Verifying Digital Provenance in Web Services

Web services often combine or ´´mashup´´ a collection of heterogeneous data sources. Service providers take data from various sources, including other service providers, and perform some computation or combination of the results and present it to the user. This paper is concerned with the provenance of data provided by web services. Provenance for services includes where the information that is provided by the service originated and who has operated on it. We use a provenance tag that is passed along with the result of the service and contains enough information to recreate a provenance graph. We consider the methods a malicious participant could use to try and fake this provenance information and provide a threat model and security analysis to show our protocol prevents these attacks. We also discuss exclusion attacks where a service provider tries to exclude some input from the provenance information provided.