Skip to main content

Detailed text description: Regular service compared to a confidential service

This page provides a long description of the diagram used in the What is confidential compute article. It compares what you have to trust when you run a regular service and when you run a confidential service.

Overview​

The diagram has two parts side by side. Background colors mark trust. Green areas are trusted. Red areas with a dashed border are untrusted.

Regular service​

  1. Trusted infrastructure:
  • Shown as a green area.
  • Includes the hosts, the hypervisor, the platform and the operators.
  1. Your service:
  • Runs directly inside the trusted infrastructure.
  • Its protection depends on trusting everything around it.

Confidential service​

  1. Untrusted infrastructure:
  • Shown as a red area with a dashed border.
  • Includes the hosts, the hypervisor, the platform and the operators.
  1. Confidential sandbox:
  • Shown as a green area inside the untrusted infrastructure.
  • Is a trusted execution environment (TEE) provided by the CPU.
  1. Your service:
  • Runs inside the confidential sandbox.
  • Is protected from the untrusted infrastructure around it.