Skip to main content

Detailed text description: Confidential encryption at rest

This page provides a long description of the encryption at rest diagram used in the Confidential architecture article. It shows where persistent data is encrypted before it reaches storage.

Overview​

Background colors mark trust. Green areas are trusted. Red areas with a dashed border are untrusted. A green confidential micro-VM sits inside a red area labeled untrusted infrastructure, which includes the host and the storage. Data exists in plain text only inside the micro-VM.

Main components​

  1. Inside the confidential micro-VM, from left to right:
  • The service.
  • The file system.
  • LUKS (dm-crypt).
  1. Storage backend:
  • Positioned to the right, outside the micro-VM but inside the untrusted infrastructure.

Data flow​

  1. The service writes files to the file system.
  2. The file system writes through LUKS, which encrypts the data.
  3. Only encrypted blocks leave the micro-VM and reach the storage backend.