Collective Threshold Multiparty Private Set Intersection Protocols for Cyber Threat Intelligence

Multiparty private set intersection enables multiple parties to determine the intersection of their private sets without disclosing the actual content. It is pivotal for collaboration in cyber threat intelligence as it allows organizations to share compromising or sensitive data in a privacy-preserving manner. This data includes infected IP addresses, malware hashes and other indicators of compromise. Then, the organizations identify elements that overlap across all datasets and take action to mitigate the threat with the broadest impact. Although, in many cases, the condition that an element be present in all sets is too stringent. Therefore, in this work, we focus on threshold multiparty private set intersection (T-MPSI), a protocol that identifies elements present in a subgroup of the total sets instead of in all sets. We highlight the differences between three different perspectives when computing the threshold intersection: individual—only the party leader learns the elements from their set that meet the threshold, all—all parties learn the elements from their set that meet the threshold, and collective—all parties jointly learn all elements that are present in the threshold, regardless of whether they possess those elements themselves. While many implementations for T-MPSI_individual and T-MPSIall have been proposed, to the best of our knowledge, no implementation for T-MPSI_collective exists. Therefore, we present a generic composition that extends any T-MPSI_individual protocol into a TMPSI_collective protocol. Our extension employs a multiparty private set union to aggregate outputs efficiently. We then provide a comprehensive analysis and runtime evaluation, demonstrating the feasibility of the extension.