported by the access point, in
> dB.
> I think it is useful as part of determining the path loss from AP to
> device, thus deducing range using log-normal propagation model. Its
> measurement unit is incorrectly written; it should be in dBm not
> measured in dB.
>
>
> gain: The gain of the access point antenna reported by the
> access
> point, in dB.
> I think it is useful as part of determining the path loss from AP to
> device, thus deducing range using log-normal propagation model. It is
> correctly specified in dB. I assume this is user entered info,
> though, so possibly subject to operator error. Nonetheless, it is
> needed for proper path loss determination, and should be included.
>
> rcpi: The received channel power indicator for the access point
> signal, as measured by the Device. This value SHOULD be in
> units of dBm (with RMS error in dB). If power is measured in
> a
> different fashion, the "dBm" attribute MUST be set to "false".
> Signal strength reporting on current hardware uses a range of
> different mechanisms; therefore, the value of the "nicType"
> element SHOULD be included if the units are not known to be in
> dBm and the value reported by the hardware should be included
> without modification. This element includes optional
> "rmsError" and "samples" attributes.
> I think it is useful as part of determining the path loss from AP to
> device, thus deducing range using log-normal propagation model.
>
> rsni: The received signal to noise indicator in dBm. This
> element includes optional "rmsError" and "samples" attributes.
> I think it can be considered as useful information. It can be used to
> verify that a high rcpi measurement is not due to something like
> interference.
>
> deviceSignal: Measurement information for the signal transmitted by
> the device, as reported by the access point. This element
> contains the same child elements as the "ap" element, with the
> access point and Device roles reversed.
>
> If we assume the RF path is symmetric between UL and DL then
> technically this is a redundant field (since we're after range
> determination through RF path loss modeling, I assume). However, it
> probably helps to have the opposite direction measurements for
> verification purposes. For instance, if both sides agree, then it
> increases confidence in the path loss estimate. So I think it is a
> good to have in addition to the APSignal measurements.
>
> All elements are optional except for "bssid".
>
> The "nicType" element is used to specify the make and model of the
> wireless network interface in the Device. Different 802.11 chipsets
> report measurements in different ways, so knowing the network
> interface type aids the LIS in determining how to use the provided
> measurement data. The content of this field is unconstrained and no
> mechanisms are specified to ensure uniqueness.
>
> 5.3.1. Wifi Measurement Requests
>
>
> Two elements are defined for requesting WiFi measurements in a
> measurement request:
>
> type: The "type" element identifies the desired type (or types that
> are requested.
>
> parameter: The "parameter" element identifies an optional
> measurements are requested for each measured access point. An
> element is identified by its qualified name. The optional
> "context" parameter can be used to specify if an element is
> included as a child of the "ap" or "device" elements; omission
> indicates that it applies to both.
>
> Multiple types or parameters can be requested by repeating either
> element.
>
>
> _______________________________________________
> Geopriv mailing list
> Geopriv@ietf.org
> https://www.ietf.org/mailman/listinfo/geopriv


_______________________________________________
Geopriv mailing list
Geopriv@ietf.org
https://www.ietf.org/mailman/listinfo/geopriv

[Geopriv] I-D Action: draft-ietf-geopriv-relative-location-02.txt

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Geographic Location/Privacy Working Group of the IETF.

Title : Relative Location Representation
Author(s) : Martin Thomson
Brian Rosen
Dorothy Stanley
Gabor Bajko
Allan Thomson
Filename : draft-ietf-geopriv-relative-location-02.txt
Pages : 36
Date : 2011-10-31

This document defines an extension to PIDF-LO (RFC4119) for the
expression of location information that is defined relative to a
reference point. The reference point may be expressed as a geodetic
or civic location, and the relative offset may be one of several
shapes. Optionally, a reference to a secondary document (such as a
map image) can be included, along with the relationship of the map
coordinate system to the reference/offset coordinate system to allow
display of the map with the reference point and the relative offset.
Also included in this document is a Type/Length/Value (TLV)
representation of the relative location for use in other protocols
that use TLVs.


A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-geopriv-relative-location-02.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-geopriv-relative-location-02.txt
_______________________________________________
Geopriv mailing list
Geopriv@ietf.org
https://www.ietf.org/mailman/listinfo/geopriv

Re: [Geopriv] Expert review of location measurements

I don't necessarily agree with all the comments. Specifically:

band: The frequency band for the radio, in gigahertz (GHz). 802.11
[IEEE.80211] specifies PHY layers that use 2.4, 3.7 and 5
gigahertz frequency bands.
I think it is not so useful, again, for other than RF finger printing matching.

<Gabor> wifi coverage depends on the band. There is a significant difference when the STA sees a beacon from an AP in 5GHz band vs a 2.4GHz band. In 5G the STA must be much closer to the AP to see the beacon than it could in 2.4G. Same goes for network type, as 11a works in 5G, while 11b in 2.4G


channel: The channel number (frequency) that the access point
operates on.
Correct, but probably with limited usefulness. Maybe useful for RF signature matching location techniques, but channel number is changeable by the user, though it very seldom occurs.

<Gabor> In managed networks, APs change dynamically their operating channel to avoid overlapping BSS operations.


flightTime: Flight time is the difference between the time of
departure (TOD) of signal from a transmitting station and time of
arrival (TOA) of signal at a receiving station, as defined in
[IEEE.80211V]. Measurement of this value requires that stations
synchronize their clocks. This value can be measured by access
point or Device; because the flight time is assumed to be the same
in either direction - aside from measurement errors - only a
single element is provided. This element includes optional
"rmsError" and "samples" attributes. RMS error might be derived
from the reported RMS error in TOD and TOA.
I think this field could be very useful if it was possible to measure it accurately, which I think it is not possible. In order use the Flight Time for range determination, both the transmitting and receiving ends should be synchronized to within 50nsec. This is not possible if the device and AP don't have access to a common reference time, such as GPS time. NTP sync won't achieve such accuracy, as far as I know. However, a more robust measurement would be Total Flight Time, or Round Trip Time. With such measurement, the device would loop back a signal, like a ping message for example, to the AP and the AP measures the round trip time. Time synchronization is not necessary in this case. Furthermore, there are ways to make this more accurate, similar to LTE, where the Device can send to the AP the Tx-to-Rx time difference in the device in order to compensate for the Rx-to-Tx path delay within the device. Lastly, it is implied that both the device and the AP have time t
agging capability that has 50nsec resolution, which may be impractical, but I don't know that for sure and can research it if needed.

<Gabor> STA and AP do not need a common reference time, as the STA syncs its clock to the AP's clock, before measuring the flight time. The accuracy of 50ns is desirable and it depends on how accurately can the wifi chips timestamp the messages. According to some chipset vendors, they are getting close to that number.

-Gabor

-----Original Message-----
From: geopriv-bounces@ietf.org [mailto:geopriv-bounces@ietf.org] On Behalf Of ext Thomson, Martin
Sent: Thursday, October 27, 2011 3:44 PM
To: GEOPRIV
Subject: [Geopriv] Expert review of location measurements

The following is a review of draft-ietf-geopriv-held-measurements-03 by Khalid Al Mufti, one of the location experts working for Commscope. I asked Khalid to provide a critique of Section 5.3, particularly with respect to the usefulness of the parameters for location.

