Designing cloud forensic-enabled system

Abstract

In recent years, cloud computing has gained popularity and it is now used to support various areas of human life. Cloud computing technology and services, despite the advantages they bring to the market, have created number of issues regarding the security and trust of the individuals using them. Incidents occurring in cloud computing environments are hard to be solved since digital forensic methods used to conduct digital investigations are not suitable for cloud computing investigations. This is due to the fact that they do not consider the specific characteristics of the Cloud. Cloud forensics has been introduced to help forensic investigators find potential evidence against cloud criminal activities and maintain the security and integrity of the information stored in the cloud. Cloud forensics introduces processes for resolving incidents occurring in cloud computing environments. However, designing cloud services capable to assist a cloud investigation process when an incident occurs is of vital importance and recent research efforts concentrate on these directions. In addition, digital forensics methods cannot support a cloud investigation since cloud environments introduce many differences compared to traditional IT environments. Although cloud forensics assists in the direction of investigating and solving cloud-based cyber-crimes, in many cases the design and implementation of cloud services falls back. Software engineers should focus their attention on the design and implementation of cloud services that can be investigated in a sound forensic manner. This thesis makes an original contribution to knowledge in the field of cloud forensics by implementing a framework that assists software engineers to design cloud forensic-enabled services. In order to do so, a thorough literature review has been conducted focusing on the methodological aspects of cloud forensics. It critically reviews cloud forensics’ existing challenges and solutions and it explores, based on a detailed review of the area, all the work that has been carried out both in digital and cloud forensic methodologies mainly for supporting the investigation of security incidents in cloud environments. Furthermore, the detailed comparison reveals similarities and drawbacks of the existing methodologies providing some novel future research directions. This thesis moves current research one step further by identifying the major concepts, actors and their relationships that participating in a cloud forensic investigation through the introduction of a meta-model. The framework, which is implemented in order to support the elicitation of forensic requirements and software engineers consists of an identified number of a set of cloud forensic constraints, a modelling language expressed through a conceptual meta-model and a process based on the concepts identified and presented in the meta-model. The meta-model presented in this thesis not only includes the concepts that make a system forensic-enabled but also the concepts for cloud forensic investigation, raising the importance of the relation between a forensic-enabled system and an investigation process and how the latter is assisted when an incident occurs. In this way an integrated meta-model is produced to assist designers in a way that, they will be able to design forensic-enabled cloud services. The applicability of the framework is demonstrated through a case study. The main advantage of the proposed model is the correlation of cloud services’ characteristics with the cloud investigation while providing software engineers the ability to design and implement cloud forensic-enabled services via the use of process patterns.