11institutetext: Blockpass ID Lab, Edinburgh Napier University 11email:
{lakshmiramakiran.pasumarthy<EMAIL_ADDRESS>22institutetext: University of Oslo 22email<EMAIL_ADDRESS>
# TIPS: Threat Sharing Information Platform for Enhanced Security

Lakshmi Rama Kiran Pasumarthy 11 Hisham Ali 11 William J Buchanan 11 Jawad
Ahmad 11 Audun Josang 22 Vasileios Mavroeidis 22 Mouad Lemoudden 11

###### Abstract

There is an increasing need to share threat information for the prevention of
widespread cyber-attacks. While threat-related information sharing can be
conducted through traditional information exchange methods, such as email
communications etc., these methods are often weak in terms of their
trustworthiness and privacy. Additionally, the absence of a trust
infrastructure between different information-sharing domains also poses
significant challenges. These challenges include redactment of information,
the Right-to-be-forgotten, and access control to the information-sharing
elements. These access issues could be related to time bounds, the trusted
deletion of data, and the location of accesses. This paper presents an
abstraction of a trusted information-sharing process which integrates
Attribute-Based Encryption (ABE), Homomorphic Encryption (HE) and Zero
Knowledge Proof (ZKP) integrated into a permissioned ledger, specifically
Hyperledger Fabric (HLF). It then provides a protocol exchange between two
threat-sharing agents that share encrypted messages through a trusted channel.
This trusted channel can only be accessed by those trusted in the sharing and
could be enabled for each data-sharing element or set up for long-term
sharing.

###### Keywords:

Distributed Ledger Technology, Cyber Threat Intelligence, Encryption, GDPR

##  1 Introduction

With increasing threats in cybersecurity, the requirement to share threat
information becomes ever more important. Traditional transport mechanisms such
as electronic email often lack any real form of privacy and trust, and so we
need improved methods that can identify the sender and receiver of threat-
sharing information. Along with this, we need to integrate threat-sharing
methods that integrate privacy-aware techniques, especially to comply with
data regulations such as the General Data Protection Regulation (GDPR) etc.
This should support enhanced features such as the redaction of information,
the Right-to-be-forgotten (RTBF), and location/time-based access controls.
And, so, end-to-end encryption using messaging applications, such as WhatsApp
and Signal can be used for information sharing, the trust infrastructure is
generally hosted on external systems, and which limit the usage of digital
wallets and in the auditing of the threat sharing exchange. Risks can also
exist in external parties _ghosting_ onto communications [1].

The paper provides an abstraction of the information-sharing process between
threat agencies and which integrates privacy-aware methods such as Attri-bute-
Based Encryption (ABE), Homomorphic Encryption (HE) and Zero Knowledge Proofs
(ZKP). It then builds on this to provide a secure and trusted channel for the
exchange of information on threats using a permissioned blockchain
(Hyperledger Fabric). The main contribution of this paper is to provide a
protocol that will allow threat agencies to pass threat information in an
encrypted format within a trusted communication channel. A permission
blockchain is used as this allows for the integration of trusted threat-
sharing agencies, where each threat-sharing agent within a trusted agency can
prove their identity and share their public keys in a trusted way. The
enactment of this is achieved through the use of chain code.

Maasimo et al. [2] presented the state-of-the-art for Threat information
sharing standards and platforms. Several standards have been introduced to
facilitate the sharing of threat information, such as Structured Threat
Information CybereXpression (STIX), Cyber Observable eXpression (CybOX),
Incident Object Description Exchange Format (IODEF), and Trusted Automated
eXchange of Indicator Information (TAXII). Some platforms based on these
standards are Malware Information Sharing Platform, Collaborative Research
Threats (MITRE CRIT), Collective Intelligence Framework (CIF), EclecticIQ
Platform and LookingGlass Cyber.

Overall, the paper outlines the creation of a trusted communication channel
between threat agents where we use digital wallets to identify them and thus
digitally sign for trusted information flows. In the case of Alice sending
threat-sharing information to Bob, Bob generates his public key pair on his
computer - ($E_{priv},E_{pub}$). Bob and Alice then set up a trusted
Hyperledger channel that cannot be accessed by other threat agents. Bob then
places his public key in that channel. Alice can then receive this and encrypt
a symmetric key with Bob’s public key ($E_{pub}$). She can then place the
encrypted threat data and the encrypted key in the channel for Bob to receive.
Bob then decrypts this on his computer using his private key. An important
advantage of this, is that We can audit and log each part of this process so
that Alice knows when Bob has read the encrypted message and in the time that
Alice posted it to the secure channel. We can thus make the channel a long-
term location for information sharing, or create for each transfer. In this
case, RSA public key encryption is used to support the generation of the key
pair.

