WO2017131695A1

WO2017131695A1 - Private sharing communities

Info

Publication number: WO2017131695A1
Application number: PCT/US2016/015340
Authority: WO
Inventors: Tomas Sander; Terence Spies; Susan K. Langford
Original assignee: Hewlett Packard Enterprise Development Lp
Priority date: 2016-01-28
Filing date: 2016-01-28
Publication date: 2017-08-03

Abstract

In one example, a method for implementing private sharing communities includes creating a private sharing community of a community intelligence sharing network with a centrally managed database. Data pertaining to the private sharing community may be stored on a local database. The method may include generating a member list of members that can access the private sharing community. An identity of each member on the member list may be withheld from the community intelligence sharing network. The method may also include performing a query using a first data retrieved from the centrally managed database and a second data retrieved the local database. The second data may be associated with the private sharing community. The method may also include presenting a first subset of the first data to members of the community intelligence sharing network and a second subset of the second data to members of the private sharing community.

Description

PRIVATE SHARING COMMUNITIES

BACKGROUND

[0001] Threat information sharing platforms (TISPs) may be used to automate collaboration and gather intelligence from a verity of sources including public feeds, security vendors and community members. This intelligence may be used to detect and protect attacks and deliver actionable results.

BREF DESCR!PT!ON OF THE DRA !NGS

[0002] The following detailed description references the drawings, wherein:

[0003] FIG. 1 is a block diagram of an example system for private sharing communities;

[0004] FIG. 2 is a flowchart of an example method for implementing private sharing communities;

[0005] FIG. 3 is a flowchart of an example method for uploading data from a private sharing community;

[0006] FIG. 4 is a block diagram of an example system for creating private sharing communities; and

[0007] FIG. 5 is a block diagram of an example system for creating private sharing communities.

DETAILED DESCRSPTSON

[0008] Members participating in TISPs may be concerned that information that was confidentially shared within a private community may be leaked to the public at large, other companies, governments, etc. For example a data sharing group comprised of major corporations of a European country may be concerned that a cloud-based TISP solution that is hosted in a country outside of Europe may be exposed to potential leaks such as back doors in the software, espionage attempts to get information, etc. These leaks could allow a cyber attacker to retrieve information regarding the success of their own attacks. In another example, a particular country may not wish that information about critical attacks leave their country.

[0009] Creating an entire TISP may include a large amount of development work to build and may include the burden of operating such an exchange. Moreover, a large fragmentation (or "balkanization") of threat intelligence may diminish some of the value that the cross-correlation of data among a number of different sources brings.

[0010] Private sharing communities (PSCs) may offer users isolated, limited sharing environments that can be run on premise for sensitive exchanges while still keeping many of the advantages of a cloud based, centrally run intelligence community. PSCs may make it easier for privacy-conscious users to participate in and take advantage of the features of TISPs, such as knowledge base,

authentication mechanisms, vetting mechanisms, etc., while enabling private collaborations with selected peers. Also, as the code base for the local community may be smaller, the code base could be made available to third parties to verify its trustworthiness.

[001 1] An example method for implementing private sharing communities may include creating a private sharing community of a community intelligence sharing network with a centrally managed database, wherein data pertaining to the private sharing community is stored on a local database separate from the centrally managed database. The method may include generating a member list of members that can access the private sharing community, wherein an identity of each member on the member list is withheld from the community intelligence sharing network. The method may also include performing a first query using a first data retrieved from the centrally managed database and a second data retrieved the local database, wherein the second data is associated with the private sharing community and is not associated with any particular member of the private sharing community. The method may also include presenting a first subset of the first data to members of the community intelligence sharing network and a second subset of the second data to members of the private sharing community.

