Journal:CustodyBlock: A distributed chain of custody evidence framework

Abstract

With the increasing number of cybercrimes, the digital forensics team has no choice but to implement more robust and resilient evidence-handling mechanisms. The capturing of digital evidence, which is a tangible and probative piece of information that can be presented in court and used in trial, is challenging due to its volatility and the possible effects of improper handling procedures. When computer systems get compromised, digital forensics comes into play to analyze, discover, extract, and preserve all relevant evidence. Therefore, it is imperative to maintain efficient evidence management to guarantee the credibility and admissibility of digital evidence in a court of law. A critical component of this process is to utilize an adequate chain of custody (CoC) approach to preserve the evidence in its original state from compromise and/or contamination. In this paper, a practical and secure CustodyBlock (CB) model using private blockchain protocol and smart contracts to support the control, transfer, analysis, and preservation monitoring is proposed. The smart contracts in CB are utilized to enhance the model automation process for better and more secure evidence preservation and handling. A further research direction in terms of implementing blockchain-based evidence management ecosystems, and the implications on other different areas, are discussed.

Keywords: forensics, cybersecurity, distributed ledger technology (DLT), smart contract, blockchain

Introduction

Evidence management is one of the most important problems in digital forensics. Digital proof plays a vital role in crime investigations because it is used to link persons with their criminal activities. Chain of custody (CoC) in digital forensics can be defined as a process of documenting and maintaining the chronological history of handling digital evidence. This plays an important role in the investigation of digital forensics because it notes every detail of concern to digital evidence through different levels of hierarchy. This goes from the first responder to the higher authorities who were responsible for handling the investigation of cybercrime.

Digital proof comes with its own particular challenges, particularly when linked with the CoC. Blockchain technology can enable various stages of digital transaction to take place, however, providing massive advantages for the forensic community. In general, blockchain can act as a scattered form of information that maintains tamper-proof arrangement blocks that hold a cluster of individual transactions. It executes a decentralized and fully replicated append-only ledger, present in a peer-to-peer network, originally deployed for the bitcoin cryptocurrency. All the nodes present on the chain maintain a complete local copy of the blockchain. The blockchain is an indigenous technology that has emerged for decentralized applications, the outcome of complicated privacy and security issues present in applications for over half a century. It is a peer-to-peer system that authorizes users to maintain a ledger for various transactions that are reproduced, and it remains identical in more than one location over multiple user servers.

A blockchain is essentially a "block of chains," with the growing list of records that come from it referred to as "blocks" that are joined with cryptography. Each blockchain contains a hash of a previous block, and a timestamp that keeps track of the creation and modification time of a document. In terms of security, nobody, not even the owners of the document, ought to be able to modify it once it has been recorded (this can be done only if the integrity of time-stampers is compromised, which is rare). Blockchain was invented in 2008 and implemented in 2009 to function in the general public ledger of the Bitcoin cryptocurrency, a type of electronic money. Blockchain technology is decentralized (i.e., peer-to-peer). It consists of world network computers, which apply blockchain technology to put together and manage the information that records each Bitcoin transaction managed by its network. The architecture of blockchain technology, shown in Figure 1, implements a decentralized, fully replicated append-only ledger in a peer-to-peer network.

Fig. 1 Architecture of blockchain

The methodology proposed in this paper uses IBM's Hyperledger blockchain technology, as it is private and open-source. Hyperledger supports smart contracts called chaincodes. Hyperledger is able to approve blocks and send the associated exchange transactions to the trusted and approved blocks to be validated and approved. This is the most broadly utilized blockchain stage, utilized across various ventures and use-cases. It is utilized in a few models and proof-of-concepts, and is also being disseminated in record frameworks.

Hyperledger is a blockchain with pluggable agreement. It is one of the more favorable uses of Hyperledger, which is hosted by the Linux Foundation. It is the first blockchain framework that permits the execution of dispersed applications written in standard programming. While generic blockchain utilizes request–execute–approve engineering, Hyperledger uses an execute–request–approve design and a support strategy that is overseen by assigned directors and functions as a static library for exchange approval.