I'll correct the mistakes Khalid noticed in the next revision.

--Martin
----

5.3. 802.11 WLAN Measurements


In WiFi, or 802.11 [IEEE.80211], networks a Device might be able to
provide information about the access point (AP) that it is attached
to, or other WiFi points it is able to see. This is provided using
the "wifi" element, as shown in Figure 6, which shows a single
complete measurement for a single access point.

[MT: snipped example]

Figure 6: 802.11 WLAN Measurement Example

A wifi element is made up of one or more access points, and an
optional "nicType" element. Each access point is described using the
"ap" element, which is comprised of the following fields:

bssid: The basic service set identifier. In an Infrastructure BSS
network, the bssid is the 48 bit MAC address of the access point.

The "verified" attribute of this element describes whether the
device has verified the MAC address or it authenticated the access
point or the network operating the access point (for example, a
captive portal accessed through the access point has been
authenticated). This attributes defaults to a value of "false"
when omitted.

ssid: The service set identifier (SSID) for the wireless network
served by the access point.

The SSID is a 32-octet identifier that is commonly represented as
a ASCII [RFC0020] or UTF-8 [RFC3629] encoded string. To represent
octets that cannot be directly included in an XML element,
escaping is used. Sequences of octets that do not represent a
valid UTF-8 encoding can be escaped using a backslash ('\')
followed by two case-insensitive hexadecimal digits representing
the value of a single octet.

The canonical or value-space form of an SSID is a sequence of up
to 32 octets that is produced from the concatenation of UTF-8
encoded sequences of unescaped characters and octets derived from
escaped components.
From what I can tell this is correct. It is useful, especially for location determination based on searching databases of SSID-Location.

channel: The channel number (frequency) that the access point
operates on.
Correct, but probably with limited usefulness. Maybe useful for RF signature matching location techniques, but channel number is changeable by the user, though it very seldom occurs.

location: The location of the access point, as reported by the
access point. This element contains any valid location, using the
rules for a "location-info" element, as described in [RFC5491].
Really useful, but sounds like operator entered info (like street address), therefore it is useful, especially if it is augmented by the SSID-location database matching techniques.

type: The network type for the network access. This element
includes the alphabetic suffix of the 802.11 specification that
introducted the radio interface, or PHY; e.g. "a", "b", "g", or
"n".
Other than for pattern matching techniques, I think it is not so useful.

band: The frequency band for the radio, in gigahertz (GHz). 802.11
[IEEE.80211] specifies PHY layers that use 2.4, 3.7 and 5
gigahertz frequency bands.
I think it is not so useful, again, for other than RF finger printing matching.


regclass: The regulatory domain and class. The "country" attribute
optionally includes the applicable two character country
identifier (dot11CountryString), which can be followed by an 'O',
'I' or 'X'. The element text content includes the value of the
regulatory class: an 8-bit integer in decimal form.
If I understood this field correctly, I think it may depend on the ISP, which may be located far from the AP, thus have a country string it is a continent away. That's probably rare, but not impossible. If so, then it's not useful, in my opinion.


antenna: The antenna identifier for the antenna that the access
point is using to transmit the measured signals.
From what I know, most APs have a single antenna, or two antenna's for MIMO type communication. But the antennas are very closely spaced, so identifying which antenna is used for Tx/Rx is not helpful for location. Unless there's an antenna in each floor in a building for the same AP (a configuration which I am not familiar with) then maybe identifying which Antenna the device is connecting to the AP through helps identify in what floor the device is located. So in such scenarios this field is useful, otherwise it is useless from what I can tell.

flightTime: Flight time is the difference between the time of
departure (TOD) of signal from a transmitting station and time of
arrival (TOA) of signal at a receiving station, as defined in
[IEEE.80211V]. Measurement of this value requires that stations
synchronize their clocks. This value can be measured by access
point or Device; because the flight time is assumed to be the same
in either direction - aside from measurement errors - only a
single element is provided. This element includes optional
"rmsError" and "samples" attributes. RMS error might be derived
from the reported RMS error in TOD and TOA.
I think this field could be very useful if it was possible to measure it accurately, which I think it is not possible. In order use the Flight Time for range determination, both the transmitting and receiving ends should be synchronized to within 50nsec. This is not possible if the device and AP don't have access to a common reference time, such as GPS time. NTP sync won't achieve such accuracy, as far as I know. However, a more robust measurement would be Total Flight Time, or Round Trip Time. With such measurement, the device would loop back a signal, like a ping message for example, to the AP and the AP measures the round trip time. Time synchronization is not necessary in this case. Furthermore, there are ways to make this more accurate, similar to LTE, where the Device can send to the AP the Tx-to-Rx time difference in the device in order to compensate for the Rx-to-Tx path delay within the device. Lastly, it is implied that both the device and the AP have time t
agging capability that has 50nsec resolution, which may be impractical, but I don't know that for sure and can research it if needed.

apSignal: Measurement information for the signal transmitted by the
access point, as observed by the Device. Some of these values are
derived from 802.11v [IEEE.80211V] messages exchanged between
Device and access point. The contents of this element include:

transmit: The transmit power reported by the access point, in dB.
I think it is useful as part of determining the path loss from AP to device, thus deducing range using log-normal propagation model. Its measurement unit is incorrectly written; it should be in dBm not measured in dB.


gain: The gain of the access point antenna reported by the access
point, in dB.
I think it is useful as part of determining the path loss from AP to device, thus deducing range using log-normal propagation model. It is correctly specified in dB. I assume this is user entered info, though, so possibly subject to operator error. Nonetheless, it is needed for proper path loss determination, and should be included.

rcpi: The received channel power indicator for the access point
signal, as measured by the Device. This value SHOULD be in
units of dBm (with RMS error in dB). If power is measured in a
different fashion, the "dBm" attribute MUST be set to "false".
Signal strength reporting on current hardware uses a range of
different mechanisms; therefore, the value of the "nicType"
element SHOULD be included if the units are not known to be in
dBm and the value reported by the hardware should be included
without modification. This element includes optional
"rmsError" and "samples" attributes.
I think it is useful as part of determining the path loss from AP to device, thus deducing range using log-normal propagation model.

rsni: The received signal to noise indicator in dBm. This
element includes optional "rmsError" and "samples" attributes.
I think it can be considered as useful information. It can be used to verify that a high rcpi measurement is not due to something like interference.

deviceSignal: Measurement information for the signal transmitted by
the device, as reported by the access point. This element
contains the same child elements as the "ap" element, with the
access point and Device roles reversed.

If we assume the RF path is symmetric between UL and DL then technically this is a redundant field (since we're after range determination through RF path loss modeling, I assume). However, it probably helps to have the opposite direction measurements for verification purposes. For instance, if both sides agree, then it increases confidence in the path loss estimate. So I think it is a good to have in addition to the APSignal measurements.

All elements are optional except for "bssid".

