Internet　of　things　are　increasingly　being　deployed　over　the　cloud　(also　referred　to　as　cloud　of　things)　to　provide　a　broader　range　of　services.　However,　there　are　serious　challenges　of　CoT　in　the　data　protection　and　security　provenance.　This　paper　proposes　a　data　privacy　protection　and　provenance　model　(DPSPM)　based　on　CoT.　It　can　protect　the　privacy　data　of　the　users　and　trace　the　source　of　leaked　data.　In　detail,　security　encryption　and　watermarking　algorithms　are　proposed.　Meanwhile,　we　use　the　improved　k-anonymity　data　masking　algorithm　and　pseudo-row　watermarking　algorithm　in　this　scheme.　Those　algorithms　can　carry　out　security　control　over　the　whole　process　of　data　publishing,　especially　in　data　encryption,　data　masking　and　provenance　verification.　Finally,　the　experimental　results　show　that　our　scheme　has　good　efficiency.　It　is　proved　that　the　data　masking　time　is　proportional　to　the　parameters　k　and　L,　the　results　also　show　good　robustness　to　the　common　database　watermarking　attacks.　©　2020　Inderscience　Enterprises　Ltd.