A cloud data forensics method and system
Through the cloud data forensics method of client and server architecture, using crawlers to simulate requests and perform core algorithm calculations on the server, the problems of high cost and low efficiency of traditional cloud forensics are solved, and efficient cloud data extraction is achieved.
Patent Information
- Application Number
- CN202111591773.8
- Authority / Receiving Office
- CN · China
- Patent Type
- Patents(China)
- Current Assignee / Owner
- Filing Date
- 2021-12-23
- Publication Date
- 2025-09-09
- Estimated Expiration
- 2041-12-23
AI Technical Summary
Existing cloud forensics technology has high costs, long development cycles, and is difficult to reverse analyze, especially when faced with the data security protection measures of mainstream apps. This makes traditional methods inefficient in the reverse analysis and data restoration process.
It adopts a client-side and server-side architecture, simulates APP network requests through the crawler module, uses the core algorithm module to perform calculations and data packet processing on the server, and combines multi-threading and message queue mechanisms to achieve rapid cloud data forensics.
Significantly reduce reverse R&D investment, improve cloud forensics development efficiency, shorten reverse restoration time, and improve cloud data extraction efficiency.
Smart Images
Figure CN114444117B_ABST
Abstract
Description
Technical Field
[0001] The present invention relates to the field of cloud forensics technology, and in particular to a cloud data forensics method and system. Background Art
[0002] With the development of mobile network technology, more and more apps are storing various types of data in the cloud. Traditional forensic techniques are increasingly limited in the amount of core data they can obtain, leading to a surge in cloud-based data forensics. For example, many chat apps in China currently offer not only chat functions but also transaction functions, facilitating daily user experience. Important transaction data is typically stored in the cloud, effectively ensuring the security of sensitive data.
[0003] Currently, traditional cloud forensics technologies primarily include those based on web protocols, app protocols, simulation environments, and mobile traffic data interception. Each approach carries high reverse engineering costs and a lengthy development cycle. For example, web protocol analysis and app protocol analysis require protocol reverse engineering, potentially encountering challenges such as JavaScript reverse engineering, OLLVM obfuscation restoration, and VMP unpacking. This requires significant research effort and time. Simulation environments, on the other hand, are increasingly limited due to the detection and restriction of various hook frameworks in mainstream apps to protect data security. Mobile traffic data interception requires the installation of a certificate on the phone and the restoration of the intercepted data, which is costly and complex, making it less suitable for everyday forensic investigations. Summary of the Invention
[0004] In order to solve the above problems, the present invention proposes a cloud data forensics method and system.
[0005] The specific plan is as follows:
[0006] A cloud data forensics method includes the following steps:
[0007] S1: When the client initiates an APP login request, it is determined whether the core algorithm service calculation is required for the APP login. If so, a request data packet is constructed based on the client number, the interface number corresponding to the required core algorithm service calculation, and the parameter information used for the core algorithm service calculation and sent to the server; then the process proceeds to S2; otherwise, the APP login operation is performed directly according to the APP login protocol, and the process proceeds to S4;
[0008] S2: After receiving the request data packet, the server checks the illegality of the request data packet. If it is legal, it parses the request data packet and calculates the parameter information used for the core algorithm service calculation using the core algorithm module corresponding to the interface number in the request data packet. The calculation results are packaged and returned to the client corresponding to the client number in the request data packet.
[0009] S3: The client checks the illegality of the returned calculation result data packet. If it is legal, it performs the APP login operation based on the returned calculation result data packet according to the reverse APP login protocol requirements;
[0010] S4: After the APP login is successful, when the client initiates a data acquisition request, it determines whether the core algorithm service calculation is required when acquiring the data. If so, a request data packet is constructed based on the client number, the interface number corresponding to the required core algorithm service calculation, and the parameter information used for the core algorithm service calculation and sent to the server; then proceed to S5; otherwise, the data acquisition request is directly made according to the reverse network protocol;
[0011] S5: After receiving the request data packet, the server determines whether the request data packet is illegal. If it is legal, it parses the request data packet and calculates the parameter information used for the core algorithm service calculation using the core algorithm module corresponding to the interface number in the request data packet. The calculation results are packaged and returned to the client corresponding to the client number in the request data packet.
[0012] S6: The client judges the illegality of the returned calculation result data packet. If it is legal, the client obtains and parses the data according to the reverse data request protocol based on the returned calculation result data packet.
