Hiding Data and Structure in Workflow Provenance

In this paper we discuss the use of views to address the problem of providing useful answers to provenance queries while ensuring that privacy concerns are met. In particular, we propose a hierarchical workflow model, based on context-free graph grammars, in which fine-grained dependencies between the inputs and outputs of a module are explicitly specified. Using this model, we examine how privacy concerns surrounding data, module function, and workflow structure can be addressed.