The "nicType" element is used to specify the make and model of the
wireless network interface in the Device. Different 802.11 chipsets
report measurements in different ways, so knowing the network
interface type aids the LIS in determining how to use the provided
measurement data. The content of this field is unconstrained and no
mechanisms are specified to ensure uniqueness.

5.3.1. Wifi Measurement Requests


Two elements are defined for requesting WiFi measurements in a
measurement request:

type: The "type" element identifies the desired type (or types that
are requested.

parameter: The "parameter" element identifies an optional
measurements are requested for each measured access point. An
element is identified by its qualified name. The optional
"context" parameter can be used to specify if an element is
included as a child of the "ap" or "device" elements; omission
indicates that it applies to both.

Multiple types or parameters can be requested by repeating either
element.


_______________________________________________
Geopriv mailing list
Geopriv@ietf.org
https://www.ietf.org/mailman/listinfo/geopriv
_______________________________________________
Geopriv mailing list
Geopriv@ietf.org
https://www.ietf.org/mailman/listinfo/geopriv

Sunday, October 30, 2011

[Geopriv] I-D Action: draft-ietf-geopriv-held-measurements-04.txt

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Geographic Location/Privacy Working Group of the IETF.

Title : Using Device-provided Location-Related Measurements in Location Configuration Protocols
Author(s) : Martin Thomson
James Winterbottom
Filename : draft-ietf-geopriv-held-measurements-04.txt
Pages : 74
Date : 2011-10-27

A method is described by which a Device is able to provide location-
related measurement data to a LIS within a request for location
information. Location-related measurement information are
observations concerning properties related to the position of a
Device, which could be data about network attachment or about the
physical environment. When a LIS generates location information for
a Device, information from the Device can improve the accuracy of the
location estimate. A basic set of location-related measurements are
defined, including common modes of network attachment as well as
assisted Global Navigation Satellite System (GNSS) parameters.


A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-geopriv-held-measurements-04.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-geopriv-held-measurements-04.txt
_______________________________________________
Geopriv mailing list
Geopriv@ietf.org
https://www.ietf.org/mailman/listinfo/geopriv

Re: [Geopriv] I-D Action: draft-ietf-geopriv-deref-protocol-04.txt

There were a few bug fixes arising from gen-art and secdir reviews. Other than that, this just keeps the draft fresh.

On 2011-10-31 at 12:10:28, internet-drafts@ietf.org wrote:
> A New Internet-Draft is available from the on-line Internet-Drafts
> directories. This draft is a work item of the Geographic
> Location/Privacy Working Group of the IETF.
>
> Title : A Location Dereferencing Protocol Using HELD
> Author(s) : James Winterbottom
> Hannes Tschofenig
> Henning Schulzrinne
> Martin Thomson
> Martin Dawson
> Filename : draft-ietf-geopriv-deref-protocol-04.txt
_______________________________________________
Geopriv mailing list
Geopriv@ietf.org
https://www.ietf.org/mailman/listinfo/geopriv

Re: [Geopriv] Location Obfuscation and Emergency Services (geopriv-policy-25)

On 2011-10-31 at 08:07:10, Richard Barnes wrote:
> 1. In the case of emergency services (such as E911 within the
> United States), local or national laws may require that
> accurate location information be transmitted in certain
> defined emergency call situations. The Geopriv Working
> Group MUST facilitate this situation.
> "
>
> That last sentence just means that the privacy rule systems developed
> by GEOPRIV must allow a Location Server / Rule Holder to overrule a
> Rule Maker, which both -policy and -policy-uri clearly do. So together
> with the above ECRIT document, I really don't think that draft-ietf-
> geopriv-policy needs to say anything on this matter.

The model simply views legislature or constitution as another Rule Maker, does it not?

Perhaps the correct way to think of it is that your *meta policy* has some Rule Makers with higher priority rules than others.

Setting policy is outside the remit of the group; setting *meta policy* is similarly beyond our humble powers. Enabling it? That we can do.

You might not that the combining rules in common-policy don't inherently allow for override rules. Applying multiple policies in sequence can be used to produce that effect.

--Martin
_______________________________________________
Geopriv mailing list
Geopriv@ietf.org
https://www.ietf.org/mailman/listinfo/geopriv

[Geopriv] I-D Action: draft-ietf-geopriv-deref-protocol-04.txt

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Geographic Location/Privacy Working Group of the IETF.

Title : A Location Dereferencing Protocol Using HELD
Author(s) : James Winterbottom
Hannes Tschofenig
Henning Schulzrinne
Martin Thomson
Martin Dawson
Filename : draft-ietf-geopriv-deref-protocol-04.txt
Pages : 24
Date : 2011-10-30

This document describes how to use the Hypertext Transfer Protocol
(HTTP) over Transport Layer Security (TLS) as a dereferencing
protocol to resolve a reference to a Presence Information Data Format
Location Object (PIDF-LO). The document assumes that a Location
Recipient possesses a URI that can be used in conjunction with the
HTTP-Enabled Location Delivery (HELD) protocol to request the
location of the Target.


A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-geopriv-deref-protocol-04.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-geopriv-deref-protocol-04.txt
_______________________________________________
Geopriv mailing list
Geopriv@ietf.org
https://www.ietf.org/mailman/listinfo/geopriv

Re: [Geopriv] Location Obfuscation and Emergency Services (geopriv-policy-25)

> I agree that it might make sense to have a more detailed discussion of how to deal with an obscured location for the emergency services use case in an ECRIT document.

Indeed, there is already an ECRIT document that covers most of this question, in particular providing guidance as to how precise is "precise enough" for routing emergency calls:
<http://tools.ietf.org/html/draft-ietf-ecrit-rough-loc>

> However, I could be wrong, but I think this is the first GEOPRIV document that describes a rule to deliberately reduce the accuracy of location information, so I think it would be appropriate to have at least a brief discussion of the consequences in this document.

The idea that privacy rules would modify returned location information is just about as old as GEOPRIV itself. See the following text from RFC 3693:
"
There are four scenarios in which some form of constraint or
override might be placed on the Privacy Rules of the Rule
Maker:

1. In the case of emergency services (such as E911 within the
United States), local or national laws may require that
accurate location information be transmitted in certain
defined emergency call situations. The Geopriv Working
Group MUST facilitate this situation.
"

That last sentence just means that the privacy rule systems developed by GEOPRIV must allow a Location Server / Rule Holder to overrule a Rule Maker, which both -policy and -policy-uri clearly do. So together with the above ECRIT document, I really don't think that draft-ietf-geopriv-policy needs to say anything on this matter.

