Privacy-Preserving Data Sharing for Collaborative Threat Analytics
Find Innovative SolutionsGenerate Solutions
Solution Overview
Problem
Organizations face challenges in securely sharing security data due to trust issues, legal liabilities, competitive concerns, and the scarcity of information, which limits their ability to enhance security intelligence and analytics mitigation techniques.
Innovation Solution
A system for privacy-preserving data sharing that computes a metric, such as the Jaccard index or set intersection, to determine whether to share data with a partner, using techniques like Private Set Intersection (PSI), Garbled Circuits, or Fully-Homomorphic Encryption, allowing organizations to optimize benefits and risks while maintaining data privacy.
Engineering Contradictions & Design Principles
Engineering Contradiction Analysis
1Measurement precision
If companies share security data with each other, then the accuracy of security intelligence and analytics mitigation techniques is enhanced, but trust issues and legal liabilities prevent companies from sharing data
Solution Approach 1:
A trusted third-party mediator is introduced to facilitate secure data sharing between companies. The mediator receives data from participating companies, performs the analytics computations, and returns results without any single company having direct access to other companies' raw data. This intermediary structure resolves the trust issue by providing a neutral, controlled environment for data collaboration.
Solution Approach 2:
Instead of sharing actual sensitive security data between companies, the system uses copies or representations of the data (such as encrypted forms, hashed values, or aggregated statistics) that preserve the analytical value while eliminating the risk of exposing sensitive information. This allows companies to benefit from collaborative analytics without compromising their competitive position or exposing themselves to legal liability.
2Reliability
If companies manually parse and approve the sharing of secure information, then data privacy is protected, but the process is unacceptably slow
Solution Approach 1:
Privacy protection measures are built into the data sharing infrastructure in advance, rather than requiring manual review of each data sharing decision. The system pre-configures encryption schemes, access control policies, and anonymization protocols, allowing data to be shared automatically while maintaining privacy protections. This eliminates the need for slow manual parsing and approval processes.
Solution Approach 2:
The system implements automated privacy-preserving mechanisms that operate without human intervention. Encryption, data masking, and access control are handled automatically by the system itself, allowing companies to share data rapidly while maintaining robust privacy protection. The infrastructure serves itself by continuously enforcing privacy policies without requiring manual oversight for each data exchange.
3Reliability
If companies have a limited view of malicious cyber activities, then information security is maintained, but prediction performance is limited
Solution Approach 1:
The system merges security data from multiple companies through a trusted intermediary, combining limited individual views into a comprehensive collective understanding of malicious cyber activities. By aggregating data from multiple sources while preserving privacy through encryption and anonymization, the system achieves both improved prediction performance and maintained information security. The merged dataset reveals attack patterns and trends that would be invisible to any single company acting alone.
Data Source
AI summary
One embodiment of the present invention provides a system for privacy-preserving sharing of data for secure collaboration. During operation, the system obtains a first set of data describing network events associated with one or more network addresses. Next, the system negotiates with a potential partner to determine a metric for deciding whether to share data. The potential partner is associated with a second set of data describing network events. The system then computes a value for the metric in a privacy-preserving way, based on the first set of data and the second set of data. Subsequently, the system determines whether the metric value exceeds a predetermined threshold, and, responsive to determining that the metric value exceeds the predetermined threshold, the system shares the first set of data with the potential partner, while controlling how the data should be shared to optimize benefits and risks of collaboration.