Simulation evidence obtaining method and system bypassing virtual firewall of cloud platform

Abstract

The invention discloses a simulation evidence obtaining method and system bypassing a virtual firewall of a cloud platform, and the method comprises the following steps: S1, obtaining the information of a cloud server, and carrying out the network connection with the cloud server; s2, the evidence obtaining equipment end is mounted on the cloud server in a mode of prefabricating memory mounting and disk file mounting, and a memory mounting module, a mounting file and an occupation mark are created; and S3, the evidence obtaining equipment side sends a simulation program to the cloud server, and the simulation program copies and decompresses a target program operated by the cloud server, detects the state of the placeholder mark, and extracts target data generated by the target program according to the state of the placeholder mark.

Description

Technical Field

[0001] The present invention relates to the technical field of virtual evidence collection, and in particular to a simulation evidence collection method and system for bypassing a cloud platform virtual firewall. Background Art

[0002] With the vigorous development of cloud server technology, many servers are currently deployed on cloud platforms. Most of the forensic technologies currently on the market require obtaining cloud platform account, password and other related credential information in advance before evidence collection, and save them properly. When evidence collection is needed, you can use these credential information to log in to the cloud console to open the port number corresponding to the specified virtual firewall to ensure that the network monitoring program is enabled normally and the traffic is received normally; or manually copy the specified program to the target server, and after fixing it, manually copy the evidence to the local through related tools; there are also some technologies that choose to use a proxy method (including the API interface provided by the cloud vendor) to actively push the target server data to the proxy server, and the proxy server will push the data to the forensic device.

[0003] During the cloud platform evidence collection process, it was found that when investigating the cloud platform server, if it is necessary to manually copy the program to the cloud server and start the corresponding program for port monitoring, it may encounter restrictions on the cloud console security rules, resulting in the inability to receive client connection data normally. At this time, front-line case handlers can try to obtain the cloud console web login information, thereby opening the port number corresponding to the specified virtual firewall to ensure that the network monitoring program is normally enabled and the traffic is received normally. However, it is not always feasible to obtain cloud console account information during on-site trials, which will bring certain technical difficulties to evidence collection.

[0004] If the cloud console account information cannot be obtained, case handlers can only copy the core data manually, which may lead to incomplete data, low case handling efficiency and other problems. Summary of the invention

[0005] To address the above shortcomings, we propose a fast forensics method to bypass the cloud platform virtual firewall, which has the following advantages:

[0006] 1. Automatically push cloud server dependent programs: There is no need to manually copy programs to the specified target server, and no human intervention is required during the extraction process.

[0007] 2. No need to use a third-party server (proxy server), the forensic device can be directly connected to the target server.

[0008] 3. You can extract and fix the server on the cloud service side without logging in to the cloud console to enable the specified network security rules.

[0009] According to one aspect of the present invention, a simulated evidence collection method for bypassing a cloud platform virtual firewall is proposed, comprising the following steps:

[0010] S1, obtaining cloud server information and establishing network connection with the cloud server;

[0011] S2, the forensic device is mounted on the cloud server by prefabricated memory mounting and disk file mounting, and a memory mounting module, mounting file and placeholder mark are created;

[0012] S3, the forensic device sends the simulation program to the cloud server, the simulation program copies and decompresses the target program running on the cloud server, and detects the status of the placeholder mark, and extracts the target data generated by the target program according to the status of the placeholder mark.

[0013] Preferably, the obtaining of cloud server information in S1 and establishing network connectivity with the cloud server specifically include obtaining the server address, login account, and login port of the cloud server, and establishing network connectivity with the cloud server by inputting the login password of the cloud server or configuring the key of the cloud server.

[0014] Preferably, in S3, the actual occupied memory size recorded by the placeholder marker is used to divide the state of the placeholder marker into an unwritten data state, a pending data reading state and a data reading completion state based on the actual occupied memory size recorded by the placeholder marker.

[0015] Further preferably, the memory mounting module performs different index markings according to different business modules on the cloud server, including network real-time module index marking, system information module index marking, network module index marking, website module index marking, file download module index marking, image creation module index marking, and secondary analysis module index marking.

[0016] More preferably, S3 specifically includes:

[0017] S31, the simulation program automatically copies the program running on the cloud server to the target server through simulated copying, and decompresses it to a specified location;

[0018] S32, after the cloud server starts the target program, the simulation program reads the target data from the specified location, returns the target data to the memory mounting module, updates the corresponding placeholder mark, writes the target data into the corresponding module according to the index mark, and then encrypts and synchronizes the target data into the mounting file;

[0019] S33, the forensic device decrypts the target data in the mounted file and reads the status of the placeholder mark. When the status of the placeholder mark is pending reading data, the target data is extracted immediately.

