SYSTEM AND METHOD FOR ANALYZING FORENSIC DATA IN A CLOUD SYSTEM

• US 20180159886A1
• Filed: 04/14/2016
• Published: 06/07/2018
• Est. Priority Date: 06/02/2015
• Status: Active Application

• Current Assignee: Siemens AG
• Original Assignee: Siemens AG
• Inventors: Gbel, Jan Gerrit, Uhrmann, Johann
• Application Number:
  US15/574,590
• Publication Number:
  US 20180159886A1
• Time in Patent Office: Days
• CPC Class Codes: G06F 21/50 Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
• CPC Class Codes: G06F 2221/2101 Auditing as a secondary aspect
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/1433 Vulnerability analysis
• CPC Class Codes: H04L 63/30 for supporting lawful interception, monitoring or retaining of communications or communication related information circuit switched telephony call monitoring H04M3/2281
• CPC Class Codes: H04L 9/14 using a plurality of keys or algorithms
• CPC Class Codes: H04L 9/30 Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083

Abstract

Disclosed is a system for the analysis of forensic data, wherein the forensic data is present in a cloud system. The system has an analysis unit for analysing the forensic data, wherein the analysis unit is arranged in the cloud system, and has an operating unit for operating the analysis unit, wherein the operating unit is located outside the cloud system remote from the analysis unit. The provided system enables forensic data, which is associated with an IT security incident, to be analysed directly in the cloud system. Thus, extraction of the data from the cloud system or complex transmission of the data to an analysis device is not required. Also disclosed is a method for the analysis of forensic data.

Claims

1. A system for analyzing forensic data, wherein the forensic data are present in a cloud system, the system comprising:

an analysis unit for analyzing the forensic data, wherein the analysis unit is arranged in the cloud system; and

an operating unit for operating the analysis unit, wherein the operating unit is arranged outside the cloud system in a manner remote from the analysis unit.

2. The system as claimed in claim 1, wherein the operating unit is set up to operate the analysis unit by means of remote access.

3. The system as claimed in claim 1, wherein the analysis unit is a virtualized analysis unit.

4. The system as claimed in claim 1, wherein the analysis unit is based on a model.

5. The system as claimed in claim 1, wherein the analysis unit is set up to store storage units of the cloud system, which contain the forensic data to be analyzed, as a local copy.

6. The system as claimed in claim 1, wherein the analysis unit is set up to directly incorporate storage units of the cloud system, which contain the forensic data to be analyzed.

7. The system as claimed in claim 1, wherein the analysis unit is set up to locally store the forensic data to be analyzed in an encrypted storage area.

8. The system as claimed in claim 1, wherein the analysis unit and the operating unit are set up to communicate by means of asymmetric authentication.

9. The system as claimed in claim 1, wherein the analysis unit is set up to communicate with predefined units.

10. The system as claimed in claim 1, wherein the analysis unit has restricted visibility in the cloud system.

11. The system as claimed in claim 1, wherein the analysis unites is set up to monitor network traffic in the cloud system.

12. A method for analyzing forensic data, wherein the forensic data are present in a cloud system, comprising:

analyzing the forensic data in an analysis unit, wherein the analysis unit is arranged in the cloud system, and

operating the analysis unit by means of an operating unit, wherein the operating unit is arranged outside the cloud system in a manner remote from the analysis unit.

13. A computer program product, comprising a computer readable hardware storage device having computer readable program code stored therein, said program code executable by a processor of a computer system to implement a method for analyzing forensic data as claimed in claim 12 to be carried out on a program-controlled device.