The Research of Keeping Digital Evidence in Untrusted Local Area Network

• Main Authors: Wen-Chao Yang, 楊文超
• Other Authors: Shi-Jen Lin
• Format: Others
• Language: zh-TW
• Published: 2002
• Online Access: http://ndltd.ncl.edu.tw/handle/09925492911201343173

碩士 === 國立中央大學 === 資訊管理研究所 === 90 === By the rate of the information secirty events and computer crimes happened increasing, the business and computer users must face up to the problem. Because the high volatility of digital evidence, the illegal user do not usually cover up the happened event but also hide the actions what they do. The research focuses on how to storage the digital evidence and keep the admissibility and weight of the digital evidence at the same time. The word “untrusted LAN” is oppsited to the Bruce Schneier’s “Trusted Machine”, means no trusted machines in the LAN, therefore any evidence that will be storaged must be protected or it will be broken. After studying the Secure Log, Cryptography, and Fault Tolerance domains, we provide a solution, “ The framework of Keeping Digital Evidence”. The flexible framework can transfer important data about the illegal event to the digital enidence that cannot be modify and has n/m fault tolerance rate. Then we design a checking function, it can decrease the mean of check times from [n/2] to [(2+n)/8]+2.Finally we use the Network Simulator 2 program to simulate our framework in LAN, to valid the framework can implement in LAN without crashing the network traffic.