Blockchain technology also provides decentralization, tracking, data transparency, security, and privacy for internet of things (IoT) applications. IoT applications running in medical, transportation, agriculture, and other contexts require a high level of security. Blockchain provides the necessary security and privacy for different IoT applications and transactions, while maintaining a high level of integrity. Additionally, blockchain provides a high level of management for IoT systems by using privileged digital identities and access management. Many researchers illustrate the importance of connecting IoT systems to a blockchain-based technology to enhance the level of security and IoT performance.

In the context of digital forensics, the production of evidence in the modern digital world is a complex task. For this reason, we consider it essential that digital evidence should be accepted as valid in court only if the CoC can assure exactly what the evidence is, why it was collected and analyzed, and how evidentiary data were collected, analyzed, and reported. This can be in the form of big data. Additionally, the CoC must demonstrate exactly where, when, and who came into contact with the electronic evidence in each stage of an investigation, as well as any manipulation of the evidence. The increasing complexity of forensic science in the digital area leads researchers to claim that traditional computer forensics “is on the edge of a precipice,” especially because of the great diversity of electronic devices to be examined and the intensive growth of the quantity of data that must be collected and examined during preservation in the blockchain. This growing complexity makes it harder to create and maintain a reliable CoC, and it exposes a wide gap between general evidentiary criteria based on traditional forensic procedures and the scientific community’s point of view about the risks and conditions necessary to consider reliable any contemporary digital evidence.

This scenario circumscribes the objective of this work: to review difficulties and formulate suggestions to make a more reliable CoC of digital evidence, making it more consistent with legal necessity regardless of the country, company, or tool through which digital evidence is collected. Within this objective, this work explores gaps between the traditional CoC and the modern studies’ point-of-view about the risks and requirements concerning the reliability of contemporary digital evidence.

This paper also aims to contribute to the discussion about the trend to establish a worldwide standard more suited to maintaining CoC throughout the lifecycle of digital evidence and to help the improvement of new versions of CoC software. This work will not define or select any standard itself, because that is outside the scope of this paper. More specifically, this paper aims to address the challenges in forensic evidence collection, preservation, and investigation processes, for IoT environments in the smart home domain, by exploiting novel CoC technology, along with the CustodyBlock (CB) model, using private blockchain protocol and smart contracts to support the control, transfer, analysis, and preservation monitoring of forensic evidence.

The remainder of the paper is structured as follows. The next section analyzes the inherent problems of maintaining the CoC of digital evidence and the motivation for the proposed research, while the existing studies done in the area of the application of blockchain in forensics are described in the section after that. The paper then explains the research methodology, shows the proposed CustodyBlock model and its supporting architecture, illustrates digital evidence custody (DEC), and explains the algorithm for the proposed methodology. The penultimate section provides discussion and states future work, while the conclusion and future enhancements are given at the end.

Problem analysis and motivation for this research

In the event of a crime, the investigation process relies heavily on physical and digital evidence. The judicial system has gradually become flexible in accepting digital evidence given the fact that the handling mechanism is somewhat similar to how they treat physical evidence. The field of digital investigation continues to grow and therefore requires effective computer investigators with skills needed to capture the crime scene, call data records, search collected records, recover data, and engage with the forensic process.

The issues a forensics team encounters with digital evidence are due to the nature of digital information. For example, digital information:

• can easily be duplicated or reproduced;
• can be altered and modified with new data or the removal of important information to the case, compromising its integrity;
• has varying levels of accessibility, depending on how and by whom the information is treated/managed and what level of access control is granted to it;
• requires secure storage to maintain its integrity;
• can be transmitted to someone else or to a different country; and
• in some cases, can be time-sensitive in purpose (e.g., to the case and pre-arrest situations).

An issue arises with the gap introduced when providing digital evidence versus physical evidence in the court of law. This is certainly becoming a challenge to the judicial system’s solid and secure digital witnesses. Another issue is that there are various practices of digital forensics activities and models. Figure 2 demonstrates the investigation process and how physical and digital evidence support each other in creating a complete theory about the criminal case.

