Preventing history forgery with secure provenance

Abstract

As increasing amounts of valuable information are produced and persist digitally, the ability to determine the origin of data becomes important. In science, medicine, commerce, and government, data provenance tracking is essential for rights protection, regulatory compliance, management of intelligence and medical data, and authentication of information as it flows through workplace tasks. While significant research has been conducted in this area, the associated security and privacy issues have not been explored, leaving provenance information vulnerable to illicit alteration as it passes through untrusted environments.In this article, we show how to provide strong integrity and confidentiality assurances for data provenance information at the kernel, file system, or application layer. We describe Sprov, our provenance-aware system prototype that implements provenance tracking of data writes at the application layer, which makes Sprov extremely easy to deploy. We present empirical results that show that, for real-life workloads, the runtime overhead of Sprov for recording provenance with confidentiality and integrity guarantees ranges from 1% to 13%, when all file modifications are recorded, and from 12% to 16%, when all file read and modifications are tracked. This is an expanded version of a paper presented at the 7th USENIX Conference on File and Storage Technologies (FAST), Hasan et al. [2009]. R. Hasan and M. ACM Reference Format:Hasan, R., Sion, R., and Winslett, M. 2009. Preventing history forgery with secure provenance.

A Formal Framework for Provenance Security

“…Hasan et al [16] and Braun et al [17] set out a number of research questions, as does a more recent position paper by Davidson et al [20]. Hasan et al [10] develop a mechanism for securing the provenance describing a chain of revisions of a document (say, a file in a file system), using appropriate encryption and digital signatures to allow auditors to check the integrity of the provenance without necessarily having access to the underlying data or vice versa. Zhang et al [18] develop tamper-detection techniques for provenance in databases.…”

“…In particular, our model does not have much to say about dynamic provenance in extant systems that seek to record all changes to some shared data [26], or to maintain the integrity of provenance records in a stateful system (e.g. file system) and prevent forgery [10]. We believe that modeling this kind of situation will require further extensions to our model to permit principals to both read and write data and communicate with one another, and to model what can be learned by multiple interactions with the system or other principals.…”

“…Among these, the first three seem to address subjective concerns where there is not necessarily a unique way of framing the problem or deriving solutions. The many different models for and implementations of provenance in different systems, such as databases [12], [13], workflow management systems [7], [8], and storage systems [10], [11], suggests that there may be no single definition that applies to all these situations, nor an obvious choice of "best" or most general provenance mechanism even for a specific system. Indeed, it seems likely that the answer to question (2) is actually "no", since any real system can be modeled at finer and finer levels of granularity.…”

“…This is a motivation for work on provenance in curated databases [26] and security aspects of this situation are also considered by Zhang et al [18] and Hasan et al [10], [16].…”

Document Provenance in the Cloud: Constraints and Challenges

“…Many other works on provenance addresses specific problems like provenance in software development known as versionning systems which manages distributed intra-files provenance but are not able to manage inter-files provenance. We also mention recent work on securing provenance from tempering based on cryptographic mechanisms [12]. The particularity of the provenance needs in our work is the superposition of a set of traditional provenance constraints with cloud specific constraints.…”