Digital forensic in IoT paradigm: Blockchain assisted digital forensic framework with improved cryptosystem

Abstract

Recent investigative frame works, digital forensic tools, and techniques are incapable of acquiring the IoT paradigm's dispersion and heterogeneity characteristics that make law enforcement organizations and digital forensic investigators do their tasks. To address these issues, this study presents a Blockchain-assisted digital forensic system for the IoT context. The devices in the perception layer contain several forensic evidences, which are transmitted to the further layer called the Fog layer. Moreover, the secure transmission of messages from the perception layer to the fog layer is a major challenge. To address this issue, the user's identity (investigators and devices) can be mapped to a pseudo-identity and the security of signature and confidentiality mechanisms ensures both privacy and security. Subsequently, the Fog layer verifies the signature data and employs an improved Blowfish encryption algorithm to provide security to the evidence transmission. In order to encrypt the evidence, the optimal key is generated using the SSAJO algorithm. Then the encrypted message is subjected to a distributed ledger called consortium blockchain that improves the security factors with a greater level of control. Moreover, the proposed IoT framework controls the cloud locally to store, and access data, and performs occasional synchronization with a consortium blockchain.

Keywords

digital forensic consortium blockchain blowfish algorithm SSAJO and cryptosystem

1 Introduction

The evolution of advancements in communication, sensing devices, and inexpensive computing devices has brought mankind into the era of IoT, enabling the collection and transmission of various contextual data to faraway locations.^1–3 By producing incredible devices, tools, and assets, and placing the most important information at reach, advancements in technology make our daily tasks simpler, quicker, and more enjoyable. Nevertheless, advancements in technology have made it simpler to enable criminals to perform their operations in the context of the IoT, since many devices are connected to the Internet.⁴ Criminals can simply exploit the security flaws in the IoT structure to gain remote access. In summary, public safety agencies desperately want IoT forensics experts to assist in identifying the case's critical facts.^5,6

Digital forensics constitutes an authorized technique for storing, analyzing, gathering, and publishing information on digital evidence. This information is crucial for police investigations since it depicts the reality of cybercrime and links defendants to illegal activities. As a result, it became critical to handle the obtained evidence carefully to ensure its reliability in law enforcement investigations and court cases, as well as to prevent manipulation or misconduct.⁷ Moreover, current digital forensic tools, research methods and frameworks are unable to meet the heterogeneity along with dispersion features of the IoT environment. The features deliver substantial challenges for digital forensic investigators as well as criminal justice authorities.^8–10

Blockchain technology is a system of shared ledgers that could hold connected records in the manner of a decentralized database on a network comprised of peers.^11,12 Also, the data is stored in a time-blocked record connected in a chain, resulting in an immutable, globally viewable, and independently verified audit trail using consensus-based confirmation of trustworthiness.^4,13,14 Further more, peers in the blockchain network were given the ability to reject any incorrect operations that crossed the network. The safety of Internet of Things provisioning was ensured via blockchain.^15,16 The benefits of integrating blockchain alongside digital forensics include immutability, decentralization, as well as confidentiality. Most of the present blockchain-based digital evidence retention schemes keep only the metadata of the evidence in the blockchain, whilst the proof is held on a centrally located server otherwise in the cloud.¹ To address this issue, a novel digital forensic in the IoT paradigm is proposed. Further more, the major contribution of this work is given as follows:

Proposing a Blowfish algorithm for encrypting the evidence, in which the function F is modified to enhance confidentiality.

Proposing a hybrid optimization scheme SSAJO for an optimal key generation that combines both SSOA and JSO algorithms.

The comparative analysis is made to validate the effectiveness of the suggested work over the standard techniques.

The rest of the paper is structured as follows: The Study of existing methodology is discussed in Section 2. The proposed framework of the IoT paradigm is elaborated in Section 3. The validation is conducted in Section 4 and the conclusion is summarized in Section 5.

2 Literature review

In 2021, Gulshan Kumar et al.¹⁷ has delivered an IoT forensics paradigm and suggested the IoF approach takes into account a blockchain-tailored IoT architecture supporting digital forensics. Moreover, it gave a clear visual of the detective's procedure, which included every stakeholder in an integrated structure. In addition, consensus was employed for consortia to address cross-border legitimacy challenges and this additionally proved advantageous for clarity and simplicity of forensic comparison. Reduced complexity was achieved through programmable lattice-based cryptographic primitives, which also offered advantages for power-constrained devices, contributing to the uniqueness of the proposed concept.

In 2021, Meng Li et al.⁷ has suggested LE Chain, a blockchain-based legitimate evidence governance system that would monitor the full evidence stream along with all court records, from gathered evidence and availability throughout police investigation using jury voting in court proceedings. In order to safeguard witnesses’ anonymity, they use brief randomizable signatures to surreptitiously authorize their identities. Ultimately, they standardized their analysis of LE Chain's safety and confidentiality, as well as its computing expenses and overhead associated with communication, by building a working model based on a small Ethereum experimental network.

In 2019, Shancang Li et al.⁴ has introduced an IoTFC, a block-enabled IoT forensics system that can provide investigative services with strong immutability, authenticity, robustness, traceability, and a network of trust among evidentiary rights with investigators. Moreover, the IoTFC can provide traceability guarantees as well as trace the origin of evidence elements. Additionally, information about evidence proof of identity, analysis, preservation, and dissemination was going to be documented in blockchains.

In 2019, Mehran Pourvahab et al.¹⁵ has developed a successful forensics framework in SDN-IoT that generated the CoC in the context of blockchain technology. Moreover, the suggested SDN-based IoT structure began with circulation chart regulations on switches for all three separate traffics namely, FTP, VoIP, as well as HTTP. All of the controllers were supplied with a classifier, which distinguished the harmful packets according to packet attributes using the Neuro Multi fuzzy. In addition, the suggested SDN-IoT design, and event logs have been implemented and stored on the blockchain.

In 2022, Randa Kama et al.¹ has introduced the FCEP System, a revolutionary framework for IoT-based smart city protection. Also, the suggested system seeks to combine blockchain alongside digital forensics to address forensic investigators’ challenges including modifications in single source evidence, as well as to improve the integrity of maintaining digital evidence by utilizing the blockchain. Moreover, maintaining digital evidence among forensic member nodes minimized the chance of failure in a centralized storage server at a single location.

In 2020, NickolaosKoroniotis et al.¹⁸ has created a PDF scheme that outlines the digital investigative steps for discovering and tracing attack activities in IoT networks. Moreover, the suggested structure encompassed three novel functions including (1) obtaining data from network flows as well as checking their confidentiality in encrypted networks; (2) employing the PSO method to continuously modify DL variables; and (3) establishing a DNN that employs the PSO algorithm to identify and track the inappropriate incidents occurring in smart home IoT networks.

In 2021, Faisal A. Garba et al.¹⁹ has presented a unique low-cost IoT forensic architecture to address the inspection and evaluation component of IoT forensics in which genetic-fuzzy specialist network was employed, and the investigation and analysis phase of IoT forensics employing a genetic-fuzzy. Furthermore, the challenge of protecting the confidentiality as well as chain of ownership of IoT forensics data utilizing hyper ledger fabric, a free and open source private-permission blockchain. Moreover, the proposed genetic-fuzzy IoT forensics system was assessed by being compared to corresponding projects like NFAT to assess its efficacy and precision.

