## 6 System Architecture  
The proposed system architecture is depicted in Figure 4, which provides a detailed representation of all the components. The proposed methodology has been named the Gini index and blockchain-based framework for detecting blackhole and greyhole attacks and is referred to as GBG-RPL in this study. To execute the simulations for this study, three types of nodes were considered--the fog node, sink node, and child node. The Cooja simulator was used under predetermined parameters. The child nodes at the device layer keep an eye on their neighbors' packet-forwarding behavior along with the energy use, message overhead, and end-to-end delay. These parameters are sent to the fog server at predetermined intervals via the sink/root node. The fog node calculates the trust value using the Gini index, which is subsequently saved in the BRGTL. The global trust list is kept up-to-date as a decentralized ledger that is distributed to child nodes for attack detection and decision making as to whether to accept a node's request to join them as a child. As a mitigating mechanism, a node would likely be isolated and blacklisted from the network if the Gini index value were \(>\)0.5. The proposed system architecture is divided into different modules, as described below:  
1. Observer and Acquirer/Direct Trust Collector: The sink/root node and the resource-constrained nodes are the two types of nodes present in the device layer. The computing, storage, and energy capacities of these nodes are constrained. According to the RPL architecture, these nodes are either parent or child nodes. The parent nodes carry out the functions of the observer and acquire trust parameters. In the proposed architecture, these nodes are performing two functions named observer and acquirer. The parent nodes observe the parameters of their neighbor nodes and child nodes, such as the packet loss, energy usage, end-to-end delay, and message overhead during normal RPL operations of the CPS, and pass these parameters to the sink/root node. The acquirer function collects the parameters, while the observer function monitors the behavior of the nodes. In the event that a child node is flagged as malicious in the global trust list, the parent nodes remove that child node from the CPS network. The RPL becomes unstable, and its rebuilding process is initiated whenever a node enters or exits the network. Following that, the CPS network resumes its regular RPL activities. 2. Dispatcher-Eliminator: As per the proposed framework, the sink/root node has more processing power, storage, and enhanced energy backup in comparison to other nodes at the device layer. The root node has two primary functions, including dispatcher and eliminator. To connect the device layer and the fog layer, the sink/root node acts as a link. As all traffic between the fog layer and device layer is routed through the sink node, the root node also serves as the cluster head. The dispatcher function gathers all trust parameters received from the parent nodes at the device layer of the CPS network and forwards the same to the fog server at the fog layer. Furthermore, the eliminator function receives the revised BRGTL from the fog layer and forwards or broadcasts downwards to all member nodes at the device layer. The root itself is not making any decisions, and it is only receiving and forwarding the traffic between the device and the fog layer. 3. Device Discoverer: The device discoverer module is a vital component of the proposed framework, operating at the fog layer to keep track of all nodes entering and leaving the CPS network. Its main function is to maintain a comprehensive record of node activity, which is essential for network management and security. This module forwards its processed device list to the trust parameter accumulator module and blockchainledger updater (smart contract) module. A comprehensive working overview of the device discoverer module is described below.