Skip to main content

Detailed text description: Confidential architecture overview

This page provides a long description of the overview diagram used in the Confidential architecture article. It shows how confidential services run inside untrusted infrastructure.

Overview​

Background colors mark trust. Green areas are trusted. Red areas with a dashed border are untrusted. The whole diagram sits inside a red area labeled untrusted infrastructure. It includes the hardware, the hypervisor, the platform, the storage and the network.

Main components​

  1. Host with TEE support:
  • A gray area inside the untrusted infrastructure.
  • Runs two confidential micro-VMs.
  1. Confidential micro-VMs:
  • Two green areas inside the host.
  • The first micro-VM contains service A.
  • The second micro-VM contains service B.
  1. Storage backend:
  • Positioned below the host, still inside the untrusted infrastructure.

Connections​

  1. Service A and service B talk to each other over the service mesh with mutual TLS (mTLS).
  2. The micro-VM of service A writes LUKS encrypted blocks to the storage backend.