In 2019, Jung Hyun Ryu et al.²⁰ has presented a blockchain-based digital forensics system for the context of the Internet of Things. In the suggested structure, all IoT device communication has been documented in the blockchain as transactions, making the current chain of custody system more reliable and easier. Blockchain technology ensured the integrity of the data to be analyzed, improved security, and made integrity maintenance more predictable through the implementation of a decentralized integrity preservation system.

In 2019, Mehran Pourvahab and Gholamhossein Ekbattanifard²¹ has presented the SRVA model to preserve the system from unauthenticated users. With the utilization of HSO, the secret keys were produced randomly in order to improve the cloud platform. Moreover, the SA-DECC-based approach was presented to encrypt the data for secure transmission. Also, various analyses were performed that ensured the implemented LGoE-based collection against the blockchain.

2.1 Problem statement

Table 1 displays the features and limitations of existing systems with regard to digital forensics in the IoT paradigm. The increasing complexity and sophistication of cybercrimes necessitate a robust approach to digital forensics, particularly in the context of network, memory, system, and cloud forensics. Moreover, the current methods lack transparency and completeness, hindering effective investigation and cross-border collaboration. However, the existing blockchain solutions show potential but are not fully developed, particularly in terms of post-quantum resistant cryptography, throughput, delay, and energy efficiency. Additionally, the lack of research into consortium-based frameworks limits the understanding of their applicability in digital forensics. Consequently, there is a pressing need for an integrated solution that addresses these gaps, enabling a comprehensive, transparent, and efficient investigative process. Hence, an improved cryptosystem method is proposed for digital forensics in the IoT paradigm which enhances digital forensic capabilities and tackling cross-border issues in cybercrime investigations.

Table 1.
Features and limitations of current systems.

Author [Citation] Methodology Features Drawbacks

Gulshan Kumar et al.¹⁷ • IOF Framework • It attained maximal residual energy • Need to examine certain blockchain view frameworks under smart contracts.

Meng Li et al.⁷ • LEChain • It achieved less computational cost. • Need to analyze real-world deployment.

Shancang Li et al.⁴ • IoTFC • It achieved maximum trustworthiness of both examiners and evidence by offering audit trains’ precision. • Require to enhance the preservation against appropriate intrusion.

Mehran Pourvahab et al.¹⁵ • SDN-IoT • It accomplished a minimal response time with maximal throughput. • Require to improve evidence acquisition in the implementation of forensics.

Randa Kama et al.¹ • Digital forensics-based blockchain framework • It accomplished greater confidentiality. • Need to incorporate the system with the cloud platform to enhance the performance.

NickolaosKoroniotis et al.¹⁸ • Particle Deep Framework • Maximum Recall and Precision were acquired • It is necessary to compute numerous generative DNNs’ hyperparameters.

Faisal A. Garba et al.¹⁹ • IoT forensic structure • It attained greater security with a minimal cost • It doesn’t enhance the effectiveness of the proposed system.

Jung Hyun Ryu et al.²⁰ • Digital forensics scheme • It attained maximal throughput. • Need to apply this system to real digital forensic investigations.

Author [Citation]	Methodology	Features	Drawbacks
Gulshan Kumar et al.¹⁷	• IOF Framework	• It attained maximal residual energy	• Need to examine certain blockchain view frameworks under smart contracts.
Meng Li et al.⁷	• LEChain	• It achieved less computational cost.	• Need to analyze real-world deployment.
Shancang Li et al.⁴	• IoTFC	• It achieved maximum trustworthiness of both examiners and evidence by offering audit trains’ precision.	• Require to enhance the preservation against appropriate intrusion.
Mehran Pourvahab et al.¹⁵	• SDN-IoT	• It accomplished a minimal response time with maximal throughput.	• Require to improve evidence acquisition in the implementation of forensics.
Randa Kama et al.¹	• Digital forensics-based blockchain framework	• It accomplished greater confidentiality.	• Need to incorporate the system with the cloud platform to enhance the performance.
NickolaosKoroniotis et al.¹⁸	• Particle Deep Framework	• Maximum Recall and Precision were acquired	• It is necessary to compute numerous generative DNNs’ hyperparameters.
Faisal A. Garba et al.¹⁹	• IoT forensic structure	• It attained greater security with a minimal cost	• It doesn’t enhance the effectiveness of the proposed system.
Jung Hyun Ryu et al.²⁰	• Digital forensics scheme	• It attained maximal throughput.	• Need to apply this system to real digital forensic investigations.

3 Digital forensic in Iot paradigm with improved cryptosystem: An overview

3.1 Proposed work of digital forensics in Iot paradigm

To verify the criminal occurrences in an IoT-based context, the Forensic Investigation Framework (FIF-IoT) makes access to a public digital ledger that records IoT entity interactions as evidence and securely stores them as distributed, actions in a public, and autonomous blockchain network. As a result, central administrative oversight is eliminated, and single-point collapse will be prevented. Moreover, it additionally incorporates a means for checking the authenticity of the evidence obtained directly from the ledger. In order to enhance the security of investigations, this paper proposes a new Blockchain-based Digital Forensics framework with the following four major layers: Perception Layer, Fog layer, Consortium Block Chain and Cloud Layer. The framework of the proposed digital forensics in the IoT paradigm is illustrated in Figure 1. In this suggested framework, the devices present at the perception layer contain forensic evidence, which is transmitted into the further layer called the Fog layer. Secure transmission is the major challenging issue while transmitting the message from the perception layer to the fog layer. To address this issue, the identity of users (investigators and devices) is mapped to a pseudo-identity and the security of signature and confidentiality. Thus, this process ensures confidentiality and security. The Fog layer then uses the Blowfish encryption method to ensure the confidentiality of the message (evidence) transmission after confirming the signature data. To encrypt the message, the optimal key is generated using the SSAJO algorithm. Then the encrypted message is subjected to a distributed ledger called consortium blockchain, assuming that legalization offices are a part of the consortium to improve the security factors with a greater level of control. Further more, the cloud is employed to store and access the data, leading make a shared framework with the aid of blockchain. Moreover, the proposed IoT framework controls the cloud locally and, it occasionally performs synchronization with a consortium blockchain.

Figure 1.

Framework of proposed digital forensic in IoT paradigm.

3.2 Perception layer

The perception layer¹⁷ is made up of a variety of low-powered devices. Further more, hand evidence entering is considered here and it is often necessary to safeguard the confidentiality of the investigators and the device until the proof is presented in the court. In order to resolve this challenge, users’ identities are being assigned to a pseudo-identity, as well as signature and confidentiality processing. For that, Programmable Hash Functions (PHFs) are additionally employed to process the signing procedure to verify that only certain authorized devices are included in the proposed IoT. This secures the paradigm along with privacy, confidentiality, and reliability of blockchain digital data. As a result, this procedure assures secrecy along with confidentiality. Subsequently, it emphasizes that this framework is consistent for the detection of intrusions; otherwise, superfluous data would have to be collected. Further more, the pseudo-identity, as well as signature and confidentiality processing procedures, are discussed as follows:

3.2.1 Pseudo identity generation

To generate a pseudo-identity, each device offers input as relevant hardware identity such as its MAC address to the hash function and then generates the corresponding output. In the private cloud, the mapping is stacked; on the other hand, pseudo-identities are broadcasted over the public cloud. Likewise, the identity of investigators is mapped, which ensures confidentiality. Moreover, this work selects the trapdoor key when the attackers try to utilize the trapdoors in an IoT environment. Assume that the lattice-based PHF is assigned $z \in Z$ as input to $Y_{B} (z)$ matrix, where $Y_{B} (z) = Q U_{z} + \in C V_{z} \in Z_{q}^{f \times g}$ , here, $f, q, and g$ specifies positive integers, $\in Z$ specifies integers set, $Y_{B}$ specifies hash function with key B; C and Q specifies matrices representing the user-defined generators, which belong to $Z^{f \times g_{q}^{'}}$ and $Z^{f \times g_{q}}$ , respectively. Moreover, $U_{z}$ and $V_{z}$ specifies matrices that are feasible using a trapdoor rate. Also, it is essential to consider the following steps to begin the pseudo-identity procedure. Initially, the input MAC address is transformed to the polynomials of degree considered as h and these polynomials are again transformed to a polynomial ring W. Finally, the polynomial ring W is subjected as input to $Y_{B} (z)$ and the computed hash formulation can be defined according to equation (1). Here, $Q_{x}$ specifies the evaluated value function with a key parameter and $C f_{z}$ specifies a cover-free set.

