Blockchain-based tamper-proof and transparent investigation model for cloud VMs

In cloud forensics, ensuring the integrity of the evidence such that it is admissible in a court of law is essential. There is always a possibility that multiple stakeholders involved in the investigation of cloud incidents can collude to tamper with the evidence for their benefit. To ensure the integrity of evidence in the cloud, most researchers in this domain have proposed applying blockchain to cloud forensic artifacts. These artifacts include cloud logs, the chain of custody, and the metadata of files on the cloud. Most of the proposed solutions are computing the hash value of the forensic artifacts and pushing the hash value to the blockchain. Later, these hash values verify the integrity of the forensic artifact. In this paper, along with ensuring the integrity of evidence by using hash values, we propose an investigation model that provides tamper-proof and transparent investigation across the stakeholders involved in the investigation of the cloud virtual machines. Also, using blockchain technology in the proposed investigation model ensures the availability of evidence for analysis throughout the investigation to all participating stakeholders. We validated the proposed model using a case study for the proof of concept and evaluated its performance using Hyperledger Caliper.