Block-DEF: A secure digital evidence framework using blockchain

Highlights

• Block-DEF is proposed to solve big data and privacy challenges with a loose coupling design.

• The blockchain bloat is avoided by combining a mixed blockchain structure with an O-NPBFT mechanism.

• The traceability and privacy of evidence are balanced by using multi-signature schemes.

Abstract

A secure digital evidence system should ensure that evidence cannot be tampered with and that private information cannot be leaked. Blockchain, a distributed tamper-resistant and privacy-preserving ledger, provides a promising solution for decentralized secure digital evidence systems. However, due to the huge number of digital evidences and the contradiction between the traceability and the privacy of evidence, blockchain faces big data and privacy challenges. To solve the above issues, we propose a secure digital evidence framework using blockchain (Block-DEF) with a loose coupling structure in which the evidence and the evidence information are maintained separately. Only the evidence information is stored in the blockchain, and the evidence is stored on a trusted storage platform. To avoid blockchain bloat, a lightweight blockchain combining a mixed block structure with an optimized name-based practical byzantine fault tolerance consensus mechanism is proposed. To support the traceability and the privacy of evidence, the multi-signature technique is adopted for evidence submission and retrieval. The analytical and experimental results show that Block-DEF is a scalable framework, it guarantees the integrity and validity of evidence, and balances privacy and traceability well.

Introduction

The application of the Internet has changed from host-centric to content-centric. Publishing and retrieving contents is becoming the main requirement of Internet users [45]. The content may be a file or a piece of file that is transported across the Internet, such as web pages, images, audios or videos. Accordingly, content security becomes an important part of cyber security, and it mainly focuses on three security properties: privacy, integrity and non-repudiation. Unfortunately, not all contents are properly protected. Many content objects (files) are tampered with due to network attacks or other reasons. Such file tampering has many negative effects. For example, web page tampering can be used to craft phishing attacks or broadcast illegal information. Executable files can be injected with malicious codes by the attacker to monitor user behavior or illegally access private data. For technical, economic and legal reasons, it is often necessary to investigate the corresponding digital evidence for file tampering.

The process of digging and collecting digital evidence has attracted considerable attention [32], [34]. When digital evidence is obtained, it is always transmitted directly to the third party management or stored in local devices. Evidence storage, management and transmission are all based on these systems. However, the security of digital evidence systems has been ignored. Digital evidence system may harbor vulnerabilities. These vulnerabilities can be exploited by attackers, resulting in (1) evidence tampering, in which the evidence may be maliciously modified, removed or untraceable, and (2) privacy leaks. Private information, such as evidence content, evidence providers, and other information, may be leaked. How to maintain the security of digital evidence is worth studying.

Existing secure digital evidence systems such as those described in [1], [9], [27] mostly adopt centralized designs. They provide tamper-resistant mechanisms on a single device or a centralized system via secure software, secure hardware, physical separation or hybrid strategies. The centralized design faces the following challenges: (1) the single point of failure, which may invalidate the system; (2) the scalability issue, which arises if the amount of evidence is too large to store.

The blockchain, which is widely used in cyptocurrency systems [26], [42], is a promising technology that can be used to overcome the foregoing challenges due to its distributed, tamper-resistant and private nature. However, blockchain also faces a scalability issue: blockchain bloat. In a blockchain, each node stores all blocks. As the length of the blockchain increases, the storage requirement for each node also increases. Thus, a lightweight blockchain is demanded for a secure digital evidence system. At the same time, to guarantee the availability and legitimacy of the evidence, the evidence should be traceable. How to track the evidence while ensuring privacy is also another of problems associated with the use of a blockchain.

In this paper, we choose file tampering as a case study and propose a lightweight, scalable secure digital evidence framework using blockchain (Block-DEF). The main contributions of Block-DEF are as follows. First, Block-DEF adopts a loose coupling design. Only the evidence information is stored in the blockchain, and the evidence is stored on a trusted storage platform. Thus, in Block-DEF, the storage pressure is significantly reduced. Second, two multi-signature schemes for evidence submission and retrieval are proposed, such that the traceability and the privacy of evidence are balanced. Third, to avoid blockchain bloat, a lightweight blockchain with a mixed block structure and an optimized name-based practical byzantine fault tolerance (PBFT) consensus mechanism is proposed. Each node only needs to store all the block headers and a part of the block bodies. The results of analyses and experiments show that Block-DEF effectively supports scalability, integrity, validity, privacy and traceability.

The remainders of this paper are organized as follows. Section 2 discusses related work. Section 3 presents the architecture of Block-DEF and Section 4 details the design of Block-DEF. In Section 5, we analyze and evaluate the performance of Block-DEF. We then conclude the paper in Section 6.