[0020] Further preferably, when the target data is written into the corresponding module according to the index mark in S32, the target data is encrypted by the public key of the forensic device, and the corresponding hash digest value is calculated to obtain the original hash digest value, and the encrypted target data and the original hash digest value are synchronized to the mounted file.

[0021] Further preferably, the forensic device in S33 decrypts the target data in the mounted file, specifically including decrypting the target data in the mounted file by using the private key of the forensic device, and recalculating the hash summary value of the target data and comparing it with the original hash summary value to confirm the integrity of the target data.

[0022] According to one aspect of the present invention, a simulated forensics system for bypassing a cloud platform virtual firewall is proposed, comprising the following modules:

[0023] Network connection module: obtains cloud server information and establishes network connection with the cloud server;

[0024] Mounting module: The forensic device is mounted on the cloud server by prefabricated memory mounting and disk file mounting, creating a memory mounting module, mounting file and placeholder mark;

[0025] Simulation extraction module: The forensic device sends the simulation program to the cloud server, the simulation program copies and decompresses the target program running on the cloud server, and detects the status of the placeholder mark, and extracts the target data generated by the target program according to the status of the placeholder mark.

[0026] According to one aspect of the present invention, a computer program product is provided, on which a computer program is stored. When the computer program is executed by a processor, the method according to any one of the first aspects is implemented.

[0027] The present invention operates through the above complete steps, and the user can completely bypass the port restriction and realize automatic network data fixation during the extraction and fixation process, thereby solving the problem of manually copying and opening the designated port of the cloud target server.

[0028] The present invention is beneficial in that:

[0029] Based on the method of prefabricated memory mounting and file mounting, an encrypted data transfer channel with a custom format is constructed for the target server that cannot directly communicate through the basic network. The forensic device and the forensic service process on the cloud server jointly maintain and operate. The cloud-collected data is cached through prefabricated memory, and the memory placeholder mark is used to facilitate the rapid indexing of the collected data, and synchronously encrypt and write it to the mounted file. The forensic device reads the mounted local file data in real time, decrypts the file content data, obtains the collected data from the remote target machine, and also uses the mounted file channel to set instructions to link the forensic service process on the cloud server. In this way, a data transmission channel based on file mounting is customized to achieve efficient forensics that bypasses firewall isolation.

[0030] Secondly, simulation technology is used to realize user behavior, realize automatic copy process, automatic start process, automatic trigger event and other behaviors to achieve one-click deployment and extraction, and realize the automation of the whole process. By bypassing the network port restriction technical solution as above, the problem of not being able to directly extract data on the cloud platform is solved.

[0031] Finally, the security and integrity of the target data obtained during the forensics process are ensured by combining the encryption algorithm, hash summary value, and the status of the placeholder mark. BRIEF DESCRIPTION OF THE DRAWINGS

[0032] The accompanying drawings are included to provide a further understanding of the embodiments and are incorporated into and constitute a part of this specification. The accompanying drawings illustrate the embodiments and are used together with the description to explain the principles of the present invention. It will be easy to recognize other embodiments and many expected advantages of the embodiments because they become better understood by reference to the following detailed description. The elements of the drawings are not necessarily to scale with each other. The same reference numerals refer to corresponding similar parts.

[0033] Figure 1 A flow chart of a simulated evidence collection method for bypassing a cloud platform virtual firewall according to the present invention is shown;

[0034] Figure 2 A structural diagram of a simulated forensics system for bypassing a cloud platform virtual firewall according to the present invention is shown;

[0035] Figure 3 A schematic diagram of the computer system structure of an electronic device suitable for implementing an embodiment of the present application is shown. DETAILED DESCRIPTION

[0036] The present application will be further described in detail below in conjunction with the accompanying drawings and embodiments. It is to be understood that the specific embodiments described herein are only used to explain the relevant invention, rather than to limit the invention. It should also be noted that, for ease of description, only the parts related to the relevant invention are shown in the accompanying drawings.

[0037] It should be noted that, in the absence of conflict, the embodiments and features in the embodiments of the present application can be combined with each other. The present application will be described in detail below with reference to the accompanying drawings and in combination with the embodiments.

[0038] Figure 1 A simulated evidence collection method for bypassing a cloud platform virtual firewall according to an embodiment of the present invention includes the following steps:

[0039] S1, obtaining cloud server information and establishing network connection with the cloud server;

[0040] S2, the forensic device is mounted on the cloud server by prefabricated memory mounting and disk file mounting, and a memory mounting module, mounting file and placeholder mark are created;

[0041] S3, the forensic device sends the simulation program to the cloud server, the simulation program copies and decompresses the target program running on the cloud server, and detects the status of the placeholder mark, and extracts the target data generated by the target program according to the status of the placeholder mark.