[0012] FIG. 1 is a block diagram of an example system 100 for private sharing communities. System 100 may include a processor 102 and a memory 104 that may be coupled to each other through a communication link (e.g., a bus). Processor 102 may include a Central Processing Unit (CPU) or another suitable hardware processor. In some examples, memory 104 stores machine readable instructions executed by processor 102 for operating system 100. Memory 104 may include any suitable combination of volatile and/or non-volatile memory, such as combinations of Random Access Memory (RAM), Read-Only Memory (ROM), flash memory, and/or other suitable memory. Memory 104 may also include a random access non-volatile memory that can retain content when the power is off. Memory 104 stores instructions to be executed by processor 102 including instructions for PSC creator 1 10, member list generator 1 12, data receiver 1 14, identity remover 1 16, consensus determiner 1 18, query performer 120, control interface 122, data uploader 124 , data analyzer 126, data presenter 128 and/or other components. According to various implementations, private sharing community system 100 may be implemented in hardware and/or a combination of hardware and programming that configures hardware. Furthermore, in FIG. 1 and other Figures described herein, different numbers of components or entities than depicted may be used.

[0013] Processor 102 may execute instructions of PSC creator 1 10 to create an instance private sharing community of a community intelligence sharing network with a centrally managed database. The PSC instance and/or a corresponding local database may be run on hardware of a particular user of the PSC (member, owner, moderator, etc.) including hardware owned by the user, operated by the user, on the premises of the user's offices, a contractor of the user, a cloud provider, a third party service provider determined by the user, etc. The hardware of the PSC instance, including a local database, may be geographically local (i.e. in the same geographical region as the PSC) and/or may be run in a highly secured environment (to handle classified data that community is dealing with). In other words, the private sharing community can chose their own set ups according to desired policies. For example, the instance may be operated from a local database and information related to the private sharing community may be stored on the local database. As used herein, a local database may refer to a database local to the PSC, though not necessarily geographically local. For example, the data pertaining to the private sharing community may be stored on a local database separate from the centrally managed database. In one example, the PSC may be created for a particular incident (such as a cyber-atiack, computer virus, etc.) and may be shut down upon resolution of the incident.

[0014] The instance of the private sharing community may include a limited subset of the functionality of the community intelligence sharing network. For example, the PSC may include certain minimum functionality so that the PSC can be operated, while the code base of the PSC remains small enough for a practical audit by a third party provider. By maintaining a smaller codebase, users of the PSC can have the code base audited for potential backdoors, malicious attacks, insecurities, etc. Example functionality that may be included in the PSC may include vetting features that provide background checks on users of the PSC (to make sure the users are who they claim to be), credential checking, etc. The private sharing community may also use the same user interface as the community intelligence sharing network,

[0015] Processor 102 may execute instructions of member list generator 1 12 to generate a member list of members that can access the private sharing community. The identity of each member on the member list may be withheld from the community intelligence sharing network. The identities of the members of the community intelligence sharing network may also be withheld from the private sharing community. In this manner, the members of the community intelligence sharing network and the members of the private sharing community may be able to exchange data without revealing their true identify. In one example, a member may belong to both the community intelligence sharing network and the private sharing community, in this example, the membership status of the first member of the private sharing community may be withheld from members of the community intelligence sharing network and/or the membership status of the first member in the community intelligence sharing network may be withheld from members of the private sharing community. Additionally, the identity of the members of the private sharing community may be withheld from other members of the private sharing community. Withholding the identity of the members in this way may allow members to participate in data sharing while staying anonymous. Anonymity may be of particular concern to certain members who would like to get additional information on cyber-attacks while not letting the attackers (who may belong to one of the communities) to discover that the attack was successful. [0018] Member list generator 1 12 may also be used to identify a moderator of the PSC who can invite other members to join the PSC, such as members of the community intelligence sharing network, other people not in the PSC or community intelligence sharing network, etc. Member list generator 1 12 may also use a member authentication functionality from the community intelligence sharing network to control access to the PSC and/or issue access tokens originating from the PSC. The community intelligence sharing network may not have any control who is joining PSC. Access to the centrally managed database may be limited to members of the PSC. Members of the PSC may be able to query the centrally managed database using access privileges that have been granted to the PSC. For example, members of the PSC may have limited access to paid content depending on a subscription agreement between the owner of the PSC and the community intelligence sharing network.

