Provenance-based Auditing of Private Data Use

Abstract

Across the world, organizations are required to comply with regulatory frameworks dictating how to manage personal information. Despite these, several cases of data leaks and exposition of private data to unauthorized recipients have been publicly and widely advertised. For authorities and system administrators to check compliance to regulations, auditing of private data processing becomes crucial in IT systems. Finding the origin of some data, determining how some data is being used, checking that the processing of some data is compatible with the purpose for which the data was captured are typical functionality that an auditing capability should support, but difficult to implement in a reusable manner. Such questions are so-called provenance questions, where provenance is defined as the process that led to some data being produced. The aim of this paper is to articulate how data provenance can be used as the underpinning approach of an auditing capability in IT systems. We present a case study based on requirements of the Data Protection Act and an application that audits the processing of private data, which we apply to an example manipulating private data in a university.

UP-SDCG: A Method of Sensitive Data Classification for Collaborative Edge Computing in Financial Cloud Environment

“…In the realm of data classification and grading, scholars typically commence their endeavors by establishing policies to ensure data compliance, which serves as a foundational step in constructing programs and frameworks for data classification and grading. For instance, Aldeco-Perez et al introduced a compliance analysis framework based on data source and data usage, aligned with the UK Data Protection Act [24,25]. Their approach focuses on averting the misuse of personal sensitive data and evaluating the propriety of its utilization.…”

DiALog

“…In difference to our work they assume that a global model of the observed services is given by the BPEL specification. The authors of (Aldeco-Perez et al, 2008) present an architecture for auditing private data in IT-Systems by collecting provenance information. Their architecture is also based on requirements specified by privacy laws.…”

Provenance in bioinformatics workflows

“…Therefore, on the one hand, data provenance is essential to scientific environments. Many works describe details of data provenance [ 1 , 2 ], classify their characteristics [ 3 ], propose models [ 4 - 7 ] and present practical applications [ 8 , 9 ]. Buneman et al [ 10 ] define data provenance as "the description of the origins of a piece of data and the process by which it arrived in a database" .…”