Forensic software investigation

• US 9,887,886 B2
• Filed: 07/15/2014
• Issued: 02/06/2018
• Est. Priority Date: 07/15/2014
• Status: Active Grant

• Current Assignee: SAP SE
• Original Assignee: SAP SE
• Inventors: Rahaman, Mohammad Ashiqur
• Primary Examiner(s): Hussain, Tauqir
• Assistant Examiner(s): GRIJALVA LOBOS, BORIS D
• Application Number:
  US14/331,865
• Publication Number:
  US 20160020959A1
• Time in Patent Office: 1,302 Days
• CPC Class Codes: G06F 16/951 Indexing; Web crawling techniques
• CPC Class Codes: H04L 41/5006 Creating or negotiating SLA contracts, guarantees or penalties
• CPC Class Codes: H04L 41/5032 Generating service level reports
• CPC Class Codes: H04L 63/308 retaining data, e.g. retaining successful, unsuccessful communication attempts, internet access, or e-mail, internet telephony, intercept related information or call content

Abstract

In accordance with aspects of the disclosure, systems and methods are provided for managing forensic investigations of client assets associated with a client based on a forensic service agreement between the client and a cloud service provider, including establishing the forensic service agreement between the client and the cloud service provider for servicing the forensic investigations of the client assets associated with the client, acquiring forensic data related to each client asset associated with the client, and generating one or more client inventory records for each client asset based on the forensic data related to each client asset, and generating one or more client evidence records for each client asset based on each client inventory record generated for each client asset.

Claims

1. A computer system including instructions recorded on a non-transitory computer-readable medium and executable by at least one processor, the system comprising:

a server configured to cause the at least one processor to manage forensic investigations of client assets associated with a client based on a forensic service agreement between the client and a cloud service provider in a cloud environment, the server including;

a forensic service interface configured to establish the forensic service agreement between the client and the cloud service provider for servicing the forensic investigations of the client assets associated with the client, the forensic service interface providing multiple modes for the forensic service agreement, the multiple modes including at least;

(i) a first mode where the server is configured to manage the forensic investigations in real time on an ongoing basis;

(ii) a second mode where the server is configured to manage the forensic investigations for an event during a time period specified by the client; and

(iii) a third mode where the server is configured to manage the forensic investigations on a just-in-time basis in response to an investigation request from the client;

a forensic data handler configured to acquire forensic data related to each client asset associated with the client, wherein the forensic data handler acquires the forensic data in real time on an ongoing basis when the forensic service agreement specifies the first mode, wherein the forensic data handler acquires the forensic data for the event during the time period when the forensic service agreement specifies the second mode, and wherein the forensic data handler acquires the forensic data on a just-in-time basis when the forensic service agreement specifies the third mode, and generate one or more client inventory records for each client asset based on the forensic data related to each client asset; and

a forensic engine configured to generate one or more client evidence records for each client asset based on each client inventory record generated for each client asset;

wherein the forensic service agreement includes a subscription for Forensics as a Service (FaaS), and under the FaaS subscription, the cloud service provider is configured to expose one or more forensic functionalities related to one or more of on-demand investigation, troubleshooting, auditing, and logging of forensic data related to the client assets associated with the client.

2. The system of claim 1, wherein the forensic investigations are related to data ownership for each client asset associated with the client, including one or more of data dependency information and contract termination information.

3. The system of claim 1, wherein the forensic investigations are related to data acquisition for each client asset associated with the client, including one or more of data collection information and data preservation information.

4. The system of claim 1, wherein the forensic investigations are related to one data analysis for each client asset associated with the client, including one or more of filtering information and presentation information.

5. The system of claim 1, wherein the forensic investigations are related to technical evidence generation for each client asset associated with the client, including one or more of contextual reporting information, data encryption information, and anonymous usage information.

6. The system of claim 1, wherein the client assets include one or more of files, networks, and tenants.

7. The system of claim 1, wherein the forensic data includes data related to one or more of client configuration, network configuration, memory configuration, tenant configuration, historical data, file metadata, and user access history data.

8. The system of claim 1, wherein the forensic service interface includes forensic service application programming interface (API) associated with the forensic service agreement.

9. The system of claim 1, wherein the forensic data handler is configured to:

retrieve relevant data from the cloud service provider including tenant information related to the client; and

cluster different forensic data related to the client assets into dedicated sub-components for the one or more client inventory records.

10. The system of claim 1, further comprising:

a forensic record handler configured to persist the one or more client inventory records and the one or more client evidence records in a data store.

11. The system of claim 1, wherein the one or more client evidence records include data related to identifying client upload history, client file history, client tenant history, and client responsibility history related to client inventory records.