Fig. 2 Physical and digital investigation constructs

This paper argues for the utilization of blockchain technology to improve the CoC process and the evidence-handling life cycle. The blockchain is a digital ledger system, namely a distributed ledger technology (DLT), and we believe it can address the current issues faced with the digital evidence handling lifecycle. DLT implementation is growing due to its benefits in advancing sustainability, automation, and digital transformation. It also provides built-in security to control access to information and trace changes throughout the data life period. Nonetheless, the blockchain is an emerging technological advancement, hence very few concrete real-life applications have been identified.

Proposed herein is a conceptual blockchain model (CB) to fill the gap in the literature and address the challenges faced in handling digital evidence to efficiently transform the global practice of law. The CB model demonstrates how blockchain and smart contracts can provide monitored and traceable access to the evidence chain for those involved participants, e.g., regulators, courts, law firms, etc. The CB nodes are trusted network stakeholders that have a sustainable and distributed set of rules/standards. The CB smart contracts ensure the automation of rights on the evidence related to the plaintiff, defendant, and involved third party. It also has the flexibility to adapt to and comply with the applicable judicial system and provide compliance metrics to the evidence-handling lifecycle.

Various researchers have strongly suggested that computer forensics and law firms consider blockchain implementations for evidence handling before acquiring CoC services. By combining trustless, scalable, distributed, and traceable custody systems with the next generation of legal digital standards and service level agreements (SLAs), the forensics team and involved parties on a crime scene can be confident in their CoC and forensics activities. However, the focus here is on leveraging the trust, security, accessibility, provenance, and transportation of the digital evidence and handling service, the improvement of and investment in supporting law-enforcement institutions, and the investigation of cybercrime.

Existing research

Nowadays, forensic software is used to better acquire evidence that describes and identifies the electronic user, e.g., via the digital signature, audit trail, etc. Still, there is still a significant gap between the usual CoC software and using traceable digital evidence effectively in the courtroom. Nowadays, this process is executed through the concept of CoC. The CoC is a set of consecutive documented records that demonstrate the order of custody for physical or electronic evidence, as well as of its control, transfer, and analysis. Maintaining CoC during the process of investigation and at the time of submitting the evidence in court can be challenging, however. In the past few years, various IoT-based studies have been conducted in forensics, which includes the identification of the digital evidence, its collection, storage, analysis, and distribution within IoT platforms. This process is entirely different from existing computer-based forensics. Since 2017, blockchain technology has been applied in various applications of digital forensics, such as the documentation of evidence. Zhang et al. proposed a provenance process model for digital investigations using blockchain in a cloud-based environment, with the idea that it can enhance the interaction trust between stakeholders in cloud forensics. Al-Nemrat investigated the possibility of introducing blockchain-based technologies in the investigation of financial fraud in e-governance. Al-Nemrat's results show that their proposed technology can be effective in determining financial fraud related to the reviews of online products.

Ulybyshev et al. explained that the blockchain is used to provide the process of audibility, traceability in software development, and a role-based access control mechanism for the accesses of unauthorized data. Hossain et al. proposed a forensic investigation framework based on the blockchain, which focuses on detecting various criminal incidents in the IoT and also on collecting the details of communications from different entities present in it. Their proposed framework can model the interaction of transactions. The main drawback of their methodology is its inefficiency in the collection of data and its analysis in large-scale IoT-based systems. Lone and Mir proposed a digital forensic chain based on the popular blockchain platform called Ethereum. Ethereum can provide integrity, transparency, and authenticity for the multiple sources of data. Various studies have been done on the process of digital investigations in the heterogeneous environment, security solutions in lightweight IoT devices, digital witnesses, etc.

