Design and implementation of FROST: Digital forensic tools for the OpenStack cloud computing platform

Simple item page
dc.contributor.authorDykstra, Josiah
dc.contributor.authorSherman, Alan T.
dc.date.accessioned2019-02-21T15:58:07Z
dc.date.available2019-02-21T15:58:07Z
dc.date.issued2013-08
dc.descriptionThe Proceedings of the Thirteenth Annual DFRWS Conferenceen_US
dc.description.abstractWe describe the design, implementation, and evaluation of FROST|three new forensic tools for the OpenStack cloud platform. Operated through the management plane, FROST provides the rst dedicated forensics capabilities for OpenStack, an open-source cloud platform for private and public clouds. Our implementation supports an Infrastructure- as-a-Service (IaaS) cloud and provides trustworthy forensic acquisition of virtual disks, API logs, and guest rewall logs. Unlike traditional acquisition tools, FROST works at the cloud management plane rather than interacting with the operating system inside the guest virtual machines, thereby requiring no trust in the guest machine. We assume trust in the cloud provider but FROST overcomes non-trivial challenges of remote evidence integrity by storing log data in hash trees and returning evidence with cryptographic hashes. Our tools are user-driven, allowing customers, forensic examiners, and law enforcement to conduct investigations without necessitating interaction with the cloud provider. We demonstrate through examples how forensic investigators can independently use our new features to obtain forensically- sound data. Our evaluation demonstrates the e ectiveness of our approach to scale in a dynamic cloud environment. The design supports an extensible set of forensic objectives, including the future addition of other data preservation, discovery, real-time monitoring, metrics, auditing, and acquisition capabilities.en_US
dc.description.sponsorshipWe thank Simson Gar nkel, Ken Zatyko, and Tim Leschke for helpful comments on early drafts. We also thank Ron Rivest and Stuart Haber for insights and sug- gestions related to hash trees. Sherman was supported in part by the Department of Defense under IASP grant H98230-11-1-0473 and by the National Science Foundation under SFS grant 1241576. Dykstra was supported in part by an AWS in Education grant award.en_US
dc.description.urihttps://www.sciencedirect.com/science/article/pii/S174228761300056Xen_US
dc.format.extent9 pagesen_US
dc.genreconference papers and proceedingsen_US
dc.identifierdoi:10.13016/m2munv-fumm
dc.identifier.citationJosiah Dykstra, Alan T. Sherman, Design and implementation of FROST: Digital forensic tools for the OpenStack cloud computing platform, Digital Investigation Volume 10, Supplement, August 2013, Pages S87-S95, https://doi.org/10.1016/j.diin.2013.06.010en_US
dc.identifier.urihttps://doi.org/10.1016/j.diin.2013.06.010
dc.identifier.urihttp://hdl.handle.net/11603/12833
dc.language.isoen_USen_US
dc.publisherElsevier B.V.en_US
dc.relation.isAvailableAtThe University of Maryland, Baltimore County (UMBC)
dc.relation.ispartofUMBC Center for Research and Exploration in Space Sciences & Technology II (CRSST II)
dc.relation.ispartofUMBC Faculty Collection
dc.relation.ispartofUMBC Computer Science and Electrical Engineering Department
dc.relation.ispartofUMBC Student Collection
dc.rightsThis item is likely protected under Title 17 of the U.S. Copyright Law. Unless on a Creative Commons license, for uses protected by Copyright Law, contact the copyright holder or the author.
dc.rightsAttribution-NonCommercial-NoDerivs 4.0 International (CC BY-NC-ND 4.0 DEED)
dc.rightshttps://creativecommons.org/licenses/by-nc-nd/4.0/
dc.subjectopenstacken_US
dc.subjectcloud computingen_US
dc.subjectdigital forensicsen_US
dc.subjectcloud forensicsen_US
dc.subjectFROSTen_US
dc.titleDesign and implementation of FROST: Digital forensic tools for the OpenStack cloud computing platformen_US
dc.typeTexten_US
dcterms.creatorhttps://orcid.org/0000-0003-1130-4678

Files

Original bundle
Now showing 1 - 1 of 1
Thumbnail Image
Name:
1-s2.0-S174228761300056X-main.pdf
Size:
1 MB
Format:
Adobe Portable Document Format
Description:
Download
License bundle
Now showing 1 - 1 of 1
No Thumbnail Available
Name:
license.txt
Size:
2.56 KB
Format:
Item-specific license agreed upon to submission
Description:
Download

Collections

UMBC Center for Information Security and Assurance (CISA)
UMBC Computer Science and Electrical Engineering Department
UMBC Faculty Collection
UMBC Student Collection