[0017] Processor 102 may execute instructions of data receiver 1 14 to receive a data from a member of the private sharing community (e.g. as discussed herein with respect to PSC creator 1 10). The data may be stored on a local database associated with the instance of the private sharing community. Data in the local database may be encrypted using a cryptographic key. The data may be anonymized so that the identity of the member is not known to the community intelligence sharing network and/or the other members of the private sharing community (e.g. as discussed herein with respect to member list generator 1 12). For example, an identity remover 1 16 may remove information (such as user name, real name, origination country, IP address, etc) from the first data that may identify a member of the private sharing community and/or the community intelligence sharing network. By removing the identity and/or identifying information from the data, the originator(s) of the data may have some practical deniabiiity of their involvement.

[0018] Processor 102 may execute instructions of consensus determiner 1 18 to determine data originating from the PSC to be uploaded to the centrally managed database and/or otherwise made available to the community intelligence sharing network. The consensus determiner 1 18 may tally votes and/or other elections from the members of the PSC in decided whether to upload a particular data originating from the PSC. Consensus determiner 1 18 may determine based on a consensus of the members of the private sharing community, to upload the second data to the community intelligence sharing network. The consensus could be a majority of the group, a majority of the originators/uploaders, of the data, a unanimous decision, and/or some other criteria, A vote and/or election of a PSC member in regards to the decision to update could also be contingent on some other event occurring. A member may elect to upload a particular data under the condition that some sort of identifying information is removed. For example, a particular IP address involved with a cyberattack may be used to identify a victim of the attack. If a member of the PSC does not wish that the victim be identified to the community intelligence sharing network, the member may decide to elect that the information is uploaded to the centrally managed database if the identifying information (in this example the I P address) be removed.

[0019] Processor 102 may execute instructions of query performer 120 performing a first query using a first data retrieved from the centrally managed database and a second data retrieved from the local database (e.g. as discussed herein with respect to data receiver 1 14). The first query may be initiated by a first member of the private sharing community and a first identity of the member may be withheld from the community intelligence sharing network. The second data may be associated with the private sharing community and may not be associated with any particular member of the private sharing community. Query performer 120 may also perform a second query using data retrieved from the centrally managed database and data retrieved the local database. The second query may originate from a member of the community intelligence sharing network. The identity of the member of the community intelligence sharing network may be withheld from the private sharing community.

[0020] Processor 102 may execute instructions of control interface 122 to control the flow of information and origins of data between the PSC and the community intelligence sharing network. The control interface 122 may identify information originating from the private sharing community that is accessible by members of the community intelligence sharing network. The control interface 122 may identify information originating from the community intelligence sharing network that is accessible by members of the private sharing community.

[0021] The control interface 122 may include settings for what types of data can be seen by the PSC, community intelligence sharing network, etc. as well as what types of identifying information, if any, associated with the data is made available. The control interface 122 may be used by members of the PSC and/or community intelligence sharing network, depending on the configuration of the system, in one example, members of the PSC control the control interface 122 for information originating from the local database and/or members of the PSC and members of the community intelligence sharing network may use the control interface 122 for information originating from the centrally managed database. This is only an example and other settings may be used with varying levels of granularity. For example, a specific user of the PSC may use the control interface 122 to create settings for data that the specific user uploaded to the local database.

[0022] Processor 102 may execute instructions of data uploader 124 to upload data to the community intelligence sharing network and/or the centrally managed database. For example, the uploaded data may be identified to be uploaded by the PSC and/or a member of the PSC (e.g. as discussed herein with respect to control interface 122), determined to be uploaded by consensus (e.g. as discussed herein with respect to consensus determiner 1 18), data that has been stripped of identifying information (e.g. as discussed herein with respect to identity remover 1 18).

