## Diagram: System Architecture Flow for ProveTEE and VerifyTEE ### Overview The image is a high-level architectural flow diagram illustrating a secure computing process within a "Cloud Environment." It depicts the interaction between two distinct Trusted Execution Environments (TEEs)—labeled "ProveTEE" and "VerifyTEE"—and two external users. The diagram outlines a five-step process where data flows from an initial user, through the TEEs, and results in an output for a second user. ### Components/Axes The diagram is organized horizontally within a dashed-line container labeled "Cloud Environment." * **Container:** "Cloud Environment" (dashed rectangle encompassing the central components). * **Left Component:** "ProveTEE" (a rectangular block). * Contains: "Target" (top) and "Trampoline" (bottom). * **Right Component:** "VerifyTEE" (a rectangular block). * Contains: "Attestation Log" (top) and "Analyzer" (bottom). * **External Actors:** * **Left User:** Represented by an icon of a person in a grey hat and blue jacket. * **Right User:** Represented by an icon of a person in a yellow/orange shirt. * **Flow Markers:** Numbered black circles (1 through 5) indicating the sequence of operations. ### Detailed Analysis The process follows a linear, sequential flow from left to right: 1. **Step 1 (Input):** The Left User initiates the process by sending data/input to the "Target" component located inside the "ProveTEE" block. 2. **Step 2 (Internal Transfer):** The "Target" component processes the input and passes it downward to the "Trampoline" component, also located within the "ProveTEE" block. 3. **Step 3 (Cross-Environment Transfer):** The "Trampoline" component transmits data across the boundary of the "ProveTEE" block to the "Analyzer" component located inside the "VerifyTEE" block. 4. **Step 4 (Internal Processing):** The "Analyzer" component processes the received data and sends the result upward to the "Attestation Log" component within the "VerifyTEE" block. 5. **Step 5 (Output):** The "Attestation Log" provides the final output or verification result to the Right User. ### Key Observations * **Separation of Concerns:** The architecture explicitly separates the "Prove" environment from the "Verify" environment. This suggests a security model where the execution of a task (Prove) is isolated from the verification of that task (Verify). * **The "Trampoline" Role:** The "Trampoline" acts as the bridge or gateway between the two TEEs. In software architecture, a "trampoline" is often used to facilitate jumps between execution contexts or to manage control flow, which aligns with its placement here as the exit point of the "ProveTEE." * **Directional Flow:** The internal flow within "ProveTEE" is downward (Target to Trampoline), while the internal flow within "VerifyTEE" is upward (Analyzer to Attestation Log). This creates a "U-shaped" flow pattern across the two blocks. * **Linear Progression:** Despite the internal vertical movements, the overall system architecture is strictly linear from the Left User to the Right User. ### Interpretation This diagram illustrates a **Remote Attestation** or **Confidential Computing** workflow. * **The Logic:** The "ProveTEE" is likely responsible for executing a specific workload or application (the "Target"). Because the "Target" might be untrusted or require validation, the system uses a "Trampoline" to pass the execution state or evidence to a separate, trusted "VerifyTEE." * **The Verification:** The "VerifyTEE" contains an "Analyzer" that evaluates the evidence provided by the "ProveTEE." The result of this analysis is recorded in an "Attestation Log." * **The Users:** The Left User is likely the data owner or the entity requesting the computation, while the Right User is likely an auditor, a verifier, or a service that consumes the attestation result to confirm that the computation performed in the "ProveTEE" was executed correctly and securely. * **Security Implication:** By separating the "Analyzer" from the "Target," the system ensures that even if the "Target" environment is compromised, the verification logic (the "Analyzer") remains isolated and secure within the "VerifyTEE," maintaining the integrity of the attestation process.