# Contract-Theoretic Resource Allocation for Critical Infrastructure Protection

## TL;DR

This paper introduces a contract-theoretic method for allocating resources to critical infrastructures with unknown vulnerability and importance levels, optimizing security investments despite asymmetric information.

## Contribution

It develops a novel mechanism for designing optimal contracts that incentivize infrastructures to reveal their true vulnerability and criticality levels under asymmetric information.

## Key findings

- Maximizes the control center's utility
- Ensures infrastructures have no incentive to misrepresent
- Provides necessary and sufficient conditions for optimal contracts

## Abstract

Critical infrastructure protection (CIP) is envisioned to be one of the most challenging security problems in the coming decade. One key challenge in CIP is the ability to allocate resources, either personnel or cyber, to critical infrastructures with different vulnerability and criticality levels. In this work, a contract-theoretic approach is proposed to solve the problem of resource allocation in critical infrastructure with asymmetric information. A control center (CC) is used to design contracts and offer them to infrastructures' owners. A contract can be seen as an agreement between the CC and infrastructures using which the CC allocates resources and gets rewards in return. Contracts are designed in a way to maximize the CC's benefit and motivate each infrastructure to accept a contract and obtain proper resources for its protection. Infrastructures are defined by both vulnerability levels and criticality levels which are unknown to the CC. Therefore, each infrastructure can claim that it is the most vulnerable or critical to gain more resources. A novel mechanism is developed to handle such an asymmetric information while providing the optimal contract that motivates each infrastructure to reveal its actual type. The necessary and sufficient conditions for such resource allocation contracts under asymmetric information are derived. Simulation results show that the proposed contract-theoretic approach maximizes the CC's utility while ensuring that no infrastructure has an incentive to ask for another contract, despite the lack of exact information at the CC.