[0023] Processor 102 may execute instructions of data analyzer 128 to perform analysis on the data retrieved from the centrally managed database and the data retrieved from the local database (e.g. as discussed herein with respect to query performer 120). Data analyzer 126 may user certain criteria, requirements, etc. for the data analysis. The criteria, requirements, etc. may be specified by a member of the community intelligence sharing network and/or the private sharing community (e.g. as discussed herein with respect to member list generator 1 12), Of course the identity of any of the members may be kept anonymous from the other members (e.g. as discussed herein with respect to member list generator 1 12). For example, data analyzer 126 may determine an intersection of the first data retrieved from the centrally managed database and the second data retrieved from the local database. The intersection could be based on a confidence level of the information, a recentness of the information, a severity of an attack, etc. The intersection may include a subset of the first data and the second data.

[0024] Data analyzer 126 may determine the intersection using a cryptographic technique, such as a secure data exchange protocol. The secure data exchange protocol may be policy driven and may be configured to release precisely specified types of information to identified parties (such as the community intelligence sharing network and the private sharing community). An example secure data exchange protocol is a private set interaction protocol. A Private Set Interaction (PSi) protocol is a protocol used for determining intersections between data sets. Data analyzer 126 may use a PSi to allow somewhat mistrusting parties (such as members of the community intelligence sharing network and/or the members of the private sharing community) to collaborate in a controlled manner. Data analyzer 126 may use a PSI to provide provable privacy guarantees when cross-correlating data from the local database with data from the centrally managed database. Protection of data (i.e. identity, etc.) may be done cryptographicaily, via hardware, via trusted third parties, a combination thereof, etc.

[0025] Processor 102 may execute instructions of data presenter 128 to present a subset of the analyzed data originally retrieved from the local database (e.g. as discussed herein with respect to data analyzer 126) to members of the community intelligence sharing network and a second subset of the analyzed data originally retrieved from the centrally managed database to members of the private sharing community (e.g. as discussed herein with respect to data analyzer 126).

[0026] For example, if the centrally managed database includes data set A and the local database includes data set B. Data analyzer 126, using PSi may determine the intersection of data set A and data set B without revealing any other information (i.e. the data in data set B that does not belong to the intersection) about B to the community intelligence sharing network and about A (i.e. the data in data set A that does not belong to the intersection) to the PSC. Data analyzer 126 may perform other analysis where the output is not the intersection itself but some other data with associated the intersection (e.g. threat actors) while hiding the values in the intersection. In one example, data presenter 126 may present partial information about the intersection made available to both the community intelligence sharing network and the PSC (e.g. only the first few octets of IP addresses in the intersection rather than the full I P addresses). Of course PSIs are only one example cryptographic technique and other cryptographic techniques may be used.

[0027] FIG. 2 is a flowchart of an example method 200 for implementing private sharing communities. Method 200 may be described below as being executed or performed by a system, for example, system 100 of FIG. 1 , system 400 of FIG. 4 or system 500 of FIG. 5, Other suitable systems and/or computing devices may be used as well. Method 200 may be implemented in the form of executable instructions stored on at least one machine-readable storage medium of the system and executed by at least one processor of the system. The machine-readable storage medium may be non- transitory. The processor may include a Central Processing Unit (CPU) or another suitable hardware processor. Method 200 may be implemented in the form of electronic circuitry (e.g., hardware). At least one block of method 200 may be executed substantially concurrently or in a different order than shown in FIG. 2. Method 200 may include more or less blocks than are shown in FIG. 2. Some of the blocks of method 200 may, at certain times, be ongoing and/or may repeat.

[0028] Method 200 may start at block 202 and continue to block 204, where the method may include creating a private sharing community of a community intelligence sharing network with a centrally managed database. Data pertaining to the private sharing community may be stored on a local database separate from the centrally managed database. The private sharing community may be a subset of the community intelligence sharing community. The private sharing community may have ail of or some portion of the functionality from the community intelligence sharing community. At block 206, the method may include generating a member list of members that can access the private sharing community. An identity of each member on the member list may be withheld from the community intelligence sharing network. A moderator may also be selected to manage the PSC. At block 208, the method may include performing a first query using a first data retrieved from the centrally managed database and a second data retrieved the local database. The second data may be associated with the private sharing community and may not be associated with any particular member of the private sharing community. At block 210, the method may include presenting a first subset of the first data to members of the community intelligence sharing network and a second subset of the second data to members of the private sharing community. Method 200 may eventually continue to block 212, where method 200 may stop.