--Richard

>
> I am suggesting some text to clarify whether a rule to obscure location will either prevent obtaining the most accurate location information available in cases that it is needed or desired, or will make it necessary to take additional actions to obtain accurate location information when it is needed.
>
> In other words, if a rule maker sets a rule to obscure location, does this mean a location recipient (either the location target or a third party) cannot obtain accurate location in the case that it needs it, whether for an emergency call (where the consequences for deliberately providing less useful location information are high) or to order a pizza? I think it appropriate for this document to provide some guidance to the rule maker to address this.
>
> Eric
>
>
> -----Original Message-----
> From: Hannes Tschofenig [mailto:hannes.tschofenig@gmx.net]
> Sent: Tuesday, October 18, 2011 7:39 PM
> To: Richard L. Barnes
> Cc: Hannes Tschofenig; Arolick, Eric; geopriv@ietf.org
> Subject: Re: [Geopriv] Location Obfuscation and Emergency Services (geopriv-policy-25)
>
> Richard, Eric,
>
> I will put some text about this issues into the upcoming version of the trustworthy location document.
> Planning to work on it next week.
>
> Ciao
> Hannes
>
> On Oct 18, 2011, at 4:21 PM, Richard L. Barnes wrote:
>
>> <hat type="individual"/>
>>
>> Hi Eric,
>>
>> Thanks for the comments. You're correct that emergency services use cases do create new scenarios for location privacy. This document is not the place to address them. All this document does is define a policy language that can be applied in many different circumstances. Documents that define emergency services architectures should define how they handle privacy rules.
>>
>> Note that this will vary quite a bit from jurisdiction to jurisdiction. Your assumption that privacy rules can be ignored is not valid everywhere; for example, in Japanese emergency calls today, the caller can choose to suppress location information for the call.
>>
>> I think the best place to address these concerns is probably in the ECRIT location security document:
>> <http://tools.ietf.org/html/draft-ietf-ecrit-trustworthy-location-02>
>>
>> Best,
>> --Richard
>>
>>
>> On Oct 18, 2011, at 1:57 PM, Arolick, Eric wrote:
>>
>>> Hannes
>>>
>>> There does not appear to be text in draft-ietf-geopriv-policy-25.txt that addresses the impact of location obfuscation on the emergency services use case. Specifically, there may be a desire to obscure or lie about location to protect privacy in some or most cases. But in the emergency case, it is in the best interests of the location target, and there may be a legal obligation in some jurisdictions, to use the most accurate location information available.
>>>
>>> Parameters in the location object describing its use (e.g. retransmission allowed) can be ignored if appropriate for an emergency call, but nothing can be done to the location information itself once the object is created. It would be useful to clarify in this document the impact of a rule to deliberately obscure location when a location object is created would have on the emergency services use case and to describe how it is possible to make sure a location object contains accurate location information for an emergency call.
>>>
>>> Thanks
>>>
>>> Eric Arolick
>>>
>>> _______________________________________________
>>> Geopriv mailing list
>>> Geopriv@ietf.org
>>> https://www.ietf.org/mailman/listinfo/geopriv
>>
>

_______________________________________________
Geopriv mailing list
Geopriv@ietf.org
https://www.ietf.org/mailman/listinfo/geopriv

Thursday, October 27, 2011

[Geopriv] Expert review of location measurements

The following is a review of draft-ietf-geopriv-held-measurements-03 by Khalid Al Mufti, one of the location experts working for Commscope. I asked Khalid to provide a critique of Section 5.3, particularly with respect to the usefulness of the parameters for location.

I'll correct the mistakes Khalid noticed in the next revision.

--Martin
----

5.3. 802.11 WLAN Measurements


In WiFi, or 802.11 [IEEE.80211], networks a Device might be able to
provide information about the access point (AP) that it is attached
to, or other WiFi points it is able to see. This is provided using
the "wifi" element, as shown in Figure 6, which shows a single
complete measurement for a single access point.

[MT: snipped example]

Figure 6: 802.11 WLAN Measurement Example

A wifi element is made up of one or more access points, and an
optional "nicType" element. Each access point is described using the
"ap" element, which is comprised of the following fields:

bssid: The basic service set identifier. In an Infrastructure BSS
network, the bssid is the 48 bit MAC address of the access point.

The "verified" attribute of this element describes whether the
device has verified the MAC address or it authenticated the access
point or the network operating the access point (for example, a
captive portal accessed through the access point has been
authenticated). This attributes defaults to a value of "false"
when omitted.

ssid: The service set identifier (SSID) for the wireless network
served by the access point.

The SSID is a 32-octet identifier that is commonly represented as
a ASCII [RFC0020] or UTF-8 [RFC3629] encoded string. To represent
octets that cannot be directly included in an XML element,
escaping is used. Sequences of octets that do not represent a
valid UTF-8 encoding can be escaped using a backslash ('\')
followed by two case-insensitive hexadecimal digits representing
the value of a single octet.

The canonical or value-space form of an SSID is a sequence of up
to 32 octets that is produced from the concatenation of UTF-8
encoded sequences of unescaped characters and octets derived from
escaped components.
From what I can tell this is correct. It is useful, especially for location determination based on searching databases of SSID-Location.

channel: The channel number (frequency) that the access point
operates on.
Correct, but probably with limited usefulness. Maybe useful for RF signature matching location techniques, but channel number is changeable by the user, though it very seldom occurs.

location: The location of the access point, as reported by the
access point. This element contains any valid location, using the
rules for a "location-info" element, as described in [RFC5491].
Really useful, but sounds like operator entered info (like street address), therefore it is useful, especially if it is augmented by the SSID-location database matching techniques.

type: The network type for the network access. This element
includes the alphabetic suffix of the 802.11 specification that
introducted the radio interface, or PHY; e.g. "a", "b", "g", or
"n".
Other than for pattern matching techniques, I think it is not so useful.

band: The frequency band for the radio, in gigahertz (GHz). 802.11
[IEEE.80211] specifies PHY layers that use 2.4, 3.7 and 5
gigahertz frequency bands.
I think it is not so useful, again, for other than RF finger printing matching.


regclass: The regulatory domain and class. The "country" attribute
optionally includes the applicable two character country
identifier (dot11CountryString), which can be followed by an 'O',
'I' or 'X'. The element text content includes the value of the
regulatory class: an 8-bit integer in decimal form.
If I understood this field correctly, I think it may depend on the ISP, which may be located far from the AP, thus have a country string it is a continent away. That's probably rare, but not impossible. If so, then it's not useful, in my opinion.


antenna: The antenna identifier for the antenna that the access
point is using to transmit the measured signals.
From what I know, most APs have a single antenna, or two antenna's for MIMO type communication. But the antennas are very closely spaced, so identifying which antenna is used for Tx/Rx is not helpful for location. Unless there's an antenna in each floor in a building for the same AP (a configuration which I am not familiar with) then maybe identifying which Antenna the device is connecting to the AP through helps identify in what floor the device is located. So in such scenarios this field is useful, otherwise it is useless from what I can tell.

flightTime: Flight time is the difference between the time of
departure (TOD) of signal from a transmitting station and time of
arrival (TOA) of signal at a receiving station, as defined in
[IEEE.80211V]. Measurement of this value requires that stations
synchronize their clocks. This value can be measured by access
point or Device; because the flight time is assumed to be the same
in either direction - aside from measurement errors - only a
single element is provided. This element includes optional
"rmsError" and "samples" attributes. RMS error might be derived
from the reported RMS error in TOD and TOA.
I think this field could be very useful if it was possible to measure it accurately, which I think it is not possible. In order use the Flight Time for range determination, both the transmitting and receiving ends should be synchronized to within 50nsec. This is not possible if the device and AP don't have access to a common reference time, such as GPS time. NTP sync won't achieve such accuracy, as far as I know. However, a more robust measurement would be Total Flight Time, or Round Trip Time. With such measurement, the device would loop back a signal, like a ping message for example, to the AP and the AP measures the round trip time. Time synchronization is not necessary in this case. Furthermore, there are ways to make this more accurate, similar to LTE, where the Device can send to the AP the Tx-to-Rx time difference in the device in order to compensate for the Rx-to-Tx path delay within the device. Lastly, it is implied that both the device and the AP have time t
agging capability that has 50nsec resolution, which may be impractical, but I don't know that for sure and can research it if needed.

