Maintaining chain of custody in a cloud environment using database encryption techniques

Abstract

Cloud computing is ubiquitous, with processing and lower storage costs being a strong attraction for a very connected society. Considering the ever-increasing volume of data and widening data access to remote users, this technology has become attractive to digital forensic investigators as it allows the storing and analysing of evidence data from “anywhere”. However, the nature of the Cloud creates new challenges for forensic investigators. Since data resides on external and even distributed servers, it becomes challenging to ensure that the data acquired is uncompromised. This project investigates whether modern encryption algorithms can be seamlessly integrated in a workable system by securing the data in a DBMS and ensuring that the evidence is not seen and altered during transfer, and when it is stored in the Cloud. The performance of the encryption algorithms was also evaluated to test whether basic update operations are significantly affected. Two databases were created with the same design; however, one contains the original logs, while the other contains the same logs in encrypted form. The test data is analysed using typical select and insert queries. The performance readings are compared to investigate whether the encryption algorithms burden the day-to-day activities and ensure that performance is not significantly affected. Apart from encryption, other security features that were used in the custody system are auditing, role segregation, and hashing. Furthermore, the data is made to only accessible to those users that are in possession of the right keys, therefore, even the DBA and the DB owner would not be able to see the data if they do not have access to the encryption keys. In this project, three encryption algorithms (DES, Triple DES, and AES 256) were tested and compared in terms of performance by encrypting cloud-related data to investigate the performance impact. The results were presented, concluding that the Triple DES is the fastest algorithm for data retrieval, and the DES algorithm is the fastest among its counterparts in terms of data insertion.