[0029] FIG. 3 is a flowchart of an example method 300 for uploading data from private sharing communities. Method 300 may be described below as being executed or performed by a system, for example, system 100 of FIG. 1 , system 400 of FIG. 4 or system 500 of FIG. 5. Other suitable systems and/or computing devices may be used as well. Method 300 may be implemented in the form of executable instructions stored on at least one machine-readable storage medium of the system and executed by at least one processor of the system. The processor may include a Central Processing Unit (CPU) or another suitable hardware processor. The machine-readable storage medium may be non-transitory. Method 300 may be implemented in the form of electronic circuitry (e.g., hardware). At least one block of method 300 may be executed substantially concurrently or in a different order than shown in FIG. 3. Method 300 may include more or less blocks than are shown in FIG. 3. Some of the blocks of method 300 may, at certain times, be ongoing and/or may repeat.

[0030] Method 300 may start at block 302 and continue to block 304, where the method may include determining an intersection of first data and second data. The first data may be retrieved from a centrally managed database and a second data may be retrieved a local database. The second data may be associated a private sharing community and may not be associated with any particular member of the private sharing community. The intersection may be determining use a cryptographic technique such as a secure data exchange protocol. The intersection may include a first subset of the first data to members of the community intelligence sharing network and a second subset of the second data to members of the private sharing community.

[0031] At block 306, the method may include determining, based on a consensus of the members of the private sharing community, to upload the second data to the community intelligence sharing network. At block 308, the method may include removing information from the second data that may identify a member of the private sharing community. At block 310, the method may include uploading the second data to the community intelligence sharing network and/or centrally managed database. Method 300 may eventually continue to block 312, where method 300 may stop.

[0032] FIG. 4 is a block diagram of an example system 400 for private sharing communities. System 400 may include a processor 402 and a memory 404 that may be coupled to each other through a communication link (e.g., a bus). Processor 402 may include a Central Processing Unit (CPU) or another suitable hardware processor. In some examples, memory 404 stores machine readable instructions executed by processor 402 for operating system 400. Memory 404 may include any suitable combination of volatile and/or non-volatile memory, such as combinations of Random Access Memory (RAM), Read-Only Memory (ROM), flash memory, and/or other suitable memory. [0033] Memory 404 stores instructions to be executed by processor 402 including instructions for a PSC creator 408, a member generator 410, a data receiver 412, a query performer 414 and a data presenter 416. The components of system 400 may be implemented in the form of executable instructions stored on at least one machine- readable storage medium of system 400 and executed by at least one processor of system 400. The machine-readable storage medium may be non-transitory. Each of the components of system 400 may be implemented in the form of at least one hardware device including electronic circuitry for implementing the functionality of the component.

[0034] Processor 402 may execute instructions of PSC creator 408 to create an instance of a private sharing community that is a subset of a community intelligence sharing network with a centrally managed database. The instance may be operated from a local database and information related to the private sharing community may be stored on the local database. The local database may be separate from the centrally managed database. The private sharing community may be a subset of the community intelligence sharing community. The private sharing community may have ail of or some portion of the functionality from the community intelligence sharing community. Processor 402 may execute instructions of member generator 410 to generate a member list of members that can access the private sharing community. An identity of each member on the member list may be withheld from the community intelligence sharing network. A moderator may also be selected to manage the PSC. Processor 402 may execute instructions of data receiver 412 to receive a data from a member of the private sharing community. Processor 402 may execute instructions of query performer 414 to perform a first query using the data. The identity of the member may be withheld from the community intelligence sharing network. Processor 402 may execute instructions of data presenter 416 to present a first subset of the first data to members of the community intelligence sharing network and a second subset of the second data to members of the private sharing community.