Y_{B} (z) = Q + \sum_{x \in C f_{z}} Q_{x}

(1)

Steps for generating pseudo identity: The steps to follow pseudo-identity generation for evidence are as follows:

Step 1: Initialize Q, U and V.

Step 2: Transform MAC address to the polynomial community $W = P_{I} \otimes d_{t} \in {Z_{q}}^{f \times g_{B}}$ , where, $B = \log_{2} q$ and $Z^{f \times g_{q}} d = {1, 2, \dots, 2^{B - 1}}^{t}$ .

Step 3: Generate a trapdoor matrix $C = W$ .

Step 4: Compute the hash function $B = [Q, Q_{i}]_{i = 0, 1, \dots, λ - 1}$ , Here, $λ = \log_{2} N$ .

Step 5: $z \in x, z \to C f_{z}$ .

Step 6: $z \in C f_{z} \subseteq N$ , Evaluate binary decomposition of $x = a_{0}, \dots, a_{λ - 1}$ and $Q_{z} = f (B, x, 0)$ from B.

Step 7: Evaluate $f (B, x, i) = {\begin{cases} Q_{λ - 1} - a_{λ - 1} W, if i = λ - 1 \\ (Q_{i} - a_{i} W) . W^{- 1} (f (B, x, i) + 1), Otherwise \end{cases}$

Step 8: Compute $Y_{B} (z) = Q + \sum_{x \in C f_{z}} Q_{x}$

Step 9: Obtain $Y_{B} (z)$ .

Step 10: Return $P_{I}$ .

3.2.2 Procedure of signature and confidentiality

The devices available at the perception layer are finite resources and the main goal is to ensure confidentiality with minimal complexities in computation. Further more, the process deploys the lattice-based PHF pseudo-identity and this can be verified with the verification parameter B. Then the PHF-based signature approach deploys with a verification key as $V k = (Q, r, B_{r})$ . Here, $Q \in Z_{q}^{f \times \bar{g}}$ specifies the trapdoor matrix, $B_{r}$ specifies an arbitrary key and r specifies an arbitrary factor. Moreover, the signing key includes the trapdoor $T_{P}$ for each Q, in that $Q e = φ$ , where e specifies observation short vector and $φ \in Z_{q}^{f}$ . The device employs a signing procedure for evidence transmission R to evaluate the trapdoor by employing hash concatenation according to equation (2).

Q_{Y} = [Q | | Y_{B} (R)]

(2)

Steps for processing short signature and confidentiality: The steps to follow the signing and confidentiality processes are as follows:

Step 1: Evaluate the trapdoor by employing hashed concatenation as $Q_{Y} = [Q | | Y_{B} (R)]$ , where, Q specifies matrix.

Step 2: Produce a short vector e that satisfies the signing rules: $Q_{Y} e = φ$

Step 3: Evaluate $e = {Q_{Y}}^{- 1} . φ$

Step 4: Set signature $S g n = e$

Step 5: Verify $S g n$ and validate; if e short with a threshold value of j and $Q_{Y} e = φ$ .

After performing the signing procedure, an encryption process takes place to enable confidentiality during the transmission of evidence. Here, the fog layer acts as a verifier, which verifies and validates the signature. Further more, Figure 2 reveals the interaction between a device at the perception layer and the verifier at the fog layer.

Figure 2.

Interaction between the verifier at the fog layer and a device at the perception layer.

3.3 Fog layer

This layer includes resource-intensive equipment such as routers, gateways, and switches, as well as local or personal servers to support applications related to forensics. Additionally, the fog layer verifies the signature data given in the preceding part along with retaining and revising it regularly. In addition to the signature encryption responsibility, this layer provided certain digital forensic capabilities as well as a CoC blockchain. Further, when the device is given to users or even a location, digital forensic programs capture the data on it and generate a blockchain transaction with it.

Figure 3 exhibits the fog layer topology. The perception layer's devices interact with the fog layer's devices. When such devices acquire messages via any other layer device, they validate the signature and decrypt the contents of the message. Consider that the verifier can be trustworthy and enforceable. Following the device's validation, applications of digital forensics including memory forensics tools and networks are launched on them to collect the current functioning characteristics. All information is preserved in the blockchain for potential utilization through the CoC investigator(s). Eventually, the blockchain for CoC has been connected to the consortium blockchain for global accountability.

Figure 3.

Diagrammatic representation of Fog layer topology in IoT paradigm.

3.3.1 Improved blowfish algorithm

Once the fog layer verifies the signing, the evidence is encrypted by using a secret key block cipher method named Blowfish algorithm²² for the secure transmission of evidence. Moreover, the Blowfish constitutes the proportioned key block cipher, which employs a 64-bit block size along with the varied length of the key. That is, at a time this cipher algorithm encrypts 64-bit block data. Here, the function F is improved for secure evidence transmission. The procedure of encryption process is discussed as follows:

Data encryption: In this process, 16 rounds are there. The data-dependent substitution, key-dependent permutation and key-dependent substitution are contained in each round. In this algorithm, the XOR operation on 32-bit words is applied. Encrypting the evidence requires a key that is optimally generated by the proposed SSAJO strategy.

Function F: The Blowfish represents a Feistel network that can be comprised of 16 rounds. Initialize four S-boxes with P-array like P1… P18. In the function F, the 64-bit data block D is considered as input, which is partitioned into two 32-bits namely, $D_{L}$ and $D_{R}$ . The steps to follow function F is described in the following.

\begin{matrix} F o r i = 1 t o 16 \end{matrix}

\begin{matrix} D_{L} = D_{L} X O R P i; D_{R} = F (D_{L}) X O R D_{R} \end{matrix}

\begin{matrix} S w a p D_{R} a n d D_{L} \end{matrix}

\begin{matrix} S w a p D_{R} a n d D_{L} (Untill the final swap) \end{matrix}

\begin{matrix} D_{R} = D_{R} X O R P 17; D_{L} = D_{L} X O R P 18 \end{matrix}

\begin{matrix} R e c o m b i n e D_{R} a n d D_{L} \end{matrix}

Traditionally, the function F can be designed according to equation (3)

F = [(S 2 [b] mod 232 + S 1 [a]) X O R S 3 [c] + S [d] mod 232]

(3)

This can be improved for protecting the evidence data more effectively, in which the 32-bit input factor is assigned to the four S-boxes. The diagrammatic illustration of function F in the suggested Blowfish algorithm is depicted in Figure 4. Here, the 8-bit input is subjected to each S-Box, wherein the S-boxes transform the 8-bit into 32-bits. Initially, the S1-box gets right shifts and XOR with the S2-Box, which is added to the S2 with left shift and XOR with S3-box. Then modulus 32 to the summation and then add S4-Box with the left shift that is XOR-ed with S3-Box. Further, add S1-Box left shift. Finally, the entire function F is multiplied with mod 32. Then the improved function F formulation can be defined as in equation (4).