From these studies, it appears recent analysis and research on digital forensics falls under two categories: focusing on assisting the law enforcement community and focusing on specific forensics applications. Ćosić and Bača proposed a conceptual digital evidence management framework (DEMF) to improve the CoC of digital evidence in all the phases of the investigation. They used a hash code for the fingerprinting of evidence, assessing hash similarity to change control, identifying biometrics, authenticating digital signatures, performing automatic and trusted timestamping, and running GPS and RFID for geolocation. These components can be implemented through a database to record all the activities performed by the first responders, forensic investigators, verifier or acceptors, law enforcement personnel, and police officers, etc. This work aims at developing a blockchain-based CustodyBlock digital forensic model that can be used in complex cyber environments (such as IoT, cyber-physical systems, etc.) and providing an effective architecture for the proposed methodology.

Research methodology

There are several published forensics models with detailed guidelines for the forensics team. For instance, there is a set of tasks and procedures to maintain the integrity of the captured evidence and avoid contradiction with jurisdictional laws and regulation by maintaining compliance with the applicable law requirements. ISO/IEC 27050-2:2018 is a cybersecurity guidance document that highlights standards and codes of practice for electronic discovery, i.e., eDiscovery, which aims at protecting electronically stored information (ESI), including recorded data by any involved parties in the investigation process. Similarly, the digital forensic research workshop (DFRWS) model is set to protect the digital forensic process, and has six stages that start with the identification phase during an incident/event, followed by preservation, collection, examination, and analysis. Lastly, the collected evidence report is set as part of the presentation phase.

This methodology utilizes a grounded and qualitative theory set by Jabareen, i.e., the “conceptual framework analysis” approach to building conceptual frameworks. In addition to the current digital investigation models (e.g., ISO/IEC 27050 and DFRWS), Jabareen’s approach is used to devise the CB model. This stipulates identifying a phenomenon’s key factors, which when organized, clarify the proposed solution. Every key factor has its attributes, assumptions, and roles that have a specific function within the proposed model. In addition, three forms of a given assumption are presented:

• the way things are, i.e., ontological;
• how things interact/work, i.e., epistemological; and
• the process in building the conceptual model that fits/understands the real world, i.e., methodological.

The main step in this method is to derive concepts from data within the knowledge base, i.e., literature cases, and inject the deductive procedure to generate the relationship between the model's key factors. The overall process emphasizes an iterative interplay between inductive data and the analysis phases. In the end, this results in arriving at a solid examination of the potential and applicability of blockchain and smart contracts to advance CoC and the digital evidence handling model. Moreover, basic evidence metrics are considered to improve the traceability and evidence sources. This includes location of the data when generated, type and form of data, time elapsed since it was stored, its currently employed control and security measures, who last accessed it, when it was last reviewed, who the owner or responsible entity is, and what the transfer procedure was.

CustodyBlock framework

The CustodyBlock system architecture includes the participants (law enforcement, cloud service providers, validators), a consensus algorithm, a smart contract, cryptographic functions, and a digital signature. The main CustodyBlock model components are shown in Figure 3 and described below.

Fig. 3 CustodyBlock framework

The CustodyBlock model ensures proper CoC documentation in order to allow the admissibility and validity of digital evidence. Participants have many roles and responsibilities within the system. The following are major participating actors in the CustodyBlock model:

• Law enforcement (LE): This is the major player in the model. LE is a trusted third-party or government entity that is tasked with ensuring proper evidence handling procedures, e.g., collection, preservation, analysis, archiving, etc. The LE entity sets the roles for CustodyBlock transactions' read/write controls and ledger read/write controls. LE details the rules needed to be written/coded in smart contracts to automate entity registration and onboarding, e.g., registering digital witnesses and investigators
• Digital witness (DW): This is the interconnected network of devices, such as laptops, smartphones, and IoTs, such as home appliances and connected vehicles, etc. DW provides collaboration on providing incident-based/sensor-based evidence within their capabilities. The captured evidence puts investigators and LE forward for further investigation.

Digital evidence custody (DEC)

An approved and accredited administrative person or entity is required to ensure the proper handling of the evidence received from investigators, LE, or authorized trusted law enforcement entities. DEC can be automated through the use of smart contracts and machine learning algorithms. In this case, the "blockchain fabric" (BF) is used.

