Skip to main content

Architecture

Each Polaris container contains an instance of the Polaris Secure Proxy and the client workload container. Please refer to the diagram below for a visual representation.

Polaris Architecture

Trusted Execution Environment (TEE)​

The Polaris Container is designed to be run inside of a Trusted Execution Environment (TEE) in order to guarantee that data is encrypted at all times, including while in-use. We achieve this by provisioning Polaris inside of a Confidential Virtual Machine based on the AMD SEV-SNP technology. The exact implementation depends on the Cloud Service Provider that is used, for details please refer to the Cloud Providers documentation.

Confidential Virtual Machines provide full memory encryption with minimal overhead. This means that data in the machies memory is protected agains a malicios Hypervisor or other VMs running on the same host. The encryption is done in hardware and does not require any changes to the workload running inside the VM.

Client Workload​

The client workload is running as a Docker container inside of the TEE. You can configure the Docker image you want to run inside of the Polaris container along with environment variables, entrypoint command and parameters. Polaris takes care of creating the Docker container and configuring the network. In most cases, you don't need to do any modifications to your workload as all HTTP communication between it and the proxy is not encrypted.

For details how to configure the client workload, please refer to the Client Workload Configuration.

Polaris Secure Proxy​

The Polaris Secure Proxy sits in front of the Client Workload and acts as an HTTP proxy server. It is implemented in TypeScript based on the efficient express-http-proxy library. The proxy can be configured to enable transparent decryption of input requests and encryption of responses if you want to enable encrypted communication.

The proxy is also responsible for providing access to the private keys used to decrypt the data inside of the TEE. In the case of Polaris, the proxy provisions an ephemeral 4096-bit RSA public/private key pair and stores it in memory. The private key is only accessible from inside of the TEE and is never exposed to the outside world. This means that the key will change every time the Polaris container is restarted, so it cannot be used to encrypt data that is permanently stored. If your use-cases requires permanent data encryption, please refer to Polaris Pro.

For details on how to configure the Polaris Secure Proxy, please refer to the Polaris Secure Proxy documentation.