One document matched: draft-haddad-alien-privacy-terminology-00.txt

Internet Engineering Task Force                            Wassim Haddad
Privacy                                                Ericsson Research
Internet Draft                                             Erik Nordmark
Expires March 2006                                      Sun Microsystems
                                                            October 2005




                            Privacy Terminology
                <draft-haddad-alien-privacy-terminology-00>



Status of this Memo

   By submitting this Internet-Draft, each author represents that any
   applicable patent or other IPR claims of which he or she is aware
   have been or will be disclosed, and any of which he or she becomes
   aware will be disclosed, in accordance with Section 6 of BCP 79.

   Internet-Drafts are working documents of the Internet Engineering
   Task Force (IETF), its areas, and its working groups.  Note that
   other groups may also distribute working documents as Internet-
   Drafts.

   Internet-Drafts are draft documents valid for a maximum of six months
   and may be updated, replaced, or obsoleted by other documents at any
   time.  It is inappropriate to use Internet-Drafts as reference
   material or to cite them other than as "work in progress."

   The list of current Internet-Drafts can be accessed at
   http://www.ietf.org/ietf/1id-abstracts.txt.

   The list of Internet-Draft Shadow Directories can be accessed at
   http://www.ietf.org/shadow.html.



Abstract

   This memo introduces the terminology for the main privacy 
   aspects. The prime goal is to avoid situations where different 
   interpretations of the same key privacy aspects result in 
   different requirements when designing specific solutions, thus 
   leading to an unnecessary confusion.
   










Haddad, Nordmark              Expires March 2006                [Page 1]

INTERNET-DRAFT                Privacy Terminology           October 2005



Table of Contents


   1. Introduction.................................................2
   2. Conventions used in this document............................2
   3. General Terminology..........................................3
   4. Privacy......................................................3
   5. Location Privacy.............................................4
   6. Privacy Aspects..............................................4
   6.1. Anonymity..................................................4
   6.2. Unlinkability..............................................5
   6.3. Unobservability............................................5
   6.3. Relation between Anonymity and Unlinkability...............6
   6.5. Pseudonymity...............................................6
   7. Security Considerations......................................6
   8. References...................................................7
   9. Authors'Addresses............................................7
   Intellectual Property Statement.................................8
   Disclaimer of Validity..........................................8
   Copyright Statement.............................................8



1. Introduction


   Privacy is becoming a key requirement to allow deployment of
   specific internet services. However, privacy has many aspects,
   which differ in scope, properties and limitations.
 
   To avoid any possible confusion with regard to the meanings of 
   privacy in some particular scenarios and to differentiate 
   between requirements related to each scenario, privacy aspects
   have to be well defined before designing any solution. It is 
   the intention of this memo to introduce the terminology for the 
   main aspects of privacy.



2. Conventions used in this document


   The key words "MUST", "MUST NOT", "REQUIRED", "SHALL", "SHALL
   NOT", "SHOULD", "SHOULD NOT", "RECOMMENDED", "MAY", and 
   "OPTIONAL" in this document are to be interpreted as described 
   in [TERM].







Haddad, Nordmark              Expires March 2006                [Page 2]

INTERNET-DRAFT                Privacy Terminology           October 2005



3. General Terminology


   Item of Interest (IOI)

      An Item of Interest (IOI) represents what an attacker is 
      trying to discover, learn, trace and possibly link to other 
      IOI(s), in order to identify its target. 
      Examples of IOI include a subject, event, action (e.g.,
      send, receive, move, etc), specific type of messages,...

 
   Knowledge

      In the field of privacy, knowledge refers to the information 
      available to an attacker about its target. In terms of IOI, 
      knowledge can be described by the probability of one or more
      IOIs.
      We refer to any prior information available to an attacker 
      about a specific target as background knowledge.  

 

4. Privacy


   Privacy is a fundamental human right. The most common 
   definition of privacy is the one by Alan Westin: "Pivacy is 
   the claim of individuals, groups and institutions to determine 
   for themesleves, when, how and to what extent information about 
   them is communicated to others".

   Privacy is a general term that involves several different 
   aspects. These aspects enable features like hiding the node's 
   address(es) (e.g., MAC and/or IP), name(s) (e.g., DNS), and/or 
   location(s), in addition to hiding specific IOIs. One or more 
   of these features can be obtained during one particular 
   session. 

