Agenda for vCon, IETF 121, Dublin

2024-11-07 15:30 - 17:00 UTC, Room: Liffey MR 2

Chairs: Chris Wendt, Brian Rosen

• Charter
• Mailing list: vcon@ietf.org

Intro/Agenda Bashing: Chairs (5 min)

Rohan Mahy - https://datatracker.ietf.org/doc/html/draft-mahy-vcon-mimi-messages

• mimi messages, expressed as a vCon
• IM Messaging use Cases
• Sharing the message history from one device to another
• Group chat, we should bring in (person). Do they bring in the full
  conversatoin, such as I think (person) is an idiot. How do you
  manage that info
• Added a bunch to the dialog object
• Track metadata changes, such as changing the title of the meeting,
  name of the people
• Rooms and Parties examples
• Mimi content is a binary format
• Demonstrated how the binary could be represented in a vCon
• Uses attachments to contain the attachments on the messages,
  references back to dialog

• Murray Kucherawy

  • mimetype is no longer used, can it be changed
  • Dan: it's been in a while
  • Murray, might get friction if it's not changed
  • chooSeOne: how do you infer chooseOne
  • Murray: The receiver is allowed to do whatever they want. Comes
    from mimi content
  • After talking with Pete, and others, felt like being able to
    express pick one, the recieve is in charge
  • Murray: do I pick the biggest, smaller, pick which is cooler?
  • Rohan, was reticient to give it alternatives
  • Murray, if your trying to get away from something, use a
    different name
  • Jonathan: how much is related to mimi, and how much is
    different?
  • Murray: wanted to make sure the important fields in mimi were
    preserved in vCon
  • Open to counter examples.
  • Audience: add it to mimi
  • Rohan: not supported in mimi, there's an extension field to use

• Show of hands for who's interested in adding to vCon and should this
  be prusued

  • 4 hands

• Dan: yes, this is in the charter

The JSON format for vCon - Conversation Data Container

• Dan Petrie draft-ietf-vcon-vcon-container-01
  (35 min)

• Use Cases

  • Contact Center
  • Messaging (new from Rohan)
  • Need a volunteer for ECRIT/911 (Just in case Brian says no)

• MIMI/vCon: Externally referenced content hash

  • vCon has a different format from MIMI
  • General agreement in consistency, Jonathan suggests array
  • Jeff, similar in...
  • Steve Lasker: docker containers use embedded hash. Linux
    foundation has a spec OCI Image Spec

• MIMI/vCon naming conventions

  • Snake case vs camel case
  • Even Rohan doesn't know what MIMI uses. :)
  • Everyone wants consistency. vCon is snake case

• Hackathon

  • New RUST implementation from Dan. Avalable in py-vcon in GitHub
  • Further exploration of redacted

• Changes from 00

  • CBOR & CDDL removed
  • Added application adn interaction type parameters
  • Removed use cases description from introduction
  • Corrected externally referenced recording link

• Redacted

  • Removing content from redacted objected
  • Leaves uuid and type, url, alg, signature optional
  • Same for group and appended
  • Redaction object contains the original uuid of the least
    redacted, "should" not "must"

• Dialog, Attachment, Analysis Object

  • Scenario redacted vCon, want to redact entire content of a
    Dialog, Attachment, Analysis
  • Solution: leave whole object but remove body or url parameter
  • ID says objects should havebody or url (unless redacted)

• Appended

  • Scenario: signed or encrypted, want to add more data to
  • Solution: create new vCOn to add the new content and refer to
    the prior
  • Issue: what does the new vCon contain?
  • Howe: We have to have the entire vCon sent across the network,
    practical
  • Lasker: Not have a placeholder?
  • Petrie: trying to keep the dialogs in the right order,
    placeholders do that.
  • Lasker: Looks weird.
  • More noodling required

• Mediatyps for vCon

  • type: application

  • subtypes

    • vcon
    • vcon+gzip

  • How does this work?

  • Murray: consensus was we don't have multiple +s
  • Petrie: We don't know what to do.

• Still needs to be done

  • Highlighted in the draft

  • draft-james-privacy-primer-vcon

    Diana James / Thomas Howe (15 min)

• Why: recognize there will be a lot of new players and actors that
  may not have backgrounds in privacy.

  • Privacy by design, rathre than afterthought
  • Help others to understand the nomenclature
  • Privacy does change, based on juristiction, but the concepts are
    similar
  • Draft is for all of us that may not have the background

• Diana: prepared based on requirements, worldwide

• vCons can contain numerous elements of data, which are protected by
  privacy laws
• vCons contain communication data, which can be in violaotion of the
  recordings lawas

• There's two main ways to remove protected data.

  • Anonmization and replacing
  • PII Masking or removing segments of whole recordings to avoid
    voice or facial recognition

• Privacy principles

  • Notice/Transparency
  • Consent
  • Purpose and storage limitations and data minimization
  • Sometimes, notice is enough, sometimes it's not
  • Some jurisdictions have one or two party consent. At least one
    party must consent.

  • Security

    • vCons in some cases should be encrypted
    • Externall referenced files that are part of a vCon should be
      encrpted if they contain protected information
    • Access to unredacted vCons and their referneced files should
      be restricted to authorized personnel only

  • Data Integrity

    • vCon can be used ith SCITT to track conversations data's
      provenance and ensure its integrity. Before it leaves its
      domain, it should be signed to maintain the chain of trust.

  • Record keeping

    • Many juristictions require maintaining copies of the data
      that was shared

  • Individual Rights

    • Consumers have the right to change their personal
      infomration, and deleted
    • Referred to "right to be forgotten"
    • Should be able to move the data_manager

  • vCons not a silver bullet but can help with those willing to
    comply

• Questions:

  • Should it be adopted by the working group as a BCP,
    informational
  • Murray, it's relevant to the working group
  • ? from the EU, would like to contribute to improve the doc, but
    not sure where to do it
  • Murray: sounds like it will be worked on and vaulable, so might
    as well adopt
  • Diana: regarding the level of compliance, do folks have an
    opinion
  • Jon Geater: conflicting thoughts, don't beleive we should
    require BCP, as it's an interchange format. If you don't show
    people how to use it correctly, it will be a mess.
  • Should have references in the doc for how to support privacy
    requiremnts

- Privacy by Default

Presentation
Steve Lasker (10 min)

• Reviewed Diana's talk
• SCITT working with vCons

• vCon lifecycle analysis

  • DataSource - Ztelco: creates the vCon

  • Data Controller

    • Gavin (consumer) has conversation, vCon created
    • Owns the vCon
    • vCon has a license
    • Mentions the data controller, lifetime, license
    • vCon is now shared with one or more parties. Since it has a
      license, lifetime and data controller, each party
      understands the responsibilities
    • Each of the parties, manages and processes the vCon
    • Each of these are added onto the SCITT ledger
    • Customer revokes consent

  • Inclusion and Consistency

    • SCITT log holds all of the events

• Proposal

  • To enable privacy by design primitive as vCon begins adoption

  • Adds

    • license: uri = a versioned license that specifies the rules
      for use
    • consent_lifetime: the lifetime of consent
    • data_controller: identity

  • Jonathan

    • Consent is one of many lawful basis
    • Retention is more accurate?

  • Dan

    • We need to break out consent from the license

  • Chris

    • We need to think this one through

  • Diana

    • We might want to get

Wrap up: Chairs (5 min)