BF describes the private blockchain implementation using, e.g., Ethereum or Hyperledger fabric as the main underlying system for the CustodyBlock application. Participating roles and responsibilities act as active nodes of the CustodyBlock blockchain network. The BF contains an essential element to this structure, i.e., the shared ledger or DLT, which will be able to log all collective and transferred evidence and immutability shared among all the different and authorized entities. The DLT is governed by lawmakers and law enforcement institutes.

The BF has three sub-functions, which together form the operation of the BF. These are:

1. Secure transaction: This carries the evidence track records, e.g., submission, archiving, transfer, fetching, etc. Each transaction entails necessary information and a unique identifier. Information details are set as per forensic investigation standards to include data type, timestamp, submitter and receiver IDs, geographical locations, etc. The transaction is then hashed, and once verified by the consensus algorithm, will be stored in the CustodyBlock DLT and distributed among all active network nodes.

2. Smart contract: Each transaction can be automated using a smart contract. A smart contract is a set of predetermined executable instructions based on the nature of a certain transaction or input. An output can also trigger another smart contract. For example, a case is created, and the smart contract logs the submitter ID and associated evidence provided by the analysis phase. Based on the analysis output, the smart contract initiates another instance to request more evidence from the submitter or witnesses. If the submitted evidence is sufficient for the case, then the smart contract proceeds to the analysis and investigation procedures. Additional steps in the investigation process, e.g., evidence transfer and archival, are not presented in this paper.

3. Consensus node: This is a function with a set of rules that is responsible for maintaining, verifying, and approving BF records/transactions and updating the ledger. It also ensures trustworthiness when reliability, availability, accuracy, and authenticity are built in by design. The on-chain governance of the CustodyBlock blockchain is achieved by consensus nodes by not only restricting access to the CustodyBlock ledger, but also who can perform different actions, e.g., validation of transactions. There are different implementations of consensus algorithms, such as proof of work (PoW), proof of stake (PoS), delegated proof of stake (DPoS), practical byzantine fault tolerance (pBFT), proof of authority (PoA), etc. A private (permissioned) implementation of the CustodyBlock model is suggested with the use of practical byzantine fault tolerance (pBFT) as a consensus algorithm. The pBFT is considered for the CustodyBlock model with the assumption that some of the consensus nodes may act faultily or maliciously in the network, hence the need for taking proactive measures to ensure consistent and valid voting/validation, shown in Figure 4. The pBFT does not scale to accommodate other blockchains or larger volume, but for maintaining evidence handling, the author believes it should suffice.

Fig. 4 Operation phases of pBFT

The given process achieves consensus if the majority of the CB network nodes agree on the same output value. The pBFT phases are:

1. A “request” for evidence handling procedure is received.
2. A “pre-prepare” phase includes this shared request in a proposal.
3. A “prepare” phase is set for voting/validating and coming to an agreement.
4. A “commit” phase allows each consensus node to communicate to each other their results, and the majority agreed-upon value will be committed into the ledger and updated in the whole CB network.

Algorithm for the proposed methodology

The following programing is the pseudo code of the algorithm of the proposed mechanism using Python and the Hyperledger platform. Our algorithm creates a number of blocks with different hashes and with timestamps to approve, verify, and track the transactions made by the blocks. The blocks’ authentication uses public key infrastructure (PKI) with smart contracts to approve the creation of the created evidence. Figure 5 shows the flowchart of the proposed algorithm.

