Collaborative Research: Secure Provenance in High-End Computing Systems

数据来源记录了影响感兴趣数据的输入、实体、系统和过程-实际上提供了数据及其来源的历史记录。生成的证据支持基本的取证活动，如数据依赖分析、错误/危害检测和恢复以及审计和合规分析。这个合作项目的重点是高端计算系统中支持实际端到端来源的理论和系统。在这里，种源当局接受来自经过验证的种源监测器的寄主级别的种源数据，以汇编可信的种源记录的系统被调查。出处监控器从外部观察系统或应用程序，并安全地记录它们处理的数据的演变。来源记录在整个分布式环境中共享。为支持这一愿景，探索了确定政策(记录什么来源数据)、受信任的当局(哪些实体可以断言来源信息)和基础设施(记录来源数据的位置)的工具和系统。此外，来源有可能损害系统性能：收集太多的来源信息或以低效或侵入性的方式这样做可能会带来不可接受的开销。作为回应，该项目进一步侧重于如何了解和减少种源收集的成本。

Data provenance documents the inputs, entities, systems, and processes that influence data of interest---in effect providing a historical record of the data and its origins. The generated evidence supports essential forensic activities such as data-dependency analysis, error/ compromise detection and recovery, and auditing and compliance analysis. This collaborative project is focused on theory and systems supporting practical end-to-end provenance in high-end computing systems. Here, systems are investigated where provenance authorities accept host- level provenance data from validated provenance monitors, to assemble a trustworthy provenance record. Provenance monitors externally observe systems or applications and securely record the evolution of data they manipulate. The provenance record is shared across the distributed environment. In support of this vision, tools and systems are explored that identify policy (what provenance data to record), trusted authorities (which entities may assert provenance information), and infrastructure (where to record provenance data). Moreover, the provenance has the potential to hurt system performance: collecting too much provenance information or doing so in an inefficient or invasive way can introduce unacceptable overheads. In response, the project is further focused on ways to understand and reduce the costs of provenance collection.