F_{I m p} = [(S 1 [a] >> \otimes S 2 [a] + (S 2 [a] << \otimes S 3 [a])) mod 32 + (S 3 [a] \otimes S 4 [a] <<) + S 1 [a] <<] mod 32

(4)

Figure 4.

Framework of function F in the proposed Blowfish algorithm.

3.3.2 Solution encoding

To encrypt the evidence, this work suggested a hybrid optimization approach named SSAJO, which takes keys $K_{i}$ as input such that $K_{i} : i \to 1, 2, \dots, J$ , for generating optimal keys.

3.3.3 Objective function

The proposed hybrid optimization SSAJO fixed the objective function as the minimization function according to equation (5). Here, $C o r$ specifies the correlation between encryption and decryption.

O b j F n = M i n (C o r)

(5)

3.3.4 Proposed hybrid optimization: SSAJO scheme for generating optimal key

A metaheuristic approach is a type of algorithm, in which JSO is inspired by jellyfish activity in water and replicates their search behavior. Moreover, the jellyfish uses its tentacles to injure its target as well as paralyze them. Additionally, it includes assessments related to jellyfish in currents of the ocean, a temporal management system for switching among these movements, and the movement within a jellyfish swarm, along their intersections into jellyfish blooms that occur during both the exploration and the extraction phases. Nevertheless, maintaining an equilibrium among the stages is a significant challenge. To address the aforementioned problem, a unique hybrid SSAJO technique is used that combines the SSOA²³ and JSO²⁴ algorithms. The SSOA technique is implemented by replicating the natural herding routines of shepherds. Further more, the mathematical simulation of the proposed strategy of SSAJO is elaborated in the following.

3.3.4.1 Mathematical modeling

Improved ocean current: The ocean circulation contains an enormous quantity of nutrients, which attracts the jellyfish. Additionally, the direction of each jellyfish's current ideal position in the ocean must be averaged using equation (6).

\begin{aligned} \vec{O d r} & = \frac{1}{K_{J}} \sum \vec{O d r_{i}} \\ = \frac{1}{K_{J}} \sum (p^{*} - c_{e} p_{i}) \\ = p^{*} - c_{e} \frac{\sum p_{i}}{K_{J}} = p^{*} - c_{e} ϕ \end{aligned}

(6)

Where,

K_{J}

specifies the total number of keys (jellyfish),

ϕ

specifies the average jellyfish's location,

c_{e}

specifies the factor that governs the attraction,

p^{*}

specifies the present optimal location of jellyfish, and

\vec{O d r}

specifies the direction of ocean current. Further, the jellyfish's direction of the present optimal location is defined according to equation (7).

\vec{O d r} = p^{*} - d i f

(7)

Where,

d i f = c_{e} ϕ

specifies the difference among the average jellyfish's position as well as the present best location of jellyfish. Further more, the difference between the average jellyfish position and the current best location of jellyfish is specified by equation (8), and a typical spatial distribution is applied. After performing

σ = r a n d^{β} (0, 1) \times ϕ

, the difference among the average jellyfish's position as well as the present best location of jellyfish is defined according to equation (9).

\begin{aligned} d i f & = λ \times σ \times r a n d^{j} (0, 1) \end{aligned}

(8)

\begin{aligned} d i f & = λ \times r a n d^{j} (0, 1) \times r a n d^{β} (0, 1) \times ϕ \\ = λ \times r a n d (0, 1) \times ϕ \end{aligned}

(9)

Where,

c_{e} = λ \times r a n d (0, 1)

, and the jellyfish's present optimal location direction to all jellyfish in the ocean is defined according to equation (10). Also, the extant position of jellyfish is defined according to equation (11).

\begin{aligned} \vec{O d r} & = p^{*} - λ \times r a n d (0, 1) \times ϕ \end{aligned}

(10)

\begin{aligned} p_{i} (t + 1) & = p_{i} (t) + r a n d (0, 1) \times \vec{O d r} \\ = p_{i} (t) + r a n d (0, 1) \times (p^{*} - λ \times r a n d (0, 1) \times ϕ) \end{aligned}

(11)

This traditional position of jellyfish is improved to enhance the computational speed by employing the SSOA strategy. The location of the shepherd is defined as per equation (12).

P_{i, j}^{N e w S h p} = P_{i, j}^{N e w S h p} + S t e p s i z e_{i, j}^{N e w S h p}

(12)

By adding equation (11) and equation (12), we get a new position according to equation (13).

P_{i} (t + 1) = \frac{2 P_{i} (t) + S t e p s i z e_{i, j}^{N e w S h p} * (p^{*} - α \times r a n d (0, 1) \times ϕ)}{2}

(13)

Where,

r a n d

is an arbitrary value, it can be improved to utilize an external secret key through performing a whole logical operation by using a modified logistic map²⁵ according to equation (14).

r a n d_{n + 1} = [\frac{s . r a n d_{n} . (1 - r a n d_{n})}{s . e^{r a n d_{n}} . (1 - e^{r a n d_{n}})} * e^{r a n d_{n}}]

(14)

Jellyfish swarm: During this phase, the swarm performs two sorts of motions namely type A as active and type B as inactive. Further, the type A motion of jellyfish in the present moment along with their appropriate transformed position for every jellyfish is described according to equation (15).

p_{i} (t + 1) = p_{i} (t) + α \times r a n d (0, 1) \times (u b - l b)

(15)

Where,

u b

specifies the upper bound,

α

specifies jellyfish's movement coefficient, and

l b

specifies the lower limit of the search region. On the other hand, the type B movement specifies the direction of motion which takes a spot arbitrarily to look for food in a swarm according to equation (16). Here,

\vec{O w} = r a n d (0, 1) * \vec{d i r}

. Furthermore, the direction as well as objective function of the jellyfish's position is defined according to equation (17) and equation (18).

\begin{matrix} \vec{O w} = p_{i} (t + 1) - p_{i} (t) \end{matrix}

(16)

\begin{matrix} \vec{d i r} = {\begin{cases} p_{j} (t) - p_{i} (t); & i f f (p_{i}) \geq f (p_{j}) \\ p_{i} (t) - p_{j} (t); & i f f (p_{i}) < f (p_{j}) \end{cases} \end{matrix}

(17)

\begin{matrix} x_{i} (t + 1) = x_{i} (t) + \vec{O s w a} \end{matrix}

(18)

Time control mechanism: The abundance of nourishing food in the ocean current attracts jellyfish. When a breeze or a temperature change occurs in the current, the jellyfish will move to the opposite current, following the behaviors of type A and type B, respectively. That is, the type A action is carried out first, followed by the type B action. To equalize the jellyfish's movement, an effective time control mechanism is computed as defined according to equation (19).

T c (t) = | (1 - \frac{t}{I t r^{M a x}}) \times (2 \times r a n d (0, 1) - 1) |

(19)

Here, t specifies time,

T c (t)

specifies time control function, and

I t r^{M a x}

specifies maximum iteration.

3.3.4.2 Pseudo-code of suggested SSAJO

Table 2 discusses the parameter settings of the proposed optimization algorithms.

Table 2.
Parameter settings of the optimization algorithms.

