# US 8,789,200 B2 · Agent apparatus and method for sharing anonymous identifier-based security information among security management domains

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 8,789,200 B2
- Document ID: US8789200B2
- Status: Granted
- Kind: B2
- Application number: 13/493,120
- Filed: 2012-06-11
- Published: 2013-05-30
- Granted: 2014-07-22
- Earliest claimed: 2011-11-28
- Assignees: Electronics and Telecommunications Research Institute
- Applicants: Gae-Il An; Dae-Hee Seo; Jong-Hyun Kim; Sun-Hee Lim; Sungwon Yi; Ki-Young Kim; Dong-Il Seo
- Inventors: Gae-Il An; Dae-Hee Seo; Jong-Hyun Kim; Sun-Hee Lim; Sungwon Yi; Ki-Young Kim; Dong-Il Seo
- Web page: https://patentgrep.com/patent/US8789200B2

## CPC

- H04L 63/0407: {wherein the identity of one or more communicating identities is hidden (cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00)}
- G06F 21/6245: {Protecting personal data, e.g. for financial or medical purposes}
- G06F 21/6254: {by anonymising data, e.g. decorrelating personal data from the owner's identification}
- G06F 21/6263: {during internet communication, e.g. revealing personal data from cookies}
- H04L 63/1441: {Countermeasures against malicious traffic (countermeasures against attacks on cryptographic mechanisms H04L9/002)}
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)

## Abstract

The present invention relates to an agent apparatus and method for sharing anonymous identifier-based security information among security management domains. A plurality of security information sharing agent apparatuses respectively located in a plurality of security management domains and configured to collect security information and transmit collected security information to outside of the security management domains. Each security information sharing agent apparatus includes an identifier conversion unit for converting real name identifier-based security information into anonymous identifier-based security information by converting a real name identifier included in the security information into an anonymous identifier, and a security information communication unit for transmitting the anonymous identifier-based security information obtained by the identifier conversion unit to outside of a corresponding security management domain so that security information is shared among the plurality of security management domains.

## Claims

### Claim 1

A security information sharing agent apparatus located in a security management domain and configured to collect security information and transmit collected security information to outside of the security management domain, comprising:
an identifier conversion unit for converting real name identifier-based security information into anonymous identifier-based security information by converting a real name identifier included in the security information into an anonymous identifier included in the anonymous identifier-based security information;
a security information communication unit for transmitting, to outside of the security management domain, the anonymous identifier-based security information produced by the identifier conversion unit; and
an identifier mapping information storage unit for storing mapping information between the real name identifier and the anonymous identifier,
wherein when a security information analysis result includes the anonymous identifier, the identifier conversion unit converts the anonymous identifier into the real name identifier using the mapping information.

### Claim 2 (depends on 1)

The security information sharing agent apparatus of claim 1, wherein the identifier conversion unit converts the real name identifier included in the security information into a hash identifier that is the anonymous identifier by using a one-way hash function.

### Claim 3 (depends on 2)

The security information sharing agent apparatus of claim 2, wherein an algorithm and a key for the one-way hash function required to convert the real name identifier included in the security information into the hash identifier are shared among only a plurality of security information sharing agent apparatuses.

### Claim 4

A security analysis agent apparatus located in a security analysis domain, comprising:
a security information reception unit for receiving anonymous identifier-based security information from a plurality of security information sharing agent apparatuses respectively located in a plurality of security management domains;
a security information analysis unit for analyzing the anonymous identifier-based security information received by the security information reception unit and outputting results of the analysis of the anonymous identifier-based security information;
a security analysis information transmission unit for transmitting the anonymous identifier-based security information analysis results output from the security information analysis unit to the security information sharing agent apparatuses;
an identifier source storage unit for storing mapping information between anonymous identifiers included in security information received from the security information sharing agent apparatuses and the respective originating security information sharing agent apparatuses thereof; and
a reception agent apparatus determination unit for determining the security information sharing agent apparatuses to which the anonymous identifier-based security information analysis results are to be transmitted according to the mapping information stored in the identifier source storage unit.

### Claim 5 (depends on 4)

The security analysis agent apparatus of claim 4, wherein the reception agent apparatus determination unit classifies the security information analysis results for respective anonymous identifiers and searches the mapping information stored in the identifier source storage unit for security information sharing agent apparatuses that transmitted the security information including the anonymous identifiers, thus determining the security information sharing agent apparatuses to which the anonymous identifier-based security information analysis results are to be transmitted.

### Claim 6

A security information sharing method for sharing security information among a plurality of security management domains, comprising:
converting, by a security information sharing agent apparatus located in a security management domain, a real name identifier included in security information about the security management domain into an anonymous identifier;
storing, by the security information sharing agent apparatus, mapping information between the real name identifier and the anonymous identifier;
transmitting, by the security information sharing agent apparatus, anonymous identifier-based security information to a security analysis agent apparatus, the anonymous identifier-based security information including the anonymous identifier;
analyzing, by the security analysis agent apparatus, the anonymous identifier-based security information received from the security information sharing agent apparatus;
transmitting, by the security analysis agent apparatus, a result of the analysis of the anonymous identifier-based security information to the security information sharing agent apparatus, the result including the anonymous identifier; and
converting, by the security information sharing agent apparatus using the mapping information, the anonymous identifier included in the result into the real name identifier.

### Claim 7 (depends on 6)

The security information sharing method of claim 6, wherein the converting the real name identifier into the anonymous identifier is configured to convert the real name identifier included in the security information into a hash identifier that is the anonymous identifier by using a one-way hash function.

### Claim 8 (depends on 7)

The security information sharing method of claim 7, wherein an algorithm and a key for the one-way hash function required to convert the real name identifier included in the security information into the hash identifier are shared among only the security information sharing agent apparatuses.

### Claim 9 (depends on 6)

The security information sharing method of claim 6, further comprising:
determining, by the security analysis agent apparatus, a security information sharing agent apparatus to which the result is to be transmitted.

### Claim 10 (depends on 9)

The security information sharing method of claim 9, further comprising:
storing, by the security analysis agent apparatus, mapping information between anonymous identifiers included in security information, received from respective security information sharing agent apparatuses, and corresponding security information sharing agent apparatuses that transmitted the security information including the anonymous identifiers.

### Claim 11 (depends on 10)

The security information sharing method of claim 10, wherein determining the security information sharing agent apparatus to which the result is to be transmitted includes using the mapping information, so that the result is transmitted to the corresponding security information sharing agent apparatus that transmitted the security information including the anonymous identifier included in the result.

### Claim 12 (depends on 11)

The security information sharing method of claim 11, wherein the determining the security information sharing agent apparatus comprises classifying the security information analysis results for respective anonymous identifiers and searching the stored mapping information for security information sharing agent apparatuses that transmitted the security information including the anonymous identifiers.