apSignal: Measurement information for the signal transmitted by the
access point, as observed by the Device. Some of these values are
derived from 802.11v [IEEE.80211V] messages exchanged between
Device and access point. The contents of this element include:

transmit: The transmit power reported by the access point, in dB.
I think it is useful as part of determining the path loss from AP to device, thus deducing range using log-normal propagation model. Its measurement unit is incorrectly written; it should be in dBm not measured in dB.


gain: The gain of the access point antenna reported by the access
point, in dB.
I think it is useful as part of determining the path loss from AP to device, thus deducing range using log-normal propagation model. It is correctly specified in dB. I assume this is user entered info, though, so possibly subject to operator error. Nonetheless, it is needed for proper path loss determination, and should be included.

rcpi: The received channel power indicator for the access point
signal, as measured by the Device. This value SHOULD be in
units of dBm (with RMS error in dB). If power is measured in a
different fashion, the "dBm" attribute MUST be set to "false".
Signal strength reporting on current hardware uses a range of
different mechanisms; therefore, the value of the "nicType"
element SHOULD be included if the units are not known to be in
dBm and the value reported by the hardware should be included
without modification. This element includes optional
"rmsError" and "samples" attributes.
I think it is useful as part of determining the path loss from AP to device, thus deducing range using log-normal propagation model.

rsni: The received signal to noise indicator in dBm. This
element includes optional "rmsError" and "samples" attributes.
I think it can be considered as useful information. It can be used to verify that a high rcpi measurement is not due to something like interference.

deviceSignal: Measurement information for the signal transmitted by
the device, as reported by the access point. This element
contains the same child elements as the "ap" element, with the
access point and Device roles reversed.

If we assume the RF path is symmetric between UL and DL then technically this is a redundant field (since we're after range determination through RF path loss modeling, I assume). However, it probably helps to have the opposite direction measurements for verification purposes. For instance, if both sides agree, then it increases confidence in the path loss estimate. So I think it is a good to have in addition to the APSignal measurements.

All elements are optional except for "bssid".

The "nicType" element is used to specify the make and model of the
wireless network interface in the Device. Different 802.11 chipsets
report measurements in different ways, so knowing the network
interface type aids the LIS in determining how to use the provided
measurement data. The content of this field is unconstrained and no
mechanisms are specified to ensure uniqueness.

5.3.1. Wifi Measurement Requests


Two elements are defined for requesting WiFi measurements in a
measurement request:

type: The "type" element identifies the desired type (or types that
are requested.

parameter: The "parameter" element identifies an optional
measurements are requested for each measured access point. An
element is identified by its qualified name. The optional
"context" parameter can be used to specify if an element is
included as a child of the "ap" or "device" elements; omission
indicates that it applies to both.

Multiple types or parameters can be requested by repeating either
element.


_______________________________________________
Geopriv mailing list
Geopriv@ietf.org
https://www.ietf.org/mailman/listinfo/geopriv

Saturday, October 22, 2011

Re: [Geopriv] Gen-ART review of draft-ietf-geopriv-policy-uri-02

Hi Richard,

Thanks for the quick response. Two of the three proposed changes are fine with me:

- The additional text in section 3.1 stating that the policy URI is a shared
secret with a forward reference to the security considerations section
removes the surprise factor.
- The additional text on URI unpredictability in section 7.2 recommending a
combination of 32 bits of entropy with rate limiting provides concrete
guidance to implementers.

That leaves the issue of confidentiality and integrity requirements in section 7.2:

> > Alternatively, changing "required" to "REQUIRED" in the following sentence
> > in Section 7.2 may suffice, although integrity is not mentioned in this
> > sentence:
> >
> > Confidentiality is required for its conveyance in the
> > location configuration protocol, and in the requests that are used
> > to inspect, change or delete the policy resource.
>
> I like this phrasing. I'm not sure it's quite REQUIRED (following the "MUST implement / MAY use"
> pattern of BCP 61), but I would go for a strong SHOULD. The underlying LCP protocols already
> guarantee the "MUST implement". Suggested text:
>
> Section 7.2
> OLD:
> "
> Confidentiality is required for its conveyance in the location configuration protocol, and in the
> requests that are used to inspect, change or delete the policy resource.
> "
> NEW:
> "
> Confidentiality and integrity protections SHOULD be used when policy URIs are conveyed in a location
> configuration protocol, and in the requests that are used to inspect, change or delete the policy
> resource.
> "

The reason for going beyond BCP 61 is that BCP 61 concerns protocols in general, but this
is a specific case with additional security requirements because a policy URI is a shared
secret. If a policy URI is sent without confidentiality, a likely result is that the
policy URI is still shared, but is no longer sufficiently secret (oops).

This is particularly dangerous if there are no additional authorization checks on the
PUT or DELETE methods for the policy URI, but it's probably ok in some situations if only
the GET method is allowed (e.g., policy creation and update are handled via some other means
such as a secure web portal).

For that reason, the proposed SHOULD requirement would be ok with me if a couple of things
were added:
(i) If an LCP sends a policy URI without confidentiality protection, then the
LIS or LS MUST reject the PUT and DELETE methods for that URI.
(ii) The PUT and DELETE methods SHOULD NOT be supported for policy URIs that
use the "http:" URI scheme (in contrast to the "https:" URI scheme).

For (i) it'd also be useful to note that the current LCPs never send a policy URI
without confidentiality protection in connection with this (already stated in 7.1,
but ought to be connected to (i) if that text winds up in a different section).

For (ii), I'm not sure what is envisioned by the final sentence in section 7.1:

If other means of protection are available, an "http:" URI MAY be used.

What sorts of "other means of protection" were the underlying motivation? Those "other
means of protection" would be the reason for (ii) being a "SHOULD" instead of a "MUST".