Fig. 5 Flowchart of the proposed algorithm

The mathematical model and algorithm are inspired by the work of Giova and Tang et al. The following is the pseudo Algorithm 1 of our proposed algorithm, which was also created in advance by the Hyperledger platform:

Algorithm 1. Custody Block # (parent_hash, transactions, hash_evidence, smart_contract) def get_parent_hash (block): return block [0] def get_transactions (block): return block [1] def get_hash_evidence (block): return block [15] # function to create a block in a blockchain “ver”:1, “vin_sz”:1, “vout_sz”:2, “lock_time”:”Unavailable”, hash_evidence=hash ((transactions, parent_hash)) return (parent_hash, transactions, hash_evidence) # function to create the genesis block def create_genesis_block (transactions): return create_block (transactions, 0) Smart_Contract = create_genesis_block (“Create Evidence”) # function to create the smart contract block block1 = create_block (“Smart Contract”, genesis_block_hash) # function to create the smart contract genesis_block_hash = get_hash_evidence (smart_contract) print “smart contract hash:”, smart_contract_hash

Discussion and further applications

The CB model can be used in different applications, such as private blockchain or IoT applications. This model is a novel technique inspired by the Hyperledger technology supported by the Linux Foundation and IBM, which uses smart contracts and public key infrastructure (PKI) to achieve confidentiality, integrity, availability, authentication, and authorization. PKI-based solutions encrypt the transaction transmitted from the authorized source peer to the destination. The proposed model can be used to authenticate IoT users and devices to avoid different kinds of inside and outside threads and attacks.

Blockchain is a decentralization technology that stores the data and the transactions into distributed peer-to-peer blocks. These blocks can be used to create and verify transactions using hashing and cryptographic algorithms. New technologies such as zero-knowledge proof (ZKP) are adding even more security to blockchain technology by using a third party, called the “prover,” who can prove and verify the value without getting any information about the transaction while only possessing the secret information. In fact, Liu et al. used ZKP and multi-factor authentication in 2019 to secure the verifier's identity. This method is promising and may also be used in many IoT devices and applications. However, the following three properties need to be satisfied for the method to work:

• Completeness: Knowing a spectator and the authenticity of a statement, the prover can convince the verifier.
• Soundness: A malicious prover cannot persuade the verifier in the situation that the assertion is bogus.
• Zero-information: The verifier asserts nothing aside from the fact that the assertion is valid.

Conclusions and future work

In this paper, a blockchain-based protocol and smart contracts to support the control, transfer, analysis, and preservation monitoring have been proposed. The proposed method utilizes a conceptual blockchain model using novel CoC technology, along with the CB model using private blockchain protocol and smart contracts, to fill the gap in the literature and address the challenges faced in handling digital evidence to efficiently transform global legal practices. The CB model demonstrates how blockchain and smart contracts can provide monitored and traceable access to the evidence chain for those involved participants, e.g., regulators, courts, law firms, etc. To ensure security in sharing the forensic data, the proposed mechanism ensures that all participating entities are authorized to exchange and share the data. The proposed model provides the platform on which the forensic data can be stored without any attacks and acts as a better and more secure evidence preservation and handling methodology.

Future enhancements to this model can be imagined. For example, intelligent-based methods can be combined with the blockchain for providing privacy and security in electronic data. Additional benefits could be had with the addition of biometric-based systems.

In the future, CoC technology can be used for IoT smart home and healthcare applications to add security. In situations like the COVID-19 pandemic—where rapid, accurate, and secure information is vital to effective treatments—this model has the potential to help patients and the treatment team by better securing point-of-care and IoT medical devices, electronic health records (EHRs), patient healthcare information (PHI), and other healthcare applications. In the future, we would like to conduct a case study comparing the proposed CB model with a zero-knowledge proof (ZKP) model for smart home IoT applications using multi-factor authentication to secure the IoT user’s identity.

Acknowledgements

Funding

This research received no external funding.

Data availability

Data available on request due to restrictions e.g., privacy or ethical.

Conflict of interest

The author declares no conflict of interest.

Notes

This presentation is faithful to the original, with only a few minor changes to presentation, grammar, and punctuation. In some cases important information was missing from the references, and that information was added. The original uses "DC" in the text but fails to establish what it means. It's also not clear what it means after looking at the figures. This version assumes it means "investigators." The original mistakenly omitted a citation for Liu et al. 2019 in the discussion; it was added for this version.