Toward Efficient Secure Threat Information Analysis in Cyber‐Physical Systems

ABSTRACT Critical‐physical systems such as transportation systems often deploy intrusion detection systems to gather crucial threat information. Multiple systems can jointly perform threat information set intersections to better analyze the threat information. However, threat information is considered private by individual systems that are unwilling to publicly share it. No specialized solution has been proposed for this problem. This article introduces two efficient threat information analysis protocols to address this gap. Protocol 1 supports the intersection calculation of threat information datasets from multiple systems to analyze the most threatening information with the help of the cloud server. Finally, all parties as well as the cloud server receive the output. Protocol 2 also supports the threat information set intersection calculation from multiple systems, where all participants eventually obtain the output except the cloud server. The security analysis indicates that both of our protocols meet practical security requirements.