Thanks,
--David

> -----Original Message-----
> From: Richard L. Barnes [mailto:rbarnes@bbn.com]
> Sent: Saturday, October 22, 2011 11:19 AM
> To: Black, David
> Cc: martin.thomson@andrew.com; james.winterbottom@andrew.com; Hannes.Tschofenig@gmx.net; gen-
> art@ietf.org; ietf@ietf.org; rjsparks@nostrum.com
> Subject: Re: Gen-ART review of draft-ietf-geopriv-policy-uri-02
>
> Hi David,
>
> Thanks for your review. Glad to provide clarification on these points. Responses inline below. Let
> me know if these address your concerns.
>
> --Richard
>
>
> > This draft specifies policy URIs for management of privacy policy for location
> > information obtained and maintained by Location Configuration Protocols (LCPs).
> > The draft is clear and well written.
>
> Thanks!
>
>
> > [1] This first turns up as an editorial issue in Section 3:
> >
> > Knowledge of the policy URI can be considered adequate evidence of
> > authorization.
> >
> > That sentence should be expanded to explain why, because this is not the case
> > for URIs in general. The explanation is that a policy URI is constructed
> > to be very hard to predict, and functions as a shared secret (e.g.,
> > confidentiality protection is required in all protocols that transmit
> > a policy URI).
> >
> > There are a couple of Security Considerations (Section 7) aspects that should
> > be strengthened because a policy URI is a shared secret.
>
> I definitely appreciate that this could be surprising in Section 3, but since this section is mainly
> dealing with how the server makes access control decisions, I'm inclined to address this mainly with a
> forward reference to the Security Considerations. Suggested text:
>
> Section 3.1
> OLD:
> "
> Knowledge of the policy URI can be considered adequate evidence of authorization.
> "
> NEW:
> "
> Knowledge of the policy URI can be considered adequate evidence of authorization; a policy URI
> functions as a shared secret between the client and the server (see Section 7).
> "
>
>
> > Alternatively, changing "required" to "REQUIRED" in the following sentence
> > in Section 7.2 may suffice, although integrity is not mentioned in this
> > sentence:
> >
> > Confidentiality is required for its conveyance in the
> > location configuration protocol, and in the requests that are used
> > to inspect, change or delete the policy resource.
>
> I like this phrasing. I'm not sure it's quite REQUIRED (following the "MUST implement / MAY use"
> pattern of BCP 61), but I would go for a strong SHOULD. The underlying LCP protocols already
> guarantee the "MUST implement". Suggested text:
>
> Section 7.2
> OLD:
> "
> Confidentiality is required for its conveyance in the location configuration protocol, and in the
> requests that are used to inspect, change or delete the policy resource.
> "
> NEW:
> "
> Confidentiality and integrity protections SHOULD be used when policy URIs are conveyed in a location
> configuration protocol, and in the requests that are used to inspect, change or delete the policy
> resource.
> "
>
>
>
> > [3} The unpredictability requirements are vague:
> >
> > o The Location Server MUST ensure that the URI cannot be easily
> > predicted. The policy URI MUST NOT be derived solely from
> > information that might be public, including the Target identity or
> > any location URI. The addition of random entropy increases the
> > difficulty of guessing a policy URI.
> >
> > Something needs to be stated about how much random entropy is required
> > (e.g., 8 bits is probably not enough ;-) ).
>
> I actually don't think the entropy requirements are huge here. Because the number of legitimate
> requests from any client should be quite small (are you going to update your policy 2^16 times?), the
> server can apply rate limits to prevent brute force attacks. Suggested text:
>
> Section 7.2
> OLD:
> "
> o The Location Server MUST ensure that the URI cannot be easily predicted. The policy URI MUST NOT
> be derived solely from information that might be public, including the Target identity or any location
> URI. The addition of random entropy increases the difficulty of guessing a policy URI.
> "
> NEW:
> "
> o The Location Server MUST ensure that the URI cannot be easily predicted. The policy URI MUST NOT
> be derived solely from information that might be public, including the Target identity or any location
> URI. The addition of 32 bits or more of random entropy is RECOMMENDED to make it infeasible for a
> third party to guess a policy URI.
> o Servers SHOULD apply rate limits in order to make brute-force guessing infeasible. If a server
> allocates policy URIs that include N bits of entropy with a default lifetime of T seconds, then the
> server should limit clients to 2^(N/2)/T queries per second.
> "
>
>
>
> > Nits: I found a number of acronyms that should be expanded on first use,
> > e.g., LIS, LS, and HELD.
>
> Section 1:
> OLD: "(acting for the Location Server)"
> NEW: "(acting for the Location Server (LS) or Location Information Server (LIS))"
>
> Section 1:
> OLD: "extensions to the HELD protocol"
> NEW: "extensions to the HTTP-Enabled Location Delivery (HELD) protocol"
>

_______________________________________________
Geopriv mailing list
Geopriv@ietf.org
https://www.ietf.org/mailman/listinfo/geopriv

Wednesday, October 19, 2011

Re: [Geopriv] Location Obfuscation and Emergency Services (geopriv-policy-25)

Richard, Hannes

Thanks for the responses.

I agree that it might make sense to have a more detailed discussion of how to deal with an obscured location for the emergency services use case in an ECRIT document.

However, I could be wrong, but I think this is the first GEOPRIV document that describes a rule to deliberately reduce the accuracy of location information, so I think it would be appropriate to have at least a brief discussion of the consequences in this document.

I am suggesting some text to clarify whether a rule to obscure location will either prevent obtaining the most accurate location information available in cases that it is needed or desired, or will make it necessary to take additional actions to obtain accurate location information when it is needed.

In other words, if a rule maker sets a rule to obscure location, does this mean a location recipient (either the location target or a third party) cannot obtain accurate location in the case that it needs it, whether for an emergency call (where the consequences for deliberately providing less useful location information are high) or to order a pizza? I think it appropriate for this document to provide some guidance to the rule maker to address this.

Eric


-----Original Message-----
From: Hannes Tschofenig [mailto:hannes.tschofenig@gmx.net]
Sent: Tuesday, October 18, 2011 7:39 PM
To: Richard L. Barnes
Cc: Hannes Tschofenig; Arolick, Eric; geopriv@ietf.org
Subject: Re: [Geopriv] Location Obfuscation and Emergency Services (geopriv-policy-25)

Richard, Eric,

I will put some text about this issues into the upcoming version of the trustworthy location document.
Planning to work on it next week.

Ciao
Hannes

On Oct 18, 2011, at 4:21 PM, Richard L. Barnes wrote:

> <hat type="individual"/>
>
> Hi Eric,
>
> Thanks for the comments. You're correct that emergency services use cases do create new scenarios for location privacy. This document is not the place to address them. All this document does is define a policy language that can be applied in many different circumstances. Documents that define emergency services architectures should define how they handle privacy rules.
>
> Note that this will vary quite a bit from jurisdiction to jurisdiction. Your assumption that privacy rules can be ignored is not valid everywhere; for example, in Japanese emergency calls today, the caller can choose to suppress location information for the call.
>
> I think the best place to address these concerns is probably in the ECRIT location security document:
> <http://tools.ietf.org/html/draft-ietf-ecrit-trustworthy-location-02>
>
> Best,
> --Richard
>
>
> On Oct 18, 2011, at 1:57 PM, Arolick, Eric wrote:
>
>> Hannes
>>
>> There does not appear to be text in draft-ietf-geopriv-policy-25.txt that addresses the impact of location obfuscation on the emergency services use case. Specifically, there may be a desire to obscure or lie about location to protect privacy in some or most cases. But in the emergency case, it is in the best interests of the location target, and there may be a legal obligation in some jurisdictions, to use the most accurate location information available.
>>
>> Parameters in the location object describing its use (e.g. retransmission allowed) can be ignored if appropriate for an emergency call, but nothing can be done to the location information itself once the object is created. It would be useful to clarify in this document the impact of a rule to deliberately obscure location when a location object is created would have on the emergency services use case and to describe how it is possible to make sure a location object contains accurate location information for an emergency call.
>>
>> Thanks
>>
>> Eric Arolick
>>
>> _______________________________________________
>> Geopriv mailing list
>> Geopriv@ietf.org
>> https://www.ietf.org/mailman/listinfo/geopriv
>

_______________________________________________
Geopriv mailing list
Geopriv@ietf.org
https://www.ietf.org/mailman/listinfo/geopriv

Tuesday, October 18, 2011

Re: [Geopriv] Location Obfuscation and Emergency Services (geopriv-policy-25)

Richard, Eric,

I will put some text about this issues into the upcoming version of the trustworthy location document.
Planning to work on it next week.