Optimization Parameters

BMO bm_teams = 5

ID_RATE = 2

epoch = 25

problem_size = 10

batch_size = 10

BOA epoch = 25

problem_size = 10

c = 0.01

p = 0.8

alpha = (0.1, 0.3)

CA epoch = 25

problem_size = 10

accepted_rate = 0.2

HGS epoch = 25

problem_size = 10

ID_HUN = 2

A = 5

Speed = 1

T1 = 3

e = 4

PUP = 0.08

LH = 10,000

JSO epoch = 25

problem_size = 10

delta = 0.1

SSOA epoch = 25

problem_size = 10

N = 10

M = 5

a0 = 1

b0 = 1

bmax = 5

HSO epoch = 25

problem_size = 10

PSO epoch = 25

problem_size = 10

c1 = 1.2

c2 = 1.2

w_min = 0.4

w_max = 0.9

SSAJO epoch = 25

problem_size = 10

a0 = 1

b0 = 1

Optimization	Parameters
BMO	bm_teams = 5
	ID_RATE = 2
	epoch = 25
	problem_size = 10
	batch_size = 10
BOA	epoch = 25
	problem_size = 10
	c = 0.01
	p = 0.8
	alpha = (0.1, 0.3)
CA	epoch = 25
	problem_size = 10
	accepted_rate = 0.2
HGS	epoch = 25
	problem_size = 10
	ID_HUN = 2
	A = 5
	Speed = 1
	T1 = 3
	e = 4
	PUP = 0.08
	LH = 10,000
JSO	epoch = 25
	problem_size = 10
	delta = 0.1
SSOA	epoch = 25
	problem_size = 10
	N = 10
	M = 5
	a0 = 1
	b0 = 1
	bmax = 5
HSO	epoch = 25
	problem_size = 10
PSO	epoch = 25
	problem_size = 10
	c1 = 1.2
	c2 = 1.2
	w_min = 0.4
	w_max = 0.9
SSAJO	epoch = 25
	problem_size = 10
	a0 = 1
	b0 = 1

3.4 Consortium blockchain

The legalization offices will form a consortium. Moreover, the consortium components will work together to provide an autonomous blockchain with a permission infrastructure. Since, a consortium blockchain¹⁷ is controlled through an assembly of recognized persons, advisory committees and police departments; hence, decentralized operation occurs. Moreover, because users on this consortium blockchain are part of a network of already authorized nodes, the consensus-building process on this blockchain is not as stable as it is on the public blockchain. As a result, consortium blockchain adds a higher level of authority to the traditional blockchain security characteristics.

3.5 Cloud layer

To establish a system that is distributed using the blockchain, a cloud is required to feed retention and information access. Also, IoF administers the cloud remotely and periodically synchronizes using consortium blockchain. Moreover, the inclusion of these types of cloud companies in a consortium blockchain enhances the accessibility of data.

3.6 Threat model

Applications built on blockchain technology are by nature thought to be secure in terms of maintaining non-repudiation, integrity, and confidentiality. Further more, because digital forensic investigations are carried out in a fog layer without human involvement, the data is impervious to tampering. The gathering of evidence is the sole situation that calls for manual intervention. The chain of custody has an impact on the forensic framework's overall coordination and monitoring procedures. Maintaining a suspect's social dignity during the forensic process requires privacy and anonymity until the evidence as well as its analysis are verified. Blockchain uses pseudo-identities; the primary identification mapping procedure is kept locally. It is acknowledged, nonetheless, that the forensic process's traceability of the evidence does not substantiate the privacy concerns. This section shows how the suggested approach improves security and greatly increases security against attacks of a similar nature.

3.6.1 Resistant to man-in-the-middle-attack

In this attack, the eavesdropper intercepts communication among the parties and impersonates a real user or other communicating party, sending and receiving messages to each party and attempting to alter the intercepted messages in a similar way it could get access. The proposed protocol effectively resists this attack.

3.6.2 Resistant to brute-force attack

In this attack, the unauthorized user tries to hack the password and a combination of encryption keys and tries to access the data. This attack depends on doing a thorough trial and error process until the right password is discovered. This technique can readily breach weak or simple passwords. However, the suggested strategy would firmly resist this threat.

3.6.3 Resistant to side-channel attack

The side channel attack is a kind of retrieving information from the leakage of data during communication or while accessing the system. The side channel attack leverages the physical properties of the hardware, software or transmission medium to retrieve sensitive data from the internal functions of the targeted device. Nevertheless, the suggested protocol has successfully resisted this attack.

3.6.4 Resistant to false injection attack

In this attack, the intruder can alter or inject fake data from one or more sensors at any point, allowing the false data to fall within a reasonable range of genuine observations. However, the proposed mechanism has effectively resisted this attack.

4. Results and discussion

4.1 Simulation procedure

The suggested Blockchain-based Digital Forensics system was simulated in PYTHON. Moreover, the Python version was “PYTHON 3.7”. The processor utilized was “11th Gen Intel(R) Core(TM) i3-1115G4 @ 3.00 GHz 3.00 GHz” as well as the installed RAM size was “8.00 GB (7.74 GB usable)”.

4.2 Performance analysis

The SSAJO and the standard schemes were analyzed regarding encryption time, decryption time, latency, energy and various types of attacks including KCA, CPA, CCA, and KPA. Moreover, the SSAJO is compared with state-of-the-art methods like HSO²¹ and PSO¹⁸ as well as was contrasted with conventional methods, such as BMO, BOA, CA, HGS, JSO and SSOA.

4.3 Attack analysis

The attack evaluation on SSAJO is compared with BMO, BOA, CA, HGS, JSO, HSO,²¹ PSO¹⁸ and SSOA regarding CCA, CPA, KCA and KPA attacks for blockchain-based digital forensics framework is demonstrated in Figure 5. Lower attack ratings are necessary for the model to function well. Moreover, the CCA attack has been characterized as a cryptanalysis assault mechanism that allows the cryptanalyst to obtain information by gathering decryptions from predefined ciphertexts. Moreover, the CCA attack rate of the SSAJO scheme is 0.457, meanwhile, the conventional approaches yielded higher CCA attack ratings, including, BMO = 0.549, BOA = 0.683, CA = 0.758, HGS = 0.726, JSO = 0.714, HSO²¹ = 0.558, PSO¹⁸ = 0.534 and SSOA = 0.519, correspondingly. The CPA assumes that the intruder has got access to the plaintext ciphers for every piece of plaintext in the cryptanalysis attack. The goal of the attack is to gather data that will weaken the system's defences against data encryption. According to this criterion, the model ought to have lower CPA attack rates. Similarly, the CPA attack value of the SSAJO is much lower than BMO, BOA, CA, HGS, JSO, HSO,²¹ PSO¹⁸ and SSOA.

Figure 5.

Attack analysis on SSAJO and conventional methods (a) CCA (b) CPA (c) KCA and (d) KPA.

The KCA attack is defined as “The known ciphertext attack is a type of cryptanalysis attack in which the attacker is presumptively limited to a particular set of ciphertexts.” Mainly, the KCA attack rate of the SSAJO approach is 0.473, meanwhile, the BMO is 0.695, BOA is 0.783, CA is 0.571, HGS is 0.654, JSO is 0.682, HSO²¹ is 0.638, PSO¹⁸ is 0.625 and SSOA is 0.609, correspondingly. According to a summary of the KPA attack study, the KPA attack is a type of cryptanalysis attack that happens when the attacker has access to both the plaintext, also called a crib, and the encrypted version, also called ciphertext. This might be employed to find more hidden information, including code books and secret codes. Additionally, the KPA attack value of the SSAJO methodology is 0.578, whilst the BMO, BOA, CA, HGS, JSO, HSO,²¹ PSO¹⁸ and SSOA gained greater KPA attack ratings. Thus, the SSAJO approach is shown to be more effective and offers greater security to the stored data in the cloud architecture. This enhancement is due to the pseudo-identity generation and signature and confidentiality processing for the security process in the perception layer with a hybrid optimization scheme (SSOA and JSO).