[0013] Furthermore, after each APP login operation, the process also includes: if the APP login operation fails, re-initiating a login request, and repeating steps S1-S3 until the number of logins reaches the first number threshold.
[0014] Furthermore, after each data acquisition request is made, the process also includes: if the cloud data acquisition fails, re-initiating the data acquisition request, and repeating steps S4-S6 until the number of data acquisition requests reaches the second threshold.
[0015] Furthermore, the crawler module is used in the client to simulate the APP network request protocol, including the APP login request and data acquisition request, to realize the APP login and cloud data extraction.
[0016] Furthermore, the client also includes an auxiliary verification module for performing security verification during APP login and data request, to assist the crawler module in completing APP login and data request.
[0017] Furthermore, each interface in the server corresponds to a core algorithm processing module, and each core algorithm processing module loads an algorithm used in the APP reverse engineering process in the form of a so library.
[0018] Furthermore, when the server receives request data packets sent by multiple clients at the same time, it adopts a message queue mechanism and processes the request data packets in a multi-threaded manner.
[0019] A cloud-based data forensics system includes a client and a server, each of which includes a processor, a memory, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, the steps of the method described above are implemented in an embodiment of the present invention.
[0020] The present invention adopts the above technical solution, which can greatly reduce the reverse research and development investment of the currently commonly used cloud forensics technology. By adding background services, it effectively reduces the reverse cost and greatly improves the development efficiency of cloud forensics. BRIEF DESCRIPTION OF THE DRAWINGS
[0021] Figure 1 Shown is a flowchart of a login request in the first embodiment of the present invention.
[0022] Figure 2 FIG2 is a flowchart of a cloud data request in the first embodiment of the present invention. DETAILED DESCRIPTION
[0023] To further illustrate various embodiments, the present invention provides accompanying drawings. These drawings form part of the present disclosure and are primarily used to illustrate the embodiments and, in conjunction with the relevant description in the specification, to explain the operating principles of the embodiments. By referring to these drawings, those skilled in the art will be able to understand other possible implementations and the advantages of the present invention.
[0024] The present invention will now be further described with reference to the accompanying drawings and specific embodiments.
[0025] Example 1:
[0026] The embodiment of the present invention provides a cloud data forensics method, referring to Figure 1 and Figure 2 As shown, the method includes the following steps:
[0027] S1: When the client initiates an APP (application) login request, it determines whether the core algorithm service calculation is required for APP login. If so, a request data packet is constructed based on the client number, the interface number corresponding to the required core algorithm service calculation, and the parameter information used for the core algorithm service calculation and sent to the server; enter S2; otherwise, directly perform the APP login operation according to the APP login protocol and enter S4.
[0028] S2: After receiving the request data packet, the server determines whether the request data packet is illegal. If it is legal, it parses the request data packet and calculates the parameter information used for the core algorithm service calculation using the core algorithm module corresponding to the interface number in the request data packet. The calculation results are packaged and returned to the client corresponding to the client number in the request data packet.
[0029] S3: The client judges the illegality of the returned calculation result data packet. If it is legal, it performs the APP login operation based on the returned calculation result data packet according to the reverse APP login protocol requirements.
[0030] It should be noted that since APP login may fail, this embodiment further includes the following steps after each APP login operation: if the APP login operation fails, a login request is re-initiated, and steps S1-S3 are repeated until the number of logins reaches a first threshold. The first threshold can be set by those skilled in the art and is not limited here.
[0031] When the request data packet or calculation result data packet is illegal, the client resends the request data packet to the server.
[0032] S4: After the APP login is successful, when the client initiates a data acquisition request, it determines whether the core algorithm service calculation is required when obtaining the cloud data. If so, a request data packet is constructed based on the client number, the interface number corresponding to the required core algorithm service calculation, and the parameter information used for the core algorithm service calculation and sent to the server; enter S5; otherwise, the data acquisition request is directly made according to the reverse network protocol.
[0033] S5: After receiving the request data packet, the server determines whether the request data packet is illegal. If it is legal, it parses the request data packet and calculates the parameter information used for the core algorithm service calculation using the core algorithm module corresponding to the interface number in the request data packet. The calculation results are packaged and returned to the client corresponding to the client number in the request data packet.
[0034] S6: The client judges the illegality of the returned calculation result data packet. If it is legal, it makes a data acquisition request based on the returned calculation result data packet according to the reverse data request protocol.
