Monitoring Provenance of Delegated Personal Data with Blockchain

Abstract

Personal data are shared by their owners with service providers for different needs, and these data can be modified and further shared among other service providers. For transparency and accountability of such delegated data, a personal data provenance monitoring system recording how owners' data are propagated and modified is necessary. However, achieving this involves significant challenges, due to the decentralized relationship of different service providers. Therefore, we propose to use blockchain to track the provenance of owners' data. However, for privacy reasons, what service providers can upload to the blockchain is limited to some sharing records that do not reveal data contents, and blockchain peers must validate them without actual data contents. We propose a new extended vector commitment (EVC) scheme for monitoring personal data provenance in third-party services. Unlike existing vector commitment (VC) schemes, EVC has extended algorithms that keep data contents secret against verifiers. We use the EVC scheme to develop a system that allows (1) blockchain peers to check the consistency between insertion/deletion operations and sharing records and (2) data owners to monitor the provenance of delegated personal data. Our experiment with Hyperledger Fabric and real implementations shows that the extra overhead is negligible in most processes and well acceptable in others.