4.4 Analysis of decryption and encryption time

The decryption and encryption time analysis on SSAJO over BMO, BOA, CA, HGS, JSO, HSO,²¹ PSO¹⁸ and SSOA for blockchain-based digital forensics framework is described in Figure 6(a) and (b). For the model to perform better, the encryption and decryption times need also be reduced. In particular, the decryption time of the SSAJO scheme is 0.0015 s, even though the traditional methods scored greater decryption time, notably, BMO = 0.0022 s, BOA = 0.0023 s, CA = 0.0021 s, HGS = 0.0020 s, JSO = 0.0027 s, HSO²¹ = 0.0025 s, PSO¹⁸ = 0.0024 s and SSOA = 0.0018 s, correspondingly. Similarly, the encryption time of the SSAJO approach is lesser than BMO, BOA, CA, HGS, JSO, HSO,²¹ PSO¹⁸ and SSOA. Therefore, the SSAJO outperformed other earlier techniques with quick encryption and decryption, demonstrating that it has a larger capacity to safeguard the data kept in the cloud framework.

Figure 6.

Validation on SSAJO and conventional methods (a) decryption time and (b) encryption time.

4.5 Energy and latency analysis

Figure 7(a) depicts the energy assessment on SSAJO compared with BMO, BOA, CA, HGS, JSO, HSO,²¹ PSO¹⁸ and SSOA for blockchain-based digital forensics framework. Additionally, it is evaluated for a specific quantity of transactions (0–2000). During the primary transaction, the SSAJO and traditional strategies acquired the highest energy ratings, and though the transactions improved the energy value gradually improved. However, our SSAJO scheme gained maximal energy values. In particular, the energy rate of the SSAJO scheme is 69.835J, this is extremely higher than BMO (32.763J), BOA (34.172J), CA (43.273J), HGS (46.365J), JSO (50.917J), HSO²¹ (52.428J), PSO¹⁸ (65.832J) and SSOA (51.828J), correspondingly.

Figure 7.

Validation on SSAJO and conventional methods (a) energy and (b) latency.

Simultaneously, the latency evaluation on SSAJO over BMO, BOA, CA, HGS, JSO, HSO,²¹ PSO¹⁸ and SSOA for blockchain-based digital forensics framework is represented in Figure 7(b). It is validated under a varied number of rounds (0–2000). Moreover, the SSAJO reached minimum latency values in almost all the rounds. Mainly, the latency of the SSAJO approach is 54.5 at the 1500^th round, which is lesser than BMO, BOA, CA, HGS, JSO and SSOA. Because of the hybrid optimization technique (SSOA and JSO) with an upgraded blowfish algorithm for data encryption, the SSAJO has collectively declared its superiority in blockchain-based digital forensics systems with greater power consumption and lower latency values.

4.6 Convergence analysis

The convergence study of the SSAJO is compared over BMO, BOA, CA, HGS, JSO, HSO,²¹ PSO¹⁸ and SSOA for blockchain-based digital forensics framework is exposed in Figure 8. Additionally, the unique number of iterations (0–25) is analyzed. In the first iteration, the cost rate was higher for the SSAJO and the standard approaches, but it decreased for all of the algorithms as the iteration progressed. However, the SSAJO achieved faster convergence at a reduced cost rate. Mainly, at iteration 25, the SSAJO acquired the cost value of 0.526, whilst the BMO is 0.598, BOA is 0.581, CA is 0.573, HGS is 0.549, JSO is 0.564, HSO²¹ is 0.617, PSO¹⁸ is 0.582 and SSOA is 0.587, correspondingly. The hybrid optimization approach (SSOA and JSO) was added, enabling the SSAJO methodology to attain faster convergence.

Figure 8.

Convergence assessment on SSAJO and standard techniques.

4.7 Comparison of attack on SSAJO and traditional methods regarding various key sizes

Figures 9 and 10 describe the analysis of SSAJO and conventional methods for various attacks (CCA, CPA, KCA, and KPA), encryption times, and decryption times by adjusting the key sizes from (16–128 bits). For the key size 64, the CCA attack rate of the SSAJO scheme is 0.234, even though the BMO is 0.749, BOA is 0.685, CA is 0.582, HGS is 0.674, JSO is 0.563, SSOA is 0.659, HSO²¹ is 0.598 and PSO¹⁸ is 0.651, correspondingly. Furthermore, the encryption and decryption of the SSAJO method are extremely greater than BMO, BOA, CA, HGS, JSO, SSOA, HSO²¹ and PSO.¹⁸

Figure 9.

Attack assessment on SSAJO and standard techniques across various key sizes (a) CCA (b) CPA (c) KCA and (d) KPA.

Figure 10.

Evaluation of SSAJO and standard techniques across various key sizes (a) Decryption time and (b) Encryption time.

4.8 Statistical analysis on fitness

Table 3 shows the statistical comparison of SSAJO and the traditional methods including BMO, BOA, CA, HGS, JSO, and SSOA for the blockchain-based digital forensics framework. Because metaheuristic procedures are not always reliable, each method is thoroughly examined to ensure better estimation. This is done by estimating in terms of minimum, median, standard deviation, mean, and maximum statistical parameters. Moreover, the fitness rate of the SSAJO method is 0.512 under the minimum statistical measure, whilst the BMO is 0.582, BOA is 0.561, CA is 0.555, HGS is 0.530, JSO is 0.543 and SSOA is 0.571, respectively. Further more, the SSAJO reported a fitness value of 0.605 with the median measure, whereas the BMO, BOA, CA, HGS, JSO, and SSOA recorded higher fitness values.

Table 3.
Statistical analysis of fitness.

Statistical Measures BMO BOA CA HGS JSO SSOA SSAJO

Mean 0.716 0.669 0.667 0.658 0.644 0.658 0.601

SD 0.083 0.070 0.073 0.080 0.066 0.072 0.624

Maximum 0.804 0.781 0.772 0.757 0.732 0.777 0.711

Median 0.752 0.662 0.677 0.687 0.632 0.652 0.605

Minimum 0.582 0.561 0.555 0.530 0.543 0.571 0.512

Statistical Measures	BMO	BOA	CA	HGS	JSO	SSOA	SSAJO
Mean	0.716	0.669	0.667	0.658	0.644	0.658	0.601
SD	0.083	0.070	0.073	0.080	0.066	0.072	0.624
Maximum	0.804	0.781	0.772	0.757	0.732	0.777	0.711
Median	0.752	0.662	0.677	0.687	0.632	0.652	0.605
Minimum	0.582	0.561	0.555	0.530	0.543	0.571	0.512

4.9 Performance evaluation on encryption methods

The performance analysis on Improved Blowfish over Blowfish, RSA and AES with regard to varied types of attacks, encryption time and decryption time for blockchain-based digital forensics framework is summarized in Table 4. For the analysis of blockchain-based digital forensics, the Improved Blowfish recorded superior findings than the conventional methodologies. Additionally, the Improved Blowfish scheme's KCA attack rate is 0.373, meanwhile, the blowfish, RSA, and AES are 0.554, 0.432, and 0.502 respectively. Furthermore, in contrast to Blowfish, RSA, and AES, the Improved Blowfish approach has substantially faster encryption and decryption times. Similarly, since we have implemented an enhanced blowfish algorithm, the suggested solution has a lesser impact than traditional approaches for all attacks.