[0035] It should be noted that since cloud data acquisition may fail, this embodiment further includes the following steps after each data acquisition request: if the cloud data acquisition fails, re-initiate the data acquisition request, and repeat steps S4-S6 until the number of data acquisition requests reaches a second threshold. The second threshold can be set by those skilled in the art and is not limited here.
[0036] This embodiment uses a crawler module on the client to simulate the app network request protocol, including two parts: app login request and data acquisition request, to achieve app login and cloud data extraction. Different apps on the client correspond to different crawler modules. Each crawler module is independent and is responsible for acquiring cloud data for its corresponding app.
[0037] The client also includes an auxiliary verification module for security verification during APP login and data request, to assist the crawler module in completing APP login and data request. For example, during the login process, security verification of sliders, graphic clicks, and drawing tracks is required.
[0038] Since the algorithm that is difficult to break through during the APP reverse engineering process is encapsulated in the background in this embodiment, the business system needs to communicate with the corresponding interface in the server according to its own core algorithm service. In order to achieve safe and reliable network communication in this embodiment, the communication protocol adopts TCP / IP, and the key field information in the data packet includes: client number, interface number, parameter information and other information. The client number and interface number are used for unique identification between the client and the specific interface of the server. The parameter information includes the number of parameters and parameter values, which need to be set according to the requirements of the specific interface.
[0039] When the client receives the returned calculation result data packet, it parses it and sends the calculation result in it to the crawler module, so that the crawler module makes APP login requests and data acquisition requests based on the calculation results.
[0040] The client's operating system can be Windows or Linux-related operating systems, which can be determined according to business needs. There is no restriction on this part.
[0041] The server includes a plug-in management module for parsing and distributing received data packets. It parses the client ID and interface ID in the packet and forwards it to the core algorithm processing module corresponding to the interface number for processing. Once the corresponding core algorithm processing module completes processing, it returns the result information to the plug-in management module, which encapsulates it and sends it to the corresponding client for analysis.
[0042] Each interface on the server corresponds to a core algorithm processing module, which is used for the calculation of a core algorithm service. Like the crawler module on the client, the calculation algorithm processing module is composed of different core algorithm encapsulations for different apps. It directly loads the more complex algorithms (such as encryption and decryption algorithms, custom algorithms, etc.) used in the app reverse engineering process as a .so library, exports the corresponding interface functions, and passes in the parameter information passed by the client to obtain the interface return result. This effectively shortens the time it takes to restore the encapsulated algorithms in the .so library during the reverse engineering process.
[0043] On the Android operating system, there are two common methods for loading so libraries: System.loadLibrary and System.load. For difficult interface functions during Android reverse engineering, either method can be used to load them first, then export the function interface to be called. Although the app may be obfuscated by OllVM or hardened by VMP, this does not hinder the export of the corresponding so-related interfaces. Similarly, the Linux so loading principle can be implemented, except that the loading and export functions are replaced by dlopen and dlsym.
[0044] When reverse engineering a specified APP, the final core algorithm code is based on the Java Jar package program. By building a JDK operating environment through backend service, it is possible to remotely calculate the parameters returned by the Jar package. When the APP protocol is upgraded, it can also be quickly supported by updating the backend service algorithm.
[0045] Web page version crawlers often encounter the problem of high JS reverse engineering costs. By copying the corresponding JS code during protocol analysis and deploying it in the background, when JS needs to be called, Node.js is used to execute JS, thereby quickly completing the web page version crawler work.
[0046] The server-side operating system needs to use Android or Linux operating system, with the corresponding Android APP reverse engineering as the main entry point to find the key library names and interfaces in the APP, so as to implement the corresponding loading and interface export on the server side, thereby reducing the time spent on reverse engineering key interfaces (this time often takes several weeks).
[0047] In addition, when the server receives request data packets sent by multiple clients at the same time, the message queue mechanism is currently mainly used to determine the source of the message based on the client priority and client number, and perform core algorithm calculations in a multi-process manner, thereby effectively ensuring the efficiency of cloud forensics.
