[STDS-802-Privacy] Privacy consideration in bridged networks
The note at:
http://www.ieee802.org/1/files/public/docs2018/e-seaman-privacy-in-bridged-networks-1018-v01.pdf
[also available in the Privecsg area on Mentor as "Privacy
considerations in bridged
networks(e-seaman-privacy-in-bridged-networks-1018-v01.pdf)", sign in
required].
is a result of a dry run of the P802E/D1.1 (Recommended Practice for
Privacy Considerations for IEEE 802 Technologies) suggestion of a
self-assessment by the developers of each 802 standard, with the results
recorded in a Privacy Considerations annex. I started with IEEE Std
802.1AS as the target because the service it provides is rather
different from that offered by 802.11 Access Points to the users of
mobile personal devices.
Working on this I found the scope naturally expanding—it is not possible
to describe IEEE Std 802.1AS privacy exposures without some description
of how it operates within a bridged network, which brings in a
description of that network’s operation. In turn that leads to
consideration of what 802.1AS is being used for, and to the privacy
exposures inherent in recognizing flows through a bridge network, so
timed gates can be used to shaped traffic in a network. A preliminary
conclusion is that ‘the standard’ so far as P802E and 802.1 is concerned
is probably the entire set of 802.1 standards. Of course any adversary
trying to violate personal privacy is not bound to confine attacks to
the scope of any particular standard or set of standards, but we have to
draw boundaries somewhere to make work practicable.
I have cast the result in the form of an informative annex that might
conceivably be attached to a one of the 802.1 standards (most likely
802.1Q) and that would cover the entire set of .1 standards. However I
should stress that this note is not a proposal for a PAR, and the result
of any PAR might be a very different approach. For the present the goal
is to inform the development of P802E/D1.1 and show one way in which its
recommendations might be result in a feasible/tractable amount of work.
An 802.1Q informative annex would not prevent further detailed work
within specific standards, and any change to a standard’s mandatory or
optional requirements and recommendations should be in that standard.
Mick
________________________________________________________________________
To unsubscribe from the STDS-802-PRIVACY list, click the following link: https://listserv.ieee.org/cgi-bin/wa?SUBED1=STDS-802-PRIVACY&A=1