[0042] In a specific embodiment, the acquisition of cloud server information in S1 and establishing network connectivity with the cloud server specifically include obtaining the server address, login account, and login port of the cloud server, and establishing network connectivity with the cloud server by entering the login password of the cloud server or configuring the key of the cloud server.

[0043] The login port here refers to the network access port for logging into the server, which is a non-specific port set by the server administrator.

[0044] In general evidence collection, remote connection can be achieved by logging into the system through obtaining remote server information and directly establishing a network channel through an open network port to collect evidence. However, in many cases, due to firewalls, direct evidence collection cannot be performed in this way. The present invention, by utilizing the feature of remote services that allow local mounted file access, automatically establishes a set of transmission channels that are not based on network ports according to its own evidence collection needs, and achieves the same evidence collection effect as using a network port connection by synchronously mounting files.

[0045] The memory mounting module can be divided into different modules according to the actual needs of the business module of the cloud server and forensics, and different index marks and placeholder marks are performed. In a specific embodiment, the memory mounting module includes a network real-time module, a system information module, a network module, a website module, a file download module, an image production module, and a secondary analysis module. Correspondingly, a network real-time module index mark, a system information module index mark, a network module index mark, a website module index mark, a file download module index mark, an image production module index mark, and a secondary analysis module index mark are created. At this time, the corresponding placeholder mark is in a state where no data is written.

[0046] In a specific embodiment, S3 specifically includes:

[0047] The simulation program automatically copies the program running on the cloud server to the target server through simulated replication, and decompresses it to a specified location.

[0048] After the cloud server starts the target program, the simulation program reads the target data from the specified location, returns the target data to the memory mounting module, updates the corresponding placeholder mark, at which time the corresponding placeholder mark is in a pending read data state, and is written into the corresponding module according to the index mark, and then encrypted and synchronized to the mounting file.

[0049] When the target data is written into the corresponding module according to the index mark, the target data is encrypted by the public key of the forensic device, and the corresponding hash digest value is calculated to obtain the original hash digest value, and the encrypted target data and the original hash digest value are synchronized to the mounted file.

[0050] The forensic device decrypts the target data in the mounted file, specifically including decrypting the target data in the mounted file by using the private key of the forensic device, and recalculating the hash summary value of the target data and comparing it with the original hash summary value to confirm the integrity of the target data.

[0051] When the forensic device finds that the hash digest value of the target data is inconsistent with the original hash digest value, the target data transmitted this time will be deleted, and the status of the placeholder mark will be reset to the state of no data written, and the data of the corresponding module on the cloud server will be read again according to the index until the hash digest value detection is consistent and the placeholder mark status is changed to the data reading completion status.

[0052] The prior art generally only confirms the integrity of data transmission by judging the status of placeholders. The method disclosed in the present invention can better ensure the integrity and security of target data during transmission by using public and private keys, verifying hash values ​​and combining the status of placeholders, and prevent the target data collected from being intercepted and tampered by a third party. This is another important innovation of the present invention, which is an unconventional choice different from the prior art.

[0053] The forensic device decrypts the target data in the mounted file and reads the status of the placeholder mark. When the status of the placeholder mark is pending reading data, the target data is extracted immediately, the acquired information is forwarded to other modules, and the status of the mounted file is continued to be detected in real time, so as to achieve the purpose of monitoring the forensic environment connection required for network data transmission, and ensure the integrity and timeliness of the extracted data.

[0054] When the common firewall of Windows server is turned on, the case handling hot source cannot open the corresponding port to provide direct access. However, the remote desktop can access and mount files. Through this technical solution, automatic evidence collection can be achieved by bypassing the firewall.

[0055] like Figure 2 As shown, according to one aspect of the present invention, a simulated forensics system for bypassing a cloud platform virtual firewall is proposed, comprising the following modules:

[0056] Network connection module 201: obtain cloud server information and establish network connection with the cloud server;

[0057] Mounting module 202: The forensic device is mounted on the cloud server by prefabricated memory mounting and disk file mounting, and a memory mounting module, a mounting file and a placeholder mark are created;

[0058] Simulation extraction module 203: The forensic device sends the simulation program to the cloud server, the simulation program copies and decompresses the target program running on the cloud server, and detects the status of the placeholder mark, and extracts the target data generated by the target program according to the status of the placeholder mark.

