Privacy Preserved Rule-Based Risk Analysis through Secure Multi-party Computation

Network systems are becoming the core components of technical information infrastructures. The protection of network systems from malicious attacks is an urgent priority in our society. However, considering that all security threats are very complicated, easily missed, and error-prone, dealing with network vulnerabilities has brought about enormous challenges to network management. Therefore, one reasonable solution for a risk analysis is delegating an analysis of a network system to third parties that have more professional knowledge regarding a risk analysis. Highly confidential data such as the network configuration and vulnerabilities, as well as each hosts, are needed when delegating a risk analysis to a third party. Such confidential data may cause information leakage if no protection is provided. In this paper, we proposed a risk analysis system based on a rule-based risk analysis method. The prototype system was developed using Fairplay MP, a secure multi-party computation system, and was evaluated for a small network environment.