Table 4.
Performance analysis of proposed and conventional encryption methods.

Methodologies KPA KCA CCA CPA Encryption time Decryption time

Improved Blowfish 0.203 0.373 0.237 0.161 0.000165 0.000161

AES 0.283 0.502 0.495 0.302 0.003714 0.004157

BLOWFISH 0.361 0.554 0.420 0.281 0.001794 0.001794

RSA 0.251 0.432 0.377 0.369 0.006108 0.007324

Methodologies	KPA	KCA	CCA	CPA	Encryption time	Decryption time
Improved Blowfish	0.203	0.373	0.237	0.161	0.000165	0.000161
AES	0.283	0.502	0.495	0.302	0.003714	0.004157
BLOWFISH	0.361	0.554	0.420	0.281	0.001794	0.001794
RSA	0.251	0.432	0.377	0.369	0.006108	0.007324

4.10 Attack analysis on SSAJO and conventional strategies for varied types of key size

The attack evaluation on SSAJO is compared with BMO, BOA, CA, HGS, JSO, HSO,²¹ PSO¹⁸ and SSOA for blockchain-based digital forensics framework in terms of key sizes varies from (16, 32, 64 and 128) are summarized from Tables 5–8. In order to ensure secure cloud data storage, the model should achieve lower attack scores. Considering Table 5 (Key size = 32), for the Side channel attack, the SSAJO obtained a lower attack value of 0.487, meanwhile, the BMO is 0.737, BOA is 0.675, CA is 0.781, HGS is 0.693, JSO is 0.688, HSO²¹ is 0.563, PSO¹⁸ is 0.584 and SSOA is 0.563, correspondingly. Further, analyzing Table 8 (key size = 128), for the message tampering attack, the SSAJO acquired the attack rate of 42.105, though the BMO, BOA, CA, HGS, JSO, HSO,²¹ PSO¹⁸ and SSOA yielded lower attack ratings. In a similar vein, the SSAJO outperformed the traditional schemes across other attacks.

Table 5.
Attack analysis for key size 16.

Attacks BMO BOA CA HGS JSO SSOA HSO²¹ PSO¹⁸ SSAJO

Eavesdropping 64.505 58.595 61.379 55.034 66.328 62.389 60.323 64.325 40.407

False injection attack 0.924 0.793 0.843 0.747 0.658 0.735 0.625 0.582 0.348

Side channel attack 0.684 0.785 0.559 0.697 0.595 0.568 0.669 0.713 0.327

Man in the middle 67.336 60.970 56.468 57.055 58.583 52.505 73.251 77.322 44.756

Message tampering 60.340 59.237 64.489 60.955 68.560 56.884 55.326 59.363 43.077

Brute force attack 66.560 69.202 58.151 65.177 68.382 59.011 67.321 56.325 44.970

Plain text attack 67.478 56.635 69.191 66.483 64.382 50.321 68.321 58.322 42.290

Attacks	BMO	BOA	CA	HGS	JSO	SSOA	HSO²¹	PSO¹⁸	SSAJO
Eavesdropping	64.505	58.595	61.379	55.034	66.328	62.389	60.323	64.325	40.407
False injection attack	0.924	0.793	0.843	0.747	0.658	0.735	0.625	0.582	0.348
Side channel attack	0.684	0.785	0.559	0.697	0.595	0.568	0.669	0.713	0.327
Man in the middle	67.336	60.970	56.468	57.055	58.583	52.505	73.251	77.322	44.756
Message tampering	60.340	59.237	64.489	60.955	68.560	56.884	55.326	59.363	43.077
Brute force attack	66.560	69.202	58.151	65.177	68.382	59.011	67.321	56.325	44.970
Plain text attack	67.478	56.635	69.191	66.483	64.382	50.321	68.321	58.322	42.290

Table 6.

Attack analysis for key size 32.

Attacks	BMO	BOA	CA	HGS	JSO	SSOA	HSO²¹	PSO¹⁸	SSAJO
Eavesdropping	66.732	68.884	59.186	66.646	65.584	65.524	63.323	60.125	41.896
Side channel attack	0.737	0.675	0.781	0.693	0.688	0.563	0.584	0.653	0.487
Man in the middle	79.532	65.181	69.227	75.685	58.871	62.732	63.214	69.321	43.107
Plain text attack	76.655	65.803	69.589	64.365	70.528	60.527	68.321	66.321	46.505
Message tampering	75.546	57.431	66.066	66.686	58.747	67.156	69.321	70.323	37.401
Brute force attack	60.747	63.396	61.330	63.365	74.528	66.173	62.314	68.321	43.253
False injection attack	0.808	0.602	0.670	0.703	0.552	0.632	0.593	0.693	0.441

Table 7.

Attack analysis for key size 64.

Attacks	BMO	BOA	CA	HGS	JSO	SSOA	HSO²¹	PSO¹⁸	SSAJO
Eavesdropping	64.846	75.730	61.817	68.730	64.817	63.118	60.321	64.322	45.429
Brute force attack	63.724	69.870	57.092	67.870	57.092	68.688	65.321	59.324	41.405
Side channel attack	0.742	0.473	0.674	0.575	0.598	0.551	0.603	0.652	0.421
Man in the middle	64.034	79.710	65.005	65.710	71.005	75.050	70.322	66.326	40.054
Message tampering	62.095	63.734	68.185	70.734	61.185	67.341	68.321	64.321	42.429
Plain text attack	69.844	63.271	77.092	73.271	67.092	72.911	65.399	69.321	40.860
False injection attack	0.791	0.623	0.684	0.633	0.541	0.528	0.672	0.693	0.439

Table 8.

Attack analysis for key size 128.

Attacks	BMO	BOA	CA	HGS	JSO	SSOA	HSO²¹	PSO¹⁸	SSAJO
Man in the middle	66.750	64.334	78.817	52.538	71.717	65.823	64.321	70.321	42.703
Brute force attack	63.997	62.620	77.510	56.717	77.946	59.526	73.211	71.213	44.123
Message tampering	68.724	62.654	70.898	64.623	71.997	50.070	68.324	65.321	42.105
Plain text attack	64.949	70.131	69.670	75.165	67.946	63.706	75.321	63.314	43.645
Eavesdropping	63.823	65.728	79.580	68.578	58.561	66.983	61.323	68.321	40.940
False injection attack	0.789	0.617	0.779	0.629	0.736	0.723	0.691	0.712	0.549
Side channel attack	0.714	0.668	0.705	0.770	0.668	0.648	0.774	0.663	0.581

4.11 Computation time analysis

The computation time analysis on SSAJO over BMO, BOA, CA, HGS, JSO, SSOA, HSO²¹ and PSO¹⁸ for blockchain-based digital forensics framework is presented in Table 9. Additionally, for the model to function well, the computation time should be shortened. Particularly, the computational time of the SSAJO method is 53.259, even though the existing methods obtained maximum computation time, notably, BMO = 67.633, BOA = 65.395, CA = 89.889, HGS = 83.332, JSO = 79.719, SSOA = 107.804, HSO²¹ = 64.215 and PSO¹⁸ = 76.405, correspondingly. This improved SSAJO scheme with reduced time for computation is due to an innovative hybrid optimization approach that uses an improved blowfish algorithm to encrypt the data more effectively.