###  1.1 Permissioned Blockchain

A permissioned blockchain, alternatively called a private blockchain, is
another type of blockchain network in which accessibility is limited to
specific user segments. Hyperledger Fabric is the best example of this kind of
blockchain network, whereas Ethereum is an example of a public blockchain.
Several industries, such as healthcare, defence, and investigation agencies,
can be applications of permissioned blockchains [3]. Hyperledger Fabric, an
open-source framework, is pivotal for building distributed ledgers using
blockchain technology, encompassing applications, tools, and libraries [4].
One significant component is the _Fabric Channel_ , providing secure
communication among network participants for transactions within a subnet. It
ensures trusted data sharing and demonstrates high transaction performance
compared to traditional blockchain processes [5].

###  1.2 General Data Protection Regulation (GDPR)

The General Data Protection Regulation (GDPR), instituted by the European
Union in May 2018 [6], safeguards the privacy of personal data exchanges among
EU member states and affiliated entities globally. Compliance with GDPR is
obligatory for all entities engaging in data transactions with EU members,
necessitating prior consent. Moreover, GDPR presides over pivotal facets of
data authorisation and authentication, encompassing rights such as data
access, modification, deletion, and combination, ensuring comprehensive
oversight of data-sharing practices.

###  1.3 Right-to-be-forgotten (RTBF)

The Right to be Forgotten (RTBF) pertains to GDPR mandates concerning data
deletion [7]. However, disseminating this right across the network proves
impractical and unfeasible. Consequently, the significance of discovering
covert protocols arises to facilitate content deletion upon request.
Furthermore, this directive may be enforced by content proprietors or their
designated representatives.

###  1.4 Cyber Threat Intelligence (CTI))

Cyber Threat Intelligence (CTI) is an evidence-based knowledge which plays an
important role in cyber security. The CTI lifecycle involves the process of
data collection, analysis and dissemination among trusted users. Threat
intelligence sharing has become crucial, enhancing organisations’ security
posture against emerging threats and keeping them vigilant to repel potential
attacks. To plan for, respond to, and mitigate these risks effectively, the
main objective of CTI is to assist organisations in understanding the threats
they face, including the tactics, methods, and procedures (TTPs) employed by
cyber attackers. Considering the background, intents, and capabilities of
threat actors is equally important to CTI in comprehending cyber threats’
technical components. However, the most significant challenges encountered by
threat intelligence agents are sharing threats across different organisational
boundaries, navigating privacy regulations, and implementing suitable
technological solutions. To solve these issues, we introduce a novel solution
using a unified threat language (STIX) and privacy-preserving methods [8].

###  1.5 Structured Threat Information eXpression (STIX)

Structured Threat Information Expression (STIX) is a standardised language for
describing cyber threat intelligence in a structured manner [8]. It provides a
common framework for organisations to share, analyse, and respond to cyber
threats effectively. STIX enables the exchange of threat information in a
machine-readable format, facilitating automation and interoperability among
security systems through different geographical locations. Using STIX,
organisations can better understand and mitigate cyber threats, improving
their overall cybersecurity posture.

##  2 Related Work

This section provides insights into recent advances at the intersection of
privacy regulations, blockchain technology, and threat information sharing.

###  2.1 Privacy-preserving Data Sharing

Coppolino et al. [9] proposed an IDS architecture that offers customers the
benefits of managed security services without giving third-party entities full
access to their sensitive information. The growing number of cyber threats has
led organisations and companies to seek managed security services (MSS) to
address their information security concerns. However, privacy concerns
regarding MSS outsourcing have resulted in a conflict between privacy and
security monitoring solutions. This paper proposes an intrusion detection
system (IDS) architecture for privacy-preserving security monitoring in MSS
using homomorphic Encryption (HE) technology. Homomorphic Encryption enables
computations on encrypted data without direct access to decryption, allowing
secure processing, storage, and exchange of confidential information.