[0035] FIG. 5 is a block diagram of an example system 500 for private sharing communities. System 500 may be similar to system 100 of FIG. 1 , for example. In the example illustrated in FIG. 5, system 500 includes a processor 502 and a machine- readable storage medium 504. The processor 502 may include a Central Processing Unit (CPU) or another suitable hardware processor. Although the following descriptions refer to a single processor and a single machine-readable storage medium, the descriptions may also apply to a system with multiple processors and multiple machine- readable storage mediums. In such examples, the instructions may be distributed (e.g., stored) across multiple machine-readable storage mediums and the instructions may be distributed (e.g., executed by) across multiple processors.

[0036] Processor 502 may be at least one central processing unit (CPU), microprocessor, and/or other hardware devices suitable for retrieval and execution of instructions stored in machine-readable storage medium 504. in the example illustrated in FIG. 5, processor 502 may fetch, decode, and execute instructions 506, 508, 510 and 512 to implement private sharing communities. Processor 502 may include at least one electronic circuit comprising a number of electronic components for performing the functionality of at least one of the instructions in machine-readable storage medium 504. With respect to the executable instruction representations (e.g., boxes) described and shown herein, it should be understood that part or all of the executable instructions and/or electronic circuits included within one box may be included in a different box shown in the figures or in a different box not shown.

[0037] Machine-readable storage medium 504 may be any electronic, magnetic, optical, or other physical storage device that stores executable instructions. Thus, machine-readable storage medium 504 may be, for example, Random Access Memory (RAM), an Electrically-Erasable Programmable Read-Only Memory (EEPROM), a storage drive, an optical disc, and the like. Machine-readable storage medium 504 may be disposed within system 500, as shown in FIG. 5. In this situation, the executable instructions may be "installed" on the system 500. Machine-readable storage medium 504 may be a portable, external or remote storage medium, for example, that allows system 500 to download the instructions from the portable/externai/remote storage medium, in this situation, the executable instructions may be part of an "installation package". As described herein, machine-readable storage medium 504 may be encoded with executable instructions for implementing private sharing communities. The machine-readable storage medium may be non-transitory.

[0038] Referring to FIG, 5, instance create instructions 506, when executed by a processor (e.g., 502), may cause system 500 to create an instance of a private sharing community that is a subset of a community intelligence sharing network with a centrally managed database. The instance may be operated from a local database and information related to the private sharing community may be stored on the local database. The local database may be separate from the centrally managed database. The private sharing community may be a subset of the community intelligence sharing community. The private sharing community may have all of or some portion of the functionality from the community intelligence sharing community. Member list generate instructions 508, when executed by a processor (e.g., 502), may cause system 500 to generate a member list of members that can access the private sharing community. An identity of each member on the member list may be withheld from the community intelligence sharing network. A moderator may also be selected to manage the PSC. Query perform instructions 510, when executed by a processor (e.g., 502), may cause system 500 to perform a first query using a first data retrieved from the centrally managed database and a second data retrieved the local database. The second data may be associated with the private sharing community and may not be associated with any particular member of the private sharing community. Data present instructions 512, when executed by a processor (e.g., 502), may cause system 500 to present a first subset of the first data to members of the community intelligence sharing network and a second subset of the second data to members of the private sharing community.

[0039] The foregoing disclosure describes a number of examples for private sharing communities. The disclosed examples may include systems, devices, computer- readable storage media, and methods for private sharing communities. For purposes of explanation, certain examples are described with reference to the components illustrated in FIGS. 1 -5. The functionality of the illustrated components may overlap, however, and may be present in a fewer or greater number of elements and components. Further, all or part of the functionality of illustrated elements may co-exist or be distributed among several geographically dispersed locations. Further, the disclosed examples may be implemented in various environments and are not limited to the illustrated examples.

[0040] Further, the sequence of operations described in connection with FIGS. 1-5 are examples and are not intended to be limiting. Additional or fewer operations or combinations of operations may be used or may vary without departing from the scope of the disclosed examples. Furthermore, implementations consistent with the disclosed examples need not perform the sequence of operations in any particular order. Thus, the present disclosure merely sets forth possible examples of implementations, and many variations and modifications may be made to the described examples.

