Detailed text description: Confidential encryption at rest

This page provides a long description of the encryption at rest diagram used in the Confidential architecture article. It shows where persistent data is encrypted before it reaches storage.

Overview​

Background colors mark trust. Green areas are trusted. Red areas with a dashed border are untrusted. A green confidential micro-VM sits inside a red area labeled untrusted infrastructure, which includes the host and the storage. Data exists in plain text only inside the micro-VM.

Main components​

1. Inside the confidential micro-VM, from left to right:

• The service.
• The file system.
• LUKS (dm-crypt).

2. Storage backend:

• Positioned to the right, outside the micro-VM but inside the untrusted infrastructure.

Data flow​

1. The service writes files to the file system.
2. The file system writes through LUKS, which encrypts the data.
3. Only encrypted blocks leave the micro-VM and reach the storage backend.