OCF: An Open Cloud Forensics Model for Reliable Digital Forensics

Supasake Vongcipaporn 6322771294

Teeramaet Bongkodmalee 6322771062
Preravitch Siripanich 6322773761

Propose model
Electronically stored information (ESI) from users is automatically transferred to
a Kubernetes environment or other cloud-native technology hosted by a cloud service
provider. Initially, this ESI is processed by verification pods, which are responsible for
validating the information and generating a Verified ESI (VESI). Given the cloud's
capability to handle a high volume of users and, consequently, a large amount of ESI,
several pods will be deployed to distribute the processing load efficiently. Once the VESI
is generated, it is then forwarded to communication pods, which are tasked with
transferring it to a blockchain system.

Within the blockchain system, the VESI (Verified Electronically Stored

Information) is stored on a trusted third-party blockchain. This blockchain incorporates
smart contract functionality for Access Control. This feature enables Investigators to
access and gather VESI for investigative purposes and subsequently present it to Court
Authorities. Court Authorities also have the capability to verify the VESI evidence. A key
advantage of using blockchain in this context is its tamper-resistant nature. This
ensures that the VESI remains secure and unaltered, safeguarding it from any potential
interference or malicious activities by users, Cloud Service Providers (CSPs), or even the
investigators themselves.
 In this model, the specifics of how Verified Electronically Stored Information
(VESI) functions are not fully defined. A more detailed understanding of the VESI
mechanism would enhance the implementation of this system. For instance, the size of
the VESI. If VESI is simply a digital signature used to validate the ESI, storing it on the
blockchain is feasible. Digital signatures are typically small and would not significantly
burden the blockchain. However, if VESI comprises larger data sets, this could present
challenges for blockchain storage, given that blockchains are generally not optimized
for large-scale data storage due to issues like increased costs and slower transaction
speeds. In such a case, alternative strategies may need to be considered. These could
include using the blockchain to store only references or hashes of the VESI while the
data itself is stored off-chain, or modifying the blockchain architecture to better
accommodate larger data sizes. This adjustment would ensure that the system remains
efficient and scalable while still leveraging the security and immutability benefits of
blockchain technology.

Kubernetes can be configured to refine the ESI processing workflow for enhanced
efficiency. This involves setting up Kubernetes pods to perform various data
optimization tasks, such as transforming the data, eliminating duplicates, and
compressing the data, depending on the specific characteristics of the ESI. Additionally,
the role of the communication pod can be adapted. For instance, if the requirement is to
store only the hash value of the VESI on the blockchain, these pods can be configured to
generate and send these hashes. Finally, an additional layer of pods can be introduced,
tailored to meet the specific requirements of different scenarios, ensuring a flexible and
responsive system.
Advantages provided by the model
1. Optimization and Synchronization

Utilize advanced cloud technologies such as Kubernetes and serverless

frameworks to dynamically adjust resources in response to varying workloads,
enhancing the management efficiency of Electronically Stored Information (ESI).
Implement automated processes for continuous synchronization, converting ESI
into Verifiable Electronically Stored Information (VESI) for blockchain storage.

2. Trust and Verification

Using a blockchain managed by a trusted third party ensures that neither the
user, Cloud Service Provider (CSP), investigator, nor court authority can alter the
VESI, even if any of these parties have malicious intentions.

3. Access Control and Tamper-Proofing

Employ smart contracts within the blockchain for access control, enabling the
CSP, investigator, and court authority to access and validate the VESI. The
blockchain's inherent feature offers resistance to tampering, enhancing the
security and integrity of the data.