B2CDMS: A Blockchain-Based Architecture for Secure and High-Throughput Classified Document Logging

The secure management of classified documents containing sensitive information is critical for governments, military organizations, and the industry. Traditional data loss prevention (DLP) systems lack robustness against insider threats, particularly regarding access log integrity and tamper-proof auditing. To address log security, the previous literature has proposed multiple solutions, including private and hybrid blockchain models (e.g., Ethereum + MultiChain) to ensure audit trail integrity. However, hybrid architectures often face challenges such as unpredictable transaction costs (gas fees) and potential privacy risks when scaled for enterprise DLP logs. Conversely, private architectures may require higher resources, potentially causing bottlenecks on endpoints. In this paper, we propose an optimized Blockchain-Based Classified Document Management System (B2CDMS) utilizing a permissioned architecture. Our work demonstrates the challenges, advantages, and weak points of current solutions. We optimized a permissioned blockchain (BC) (Hyperledger Fabric v2.5) with an External Chaincode Builder using the Chaincode-as-a-Service (CCaaS) pattern. We compared our proposed private architecture with a hybrid architecture (Ethereum + MultiChain) and a public solution (Ethereum). We conducted a comprehensive analysis using pseudo Trellix ePolicy Orchestrator (ePO) Data Loss Prevention (DLP) logs. Experimental results on an Apple Silicon M4 (Apple Inc., Cupertino, CA, USA) testbed show that the proposed architecture achieves a throughput of 845.8 Transactions Per Second (TPS) with a sub-second latency of 55 ms, aiming to eliminate the bottlenecks of public blockchains. Furthermore, the system introduces a privacy-preserving hashing mechanism (i.e., committing only deterministic Secure Hash Algorithm 256-bit (SHA-256) digests to the immutable ledger while keeping the actual sensitive Personally Identifiable Information (PII) strictly in off-chain databases) compliant with General Data Protection Regulation (GDPR). It ensures that classified document metadata remains immutable and secure against rogue access benefiting from admin privileges. This study concludes that permissioned blockchain architectures offer a scalable and resource-efficient solution for forensic evidence preservation throughout the classified document lifecycle.