[0048] The embodiment of the present invention uses the front-end and back-end service architecture in order to reduce the reverse cost and take data security transmission as the principle, which can effectively improve the reverse efficiency. The method of this embodiment focuses on shortening the reverse restoration time of various types of APPs. By finding the corresponding interface functions and building a back-end service architecture, it effectively solves the time waste caused by the difficulty of restoring the interface functions during the cloud forensics process. Once this technology is put into use, the reverse efficiency of cloud data extraction will be increased several times. By building the architecture of this embodiment, the rapid development efficiency of cloud forensics for specific APPs can be greatly reduced, and the possibility of cloud-based electronic data forensics can be effectively improved.
[0049] Example 2:
[0050] The present invention also provides a cloud-based data forensics system, including a client and a server, both of which include a memory, a processor, and a computer program stored in the memory and runnable on the processor. When the processor executes the computer program, the steps in the above-mentioned method embodiment of embodiment 1 of the present invention are implemented.
[0051] Furthermore, as an executable solution, the client and the server can both be computing devices such as mobile phones, desktop computers, notebooks, and handheld computers.
[0052] Although the present invention has been particularly shown and described in conjunction with preferred embodiments, it will be understood by those skilled in the art that various changes in form and details may be made to the present invention without departing from the spirit and scope of the invention as defined in the appended claims, and all such changes are within the scope of protection of the present invention.
Claims
1. A cloud data forensics method, characterized in that: The following steps are involved: S1: When the client initiates an APP login request, it is determined whether the core algorithm service calculation is required for the APP login. If so, a request data packet is constructed based on the client number, the interface number corresponding to the required core algorithm service calculation, and the parameter information used for the core algorithm service calculation and sent to the server; then the process proceeds to S2; otherwise, the APP login operation is performed directly according to the APP login protocol, and the process proceeds to S4; S2: After receiving the request data packet, the server checks the illegality of the request data packet. If it is legal, it parses the request data packet and calculates the parameter information used for the core algorithm service calculation using the core algorithm module corresponding to the interface number in the request data packet. The calculation results are packaged and returned to the client corresponding to the client number in the request data packet. S3: The client checks the illegality of the returned calculation result data packet. If it is legal, it performs the APP login operation based on the returned calculation result data packet according to the reverse APP login protocol requirements; S4: After the APP login is successful, when the client initiates a data acquisition request, it determines whether the core algorithm service calculation is required when acquiring the data. If so, a request data packet is constructed based on the client number, the interface number corresponding to the required core algorithm service calculation, and the parameter information for the core algorithm service calculation and sent to the server; Enter S5; Otherwise, directly make a data acquisition request according to the reverse network protocol; S5: After receiving the request data packet, the server determines whether the request data packet is illegal. If it is legal, it parses the request data packet and calculates the parameter information used for the core algorithm service calculation using the core algorithm module corresponding to the interface number in the request data packet. The calculation results are packaged and returned to the client corresponding to the client number in the request data packet. S6: The client judges the illegality of the returned calculation result data packet. If it is legal, the client obtains and parses the data according to the reverse data request protocol based on the returned calculation result data packet.
2. The cloud data forensics method according to claim 1, characterized in that: After each APP login operation, the process also includes: if the APP login operation fails, re-initiating a login request, and repeating steps S1-S3 until the number of logins reaches the first number threshold.
3. The cloud data forensics method according to claim 1, characterized in that: After each data acquisition request is made, the process also includes: if the cloud data acquisition fails, re-initiating the data acquisition request, and repeating steps S4-S6 until the number of data acquisition requests reaches the second threshold.
4. The cloud data forensics method according to claim 1, characterized in that: In the client, the crawler module is used to simulate the APP network request protocol, including the APP login request and data acquisition request, to realize the APP login and cloud data extraction.
5. The cloud data forensics method according to claim 1, characterized in that: The client also includes an auxiliary verification module for security verification during APP login and data request to assist the crawler module in completing APP login and data request.
6. The cloud data forensics method according to claim 1, characterized in that: Each interface in the server corresponds to a core algorithm processing module, and each core algorithm processing module loads an algorithm used in the APP reverse engineering process in the form of a so library.
7. The cloud data forensics method according to claim 1, characterized in that: When the server receives request data packets sent by multiple clients at the same time, it adopts a message queue mechanism and processes the request data packets in a multi-threaded manner.
8. A cloud-based data forensics system, characterized by: The method comprises a client and a server, each of which comprises a processor, a memory, and a computer program stored in the memory and running on the processor, wherein the processor implements the steps of the method according to any one of claims 1 to 7 when executing the computer program.