Verify the integrity of Azure Confidential Ledger transactions with receipts and application claims
In today's digital landscape, the integrity and confidentiality of transactional data are paramount. Microsoft’s Azure Confidential Ledger offers a robust solution for maintaining the privacy and confidentiality of your data. The service utilizes cryptographic techniques to generate transaction receipts, which serve as immutable evidence of the ledger's state at a specific point in time. These receipts are crucial for businesses that require a high level of trust and transparency in their operations.
Write receipts
The value proposition of Azure Confidential Ledger write receipts lies in their ability to provide a verifiable trail of all write transactions. Azure Confidential Ledger leverages the Confidential Consortium Framework (CCF), which ensures the integrity of transactions by using a Merkle tree data structure to store the hash of all transaction blocks that are added to the immutable ledger.
How write transactions are recorded in the ledger using an internal Merkle Tree data structure in CCF.
When a write transaction is completed, Azure Confidential Ledger users can obtain a cryptographic Merkle proof, or receipt, over the entry created in a Confidential Ledger to check that the write operation was recorded correctly. A write transaction receipt is evidence that the system has committed the corresponding transaction and can be used to confirm that the entry has been successfully appended to the ledger. This ensures that once a transaction has been committed to the ledger, it cannot be altered or deleted without detection.
For more details on Azure Confidential Ledger write receipts, their structure, and how to get a receipt from an active ledger, please refer to this dedicated article.
Application claims
Application claims take receipts a step further by allowing users to attach arbitrary metadata to a transaction, which are eventually reflected in write receipt response payloads. This metadata includes details specific to the transaction's context, such as the collection ID and the input content of a write operation. The application claims of a write transaction ensure that the claims digest is signed securely and stored together with the transaction itself, meaning that it cannot be tampered with once the transaction is committed.
Example of an application claim attached to a write receipt response payload.
Later, the application claims in plain format are shown in the receipt payload for the same transaction where they were added. Using the claims in plain format, users can recalculate the same claims digest (available in the write receipt) that the ledger signed in place during the transaction to verify the claim authenticity. The claims digest can help verify the write transaction receipt, giving an offline way for users to check the authenticity of the recorded claims.
By leveraging application claims, organizations can tailor the ledger to their specific needs, enhancing the utility and relevance of the data stored within receipts. Application claims are currently supported in the Azure Confidential Ledger preview API version 2023-01-18-preview and their current format is documented in this article.
Receipts and claims verification
The process of verifying write transaction receipts and application claims is straightforward and secure. Utilizing cryptographic proofs, users can independently confirm the authenticity and integrity of each transaction offline, without having to connect to the ledger or trust any central authority.
The Azure Confidential Ledger client library for Python offers useful functions to validate receipts of write transactions and calculate the claims digest from a list of application claims in an easy and seamless manner. With this verification utility, any write receipt from a Confidential Ledger service can be verified with ease and any application claims associated with the transaction can be fully authenticated.
How to verify receipts (with optional application claims) using the Azure Confidential Ledger Python SDK.
The decentralized and offline approach to verification bolsters the security and reliability of the system, making Azure Confidential Ledger an ideal platform for applications that demand the highest levels of data integrity. To learn more about the Data Plane Python SDK and its receipt verification utilities, check out this section and the full sample code.
Conclusion
In conclusion, Azure Confidential Ledger's receipts and application claims offer a compelling value proposition for organizations looking to secure their transactional data. With its strong focus on integrity, confidentiality, and verifiability, Azure Confidential Ledger stands out as a leading solution in the realm of confidential computing. Whether you are managing financial transactions, supply chain management, or any other data-sensitive operation, Azure Confidential Ledger provides the assurance that your data remains untampered and trustworthy through transaction receipts and application claims.
Resources
For getting started with Azure confidential ledger write receipts and application claims, please refer to our documentation:
Published on:
Learn moreRelated posts
Azure NetApp Files now stores sensitive data DoD IL5 compliant in Azure US Government regions
Table of Contents Introduction Why Azure NetApp Files? DoD IL5 compliance in Azure Government Azure NetApp Files reaches feature parity betwee...
Enhancements to Azure Monitor Baseline Alerts for Azure Landing Zones
Introduction Welcome to our latest blog post where we dive into a number of exciting new key updates, highlight the new portal accelera...
Azure Cosmos DB Vector Search with DiskANN Part 1: Full Space Search
Vector Search with Azure Cosmos DB Azure Cosmos DB NoSQL features advanced vector indexing and search capabilities powered by DiskANN, a suite...
Azure Developer CLI (azd) – September 2024
This post announces the September release of the Azure Developer CLI (`azd`). Including remote container build support, multiple hooks per eve...
IBM Power Virtual Server and Microsoft Azure Multi-cloud Integration Patterns
IBM Power Virtual Server and Microsoft Azure Multi-cloud Integration Patterns &nbs...
Azure CLI docker container base Linux image is now Azure Linux
Starting from the version 2.64.0 of Azure CLI, the base Linux distribution of Azure CLI is now Azure Linux. Impact of the change ...
Enhancing Data Security and Digital Trust in the Cloud using Azure Services.
Introduction Think of Client-Side Encryption (CSE) as a strategy that has proven to be most effective in augmenting data security and ...
Optimizing Azure Table Storage: Automated Data Clean-up using a PowerShell script with Azure Automat
Scenario This blog’s aim is to manage Table Storage data efficiently. Imagine you have a large Azure Table Storage that accumulates logs from ...
Exciting New Features for GitHub Copilot for Azure
We've been on a roll adding new features to the private preview and we've added some of my favorites in our latest release! Building App...