面向IaaS云服务基础设施的电子证据保全与取证分析系统设计.docxVIP

入 选 论 文 2014年第09期 doi ：10.3969/j.issn.1671-1122.2014.09.042 面向 IaaS 云服务基础设施的电子证据保全与 取证分析系统设计 吴羽翔，李宁滨，金鑫，楼叶 （中国人民公安大学，北京 102623） 摘 要 ：随着云技术在计算机网络领域的广泛应用，云环境下的安全审计与电子取证需求 也日益迫切。由于云取证与传统计算机取证在取证环境、证据获取及证据分析方面有较大区别， 目前尚缺乏有效的针对云的电子取证方法及技术手段，云系统作为一种信息系统，其可审计性 得不到保证。文章设计了一套新的云取证系统，面向 IaaS 云服务的基础设施，通过采集终端对 云系统中虚拟机进行监控并主动采集证据，同时将采集到的证据集中存放于一处，取证系统实 时取证、证据集中保全的特性可以有效应对云环境下证据易失、证据提取困难的特点，达到高 效取证。 关键词 ：云取证 ；IaaS 云服务 ；动态取证 ；证据保全 中图分类号 ：TP309 文献标识码 ：A 文章编号 ：1671-1122（2014）09-0184-05 Electronic Evidence and Forensic Analysis System Design of IaaS Cloud Service-oriented Infrastructure Preservation WU Yu-xiang, LI Ning-bin, JIN Xin, LOU Ye (Chinese Peoples Public Security University, Beijing 102623, China) Abstract: With the cloud technology is widely used in the field of computer networking, security, audit and e-discovery needs of cloud environments is increasingly urgent. As the cloud with traditional computer forensics evidence is quite different in the forensic environment, obtaining evidence and evidence analysis, the current lack of effective methods for cloud forensics and electronic techniques, the cloud system as an information system, which was auditability can not be guaranteed. This paper presents a new set of cloud forensics systems for infrastructure IaaS cloud services, data collection terminals through cloud system virtual machine monitor and actively collect evidence, and the evidence collected will be stored centrally in one place, forensics system Real-time forensics, evidence preservation features centralized cloud environment can effectively deal with volatile evidence, the evidence difficult to extract features, to achieve efficient forensics. Key words: cloud forensics; IaaS cloud service; dynamic forensics; evidence preservation 0 引言 云计算（cloud computing）是一种基于互联网的计算方式，它由一系列可以动态升级和被虚拟化的资源组成，这些资 源被所有云计算的用户共享并且可以方便地通过网络访问，用户无需掌握云计算的技术，只需要按照个人或者团体的需要 租赁云计算的资源。云计算一般被分成以下三种类别 ：IaaS（Infrastructure as a Service，基础设施即服务）、PaaS（Platform as a Service，平台即服务）、SaaS（Softw