   In wireless telecommunications, privacy addresses especially 
   the protection of the content as well as the context (e.g., 
   time, location, type of service, ...) of a communication event.

   Consequently, neither the mobile node nor its system software 
   shall support the creation of user-related usage profiles. Such 
   profiles basically comprise of a correlation of time and 
   location of the node's use, as well as the type and details of 
   the transaction performed.

   The main privacy aspects are the anonymity, unlinkability, 



Haddad, Nordmark              Expires March 2006                [Page 3]

INTERNET-DRAFT                Privacy Terminology           October 2005



   unobservability and pseudonymity. Note that privacy can even be
   achieved by disconnectivity, i.e., not being connected to a 
   network.



5. Location Privacy


   Location privacy is the ability to prevent other parties from
   learning one's current and/or past location. In order to get 
   such ability, the concerned (i.e., targeted :) node must 
   conceal any relation between its location and the personal 
   identifiable information. 

   In our context, location privacy refers normally to the
   topological location and not the geographic one. The latter is
   provided by other means (e.g., GPS) than an IPv6 address. But 
   it should be noted that it may be possible sometimes to deduce
   the geographical location from the topological one.



6. Privacy Aspects


   As mentioned above, privacy is a general term, which refers to
   many different aspects. In the following, we define the main
   privacy aspects and describe the different relations between
   them.



6.1. Anonymity


   Anonymity is the state of being not uniquely characterized, 
   i.e., identifiable, within a set of subjects (e.g., node, 
   user) called the anonymity set. The set of possible subjects 
   depends on the knowledge of the attacker and may vary over 
   time. Thus, anonymity is relative with respect to the attacker 
   and is very much context dependent.    

   In the security field, anonymity is a property of network 
   security. An entity "A" in a set has anonymity if no other 
   entity can identify "A", nor is there any link back to "A" 
   that can be used, nor any way to verify that any two anonymous 
   act are performed by "A".

   From a user perspective, anonymity ensures that a user may use



Haddad, Nordmark              Expires March 2006                [Page 4]

INTERNET-DRAFT                Privacy Terminology           October 2005


 
   a resource or service without disclosing the user's identity.

   In wireless networks, anonymity means that neither the mobile
   node nor its system shall by default expose any information, 
   that allows any conclusions on the owner or current use of the 
   node.    
   
   Consequently, in scenarios where a device and/or network
   identifiers are used (e.g., MAC address, IP address), neither 
   the communication partner nor any outside attacker should be 
   able to disclose any possible link between the respective 
   identifier and the user's identity.



6.2. Unlinkability


   Unlinkability of two or more IOIs means that from an 
   attacker's perspective, these IOIs are no more and no less 
   related after his observation than they are related 
   concerning his background knowledge.

   For example, two messages (e.g., binding updates) are 
   unlinkable for an attacker if the a-posteriori probability 
   describing his background knowledge that these two messages 
   are sent by the same sender and/or received by the same 
   recipient is the same as the probability imposed by his 
   a-priori knowledge.

   From a user perspective, unlinkability ensures that a user 
   may make multiple uses of resources or services without 
   other being able to link these uses together.



6.3. Unobservability


   Unobservability is the state of IOIs being indistinguishable
   from any IOI. This means that messages are not discernable 
   from e.g., random noise. Consequently, unobservability deals
   with events instead of subjects. 

   From a user perspective, unobservability ensures that a user
   may use a resource or service without others, especially 
   third parties, being able to observe that the resource or
   service is being used. 





Haddad, Nordmark              Expires March 2006                [Page 5]

INTERNET-DRAFT                Privacy Terminology           October 2005



6.4. Relation between Anonymity and Unlinkability


   In terms of unlinkability, anonymity can be defined as the 
   unlikability of an IOI and any identifier of a subject. 
   Consequently, unlinkability is a sufficient condition of
   anonymity but is not a necessary condition. 



6.5. Pseudonymity
 

   Pseudonymity is a weaker property related to anonymity. It 
   means that one cannot identify an entity, but it may be
   possible to prove that two pseudonyms acts were performed by 
   the same entity.

   From a user perspective, pseudonymity ensures that a user 
   may use a resource or service without disclosing its user 
   identity, but can still be accountable for that use.

   Consequently, a pseudonym is an identifier for a party to a
   transaction, which is not in the normal course of events, 
   sufficient to associate the transaction with a particular 
   user.