José M et al. [10] describe privacy-enhancing Cybersecurity Information
Sharing (CIS), which plays a vital role in combating cyber threats and
incidents by facilitating improved situational awareness among its members… In
the surge of sophisticated cyber attacks, partnerships via CIS are critical to
read and respond to future threats. As firms use the cloud as a tool for
transmitting data, the risk of data privacy is increasing. It proposed a
protocol called PRACIS, a system for CIS networks that ensures the
confidentiality of data as it is forwarded and aggregated. This system uses
the established STIX standard data format. PRACIS uses traditional format-
preserving techniques and homomorphic encryption methods to achieve its goals…
Additionally, after conducting tests on a prototype for a portion of STIX, the
outcome displays that up to 689 incidents per minute can be reported, much
higher than the typical estimation of 81. Furthermore, the consolidation of
104 incidents can be completed within just 2.1 seconds, and the data
transmission overhead is minimal at 13.5 kbps. Overall, these findings suggest
that the cost of implementing PRACIS is reasonable and practical for practical
use.

David W.C. et al. [11] proposed a collaborative model to address these
problems in sharing threat information. Sharing Cyber Threat Information (CTI)
can significantly aid in forecasting, preventing, and mitigating cyber-
attacks. The person or organisation that owns the Data can choose a suitable
level of trust and method for sanitising Cyber Threat Information (CTI) data.
This can involve using plain text, anonymisation or pseudo-anonymisation
strategies, or homomorphic encryption. Before the CTI data is distributed for
analysis, it is processed and secured using these techniques. This paper
proceeds with associated research on cloud-edge computing, CTI data sharing,
and data security concerns in cloud-edge computing. The proposed trust model
is then described, and it goes in-depth into the data-sharing infrastructure
and explores the diverse deployment models available. Four real-world projects
serving as test cases for the data-sharing infrastructure are explained,
including their chosen levels of trust and deployment models to meet their
unique trust requirements. An overview of the progress made thus far, the
testing methodology was implemented, and information on validation work
completed to date was provided. It concludes by discussing the current
limitations and identifying areas requiring additional research.

###  2.2 Architecture of C3ISP

Cyber threat intelligence has been proposed to achieve cyber threat
information sharing between organisations. Various frameworks, such as C3ISP,
have been proposed. C3ISP (Collaborative and Confidential Information Sharing
and Analysis for Cyber Protection) is funded by the European Commission. The
main goal of C3ISP is to create a framework in which entities can share cyber
threat information securely and confidentially. This is designed to allow more
collaboration between organisations, industries, and countries to better
respond to and prevent cyber threats [12].

According to Massimo et al. [FanW], threat information sharing, particularly
in Indicators of Compromise (IoC) and threat events, is challenging, and the
entities essential to the process of gathering verified data for machine
learning algorithms are not adequately supported by current threat information
sharing solutions, making it difficult or impossible to communicate with them.
So ORISHA - a platform for ORchestrated Information SHaring and Awareness - is
a platform that aims to make it easier for threat detection systems,
especially those that use Machine Learning (ML) techniques like intrusion
detection systems (IDS), to communicate and share information. By coordinating
an interconnected network of Malware Information Sharing Platforms, ORISHA
aims to address these issues. A distributed Threat Intelligence Platform is
formed by this network, making it possible to communicate with various
organisations’ Threat Detection layers. Improved prediction of accuracy in
Threat Detection Systems can be improved within this ecosystem. In addition to
the above features, the ORISHA platform interfaces with a honey net, which
enables adding positive attack instances and information to the knowledge
base. It was initially tested on various popular IDS and obtained good
results.

##  3 TIPS Infrastructure and Methodology

This section defines a privacy-aware threat-sharing architecture, which will
be built by analysing the use case, which will be implemented, and the
experimental work will provide insights into the overall architecture. These
will address the key gaps within the existing research work and practice. This
work uses Hyperledger Fabric, encryption and STIX Protocol [13], along with
using TAXII (Trusted Automated eXchange of Indicator Information) [14]. With
this platform, the research will integrate smart contracts and Hyperledger
Fabric channels to provide trusted identity checks and private areas for
information sharing. To control access to threat-sharing messages, attribute-
based encryption (ABE), which is an access control mechanism for cloud
storage, will be used. This provides secure and adaptive sharing encryption-
based policies and authentication. Two core attributes include time and
location, where a receiver must give a signed attestation of the current time
and place for these to be included in the policy.

