Collaborative Research: Secure Provenance in High-End Computing Systems

数据起源记录了影响感兴趣的数据的输入、实体、系统和过程--实际上提供了数据及其起源的历史记录。生成的证据支持基本的取证活动，如数据依赖性分析、错误/危害检测和恢复，以及审计和合规性分析。这个合作项目的重点是理论和系统支持实际的端到端的起源在高端计算系统。在这里，系统的起源当局接受主机级的起源数据，从验证的起源监测，组装一个值得信赖的起源记录。起源监视器从外部观察系统或应用程序，并安全地记录他们操作的数据的演变。起源记录在分布式环境中共享。为了支持这一愿景，探索了识别策略（记录什么来源数据）、可信机构（哪些实体可以断言来源信息）和基础设施（在哪里记录来源数据）的工具和系统。此外，出处有可能损害系统性能：收集太多的出处信息或以低效或侵入性的方式收集信息可能会引入不可接受的开销。作为回应，该项目进一步侧重于了解和降低来源收集成本的方法。

Data provenance documents the inputs, entities, systems, and processes that influence data of interest---in effect providing a historical record of the data and its origins. The generated evidence supports essential forensic activities such as data-dependency analysis, error/ compromise detection and recovery, and auditing and compliance analysis. This collaborative project is focused on theory and systems supporting practical end-to-end provenance in high-end computing systems. Here, systems are investigated where provenance authorities accept host- level provenance data from validated provenance monitors, to assemble a trustworthy provenance record. Provenance monitors externally observe systems or applications and securely record the evolution of data they manipulate. The provenance record is shared across the distributed environment. In support of this vision, tools and systems are explored that identify policy (what provenance data to record), trusted authorities (which entities may assert provenance information), and infrastructure (where to record provenance data). Moreover, the provenance has the potential to hurt system performance: collecting too much provenance information or doing so in an inefficient or invasive way can introduce unacceptable overheads. In response, the project is further focused on ways to understand and reduce the costs of provenance collection.