[0059] Reference below Figure 3 , which shows a schematic diagram of the structure of a computer system 700 suitable for implementing an electronic device of an embodiment of the present application. Figure 3 The electronic device shown is merely an example and should not bring any limitation to the functions and scope of use of the embodiments of the present application.

[0060] like Figure 3As shown, the computer system 300 includes a central processing unit (CPU) 301, which performs various appropriate actions and processes according to a program stored in a read-only memory (ROM) 302 or a program loaded from a storage part 309 into a random access memory (RAM) 304. In the RAM 304, various programs and data required for the operation of the system 300 are also stored. The CPU 301, the ROM 302, the ROM 303, and the RAM 304 are connected to each other through a bus 305. An input / output (I / O) interface 306 is also connected to the bus 305.

[0061] The following components are connected to the I / O interface 306: an input section 307 including a keyboard, a mouse, etc.; an output section 308 including a liquid crystal display (LCD), etc. and a speaker, etc.; a storage section 309 including a hard disk, etc.; and a communication section 310 including a network interface card such as a LAN card, a modem, etc. The communication section 310 performs communication processing via a network such as the Internet. A drive 311 is also connected to the I / O interface 306 as needed. A removable medium 312, such as a magnetic disk, an optical disk, a magneto-optical disk, a semiconductor memory, etc., is installed on the drive 311 as needed so that a computer program read therefrom is installed into the storage section 309 as needed.

[0062] In particular, according to an embodiment of the present disclosure, the process described above with reference to the flowchart is implemented as a computer software program. For example, an embodiment of the present disclosure includes a computer program product, which includes a computer program carried on a computer-readable storage medium, and the computer program includes a program code for executing the method shown in the flowchart. In such an embodiment, the computer program is downloaded and installed from the network through the communication part 310, and / or installed from the removable medium 312. When the computer program is executed by the central processing unit (CPU) 301, the above-mentioned functions defined in the method of the present application are executed.

[0063] It should be noted that the computer-readable storage medium of the present application is a computer-readable signal medium or a computer-readable storage medium or any combination of the above two. The computer-readable storage medium is, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, device or device, or any combination of the above. More specific examples of computer-readable storage media include, but are not limited to: an electrical connection with one or more wires, a portable computer disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the above. In the present application, a computer-readable storage medium is any tangible medium containing or storing a program that is used by or in combination with an instruction execution system, device or device. In the present application, a computer-readable signal medium includes a data signal propagated in a baseband or as part of a carrier wave, which carries a computer-readable program code. This propagated data signal takes a variety of forms, including but not limited to electromagnetic signals, optical signals, or any suitable combination of the above. A computer-readable signal medium is any computer-readable storage medium other than a computer-readable storage medium that sends, propagates or transmits a program for use by or in conjunction with an instruction execution system, apparatus or device. The program code contained on the computer-readable storage medium is transmitted using any appropriate medium, including but not limited to: wireless, wire, optical cable, RF, etc., or any suitable combination of the above.

[0064] Computer program code for performing the operations of the present application is written in one or more programming languages ​​or a combination thereof, including object-oriented programming languages ​​such as Java, Smalltalk, C++, and conventional procedural programming languages ​​such as "C" or similar programming languages. The program code is executed entirely on the user's computer, partially on the user's computer, as a separate software package, partially on the user's computer and partially on a remote computer, or entirely on a remote computer or server. In the case of a remote computer, the remote computer is connected to the user's computer through any type of network, including a local area network (LAN) or a wide area network (WAN), or is connected to an external computer (e.g., via the Internet using an Internet service provider).

[0065] The flow chart and block diagram in the accompanying drawings illustrate the possible architecture, function and operation of the system, method and computer program product according to various embodiments of the present application. In this regard, each box in the flow chart or block diagram represents a module, a program segment or a part of a code, and the module, the program segment or a part of the code contains one or more executable instructions for realizing the specified logical function. It should also be noted that in some implementations as replacements, the functions marked in the box also occur in a sequence different from that marked in the accompanying drawings. For example, two boxes represented in succession are actually executed substantially in parallel, and they are sometimes also executed in the opposite order, depending on the functions involved. It should also be noted that each box in the block diagram and / or flow chart, and the combination of the boxes in the block diagram and / or flow chart, are implemented by a dedicated hardware-based system that performs the specified function or operation, or are implemented by a combination of dedicated hardware and computer instructions.

[0066] The modules involved in the embodiments of the present application are implemented by software and hardware.

