Anonymous information sharing

1. A computer-implemented method comprising:

receiving, at a server from a client device, a request for anonymous authentication, the client device being operated by an authorized user of an information sharing service;

generating, at the server, a set of ciphers, wherein each cipher is based on a selected random value and a particular random token selected from a set of random tokens that are encrypted with a particular public key selected from a set of public keys associated with users of the information sharing service, wherein the set of ciphers corresponds to the set of random tokens and the set of public keys;

transmitting, to the client device, the set of ciphers;

receiving, from the client device, a decrypted value based on the set of ciphers;

determining, at the server, that the decrypted value matches the selected random value;

transmitting, to the client device, the set of random tokens such that the client device can determine that the server did not identify the authorized user;

receiving, from the client device, an anonymized incident report; and

correlating the anonymized incident report with open source information and one or more of another anonymized incident report to provide one or more reports to users of the information sharing service.

2. The computer-implemented method of claim 1 , further comprising:

providing, to the client device, a template, and

wherein the received anonymized incident report is anonymized using the template.

3. The computer-implemented method of claim 2 , wherein:

user attributable terms in the incident report are detected using the template; and

the detected user attributable terms are encrypted.

4. The computer-implemented method of claim 1 , further comprising:

detecting collaboration between users of the information sharing service after providing the one or more reports; and

updating a database of the information sharing service with the collaboration.

5. The computer-implemented method of claim 1 , wherein the anonymized incident report includes information associated with one or more of a type of cyber-attack, a date and time of the cyber-attack, a location or sector where the cyber-attack occurred, a solution or preventive measure for the cyber-attack, indicators of compromise, intelligence on an actor of the cyber-attack, and a target of the cyber-attack.

6. The computer-implemented method of claim 1 , further comprising:

breaking a connection with the client device in response to the decrypted value not matching the selected random value.

7. The computer-implemented method of claim 1 , wherein providing one or more reports to users of the information sharing service comprises:

generating, by the server and based on the correlating, cyber-attack information indicating one or more of: warnings for a cyber-attack reported in the anonymized incident report, remediation guidance for the cyber-attack, directions on how to reduce user risk to the cyber-attack, information indicating likely targets or trends of the cyber-attack, entry points and technologies associated with the cyber-attack, and methods utilized by the cyber-attack; and

transmitting, based on preferences of the users of the information sharing service, a first message including the cyber-attack information.

8. A non-transitory computer-readable storage medium comprising instructions, which when executed by one or more computers which, cause the one or more computers to perform actions comprising:

receiving, from a client device, a request for anonymous authentication, the client device being operated by an authorized user of an information sharing service;

generating, a set of ciphers, wherein each cipher is based on a selected random value and a particular random token selected from a set of random tokens that are encrypted with a particular public key selected from a set of public keys associated with users of the information sharing service, wherein the set of ciphers corresponds to the set of random tokens and the set of public keys;

transmitting, to the client device, the set of ciphers;

receiving, from the client device, a decrypted value based on the set of ciphers;

determining that the decrypted value matches the selected random value;

transmitting, to the client device, the set of random tokens such that the client device can determine that the server did not identify the authorized user;

receiving, from the client device, an anonymized incident report; and

correlating the anonymized incident report with open source information and one or more of another anonymized incident report to provide one or more reports to users of the information sharing service.

9. The non-transitory computer-readable storage medium of claim 8 , further comprising:

providing, to the client device, a template, and

wherein the received anonymized incident report is anonymized using the template.

10. The non-transitory computer-readable storage medium of claim 9 , wherein:

user attributable terms in the incident report are detected using the template; and

the detected user attributable terms are encrypted.

11. The non-transitory computer-readable storage medium of claim 8 , further comprising:

detecting collaboration between users of the information sharing service after providing the one or more reports; and

updating a database of the information sharing service with the collaboration.

12. The non-transitory computer-readable storage medium of claim 8 , wherein the anonymized incident report includes information associated with one or more of a type of cyber-attack, a date and time of the cyber-attack, a location or sector where the cyber-attack occurred, a solution or preventive measure for the cyber-attack, indicators of compromise, intelligence on an actor of the cyber-attack, and a target of the cyber-attack.

13. The non-transitory computer-readable storage medium of claim 8 , further comprising:

breaking a connection with the client device in response to the decrypted value not matching the selected random value.

14. The non-transitory computer-readable storage medium of claim 8 , wherein providing one or more reports to users of the information sharing service comprises:

generating, based on the correlating, cyber-attack information indicating one or more of: warnings for a cyber-attack reported in the anonymized incident report, remediation guidance for the cyber-attack, directions on how to reduce user risk to the cyber-attack, information indicating likely targets or trends of the cyber-attack, entry points and technologies associated with the cyber-attack, and methods utilized by the cyber-attack; and

transmitting, based on preferences of the users of the information sharing service, a first message including the cyber-attack information.

15. A system comprising:

one or more computers and one or more storage devices storing instructions that are operable and when executed by the one or more computers, cause the one or more computers to perform actions comprising:

receiving, from a client device, a request for anonymous authentication, the client device being operated by an authorized user of an information sharing service;

generating, a set of ciphers, wherein each cipher is based on a selected random value and a particular random token selected from a set of random tokens that are encrypted with a particular public key selected from a set of public keys associated with users of the information sharing service, wherein the set of ciphers corresponds to the set of random tokens and the set of public keys;

transmitting, to the client device, the set of ciphers;

receiving, from the client device, a decrypted value based on the set of ciphers;

determining that the decrypted value matches the selected random value;

transmitting, to the client device, the set of random tokens such that the client device can determine that the server did not identify the authorized user;

receiving, from the client device, an anonymized incident report; and

correlating the anonymized incident report with open source information and one or more of another anonymized incident report to provide one or more reports to users of the information sharing service.

16. The system of claim 15 , further comprising:

providing, to the client device, a template;

detecting collaboration between users of the information sharing service after providing the one or more reports; and

updating a database of the information sharing service with the collaboration.

17. The system of claim 16 , wherein:

the received anonymized incident report is anonymized using the template;

user attributable terms in the incident report are detected using the template; and

the detected user attributable terms are encrypted.

18. The system of claim 15 , wherein the anonymized incident report includes information associated with one or more of a type of cyber-attack, a date and time of the cyber-attack, a location or sector where the cyber-attack occurred, a solution or preventive measure for the cyber-attack, indicators of compromise, intelligence on an actor of the cyber-attack, and a target of the cyber-attack.

19. The system of claim 15 , wherein providing one or more reports to users of the information sharing service comprises:

generating, based on the correlating, cyber-attack information indicating one or more of: warnings for a cyber-attack reported in the anonymized incident report, remediation guidance for the cyber-attack, directions on how to reduce user risk to the cyber-attack, information indicating likely targets or trends of the cyber-attack, entry points and technologies associated with the cyber-attack, and methods utilized by the cyber-attack; and

transmitting, based on preferences of the users of the information sharing service, a first message including the cyber-attack information.

20. The system of claim 19 , wherein transmitting, based on preferences of the users of the information sharing service, a first message including the cyber-attack information comprises transmitting the first message using one or more of electronic mail and short message service (SMS) messaging, and

wherein the preferences of the users of the information sharing service include, for each respective user, indications of a type of content and message to be received.