You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: samples/features/security/ledger/sql-server/README.md
+22-22Lines changed: 22 additions & 22 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -45,18 +45,18 @@ You also need to make sure the following software is installed on your machine:
45
45
1. Open the file [CreateDatabaseSchemaAndPopulateDatabase.sql](../sql-server/setup/CreateDatabaseSchemaAndPopulateDatabase.sql)
46
46
1. Go to line 12 and replace **YourStorageAccountName** with the name of the Azure storage account you just created.
47
47
1. Run the script. This will
48
-
1. Create the database
49
-
1. Create the database schema
50
-
1. Create a function to calculate the payout
51
-
1. Create a stored procedure to place bets
52
-
1. Configure the automatic digest storage
48
+
1. Create the database.
49
+
1. Create the database schema.
50
+
1. Create a function to calculate the payout.
51
+
1. Create a stored procedure to place bets.
52
+
1. Configure the automatic digest storage.
53
53
1. Populate the database.
54
54
55
55
### Web Application
56
56
57
-
1. Open Visual Studio
58
-
1. Open the folder [WorldCup](../source/WorldCup/)
59
-
1. Click on the file Program.cs in the Explorer and go to line 25
57
+
1. Open Visual Studio.
58
+
1. Open the folder [WorldCup](../source/WorldCup/).
59
+
1. Click on the file Program.cs in the Explorer and go to line 25.
60
60
1. Change the *Server* parameter in the connection string to the name of your SQL Server Instance.
61
61
1. Save your modifications.
62
62
@@ -71,46 +71,46 @@ In this demo you will use 2 different types of users:
71
71
- Pieter, the DBA of the company.
72
72
- Michael, who is an internal auditor.
73
73
74
-
All the games and bets that are placed needs to be immutable. Using ledger tables is a good solution for this since the data of all the bets and the games needs to be fully trusted. It prevents the company from removing or updating any placed bets. Pieter, who has placed a few bets on some games, wants to maliciously increase his payout. Unfortunately for Pieter, the bets table is an append-only ledger table, which means he can't change his bets with regular T-SQL updates. Pieter knows how to tamper with the data directly in the data file and thinks his change will never be noticed. However, Michael reviews the Worldcup database after the tournament is over and noticed that the verification procedure fails, which means that the data cannot be trusted.
74
+
All the games and bets need to be immutable. Using ledger tables is a good solution for this since the data of all the bets and the games needs to be fully trusted. It prevents the company from removing or updating any placed bets. Pieter, who has placed a few bets on some games, wants to maliciously increase his payout. Unfortunately for Pieter, the bets table is an append-only ledger table, which means he can't change his bets with regular T-SQL updates. Pieter knows how to tamper with the data directly in the data file and thinks his change will never be noticed. However, Michael reviews the Worldcup database after the tournament is over and noticed that the verification procedure fails, which means that the data cannot be trusted.
75
75
76
76
### Prepare for the demo
77
77
78
78
Perform the below steps before you show the demo.
79
79
80
-
1. Connect to the database
80
+
1. Connect to the database.
81
81
1. Start the Azure Data Studio.
82
-
1. Open the Notebook [Ledger - World Cup Demo - SQL Server 2022](../sql-server/tsql-scripts/Ledger%20-%20World%20Cup%20Demo%20-%20SQL%20Server%202022.ipynb)
82
+
1. Open the Notebook [Ledger - World Cup Demo - SQL Server 2022](../sql-server/tsql-scripts/Ledger%20-%20World%20Cup%20Demo%20-%20SQL%20Server%202022.ipynb).
83
83
1. Attach the Notebook to the SQL Server Instance and WorldCup database you have created during the demo Setup.
84
84
85
-
1. Prepare a browser window.
86
-
1. Open Visual Studio
87
-
1. Open the folder WorldCup](../source/WorldCup/)
88
-
1. Go to the top menu and click *Terminal - New Terminal*
85
+
1. Prepare a browser window.
86
+
1. Open Visual Studio.
87
+
1. Open the folder [WorldCup](../source/WorldCup/).
88
+
1. Go to the top menu and click *Terminal - New Terminal*.
89
89
1. In the terminal window type *dotnet run*. This will launch the web application.
90
-
1. Open your browser and enter the following URL *http://localhost:3000*
90
+
1. Open your browser and enter the following URL *http://localhost:3000*.
91
91
92
92

93
93
94
94
### Demo steps
95
95
96
96
1. Show the app and the database.
97
-
1. Show the Contoso World Cup web app in the browser. Explain that this is a list of all the soccer games. Show that you are logged in as Pieter (the DBA of the company) and place a bet.
97
+
1. Show the Contoso World Cup web app in the browser. Explain that this is a list of all the soccer games. Show that you are logged in as Pieter (the DBA of the company), fill in an amount and place a bet.
1. Once you have placed the bet, show that the user can download a cryptographic receipt that proves the bet. This receipt could also be used to verify the database afterwards but this is not part of the demo.
99
+
1. Once you have placed the bet, show that the user can download a cryptographic receipt of his/her bet. This receipt could also be used to verify the database afterwards but this is not part of the demo.
1. Go to the Notebook and show the 2 tables, Moneyline and bets in the Explorer. Explain that Moneyline table is an updatable ledger table and bets an append-only ledger table.
101
+
1. Go to the Notebook and show the 2 tables, *Moneyline* and *Bets* in the Explorer. Explain that *Moneyline* table is an updatable ledger table and *Bets* an append-only ledger table.
1. Run the `code cell 1` in the Notebook to show the games in the Moneyline table.
104
+
1. Run the `code cell 1` in the Notebook to show the games in the *Moneyline* table.
105
105
106
-
1. Show how ledger captures history information in the updatable ledger table
106
+
1. Show how ledger captures history information in the updatable ledger table.
107
107
1. Pieter has been asked to change the Home Country Odds for the game with ID 1. Run `code cell 2` in the Notebook to update the record.
108
108
1. Run `code cell 3` in the Notebook to show the history of the updated record. Explain that updates are stored as 2 records in the history table. A delete of the old version and an insert of the new version of the row.
109
109
110
110
1. Show how append-only ledger table works and how ledger helps investigate tampering by DBAs.
111
111
1. Michael, who is an internal auditor, performs a routine review of changes in the Worldcup database. As his first step, Michael runs the ledger verification to be sure he can trust the data he’s going to examine. Run `code cell 4` to execute the verification stored procedure. The result should be "Ledger verification succeeded."
112
112
1. Pieter wants to maliciously increase his payout for the game he betted on. Run `code cell 5 and 6` to try to update the record. Explain that update on an append-only ledger table is blocked.
113
-
1. Pieter thinks he's smart and tampers with the data directly into the data file by using a stored procedure. Do not run`code cell 7` because the stored procedure does not exists.
113
+
1. Pieter thinks he's smart and tampers with the data directly into the data file by using a stored procedure. **DO NOT RUN**`code cell 7` because the stored procedure does not exists.
114
114
1. Michael, reviews the Worldcup database again after the tournament is over. He noticed that the verification procedure failed. Observe the results of `code cell 8` to see evidence of tampering in a database ledger. **DO NOT RUN** the cell just review the pre-run results to see tampering in action.
115
115
1. Review the history of the transaction and show to the audience that you can verify which transactions cannot be trusted. Observe the results of `code cell 9` but **DO NOT RUN** the cell just review the pre-run results.
0 commit comments