Trusted information sharing would happen through a trusted ledger, which will
integrate a digital wallet, where Bob and Alice’s public keys are stored on
the shared ledger. Figure 1 outlines the communication between Alice and Bob
using the ABE and in supporting interoperability. In ABE, the data is
decrypted based on different attributes and policies.

Based on the literature review and background study, Hyperledger Fabric can be
one of the best frameworks for the interoperability and implementation of this
model—the design aspects for a sharing data element between Bob and Alice.
Alice, who represents a cyber threat agency, is a sender who sends a
cyphertext encrypted by the public key of the receiver (Bob); Bob retrieves
the message from the trusted cyber threat agency.

In this scenario, the communication happens within a private channel in a
ledger, as explained in the steps shown in Figure 1:

  1. 1.

MSP manages the lifecycle of user identities, including registration, renewal,
and revocation, to maintain network security and integrity. Managing user
identities in Hyperledger Fabric involves key pair generation, certificate
issuance, enrollment, MSP configuration, and ongoing identity management to
ensure secure and authenticated interactions within the network.

  2. 2.

Use Hyperleger to create two wallets.

  3. 3.

The ledger is used to store users’ public keys, identify Bob and Alice, and
support digital signing. There may be the opportunity to blind their identity
using a privacy-aware digital signature. The ledger is used to audit shared
information.

  4. 4.

Setup a trusted channel on Hyperledger.

  5. 5.

Get the public key of the other person (generated off-chain).

  6. 6.

Alice passes the encrypted data (STIX file) to the channel using Bob’s public
key.

  7. 7.

ABE defines the attributed attributes to read the threat-sharing information.
Bob uses its private key to decrypt STIX files that contain threat
information. ZKPs are used to verify things without revealing the data source,
such as for someone’s proof of identity (such as proof of the ownership of a
hardware token). Homomorphic encryption is used to aggregate data together
from multiple threat-sharing instances.

Figure 1: Threat information sharing model with ABE, Homomorphic encryption
and Zero Knowledge proof

A well-designed threat-sharing platform has several key attributes which
increase its trustworthiness [15] [16] [17]. A firm basis to enhance data
security is provided by the permissioned blockchain system Hyperledger Fabric,
particularly when it involves threat intelligence information exchange between
threat agencies. This is especially important for data security, as timely and
safe threat intelligence sharing can greatly strengthen defences against
collective threats. Here are a few ways that Hyperledger Fabric can help with
this.

To enable the secure communications, Bob and Alice setup a Hyperledger channel
for their communication, either for a one-time session, or with a long-term
session. Bob will generate a key pair, and where the private key is:

$k_{d}\in\mathcal{K}_{d}$ (1)

and a public key of:

$k_{e}=\mathcal{E}(k_{d})\in\mathcal{K}_{e}$ (2)

This public key is then passed to the Hyperledger channel, and where Alice
picks it up. She then generates a random symmetric key of $k_{m}$ and her
threat-sharing message ($m$) of:

$m\in\mathcal{M}$ (3)

Alice will then encrypt the threat-sharing message with:

$c=e_{k_{m}}(m)$ (4)

and encrypt the symmetric key with:

$k_{s}=e_{k_{e}}(k_{m})$ (5)

She will then pass $c$ and $k_{s}$ into the Hyperledger channel. Bob will pick
these up, and then discover the symmetric key using:

$k_{m}=d_{k_{d}}(k_{s})$ (6)

and then the message with:

$m=d_{k_{m}}(c)$ (7)

##  4 Implementation and Results

Sharing threat information is vital in cybersecurity battles, yet several key
challenges persist. Firstly, there are no clear guidelines for sharing among
organisations. Secondly, privacy and legal concerns arise. Thirdly,
interoperability issues hinder understanding of different systems’ threat
data. Lastly, building trust across organisations proves difficult. This work
aims to tackle these challenges by proposing strategies to facilitate seamless
and trusted threat information sharing, ultimately enhancing online security
for all.

This section will provide a practical aspect using Hyperledger Fabric and
robust encryption techniques to address these challenges. Specifically, we
will utilise a specific environment to install a Hyperledger Fabric network
and adapt the encryption techniques.

