1. Formalising a protocol for recording provenance in Grids Paul Groth – pg03r@ecs.soton.ac.uk University of Southampton

2. Or…How to show your work. In a Grid

3. Contents 1. What is Provenance and why you should care. 2. The Grid and Provenance 3. An Architectural Vision 4. PReP 5. Let’s get formal (yawn….) 6. What’s next. 7. Conclusion

4. A Definition Main Entry: prov·e·nance Pronunciation: 'präv-n&n(t)s, 'prä-v&- "nän(t)s Function: noun Etymology: French, from provenir to come forth, originate, from Latin provenire, from pro- forth + venire to come Date: 1785 1 : ORIGIN, SOURCE 2 : the history of ownership of a valued object or work of art or literatureORIGINSOURCE Documentation of Process i.e. showing your work

5. The importance of provenance Process is IMPORTANT Art Wine Drug Discovery Financial Auditing Aerospace …

6. The Grid The Grid problem is defined as coordinated resource sharing and problem solving in dynamic, multi- institutional virtual organisations [FKT01]. Effort is required to allow users to place their trust in the data produced by such virtual organisations

7. … and the Provenance Problem Given a set of services in an open grid environment that decide to form a virtual organisation with the aim to produce a given result; How can we determine the process that generated the result, especially after the virtual organisation has been disbanded?

8. Provenance Problem cont. Provenance recording should be part of the infrastructure, so that users can elect to enable it when they execute their complex tasks over the Grid or in Web Services environments. Currently, the Web Services protocol stack and the Open Grid Services Architecture do not provide any support for recording provenance. Methods are generally adhoc and do not interoperate.

9. Execution Provenance 2 Types Provenance about an interaction Provenance about an actor Provenance is not a one way street No standard way to record execution provenance.

10. An Architecture

11. An Architecture with Provenance Support

12. PReP- Provenance Recording Protocol clientservice invocation result Provenance Service record invocation and result record invocation and result negotiate Why record 2 views?

13. Provenance Service 3 clientservice invocation result Provenance Service invocation and result record invocation and result record clientservice invocation result Provenance Service invocation and result record invocation and result record clientservice invocation result Provenance Service invocation and result record invocation and result record Provenance services may be shared or different

14. Linking Records clientservice invocation result Provenance Service invocation and result record invocation and result record clientservice invocation result Provenance Service invocation and result record invocation and result record clientservice invocation result Provenance Service invocation and result record invocation and result record Provenance Record Record Link

15. PReP in detail Model PReP using asynchronous message passing. Maps well to any implementation Helpful for scalability Four Phase Protocol Negotiation Invocation Provenance Recording Termination

16. PReP’s messages Propose Reply Invoke Result Record Negotiation Record Invocation Record Result Submission Finished Additional Provenance Record Negotiation Ack Record Invocation Ack Record Result Ack Submission Finished Ack Additional Provenance Ack

17. PReP’s messages Propose Reply Invoke Result Record Negotiation Record Invocation Record Result Submission Finished Additional Provenance Record Negotiation Ack Record Invocation Ack Record Result Ack Submission Finished Ack Additional Provenance Ack Used for connecting provenance records and for recording provenance about actors.

18. Provenance Service – An abstract state machine Formalise the protocol by formalising the individual entities in the protocol Know exactly how the Provenance Service responds to receipt of messages Use to show a liveness property Something good will eventually happen

20. Rules of the Provenance Service’s ASM

21. Client and Service State transition diagram Cannot formalise internals, only the response to PReP Show Termination Property

23. VRML Demo

24. Sketch showing Liveness Goal Submission Finished Ack Sent Assume Client & Service are live Communication channels work Personally, do not like this assumption Finite number of additional prov msgs Show termination of Client & Service using graph ASM rules guarantee that the provenance service fills up. Notify rule fires. Ack Sent Q.E.D.

25. What’s next? Security Support some “classical” properties of distributed algorithms. Using mutual authentication, an invoked service can ensure that it submits data to a specific provenance server, and vice-versa, a provenance server can ensure that it receives data from a given service. With non-repudiation, we can retain evidence of the fact that a service has committed to executing a particular invocation and has produced a given result. We anticipate that cryptographic techniques will be useful to ensure such properties

26. But wait there’s more… Err…What if you have a lot of data? Look at scalability A real (prototype) provenance service We have one in the lab Now let other people use it And along comes trust

27. Conclusion Provenance is important Execution provenance is the first layer Provenance recording must be part of the infrastructure. Standards. Start from specification not implementation. PReP is a first start. …and it’s cool.

28. Acknowledgements Luc Moreau Michael Luck Victor Tan Simon Miles

29. Visit http://www.pasoa.orghttp://www.pasoa.org E-mail me: pg03r@ecs.soton.ac.ukpg03r@ecs.soton.ac.uk The End