DATA PROVENANCEARCHITECTURETO SUPPORTINFORMATIONASSURANCE IN A MULTI-LEVELSECURE ENVIRONMENT

We describe aframeworkfor capturing Data Provenance information to support Information Assurance attributes like Availability, Authentication, Confidentiality, Integrity and Non-Repudiation. Our approach is applicable to Multi-Level Secure systems where it is not always possible to directly provide data source and data transformation information. We achieve this by combining the subjective and objective trust in data as a "FigureofMerit" value that can cross security boundaries. Our architecture captures the Data Provenance information around the 'invariant'part ofa message in an XML-based SOA architecture. We also introduce the notion of 'wrappers' so that Data Provenance can be added on while minimizing impact to an existing workflow. We outline a simulation-basedframeworkthat allows us to inject faults to model various threats and attacks. We also discuss a dashboard view of a workflow that brings together the intrinsic Information Assurance attributes ofa workflow as it was designed as well as its execution in a deployed system. The dashboard can also be used for "what-if' analysis to understand vulnerabilities and determine impactofcompromised assets.