云计算取证模型  

Cloud computing forensic model

作　　者：高元照 李学娟 李炳龙[1,2] 吴熙曦 

机构地区：[1]信息工程大学,河南郑州450001 [2]数学工程与先进计算国家重点实验室,河南郑州450001 [3]河南理工大学审计处,河南焦作454010 [4]白城兵器试验中心,吉林白城137000

出　　处：《网络与信息安全学报》2017年第9期13-23,共11页Chinese Journal of Network and Information Security

基　　金：国家高技术研究发展计划("863"计划)基金资助项目(No.2015AA016006);国家自然科学基金资助项目(No.60903220)~~

摘　　要：针对云取证面临的主要挑战,分析云计算特性,提出了一种云取证模型。提出了持续性取证准备服务的部署、基于"迭代"的多轮次证据识别策略和分布式文件系统的多层级数据定位方法、基于"数据隔离"和"按需收集"策略的证据收集方法、基于云计算资源的综合性证据分析平台的建立。最后,结合云环境下的取证场景,分析了该模型的有效性。Aiming at the main challenges facing cloud forensics, cloud characteristics were analyzed and a cloud forensic model was proposed. In the model, the deployment of persistent forensic readiness service, multi-round identification strategy based on ＂iteration＂ and multi-level evidence location method for distributed file system, ＂data isolation＂ and ＂on-demand collection＂ strategies, and the establishment of comprehensive evidence analysis platform based on cloud resources were presented. Finally, the validity of the model was analyzed combining the forensic scene in the cloud environment.

关 键 词：云计算 云取证 取证模型 取证策略 取证方法 

分 类 号：TP311[自动化与计算机技术—计算机软件与理论]