###  4.1 Users Registration on MSP, and Encryption Approach

The Membership Service Provider (MSP) registration and encryption process
plays a pivotal role in achieving the objectives. MSP registration involves
authenticating network participants and assigning them cryptographic
identities, while encryption ensures the confidentiality of data exchanged
within the network. Understanding the intricacies of MSP registration and
encryption processes is essential for effectively managing access control and
safeguarding sensitive information within Hyperledger Fabric networks. This
section delves into the MSP registration and encryption process, elucidating
the underlying mechanisms and their significance in bolstering the security
posture of Hyperledger Fabric-based blockchain networks.

Figure 2: Sequence diagram of Public key management and storage in Hyperledger
Fabric

Here’s an overview of the process for managing user identities in HLF,
starting from the generation of key pairs as shown in Figure 2:

  1. 1.

Key Pair Generation: Users generate a key pair consisting of a public key and
a private key using RSA cryptographic algorithms.

  2. 2.

Certificate Signing Request (CSR): Users create a Certificate Signing Request
(CSR) containing their public key and identity information (e.g., Common Name,
Organisation). The CSR is sent to the Certificate Authority (CA) for
certificate issuance.

  3. 3.

Certificate Issuance: The CA receives the CSR and verifies the user’s
identity. If the identity is valid, the CA issues an X.509 digital certificate
containing the user’s public key and identity information.

The CA’s private key signs the certificate, making it tamper-proof and
verifiable.

  4. 4.

Membership Service Provider (MSP) Configuration: The HLF network defines an
MSP for managing identities.

MSP configuration specifies the trusted CA(s), certificate revocation lists
(CRLs), and access control policies.

  5. 5.

Enrollment: Users enrol in the HLF network by presenting their digital
certificate to the Membership Service Provider (MSP).

MSP verifies the certificate’s authenticity and validity against the trusted
CA(s). Upon successful enrollment, users are granted membership status within
the network.

  6. 6.

Identity Management: MSP manages user identities, including registration,
revocation, and attribute-based access control. Users are assigned roles and
permissions based on their identity attributes (e.g., organisation, role).

Overall, managing user identities in Hyperledger Fabric involves key pair
generation, certificate issuance, enrollment, MSP configuration, and ongoing
identity management to ensure secure and authenticated interactions within the
network.

###  4.2 Messages Exchange Phases

Message transaction processes through HLF, enabling secure and transparent
data exchange among network participants. This process includes transaction
proposal, endorsement, ordering, validation, and commitment, ensuring the
integrity of transactions on the ledger. Understanding this process is
essential for grasping the mechanisms governing blockchain operations in HLF.
This section explores the message transaction processing in HLF, outlining its
key components and workflow for executing and validating transactions within a
Hyperledger Fabric-based blockchain network as shown in Figure 3 explained in
the following sequences:

Figure 3: Sequence diagram of Message Transaction within Hyperledger Fabric
[18]

  * •

Peer and Client Configuration: Peers and clients in the HLF network are
configured with MSP settings, including the trusted CA(s) and identity
information. MSP ensures that only authorised entities can participate in
network activities.

  * •

Transaction Endorsement and Verification: During transaction endorsement,
peers verify the identity and signature of the transaction proposer using
their digital certificate. MSP enforces access control policies to ensure that
only authorised users can endorse transactions.

  * •

Consensus and Commitment: Peers reach a consensus on transaction validity
based on endorsement policies and transaction content. MSP verifies the
integrity of transaction endorsements and ensures that only valid transactions
are committed to the ledger.

  * •

Identity Revocation: If a user’s privileges need to be revoked (e.g., due to
departure from the network or policy violation), MSP updates the Certificate
Revocation List (CRL) to invalidate the user’s certificate.

  * •

Identity Lifecycle Management: MSP manages the lifecycle of user identities,
including registration, renewal, and revocation, to maintain network security
and integrity.

###  4.3 Environment Setup and Test Configurations

This section includes network performance and functionality tests. Initially,
fabric binaries are installed via a command line interface to establish a two-
organisation network, with each organisation having two peers linked through a
private channel. Subsequently, the benchmark engine engages with chaincode to
deploy, execute, analyse, and produce network performance reports, depicted in
Fig 5. The setup of the Hyperledger Fabric network requires specific
prerequisites, detailed in Table 1 includes the installation of Hyperledger
Fabric binaries package version 2.2.0; Ubuntu version 20.04; Docker version
20.10.7; and Docker Compose version 1.25.0 for generating and managing network
entities. Hyperledger Fabric offers three optional languages: Golang, Java,
and JavaScript. Here, we utilised JavaScript (Node.js version 10.19.0) to
build chaincode (smart contract).