Claims

1 ) A method comprising:

creating a private sharing community of a community intelligence sharing network with a centrally managed database, wherein data pertaining to the private sharing community is stored on a local database separate from the centrally managed database;

generating a member list of members that can access the private sharing community, wherein an identity of each member on the member list is withheld from the community intelligence sharing network;

performing a first query using a first data retrieved from the centrally managed database and a second data retrieved the local database, wherein the second data is associated with the private sharing community and is not associated with any particular member of the private sharing community; and

presenting a first subset of the first data to members of the community intelligence sharing network and a second subset of the second data to members of the private sharing community.

2) The method of claim 1 further comprising:

determining, using a secured data exchange protocol, an intersection of the first data and the second data, wherein the intersection includes the first subset and the second subset.

3) The method of claim 1 further comprising:

identifying information originating from the private sharing community that is accessible by the members of the community intelligence sharing network

4) The method of claim 1 further comprising:

determining, based on a consensus of the members of the private sharing community, to upload the second data to the community intelligence sharing network; and

uploading the second data to the community intelligence sharing network.

5) The method of claim 1 further comprising: removing information from the second data that may identify a first member of the private sharing community; and

uploading the second data to the community intelligence sharing network.

6) The method of claim 1 wherein a first member is included in the community intelligence sharing network and the private sharing community and a membership status of the first member of the private sharing community is withheld from a membership of the community intelligence.

7) The method of claim 1 wherein an installation of the private sharing community includes a limited subset of the functionality and a user interface of the community intelligence sharing network.

8) The method of claim 1 wherein the first query is initiated by a first member of the private sharing community and a first identity of the member is withheld from the community intelligence sharing network.

9) A system comprising:

a PSC creator to create an instance of a private sharing community that is a subset of a community intelligence sharing network with a centrally managed database, wherein the instance is operated from a local database and information related to the private sharing community is stored on the local database;

a member generator to generate a member list of members that can access the private sharing community, wherein an identity of each member on the member list is withheld from the community intelligence sharing network;

a data receiver to receive a data from a member of the private sharing community;

a query performer to perform a first query using the data, wherein the identity of the member is withheld from the community intelligence sharing network; and a data presenter to present a first subset of the first data to members of the community intelligence sharing network and a second subset of the second data to members of the private sharing community. 10) The system of claim 9 further comprising:

a control interface to identify information originating from the private sharing community that is accessible by the members of the community intelligence sharing network.

1 1 ) The system of claim 9 further comprising:

a data retriever to retrieve a second data from the centrally managed database; and

a data analyzer to determine an intersection of the first data and second data.

12) The system of claim 9 further comprising:

a consensus determiner to determine, based on a consensus of members of the private sharing community, to upload the data to the community intelligence sharing network; and

a data uploader to upload the data to the community intelligence sharing network.

13) A non-transitory machine-readable storage medium encoded with instructions, the instructions executable by a processor of a system to cause the system to:

create an instance of a private sharing community that is a subset of a community intelligence sharing network with a centrally managed database, wherein the instance is operated from a local database and information related to the private sharing community is stored on the local database;

generate a member list of members that can access the private sharing community, wherein an identity of each member on the member list is withheld from the community intelligence sharing network;

perform a first query using a first data retrieved from the centrally managed database and a second data retrieved the local database, wherein the second data is associated with the private sharing community and is not associated with any particular member of the private sharing community; and

present a first subset of the first data to members of the community intelligence sharing network and a second subset of the second data to members of the private sharing community. 14) The non-transitory machine-readable storage medium of claim 13, wherein the instructions executable by the processor of the system further cause the system to: determine, using a secured data exchange protocol, an intersection of the first data and the second data, wherein the intersection includes the first subset and the second subset.

15) The non-transitory machine-readable storage medium of claim 13, wherein the instructions executable by the processor of the system further cause the system to: remove information from the second data that may identify the member of the private sharing community; and

upload the second data to the community intelligence sharing network.