12. The computer system of claim 1, further comprising an FaaS cloud station configured to enable multiple cloud service providers to interact in a heterogeneous cloud environment.

13. The computer system of claim 1, wherein when the forensic investigations include the data dependency information, the data ownership involves data dependency including identifying which data is owned by which entity in a heterogeneous jurisdiction and multi-tenant client environment, and wherein when the forensic investigations include the contract termination information, the data ownership involves contract termination including determining consequences if one entity in a chain of dependency terminates a contract.

14. A computer program product, the computer program product tangibly embodied on a non-transitory computer-readable storage medium and including instructions that, when executed by at least one processor, are configured to:

manage forensic investigations of client assets associated with a client based on a forensic service agreement between the client and a cloud service provider in a cloud environment, the instructions configured to;

establish the forensic service agreement between the client and the cloud service provider for servicing the forensic investigations of the client assets associated with the client, wherein multiple modes are provided for the forensic service agreement, the multiple modes including at least;

(i) a first mode where the forensic investigations are managed in real time on an ongoing basis;

(ii) a second mode where the forensic investigations are managed for an event during a time period specified by the client; and

(iii) a third mode where the forensic investigations are managed on a just-in-time basis in response to an investigation request from the client;

acquire forensic data related to each client asset associated with the client, wherein the forensic data is acquired in real time on an ongoing basis when the forensic service agreement specifies the first mode, wherein the forensic data is acquired for the event during the time period when the forensic service agreement specifies the second mode, and wherein the forensic data is acquired on a just-in-time basis when the forensic service agreement specifies the third mode, and generate one or more client inventory records for each client asset based on the forensic data related to each client asset;

generate one or more client evidence records for each client asset based on each client inventory record generated for each client asset; and

persist the one or more client inventory records and the one or more client evidence records in a data store;

wherein the forensic service agreement includes a subscription for Forensics as a Service (FaaS), and under the FaaS subscription, the cloud service provider is configured to expose one or more forensic functionalities related to one or more of on-demand investigation, troubleshooting, auditing, and logging of forensic data related to the client assets associated with the client.

15. The computer program product of claim 14, wherein:

the forensic investigations are related to data ownership, data acquisition, data analysis, and technical evidence generation for each client asset associated with the client, and

the client assets include one or more of files, networks, and tenants.

16. The computer program product of claim 14, wherein the forensic data includes data related to one or more of client configuration, network configuration, memory configuration, tenant configuration, historical data, file metadata, and user access history data.

17. The computer program product of claim 14, further including instructions configured to retrieve relevant data from the cloud service provider including tenant information related to the client.

18. The computer program product of claim 14, further including instructions configured to cluster different forensic data related to the client assets into dedicated sub-components for the one or more client inventory records.

19. The computer program product of claim 14, wherein the one or more client evidence records include data related to identifying client upload history, client file history, client tenant history, and client responsibility history related to client inventory records.

20. A computer-implemented method, comprising:

managing forensic investigations of client assets associated with a client based on a forensic service agreement between the client and a cloud service provider in a cloud environment, including;

establishing the forensic service agreement between the client and the cloud service provider for servicing the forensic investigations of the client assets associated with the client, including provision of multiple modes for the forensic service agreement, the multiple modes including at least;

(i) a first mode where the forensic investigations are managed in real time on an ongoing basis;

(ii) a second mode where the forensic investigations are managed for an event during a time period specified by the client; and

(iii) a third mode where the forensic investigations are managed on a just-in-time basis in response to an investigation request from the client;

receiving at least one request from the client for forensic investigation of the client assets associated with the client based on the forensic service agreement established between the client and the cloud service provider;

acquiring forensic data related to each client asset associated with the client, wherein the forensic data is acquired in real time on an ongoing basis when the forensic service agreement specifies the first mode, wherein the forensic data is acquired for the event during the time period when the forensic service agreement specifies the second mode, and wherein the forensic data is acquired on a just-in-time basis when the forensic service agreement specifies the third mode, and generating one or more client inventory records for each client asset based on the forensic data related to each client asset;

searching the generated client inventory records for suspicious activity related to each client asset associated with the client;

generating one or more client evidence records for each client asset including forensic data related to suspicious activity associated with each client asset based on each client inventory record generated for each client asset; and

persisting in a data store the one or more client inventory records and the one or more client evidence records including forensic data related to suspicious activity associated with each client asset;

wherein the forensic service agreement includes a subscription for Forensics as a Service (FaaS), and under the FaaS subscription, the cloud service provider is configured to expose one or more forensic functionalities related to one or more of on-demand investigation, troubleshooting, auditing, and logging of forensic data related to the client assets associated with the client.