Table 1: Hyperledger Fabric environment setup System & Tools | Version
---|---
Operating System | Ubuntu 20.04
Hyperledger Fabric | 2.2.0
Docker | 20.10.7
Docker-compose | 1.25.0
Node.js | 10.19.0

###  4.4 Interaction System Implementation

The implementation extends the asset-transferbasic/ chaincode-javascript using
a Solo Ordering Service provided by Hyperledger Fabric and a test network.
Performance testing of the smart contract on a Fabric network is conducted
using Caliper. The basic workflow involves implementing smart contracts using
Hyperledger Fabric, deploying them with JavaScript, and testing by
installation, approval, commitment to the channel, and invocation of chaincode
[19].

The chaincode handles various data queries and addresses constraints of threat
information sharing by using hash keys for lightweight implementation on
endorsing peers. The system’s chaincode operations include storing data,
querying checksums, retrieving objects, extracting versions, retrieving
lineage, and more.

Performance testing encompasses system throughput, latency, scalability, and
resource usage, evaluated with different transaction loads and asset batch
sizes. Benchmarks involve ’getAssetsFromBatch’ transactions, with evaluations
conducted using Caliper benchmarking tools. The assessment includes real-time
data reporting and resource consumption statistics for Hyperledger Fabric
V2.2.0. The subsequent steps below illustrate different functions within
Hyperledger infrastructure setup and network performance assessment:

  * •

Start the test network and establish the channel.

  * •

Package and deploy the smart contract.

  * •

Approve the chaincode definition.

  * •

Commit the chaincode definition on the channel.

  * •

Execute the chaincode, as depicted in Figure 4.

  * •

Integrates benchmarking tools to assess network performance, monitoring
network latency, send rate, and throughput, as demonstrated in Figure 5.

Figure 4: chaincode invocation with majority endorsement peers Figure 5:
Running Caliper benchmark and getting the network performance report

###  4.5 Results

Performance benchmarking was conducted using the Hyperledger Caliper
Benchmarking Tool, focusing on fundamental performance indicators during the
message exchange between Alice and Bob. Our results show reading measurements,
achieving approximately 91.6 transactions per second. During extensive
testing, we observed a maximum latency of 0.65 seconds, a minimum latency of
0.01 seconds, and an average latency of 0.20 seconds. The latency is the time
for the ciphertext and encrypted session key to be committed to the ledger and
then to be read by the recipient.

These results of scalability, throughput and latency are derived from
Hyperledger Fabric’s Execute-Order-Validate method, which separates
transaction execution and ordering. This separation enhances scalability and
performance and reduces node workload. Unlike traditional blockchain
architectures, Fabric’s approach enables parallel transaction processing,
mitigating smart contract non-determinism and yielding higher throughput with
lower latency. Consequently, it fosters an efficient and high-performance
blockchain ecosystem for trusted sharing.

##  5 Conclusions and Future Work

Based on the performance benchmarking results and an in-depth understanding of
message transaction processes through HLF, this research highlights the
importance of privacy-preserving threat information sharing. The method of
using RSA encryption to pass the threat-sharing information provides a
mechanism to allow the recipient to pass their public key within a trusted
channel and for the private key to be stored in a secure enclave or on the
recipient’s computer. This channel can be set up either for each session or
for a long-term session. While acceptable when a secure enclave is used, it
has weaknesses related to _forward secrecy_ in that the recipient’s private
key is breached, especially in creating a long-term channel. For this, an
enhancement would look towards PAKE (Password-Authenticated Key Exchange)
methods, such as OPAQUE [20] to allow for a symmetric key to be exchanged
within an asynchronous hand-shake of the key.

