Abstract
Multi-tenant cloud architectures pose severe challenges for digital forensics and incident response (DFIR) due to rigid data confidentiality boundaries and strict regulatory compliance mandates such as GDPR and HIPAA. Traditional cloud incident response relies heavily on full log inspection or snapshot analysis, exposing sensitive tenant data to cloud service providers (CSPs) or third-party forensic investigators. In this paper, we present zk-DFIR, a novel privacy-preserving incident response framework leveraging Zero-Knowledge Succinct Non-Interactive Arguments of Knowledge (zk-SNARKs). Our framework enables cloud tenants to generate cryptographic proofs confirming that specific security incidents—such as unauthorized access, credential abuse, or malware execution—occurred within their virtual boundaries, without disclosing raw log records, internal topology, or sensitive user payload data. We construct tailored arithmetic circuits optimized for continuous log evaluation and rule-based anomaly assertions using the Groth16 proving system over the BN254 elliptic curve. Evaluated on a simulated multi-tenant Amazon Web Services (AWS) deployment processing over 1,000,000 VPC flow and audit records, zk-DFIR achieves proof generation times under 4.2 seconds for batches of 10,000 logs, while maintaining a constant verifier latency below 12 milliseconds at the CSP supervisor layer. Proof sizes remain under 1.5 KB regardless of witness complexity. Our results demonstrate that zero-knowledge proofs offer a scalable, cryptographically secure mechanism to bridge the gap between rigorous forensic accountability and tenant data confidentiality in modern cloud infrastructure.
