Agent apparatus and method for sharing anonymous identifier-based security information among security management domains

A security analysis agent apparatus located in a security analysis domain, comprising:

• a security information reception unit for receiving anonymous identifier-based security information from a plurality of security information sharing agent apparatuses respectively located in a plurality of security management domains;
• a security information analysis unit for analyzing the anonymous identifier-based security information received by the security information reception unit and outputting results of the analysis of the anonymous identifier-based security information;
• a security analysis information transmission unit for transmitting the anonymous identifier-based security information analysis results output from the security information analysis unit to the security information sharing agent apparatuses;
• an identifier source storage unit for storing mapping information between anonymous identifiers included in security information received from the security information sharing agent apparatuses and the respective originating security information sharing agent apparatuses thereof;
• and
• a reception agent apparatus determination unit for determining the security information sharing agent apparatuses to which the anonymous identifier-based security information analysis results are to be transmitted according to the mapping information stored in the identifier source storage unit.

A security information sharing method for sharing security information among a plurality of security management domains, comprising:

• converting, by a security information sharing agent apparatus located in a security management domain, a real name identifier included in security information about the security management domain into an anonymous identifier;
• storing, by the security information sharing agent apparatus, mapping information between the real name identifier and the anonymous identifier;
• transmitting, by the security information sharing agent apparatus, anonymous identifier-based security information to a security analysis agent apparatus, the anonymous identifier-based security information including the anonymous identifier;
• analyzing, by the security analysis agent apparatus, the anonymous identifier-based security information received from the security information sharing agent apparatus;
• transmitting, by the security analysis agent apparatus, a result of the analysis of the anonymous identifier-based security information to the security information sharing agent apparatus, the result including the anonymous identifier;
• and
• converting, by the security information sharing agent apparatus using the mapping information, the anonymous identifier included in the result into the real name identifier.