## References

  * [1] C. Baraniuk, “Ghosts in the machines,” _New Scientist_ , vol. 227, no. 3028, pp. 38–41, 2015.
  * [2] M. Guarascio, N. Cassavia, F. S. Pisani, and G. Manco, “Boosting cyber-threat intelligence via collaborative intrusion detection,” _Future Generation Computer Systems_ , vol. 135, pp. 30–43, 2022.
  * [3] J. Polge, J. Robert, and Y. Le Traon, “Permissioned blockchain frameworks in the industry: A comparison,” _ICT Express_ , vol. 7, no. 2, pp. 229–233, 2021. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S2405959520301909
  * [4] E. Elrom and E. Elrom, “Hyperledger,” _The Blockchain Developer: A Practical Guide for Designing, Implementing, Publishing, Testing, and Securing Distributed Blockchain-based Projects_ , pp. 299–348, 2019.
  * [5] A.-A. C. services, “Blockchain technologies,” 2022.
  * [6] C. Grundstrom, K. Väyrynen, N. Iivari, and M. Isomursu, “Making sense of the general data protection regulation—four categories of personal data access challenges,” 2019.
  * [7] A. Havelange, M. Dumontier, B. Wouters, J. Linde, D. Townend, A. Riedl, and V. Urovi, “Luce: A blockchain solution for monitoring data license accountability and compliance,” _arXiv preprint arXiv:1908.02287_ , 2019.
  * [8] H. Ali, J. Ahmad, Z. Jaroucheh, P. Papadopoulos, N. Pitropakis, O. Lo, W. Abramson, and W. J. Buchanan, “Trusted threat intelligence sharing in practice and performance benchmarking through the hyperledger fabric platform,” _Entropy_ , vol. 24, no. 10, p. 1379, 2022.
  * [9] L. Sgaglione, L. Coppolino, S. D’Antonio, G. Mazzeo, L. Romano, D. Cotroneo, and A. Scognamiglio, “Privacy preserving intrusion detection via homomorphic encryption,” pp. 321–326, 2019.
  * [10] J. M. de Fuentes, L. González-Manzano, J. Tapiador, and P. Peris-Lopez, “Pracis: Privacy-preserving and aggregatable cybersecurity information sharing,” _Computers & Security_, vol. 69, pp. 127–141, 2017, security Data Science and Cyber Threat Management. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0167404816301821
  * [11] D. W. Chadwick, W. Fan, G. Costantino, R. de Lemos, F. Di Cerbo, I. Herwono, M. Manea, P. Mori, A. Sajjad, and X.-S. Wang, “A cloud-edge based data security architecture for sharing and analysing cyber threat information,” _Future Generation Computer Systems_ , vol. 102, pp. 710–722, 2020. [Online]. Available: https://www.sciencedirect.com/science/article/pii/S0167739X19300895
  * [12] “Ec c3isp project,” 2022. [Online]. Available: https://c3isp.eu
  * [13] K. Rantos, A. Spyros, A. Papanikolaou, A. Kritsas, C. Ilioudis, and V. Katos, “Interoperability challenges in the cybersecurity information sharing ecosystem,” _Computers_ , vol. 9, no. 1, p. 18, 2020.
  * [14] J. Connolly, M. Davidson, and C. Schmidt, “The trusted automated exchange of indicator information (taxii),” _The MITRE Corporation_ , pp. 1–20, 2014.
  * [15] E. W. Burger, M. D. Goodman, P. Kampanakis, and K. A. Zhu, “Taxonomy model for cyber threat intelligence information exchange technologies,” pp. 51–60, 2014.
  * [16] T. D. Wagner, E. Palomar, K. Mahbub, and A. E. Abdallah, “A novel trust taxonomy for shared cyber threat intelligence,” _Security and Communication Networks_ , vol. 2018, 2018.
  * [17] V. Mavroeidis and S. Bromander, “Cyber threat intelligence model: an evaluation of taxonomies, sharing standards, and ontologies within cyber threat intelligence,” pp. 91–98, 2017.
  * [18] H. Ali, P. Papadopoulos, J. Ahmad, N. Pitropakis, Z. Jaroucheh, and W. J. Buchanan, “Privacy-preserving and trusted threat intelligence sharing using distributed ledgers,” in _2021 14th International Conference on Security of Information and Networks (SIN)_ , vol. 1. IEEE, 2021, pp. 1–6.
  * [19] H. Ali, M. Abubakar, J. Ahmad, W. J. Buchanan, and Z. Jaroucheh, “Passion: Permissioned access control for segmented devices and identity for iot networks,” _arXiv preprint arXiv:2310.05032_ , 2023.
  * [20] S. Jarecki, H. Krawczyk, and J. Xu, “Opaque: an asymmetric pake protocol secure against pre-computation attacks,” in _Advances in Cryptology–EUROCRYPT 2018: 37th Annual International Conference on the Theory and Applications of Cryptographic Techniques, Tel Aviv, Israel, April 29-May 3, 2018 Proceedings, Part III 37_. Springer, 2018, pp. 456–486.