云取证：挑战，方法和开放问题的元研究
Cloud Forensics: A Meta-Study of Challenges, Approaches, and Open Problems
摘要：
近年来，云计算作为一种经济高效的计算范例已经变得流行。不幸的是，今天的云计算架构并不是为安全和取证而设计的。到目前为止，很少有研究来发展云取证的理论和实践。许多因素使云环境中的取证调查复杂化。首先，存储系统不再是本地的。因此，即使有传票，执法人员也不能没收嫌疑人的计算机并访问嫌疑人的文件。其次，每个云服务器包含来自许多用户的文件。因此，在不侵犯许多其他用户隐私的情况下从数据中心夺取服务器是不可行的。第三，即使识别出属于特定嫌疑人的数据，也很难将其与其他用户的数据分开。此外，除了云提供商的话，通常没有证据表明给定的数据文件与特定的嫌疑人有关。对于这些挑战，云不能用于存储医疗保健、业务或国家安全相关数据，这些数据需要审计和法规遵从性。在本文中，我们系统地研究了云取证问题，并探讨了云取证中的挑战和问题。然后，我们讨论了现有的研究项目，最后，我们强调了云取证研究领域的开放问题和未来的发展方向。我们认为，我们了解云取证的性质和挑战的系统方法将使我们能够研究可能的安全解决方案方法，从而提高对云计算的信任和采用，特别是在商业，医疗保健和国家安全领域。这反过来又会降低成本，为我们整个社会带来长远利益。
英文摘要：
In recent years, cloud computing has become popular as a cost-effective and efficient computing paradigm. Unfortunately, today's cloud computing architectures are not designed for security and forensics. To date, very little research has been done to develop the theory and practice of cloud forensics. Many factors complicate forensic investigations in a cloud environment. First, the storage system is no longer local. Therefore, even with a subpoena, law enforcement agents cannot confiscate the suspect's computer and get access to the suspect's files. Second, each cloud server contains files from many users. Hence, it is not feasible to seize servers from a data center without violating the privacy of many other users. Third, even if the data belonging to a particular suspect is identified, separating it from other users' data is difficult. Moreover, other than the cloud provider's word, there is usually no evidence that links a given data file to a particular suspect. For such challenges, clouds cannot be used to store healthcare, business, or national security related data, which require audit and regulatory compliance. In this paper, we systematically examine the cloud forensics problem and explore the challenges and issues in cloud forensics. We then discuss existing research projects and finally, we highlight the open problems and future directions in cloud forensics research area. We posit that our systematic approach towards understanding the nature and challenges of cloud forensics will allow us to examine possible secure solution approaches, leading to increased trust on and adoption of cloud computing, especially in business, healthcare, and national security. This in turn will lead to lower cost and long-term benefit to our society as a whole.
机构、总结、中文摘要均由AI分析而来，可能存在错误，请以论文正文为准。