Table 9.
Analysis of computational time of the SSAJO and standard strategies.

Models Computational time

BMO 67.633

BOA 65.395

CA 89.889

HGS 83.332

JSO 79.719

SSOA 107.804

HSO²¹ 64.215

PSO¹⁸ 76.405

SSAJO 53.259

Models	Computational time
BMO	67.633
BOA	65.395
CA	89.889
HGS	83.332
JSO	79.719
SSOA	107.804
HSO²¹	64.215
PSO¹⁸	76.405
SSAJO	53.259

5 Conclusion

The objective of this study was to introduce a novel architecture for digital forensics based on blockchain technology. It consists of four main layers: the Perception Layer, the Fog Layer, the Consortium Block Chain, and the Cloud Layer. Moreover, the forensic evidence is stored on devices within the perception layer and is transferred to the Fog layer, which is the next layer up. Nevertheless, secure transmission was the major challenging issue while transmitting the message from the perception layer to the fog layer. This problem can be solved by mapping user identities (such as investigators and device identities) to pseudo-identities and ensuring signature security and confidentiality. Thus, this process ensured privacy and security. The Fog layer used the Blowfish algorithm for encryption to ensure the privacy of the message (evidence) transfer and confirm the signature data. To encrypt the message, the optimal key was generated using the SSAJO algorithm. Then the encrypted message was subjected to a distributed ledger called consortium blockchain, assuming that legalization offices are a part of the consortium to improve the security factors with a greater level of control. The cloud was used to store and access the data, creating a shared framework with the aid of blockchain. Moreover, the suggested IoT framework controls the cloud locally and performs synchronization with consortium blockchain occasionally.

Footnotes

Funding

The authors received no financial support for the research, authorship, and/or publication of this article.

Declaration of conflicting interests

The authors declared no potential conflicts of interest with respect to the research, authorship, and/or publication of this article.

References

Kamal

Hemdan

El-Fishway

. Forensics chain for evidence preservation system: an evidence preservation forensics framework for internet of things-based smart city security using blockchain. Concurr Comput: Pract Exp 2022; 34: 7062.

Kebande

Mudau

Ikuesan

, et al. Holistic digital forensic readiness framework for IoT-enabled organizations. Forensic Sci Int: Rep 2020; 2: 100117.

Akhtar

Feng

. Using blockchain to ensure the integrity of digital forensic evidence in an iot environment. EAI Endorsed Trans Creat Technol 2022; 9: 2.

Qin

Min

. Blockchain-based digital forensics investigation framework in the internet of things and social systems. IEEE Trans Comput Soc Syst 2019; 6: 1433–1441.

Liang

Xin

Wang

, et al. Research on IoT forensics system based on blockchain technology. Secur Commun Netw 2022; 2022: 4490757.

Mercan

Cebe

Aygun

, et al. Blockchain-based video forensics and integrity verification framework for wireless internet-of-things devices. Secur Privacy 2021; 4: 143.

Lal

Conti

, et al. LEChain: a blockchain-based lawful evidence management scheme for digital forensics. Future Gener Comput Syst 2021; 115: 406–420.

Mahrous

Farouk

Darwish

. An enhanced blockchain-based IoT digital forensics architecture using fuzzy hash. IEEE Access 2021; 9: 151327–36.

Ali

Ismail

Elgohary

, et al. A procedure for tracing chain of custody in digital image forensics: a paradigm based on grey hash and blockchain. Symmetry 2022; 14: 334.

10.

Liu

Xuan

. A data preservation method based on blockchain and multidimensional hash for digital forensics. Complexity 2021; 2021: 5536326.

11.

Renuka

Kusuma

. Blockchain-based digital forensics investigation framework. Int Res J Eng Technol (IRJET) 2021; 8: 1433–1441.

12.

Kim

Park

Lee

. An improved IoT forensic model to identify interconnectivity between things. Forensic Sci Int: Digit Invest 2023; 44: 301499.

13.

Agbedanu

Jurcut

. BLOFF: a blockchain-based forensic model in IoT. In: Research anthology on convergence of blockchain, internet of things, and security. 2023, pp. 738–749.

14.

Noura

Salman

Chehab

, et al. Distlog: a distributed logging scheme for IoT forensics. Ad Hoc Netw 2020; 98: 102061.

15.

Pourvahab

Ekbatanifard

. An efficient forensics architecture in software-defined networking-IoT using blockchain technology. IEEE Access 2019; 7: 99573–99588.

16.

Sadineni

Pilli

Battula

. ProvNet-IoT: provenance based network layer forensics in internet of things. Forensic Sci Int: Digit Invest 2022; 43: 301441.

17.

Kumar

Saha

Lal

, et al. Internet-of-Forensic (IoF): a blockchain based digital forensics framework for IoT applications. Future Gener Comput Syst 2021; 120: 13–25.

18.

Koroniotis

Moustafa

Sitnikova

. A new network forensic framework based on deep learning for internet of things networks: a particle deep framework. Future Gener Comput Syst 2020; 110: 91–106.

19.

Garba

Kunya

Zakari

. A proposed novel low cost genetic-fuzzy blockchain-enabled internet of things (iot) forensics framework. Sci Pract Cyber Secur J 2021; 5: 9–15.

20.

Ryu

Sharma

, et al. A blockchain-based decentralized efficient investigation framework for IoT digital forensics. J Supercomput 2019; 75: 4372–4387.

21.

Pourvahab

Ekbatanifard

. Digital forensics architecture for evidence collection and provenance preservation in iaas cloud environment using sdn and blockchain technology. IEEE Access 2019; 7: 153349–64.

22.

Parihar

Kulshrestha

. Blowfish algorithm: a detailed study. Int J Technol Res Eng 2016; 3: 2253–2255.

23.

Kaveh

Zaerreza

. Shuffled shepherd optimization method: a new meta-heuristic algorithm. Eng Comput 2020; 37: 2357–2389.

24.

Chou

Truong

. A novel metaheuristic optimizer inspired by behavior of jellyfish in ocean. Appl Math Comput 2021; 389: 125535.

25.

Bekkouche

Diffellah

Yahi

. Some improved chaotic maps applied to image encryption. In: 1st International Conference on Engineering, Natural and Social Sciences, 2022.

Digital forensic in IoT paradigm: Blockchain assisted digital forensic framework with improved cryptosystem

Abstract

Keywords

1 Introduction

2 Literature review

2.1 Problem statement

3.1 Proposed work of digital forensics in Iot paradigm

3.2.1 Pseudo identity generation

3.3.3 Objective function

3.3.4.1 Mathematical modeling

3.5 Cloud layer

3.6 Threat model

3.6.1 Resistant to man-in-the-middle-attack

3.6.2 Resistant to brute-force attack

3.6.3 Resistant to side-channel attack

3.6.4 Resistant to false injection attack

4. Results and discussion

4.1 Simulation procedure

4.2 Performance analysis

4.3 Attack analysis

Table 9. Analysis of computational time of the SSAJO and standard strategies. Models Computational time BMO 67.633 BOA 65.395 CA 89.889 HGS 83.332 JSO 79.719 SSOA 107.804 HSO 21 64.215 PSO 18 76.405 SSAJO 53.259

Footnotes

Funding

Declaration of conflicting interests

References

Table 9.
Analysis of computational time of the SSAJO and standard strategies.

Models Computational time

BMO 67.633

BOA 65.395

CA 89.889

HGS 83.332

JSO 79.719

SSOA 107.804

HSO²¹ 64.215

PSO¹⁸ 76.405

SSAJO 53.259