Audit Log Service  ·  View 13 of 40  ·  3 · Structure

The Shape of the Hash Chain

Four levels from a record's bytes to a signed global checkpoint — the answer to the first core question in the requirement.

Editable source SVG draw.io All views
Level 1 — the record Canonical Bytes stored form, never re-encoded Leaf Hash SHA-256 with domain tag Leaf Index position within segment Level 2 — the segment, sealed at most every 60 seconds Merkle Tree RFC 6962 hashing Segment Root one per sealed object Segment Header prev_root, count, range Object Digest binds bytes to root Level 3 — one chain per tenant, so a proof reveals no other tenant Tenant Head hash of prev head + root Parallel Sealing 500 chains, no contention Tenant-Blind Proof path stays inside tenant Tombstone Link survives disposal Level 4 — one global checkpoint every 15 minutes binds every tenant Checkpoint Tree over all tenant heads HSM Signature non-exportable key TSA Countersign external clock Ledger Publication separate custody Public Witness Log Rekor · phase 3 leaves extends anchors phase 3 anchor The Shape of the Chain — Per-Tenant, Anchored Globally Application we own Data store Security / platform External / third party synchronous event / async Question 1 answered: per-tenant chains anchored into a global checkpoint. One global chain would serialise sealing at 100 k events/s and leak cross-tenant volume through every Merkle path; independent per-tenant chains would leave a tenant-scoped attacker a small structure to forge. v 1.0 · owner Data & AI Global Practice · date 2026-09

Question 1 answered

  • Per-tenant chains, anchored into a global checkpoint every 15 minutes. Not one global chain and not independent per-tenant chains.
  • One global chain gives the strongest ordering claim, but it serialises sealing at 100 k events/s and leaks cross-tenant volume through every Merkle path an export must reveal.
  • Independent per-tenant chains parallelise cleanly but leave an attacker with tenant-scoped access a small structure to forge. The global checkpoint binds every tenant head, so forging one tenant's history means forging a signature over all of them.

What it buys

  • Inclusion proofs are tenant-blind: a proof path stays inside its own tenant's tree and reveals nothing about anyone else's volume or timing.
  • 500 chains extend in parallel, which removes sealing throughput as a design constraint.
  • Cross-tenant ordering is still evidence when it needs to be, because the checkpoint fixes every tenant head at the same instant against an external timestamp.

Risks

  • Between checkpoints, a tenant's chain is only as strong as the chain itself. The exposure window is 15 minutes, and shortening it is a cost decision (HSM operations and ledger writes), not a redesign.
◀  Integration Surface All views Data Architecture  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 40 views · Microsoft Azure and open source13-hash-chain-structure