   Hence a transaction is pseudonymous in relation to a 
   particular party if the transaction data contains no direct 
   identifier for that party, and can only be related to them in 
   the event that a very specific piece of additional data is 
   associated with it.


   For more literature about the privacy terminology content,
   please refer to [ANON], [ISO99], [PRIVNG], [FREEDOM] and
   [ANON-PRIV]Ã.


   
7. Security Considerations


   This document presents only terminology. There are no security
   issues in this document.








Haddad, Nordmark              Expires March 2006                [Page 6]

INTERNET-DRAFT                Privacy Terminology           October 2005



8. References


   [ANON]       A. Pfitzmann et al. "Anonymity, Unobservability,
                Pseudonymity, and Identity Management - A Proposal
                for Terminology", Draft v0.23, Aout, 2005.


   [ANONPRIV]   M. Schmidt, "Subscriptionless Mobile Networking:
                Anonymity and Privacy Aspects within Personal Area
                Networks", IEEE WCNC 2002.


   [Freedom]    A.F. Westin, "Privacy and Freedom", Atheneum Press,
                New York, USA, 1967.

   
   [ISO99]      ISO IS 15408, 1999, http://www.commoncriteria.org/


   [LOPRIPEC]   A. Beresfold, F. Stajano, "Location Privacy in
                Pervasive Computing", IEEE Pervasive Computing,
                2(1):46-55, 2003 IEEE.


   [PRIV-NG]    A. Escudero-Pascual, "Privacy in the Next Generation
                Internet", December 2002.
   


9. Authors' Addresses


   Wassim Haddad
   Ericsson Research 
   8400, Decarie Blvd
   Town of Mount Royal
   Quebec H4P 2N2
   Canada
  
   Phone: +1 514 345 7900
   E-Mail: Wassim.Haddad@ericsson.com


   Erik Nordmark
   Sun Microsystems, Inc
   17 Network Circle
   Moutain View, CA
   USA




Haddad, Nordmark              Expires March 2006                [Page 7]

INTERNET-DRAFT                Privacy Terminology           October 2005
  


   Phone: +1 650 786 2921
   Fax: +1 650 786 5896
   E-Mail: Erik.Nordmark@sun.com
     

   















































Haddad, Nordmark              Expires March 2006                [Page 8]

INTERNET-DRAFT                Privacy Terminology           October 2005



Intellectual Property Statement

   The IETF takes no position regarding the validity or scope of
   any Intellectual Property Rights or other rights that might be
   claimed to pertain to the implementation or use of the
   technology described in this document or the extent to which any
   license under such rights might or might not be available; nor
   does it represent that it has made any independent effort to
   identify any such rights. Information on the IETF's procedures
   with respect to rights in IETF Documents can be found in BCP 78
   and BCP 79.

   Copies of IPR disclosures made to the IETF Secretariat and any
   assurances of licenses to be made available, or the result of an
   attempt made to obtain a general license or permission for the
   use of such proprietary rights by implementers or users of this
   specification can be obtained from the IETF on-line IPR
   repository at http://www.ietf.org/ipr.

   The IETF invites any interested party to bring to its attention
   any copyrights, patents or patent applications, or other
   proprietary rights that may cover technology that may be
   required to implement this standard. Please address the
   information to the IETF at ietf-ipr@ietf.org.
   The IETF has been notified of intellectual property rights
   claimed in regard to some or all of the specification contained
   in this document. For more information consult the online list
   of claimed rights.


Disclaimer of Validity

   This document and the information contained herein are provided
   on an "AS IS" basis and THE CONTRIBUTOR, THE ORGANIZATION HE/SHE
   REPRESENTS OR IS SPONSORED BY (IF ANY), THE INTERNET SOCIETY AND
   THE INTERNET ENGINEERING TASK FORCE DISCLAIM ALL WARRANTIES,
   EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO ANY WARRANTY
   THAT THE USE OF THE INFORMATION HEREIN WILL NOT INFRINGE ANY
   RIGHTS OR ANY IMPLIED WARRANTIES OF MERCHANTABILITY OR FITNESS
   FOR A PARTICULAR PURPOSE.


Copyright Statement

   Copyright (C) The Internet Society (2005). This document is
   subject to the rights, licenses and restrictions contained in
   BCP 78, and except as set forth therein, the authors retain all
   their rights.





Haddad, Nordmark              Expires March 2006                [Page 9]