[0067] As another aspect, the present application also provides a computer-readable storage medium, which is included in the electronic device described in the above embodiment; it also exists independently and is not assembled into the electronic device. The above computer-readable storage medium carries one or more programs. When the above one or more programs are executed by the electronic device, the electronic device: S1, obtains cloud server information and establishes network connectivity with the cloud server; S2, the forensic device end is mounted on the cloud server by prefabricated memory mounting and disk file mounting, and creates a memory mounting module, mounting file and placeholder mark; S3, the forensic device end sends a simulation program to the cloud server, the simulation program copies and decompresses the target program running on the cloud server, and detects the status of the placeholder mark, and extracts the target data generated by the target program according to the status of the placeholder mark.

[0068] The above description is only a preferred embodiment of the present application and an explanation of the technical principles used. Those skilled in the art should understand that the scope of the invention involved in the present application is not limited to the technical solution formed by a specific combination of the above technical features, but should also cover other technical solutions formed by any combination of the above technical features or their equivalent features without departing from the above invention concept. For example, the above features are replaced with the technical features with similar functions disclosed in this application (but not limited to) by each other to form a technical solution.

Claims

1. A simulated evidence collection method for bypassing a cloud platform virtual firewall, characterized in that: The following steps are involved: S1, obtaining cloud server information and establishing network connection with the cloud server; S2, the forensic device is mounted on the cloud server by prefabricated memory mounting and disk file mounting, and a memory mounting module, mounting file and placeholder mark are created; S3, the forensic device sends the simulation program to the cloud server, the simulation program copies and decompresses the target program running on the cloud server, and detects the status of the placeholder mark, and extracts the target data generated by the target program according to the status of the placeholder mark.

2. According to claim 1, a simulated evidence collection method for bypassing a cloud platform virtual firewall is characterized in that: The obtaining of cloud server information and establishing network connectivity with the cloud server described in S1 specifically includes obtaining the server address, login account, and login port of the cloud server, and establishing network connectivity with the cloud server by inputting the login password of the cloud server or configuring the key of the cloud server.

3. According to claim 1, a simulated evidence collection method for bypassing a cloud platform virtual firewall is characterized in that: In S2, the placeholder marker records the actual occupied memory size, and based on the actual occupied memory size recorded by the placeholder marker, the state of the placeholder marker is divided into an unwritten data state, a pending data reading state, and a data reading completion state.

4. According to claim 3, a simulated evidence collection method for bypassing a cloud platform virtual firewall is characterized in that: The memory mounting module performs different index markings according to different business modules on the cloud server, including network real-time module index marking, system information module index marking, network module index marking, website module index marking, file download module index marking, image production module index marking, and secondary analysis module index marking.

5. According to claim 4, a simulated evidence collection method for bypassing a cloud platform virtual firewall is characterized in that: S3 specifically includes: S31, the simulation program automatically copies the program running on the cloud server to the target server through simulated copying, and decompresses it to a specified location; S32, after the cloud server starts the target program, the simulation program reads the target data from the specified location, returns the target data to the memory mounting module, updates the corresponding placeholder mark, writes the target data into the corresponding module according to the index mark, and then encrypts and synchronizes the target data into the mounting file; S33, the forensic device decrypts the target data in the mounted file and reads the status of the placeholder mark. When the status of the placeholder mark is pending reading data, the target data is extracted immediately.

6. According to claim 5, a simulated evidence collection method for bypassing a cloud platform virtual firewall is characterized in that: When the target data is written into the corresponding module according to the index mark in S32, the target data is encrypted by the public key of the forensic device, and the corresponding hash digest value is calculated to obtain the original hash digest value, and the encrypted target data and the original hash digest value are synchronized to the mounted file.

7. A simulated evidence collection method for bypassing a cloud platform virtual firewall according to claim 6, characterized in that: The forensic device in S33 decrypts the target data in the mounted file, specifically including decrypting the target data in the mounted file by using the private key of the forensic device, and recalculating the hash summary value of the target data and comparing it with the original hash summary value to confirm the integrity of the target data.

8. A simulated evidence collection system that bypasses a cloud platform virtual firewall, characterized in that: Includes the following modules: Network connection module: obtains cloud server information and establishes network connection with the cloud server; Mounting module: The forensic device is mounted on the cloud server by prefabricated memory mounting and disk file mounting, creating a memory mounting module, mounting file and placeholder mark; Simulation extraction module: The forensic device sends the simulation program to the cloud server, the simulation program copies and decompresses the target program running on the cloud server, and detects the status of the placeholder mark, and extracts the target data generated by the target program according to the status of the placeholder mark.

9. A computer program product having a computer program stored thereon, wherein the computer program, when executed by a processor, implements the method according to any one of claims 1 to 7.

10. A computing system comprising a processor and a memory, wherein the processor is configured to execute the method according to any one of claims 1 to 7.

Images