Sharing of community-based security information

Patent metadata

Field	Value
Publication number	US-10701044-B2
Application number	US-201515737864-A
Country	US
Kind code	B2
Filing date	Jun 26, 2015
Priority date	Jun 26, 2015
Publication date	Jun 30, 2020
Grant date	Jun 30, 2020

Abstract

Examples disclosed herein relate to sharing of community-based security information. Some examples may enable generating a first community on a security information sharing platform that enables sharing of security information among a plurality of communities; obtaining a first security indicator from a first user of the first community; providing the first security indicator to the first community; obtaining contextual information related to the first security indicator from a second user of the first community; including the first security indicator and the contextual information related to the first security indicator in the security information of the first community; and encrypting a portion of the security information of the first community with an encryption key, wherein the encryption key is unavailable to users outside of the first community.

First claim

The invention claimed is:

1. A method for sharing of community-based security information, the method comprising:
generating a first community on a security information sharing platform that enables sharing of security information among a plurality of communities;
obtaining a first security indicator from a first user of the first community;
providing the first security indicator to the first community;
obtaining contextual information related to the first security indicator from a second user of the first community;
including the first security indicator and the contextual information related to the first security indicator in community-based security information of the first community; and
encrypting a portion of the community-based security information of the first community with an encryption key, wherein the encryption key is unavailable to users outside of the first community.

2. The method of claim 1 , further comprising:
sharing the community-based security information of the first community with a third user of a second community, wherein the third user has access to the community-based security information of the first community other than the encrypted portion.

3. The method of claim 2 , further comprising:
providing the encryption key to the third user; and
authorizing the third user to access the encrypted portion using the provided encryption key.

4. The method of claim 1 , further comprising:
obtaining a second security indicator from the second user of the first community;
providing the second security indicator to the first community;
obtaining contextual information related to the second security indicator from a third user of the first community; and
including the second security indicator and the contextual information related to the second security indicator in the community-based security information of the first community.

5. The method of claim 1 , wherein the first security indicator comprises at least one observable selected from among an Internet Protocol (IP) address, a domain name, an e-mail address, a Uniform Resource Locator (URL), or a software file hash.

6. The method of claim 1 , wherein the contextual information related to the first security indicator comprises one or more of an investigation result that is provided by the second user for the first security indicator, an indicator score for the first security indicator, a source entity for the first security indicator, and a threat actor for the first security indicator.

7. The method of claim 1 , wherein the first security indicator specifies an observable relating to a security threat.

8. The method of claim 1 , wherein the generating of the first community on the security information sharing platform comprises receiving a list of users at the security information sharing platform.

9. The method of claim 1 , wherein the generating of the first community on the security information sharing platform comprises identifying users and inviting, by the security information sharing platform, the identified users to join the first community.

10. The method of claim 1 , wherein the obtaining of the first security indicator comprises receiving the first security indicator from a threat intelligence feed transmitted by a source.

11. The method of claim 1 , wherein the contextual information includes information about whether a threat identified in the first security indicator was successful in an attack, and wherein the encrypting of the portion of the community-based security information comprises encrypting the contextual information and leaving unencrypted the first security indicator in the community-based security information.

12. A non-transitory machine-readable storage medium comprising instructions that upon execution cause a system to:
generate a community on a security information sharing platform that allows sharing of security information among a plurality of communities;
receive, from a first user who does not belong to the community, a request to access community-based security information of the community;
determine whether the community-based security information of the community is to be shared with the first user, the community-based security information including a portion encrypted with an encryption key that is unique to the community; and
in response to determining that the community-based security information of the community is to be shared with the first user, authorize the first user to access a portion of the community-based security information other than the encrypted portion.

13. The non-transitory machine-readable storage medium of claim 12 , wherein the instructions upon execution cause the system to:
receive, from a second user who belongs to the community, a request to access the community-based security information of the community; and
in response to the request from the second user, decrypt the encrypted portion using the encryption key to provide access of the encrypted portion to the second user.

14. The non-transitory machine-readable storage medium of claim 12 , wherein the instructions upon execution cause the system to:
provide the encryption key to the first user; and
authorize the first user to access the encrypted portion using the provided encryption key.

15. The non-transitory machine-readable storage medium of claim 12 , wherein the community-based security information comprises a security indicator and contextual information related to the security indicator.

16. The non-transitory machine-readable storage medium of claim 12 , wherein users of the community have access to: the community-based security information of the community, and community-based security information of other communities shared with the community.

17. A system comprising:
a processor; and
a non-transitory storage medium storing instructions executable on the processor to:
obtain a security indicator for a first community of a security information sharing platform that allows sharing of security information among a plurality of communities;
cause presentation, via a user interface, of the security indicator to a first user of the first community;
obtain contextual information related to the security indicator from the first user;
include the security indicator and the contextual information in community-based security information of the first community;
encrypt a portion of the community-based security information with an encryption key that is unique to the first community; and
share the community-based security information with a second user outside of the first community, wherein the second user is prevented from accessing the encrypted portion without the encryption key.

18. The system of claim 17 , wherein the second user belongs to a second community of the security information sharing platform or is a system administrator of the security information sharing platform.

19. The system of claim 17 , wherein the instructions are executable on the processor to authorize users of the first community to access the encrypted portion.

20. The system of claim 17 , wherein the instructions are executable on the processor to:
provide the encryption key to the second user to authorize the second user to access the encrypted portion using the provided encryption key.

Assignees

• Hewlett Packard Entpr Dev Lp
• Micro Focus Llc

Inventors

• Sander Tomas
• Cohen Nadav
• Hein Brian Frederik Hosea Che
• Kibbar Amir
• Ross Ted

Classifications

• G06F21/6218 Primary

  to a system of files or objects, e.g. local or distributed file system or database · CPC title

• G06F2221/2115

  Third party · CPC title

• H04L63/061 Primary

  for key exchange, e.g. in peer-to-peer networks (cryptographic mechanisms or cryptographic arrangements for key agreement H04L9/0838) · CPC title

• H04L63/0428

  wherein the data content is protected, e.g. by encrypting or encapsulating the payload · CPC title