[论文解读] A Review of Technical Problems when Conducting an Investigation in Cloud Based Environments

Manuel Jesús Rivas Sández|arXiv (Cornell University)|Aug 5, 2015

Digital and Cyber Forensics参考文献 2被引用 6

一句话总结

本文回顾了在云计算环境中开展数字取证调查面临的技术挑战，识别出数据分布、动态资源分配以及基础设施控制权丧失等关键障碍。文章指出，传统取证方法在云环境中已显不足，亟需开发专门的云取证框架，以应对动态、多租户系统中的安全与调查局限性。

ABSTRACT

Cloud computing is a relatively new technology which is quickly becoming one of the most important technological advances for computer science. This technology has had a significant growth in recent years. It is now more affordable and cloud platforms are becoming more stable. Businesses are successfully migrating their systems to a cloud infrastructure, obtaining technological and economic benefits. However, others still remain reluctant to do it due to both security concerns and the loss of control over their infrastructures and data that the migration entails. At the same time that new technologies progress, its benefits appeal to criminals too. They can not only steal data from clouds, but they can also hide data in clouds, which has provoked an increased in the number of cybercrimes and their economic impacts. Their victims range from children and adults to companies and even countries. On the other hand, digital forensics have negatively suffered the impact of the boom of cloud computing due to its dynamic nature. The tools and procedures that were successfully proved and used in digital investigations are now becoming irrelevant, making it an urging necessity to develop new forensics capabilities for conducting an investigation in this new environment. As a consequence of these needs a new area has emerged, Cloud Forensics, which is the result of the intersection between cloud computing and digital forensics. Keywords: Cloud forensics, cloud computing, forensics investigation, forensic challenges.

研究动机与目标

• 识别并分析阻碍在云计算环境中开展数字取证调查的核心技术挑战。
• 研究云基础设施的动态性、分布性和多租户特性如何削弱传统取证方法论。
• 突出云环境中网络犯罪手法不断演变与当前数字取证工具和程序能力之间的日益扩大的差距。
• 倡导开发专门的云取证框架，以应对云环境调查的独特挑战。
• 通过系统性回顾现有技术障碍及其对证据获取与完整性的影响，为未来研究奠定基础。

提出的方法

• 对现有云计算与数字取证研究文献进行全面回顾，以识别反复出现的技术挑战。
• 分析云环境的架构与运行特性（如虚拟化、弹性扩展和共享基础设施）如何使取证调查复杂化。
• 审视传统数字取证工具与程序在应用于云系统时的局限性。
• 将技术问题分类为数据位置不确定性、缺乏直接访问权限、日志记录限制以及证据完整性担忧等类别。
• 评估多租户架构与资源虚拟化对证据获取与证据保管链流程的影响。
• 提出需要开发新型取证框架，以集成云服务提供商（CSP）接口，并支持自动化、可扩展的证据收集。

实验结果

研究问题

• RQ1 哪些是阻碍在云计算环境中有效开展数字取证调查的主要技术挑战？
• RQ2 云基础设施的动态性和虚拟化特性如何影响数字证据的可靠性和完整性？
• RQ3 为何传统数字取证工具与程序在云系统中已不再足够？
• RQ4 多租户架构与共享基础设施对取证证据收集与证据保管链有何影响？
• RQ5 数字取证需要具备哪些新能力，才能在云环境的约束下有效运作？

主要发现

• 由于失去了对存储与计算资源的直接物理访问，传统数字取证方法在云环境中本质上已不适用。
• 云平台中资源的动态分配与虚拟化使得以取证合规方式定位、保存和收集数字证据变得极为困难。
• 云计算的多租户模式增加了证据污染的风险，使从无关租户中隔离相关数据变得困难。
• 云服务提供商通常限制取证访问权限，且其日志机制可能无法提供全面调查所需的详细信息。
• 当前云平台缺乏标准化接口与自动化支持，阻碍了取证流程的可扩展性与可重复性。
• 迫切需要开发新型云取证框架，以集成云API，并支持自动化、安全且符合取证要求的证据获取。