Confidential Data Hub

Documentation for Confidential Data Hub

Confidential Data Hub is a service running inside guest to provide resource related APIs.


Build and install with default KBC modules:

git clone
cd guest-components/confidential-data-hub

or explicitly specify the confidential resource provider and KMS plugin, please refer to Supported Features


Supported Features

Confidential resource providers (flag RESOURCE_PROVIDER)

Feature name Note
kbs For TDX/SNP/Azure-SNP-vTPM based on KBS Attestation Protocol
sev For SEV based on efi secret pre-attestation

Note: offline-fs is built-in, we do not need to manually enable. If no RESOURCE_PROVIDER is given, all features will be enabled.

KMS plugins (flag PROVIDER)

Feature name Note
aliyun Use aliyun KMS suites to unseal secrets, etc.

Note: If no PROVIDER is given, all features will be enabled.

Last modified October 19, 2023: website: Add initial scaffold (a16919d)