Ciao
Hannes

On Oct 18, 2011, at 4:21 PM, Richard L. Barnes wrote:

> <hat type="individual"/>
>
> Hi Eric,
>
> Thanks for the comments. You're correct that emergency services use cases do create new scenarios for location privacy. This document is not the place to address them. All this document does is define a policy language that can be applied in many different circumstances. Documents that define emergency services architectures should define how they handle privacy rules.
>
> Note that this will vary quite a bit from jurisdiction to jurisdiction. Your assumption that privacy rules can be ignored is not valid everywhere; for example, in Japanese emergency calls today, the caller can choose to suppress location information for the call.
>
> I think the best place to address these concerns is probably in the ECRIT location security document:
> <http://tools.ietf.org/html/draft-ietf-ecrit-trustworthy-location-02>
>
> Best,
> --Richard
>
>
> On Oct 18, 2011, at 1:57 PM, Arolick, Eric wrote:
>
>> Hannes
>>
>> There does not appear to be text in draft-ietf-geopriv-policy-25.txt that addresses the impact of location obfuscation on the emergency services use case. Specifically, there may be a desire to obscure or lie about location to protect privacy in some or most cases. But in the emergency case, it is in the best interests of the location target, and there may be a legal obligation in some jurisdictions, to use the most accurate location information available.
>>
>> Parameters in the location object describing its use (e.g. retransmission allowed) can be ignored if appropriate for an emergency call, but nothing can be done to the location information itself once the object is created. It would be useful to clarify in this document the impact of a rule to deliberately obscure location when a location object is created would have on the emergency services use case and to describe how it is possible to make sure a location object contains accurate location information for an emergency call.
>>
>> Thanks
>>
>> Eric Arolick
>>
>> _______________________________________________
>> Geopriv mailing list
>> Geopriv@ietf.org
>> https://www.ietf.org/mailman/listinfo/geopriv
>

_______________________________________________
Geopriv mailing list
Geopriv@ietf.org
https://www.ietf.org/mailman/listinfo/geopriv

Re: [Geopriv] Location Obfuscation and Emergency Services (geopriv-policy-25)

<hat type="individual"/>

Hi Eric,

Thanks for the comments. You're correct that emergency services use cases do create new scenarios for location privacy. This document is not the place to address them. All this document does is define a policy language that can be applied in many different circumstances. Documents that define emergency services architectures should define how they handle privacy rules.

Note that this will vary quite a bit from jurisdiction to jurisdiction. Your assumption that privacy rules can be ignored is not valid everywhere; for example, in Japanese emergency calls today, the caller can choose to suppress location information for the call.

I think the best place to address these concerns is probably in the ECRIT location security document:
<http://tools.ietf.org/html/draft-ietf-ecrit-trustworthy-location-02>

Best,
--Richard


On Oct 18, 2011, at 1:57 PM, Arolick, Eric wrote:

> Hannes
>
> There does not appear to be text in draft-ietf-geopriv-policy-25.txt that addresses the impact of location obfuscation on the emergency services use case. Specifically, there may be a desire to obscure or lie about location to protect privacy in some or most cases. But in the emergency case, it is in the best interests of the location target, and there may be a legal obligation in some jurisdictions, to use the most accurate location information available.
>
> Parameters in the location object describing its use (e.g. retransmission allowed) can be ignored if appropriate for an emergency call, but nothing can be done to the location information itself once the object is created. It would be useful to clarify in this document the impact of a rule to deliberately obscure location when a location object is created would have on the emergency services use case and to describe how it is possible to make sure a location object contains accurate location information for an emergency call.
>
> Thanks
>
> Eric Arolick
>
> _______________________________________________
> Geopriv mailing list
> Geopriv@ietf.org
> https://www.ietf.org/mailman/listinfo/geopriv

_______________________________________________
Geopriv mailing list
Geopriv@ietf.org
https://www.ietf.org/mailman/listinfo/geopriv

[Geopriv] Location Obfuscation and Emergency Services (geopriv-policy-25)

Hannes

 

There does not appear to be text in draft-ietf-geopriv-policy-25.txt that addresses the impact of location obfuscation on the emergency services use case. Specifically, there may be a desire to obscure or lie about location to protect privacy in some or most cases. But in the emergency case, it is in the best interests of the location target, and there may be a legal obligation in some jurisdictions, to use the most accurate location information available.  

 

Parameters in the location object describing its use (e.g. retransmission allowed) can be ignored if appropriate for an emergency call, but nothing can be done to the location information itself once the object is created. It would be useful to clarify in this document the impact of a rule to deliberately obscure location when a location object is created would have on the emergency services use case and to describe how it is possible to make sure a location object contains accurate location information for an emergency call.

 

Thanks

 

Eric Arolick  

 

Monday, October 17, 2011

[Geopriv] I-D Action: draft-ietf-geopriv-local-civic-02.txt

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Geographic Location/Privacy Working Group of the IETF.

Title : Specifying Civic Address Extensions in PIDF-LO
Author(s) : James Winterbottom
Martin Thomson
Richard Barnes
Brian Rosen
Robins George
Filename : draft-ietf-geopriv-local-civic-02.txt
Pages : 20
Date : 2011-10-17

New fields are occasionally added to civic addresses. A backwardly-
compatible mechanism for adding civic address elements to the Geopriv
civic address format is described. A formal mechanism for handling
unsupported extensions when translating between XML and DHCP civic
address forms is defined for entities that need to perform this
translation. Intial extensions for some new elements are also
defined. The LoST protocol mechanism that returns civic address
element names used for validation of location information is
clarified to require a namespace on each element.


A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-geopriv-local-civic-02.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-geopriv-local-civic-02.txt
_______________________________________________
Geopriv mailing list
Geopriv@ietf.org
https://www.ietf.org/mailman/listinfo/geopriv

Saturday, October 15, 2011

Re: [Geopriv] I-D Action: draft-ietf-geopriv-policy-25.txt

Hi all,

I have made two changes with this draft submission:

a) At the last IETF meeting we had a discussion about the limitations of location obscuring. Martin provided a short writeup, which is now included in Section 13.4 (as a subsection of the security consideration section).
b) I added Martin as co-author.

I believe the comments from the last IETF meetings are appropriately addressed with version -25.

