  Critical infrastructure protection (CIP) is envisioned to be one of the most
challenging security problems in the coming decade. One key challenge in CIP is
the ability to allocate resources, either personnel or cyber, to critical
infrastructures with different vulnerability and criticality levels. In this
work, a contract-theoretic approach is proposed to solve the problem of
resource allocation in critical infrastructure with asymmetric information. A
control center (CC) is used to design contracts and offer them to
infrastructures' owners. A contract can be seen as an agreement between the CC
and infrastructures using which the CC allocates resources and gets rewards in
return. Contracts are designed in a way to maximize the CC's benefit and
motivate each infrastructure to accept a contract and obtain proper resources
for its protection. Infrastructures are defined by both vulnerability levels
and criticality levels which are unknown to the CC. Therefore, each
infrastructure can claim that it is the most vulnerable or critical to gain
more resources. A novel mechanism is developed to handle such an asymmetric
information while providing the optimal contract that motivates each
infrastructure to reveal its actual type. The necessary and sufficient
conditions for such resource allocation contracts under asymmetric information
are derived. Simulation results show that the proposed contract-theoretic
approach maximizes the CC's utility while ensuring that no infrastructure has
an incentive to ask for another contract, despite the lack of exact information
at the CC.
