Secure streaming forensic data transmission for trusted cloud

Abstract

The proliferation of cloud computing requires excessive forensic data to be acquired, transmitted, and analyzed in a timely manner. However, current digital forensic technology is ill-suited to cloud as it exposes the problems of trusted data acquisition and secure data transmission. In this paper, we present a novel scheme that secure forensic data collection and transmission. Our scheme allows forensic investigator to authenticate custodies by remotely attesting the platform that is run by custodies. To expedite data processing, forensic data is transmitted between trusted custodies as data stream. We develop a unified streaming data integrity verification algorithm, which allows a custody to verify the integrity of forensic data, detect and localize any malicious modification of data. To save communication bandwidth, data integrity information is transmitted as invisible watermark. We implement a proof-of-concept system. Our experimental results demonstrate that low performance overhead of data collection, node authentication, and data verification can be achieved with good scalability.