Preventing history forgery with secure provenance

TLDR

Provenance tracking is essential for rights protection, compliance, and authentication across science, medicine, commerce, and government, yet its security and privacy aspects remain largely unaddressed, leaving provenance data vulnerable to tampering. The article aims to demonstrate how to provide strong integrity and confidentiality guarantees for provenance data at the kernel, file‑system, or application layer. The authors implement Sprov, a lightweight application‑layer provenance system that records data writes while ensuring confidentiality and integrity. Empirical evaluation shows that Sprov incurs 1–13 % overhead for full write recording and 12–16 % when both reads and writes are tracked under real‑life workloads.

Abstract

As increasing amounts of valuable information are produced and persist digitally, the ability to determine the origin of data becomes important. In science, medicine, commerce, and government, data provenance tracking is essential for rights protection, regulatory compliance, management of intelligence and medical data, and authentication of information as it flows through workplace tasks. While significant research has been conducted in this area, the associated security and privacy issues have not been explored, leaving provenance information vulnerable to illicit alteration as it passes through untrusted environments. In this article, we show how to provide strong integrity and confidentiality assurances for data provenance information at the kernel, file system, or application layer. We describe Sprov, our provenance-aware system prototype that implements provenance tracking of data writes at the application layer, which makes Sprov extremely easy to deploy. We present empirical results that show that, for real-life workloads, the runtime overhead of Sprov for recording provenance with confidentiality and integrity guarantees ranges from 1% to 13%, when all file modifications are recorded, and from 12% to 16%, when all file read and modifications are tracked.