Ciao
Hannes

On Oct 14, 2011, at 10:38 PM, internet-drafts@ietf.org wrote:

> A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Geographic Location/Privacy Working Group of the IETF.
>
> Title : Geolocation Policy: A Document Format for Expressing Privacy Preferences for Location Information
> Author(s) : Henning Schulzrinne
> Hannes Tschofenig
> Jorge R. Cuellar
> James Polk
> John B. Morris
> Martin Thomson
> Filename : draft-ietf-geopriv-policy-25.txt
> Pages : 48
> Date : 2011-10-14
>
> This document defines an authorization policy language for
> controlling access to location information. It extends the Common
> Policy authorization framework to provide location-specific access
> control. More specifically, this document defines condition elements
> specific to location information in order to restrict access based on
> the current location of the Target.
>
> Furthermore, this document defines two algorithms for reducing the
> granularity of returned location information. The first algorithm is
> defined for usage with civic location information while the other one
> applies to geodetic location information. Both algorithms come with
> limitations, i.e. they provide location obfuscation under certain
> conditions and may therefore not be appropriate for all application
> domains.
>
>
> A URL for this Internet-Draft is:
> http://www.ietf.org/internet-drafts/draft-ietf-geopriv-policy-25.txt
>
> Internet-Drafts are also available by anonymous FTP at:
> ftp://ftp.ietf.org/internet-drafts/
>
> This Internet-Draft can be retrieved at:
> ftp://ftp.ietf.org/internet-drafts/draft-ietf-geopriv-policy-25.txt
> _______________________________________________
> Geopriv mailing list
> Geopriv@ietf.org
> https://www.ietf.org/mailman/listinfo/geopriv

_______________________________________________
Geopriv mailing list
Geopriv@ietf.org
https://www.ietf.org/mailman/listinfo/geopriv

Friday, October 14, 2011

[Geopriv] I-D Action: draft-ietf-geopriv-policy-25.txt

A New Internet-Draft is available from the on-line Internet-Drafts directories. This draft is a work item of the Geographic Location/Privacy Working Group of the IETF.

Title : Geolocation Policy: A Document Format for Expressing Privacy Preferences for Location Information
Author(s) : Henning Schulzrinne
Hannes Tschofenig
Jorge R. Cuellar
James Polk
John B. Morris
Martin Thomson
Filename : draft-ietf-geopriv-policy-25.txt
Pages : 48
Date : 2011-10-14

This document defines an authorization policy language for
controlling access to location information. It extends the Common
Policy authorization framework to provide location-specific access
control. More specifically, this document defines condition elements
specific to location information in order to restrict access based on
the current location of the Target.

Furthermore, this document defines two algorithms for reducing the
granularity of returned location information. The first algorithm is
defined for usage with civic location information while the other one
applies to geodetic location information. Both algorithms come with
limitations, i.e. they provide location obfuscation under certain
conditions and may therefore not be appropriate for all application
domains.


A URL for this Internet-Draft is:
http://www.ietf.org/internet-drafts/draft-ietf-geopriv-policy-25.txt

Internet-Drafts are also available by anonymous FTP at:
ftp://ftp.ietf.org/internet-drafts/

This Internet-Draft can be retrieved at:
ftp://ftp.ietf.org/internet-drafts/draft-ietf-geopriv-policy-25.txt
_______________________________________________
Geopriv mailing list
Geopriv@ietf.org
https://www.ietf.org/mailman/listinfo/geopriv

Wednesday, October 12, 2011

Re: [Geopriv] AD review: draft-ietf-geopriv-deref-protocol-03

:)

The first could be shorter:

Without a uniform authentication infrastructure for HTTP, access control policies that rely on the identity of the requestor are difficult to implement in practice.

But I'm not sure where you thought that it might go. Section 3.2 perhaps?

The second change: great. Exactly what I had in mind.

On 2011-10-13 at 13:55:04, Richard L. Barnes wrote:
> Hey Martin,
>
> You message made me realize that my carefully crafted a response to
> Robert had not been CC'ed the group.
>
> Kind of like you said, my reading of the section that Robert cites was
> more that the access control model is just harder to implement in
> practice than the possession model. For example, the lack of a global
> authentication system makes it hard to enforce policies based on
> requester identity.
>
> Suggested text:
>
> NEW:
> "
> However, the lack of a uniform authentication infrastructure for the
> Internet means that certain access control policies will be difficult
> to implement in practice, especially policies based on the identity of
> the requestor.
> "
>
> OLD:
> "
> A possible format for these authorization policies is available with
> GEOPRIV Common Policy [RFC4745] and Geolocation Policy [I-D.ietf-
> geopriv-policy].
> "
> NEW:
> "
> A possible format for these authorization policies is available with
> GEOPRIV Common Policy [RFC4745] and Geolocation Policy [I-D.ietf-
> geopriv-policy]. If a device receives location URIs via DHCP or HELD,
> the location server may also provided with a policy URI that can be
> used to provision privacy policy [I-D.ietf-geopriv-policy-uri].
> "
>
> NEW:
> [informative reference to draft-ietf-geopriv-policy-uri]
>
> Thoughts?
>
> --Richard
>
>
>
> On Oct 12, 2011, at 10:34 PM, Thomson, Martin wrote:
>
> > On 2011-10-12 at 04:30:00, Robert Sparks wrote:
> >> There is some text that I think could be further improved before
> >> publishing this as an RFC.
> >> The following notion appears several times in the document:
> >>
> >> However, no authentication framework is provided, which
> >> limits the policy options available when the "Authorization by
> >> Access
> >> Control" model is used.
> >> There is other work coming from this working group that supports
> >> the authorization by access control model. Is the point of these
> >> phrases to highlight that other documents are needed to make
> >> authorization
> by
> >> access control more useful? Or is it to note that the current tools
> >> deployed for authentication over http make authorization by access
> >> difficult.
> >
> > The intent was to simply highlight an area where a commonplace or
> reasonable assumption (that identity-based access control is an
> option) could lead to an unexpected conclusion. HTTP authentication
> doesn't work until you put in a lot of ground-work: identifying
> principals, deciding on realms, authentication credentials, trust
> anchors, and much more. We don't define them here, so it would be
> dishonest to even give the impression that HTTP authentication is going to work.
> >
> > Whether or not we ever get to the point that we can reliably use
> (client) authentication in HTTP, I don't want to speculate.
> >
> >> As written, I expect readers who have not been following this work
> >> closely to interpret the phrase to mean that the group chose not to
> >> provide a framework and thus doesn't expect people to use
> >> authorization by access control much.
> >
> > I didn't think that it was a good idea to presume anything about how
> a specification would be deployed. But your conclusion is the exact
> one that I would hope that readers take away.
> >
> > Given the maturity of -policy-uri, it might improve the situation by
> adding a citation in Section 3.2. That might at least point a reader
> in the right direction.
> >
> > --Martin
> > _______________________________________________
> > Geopriv mailing list
> > Geopriv@ietf.org
> > https://www.ietf.org/mailman/listinfo/geopriv

_______________________________________________
Geopriv mailing list
Geopriv@ietf.org
https://www.ietf.org/mailman/listinfo/geopriv