Abstract: A cross-domain solution architecture includes a higher-security domain and a lower-security domain. The higher-security domain (i) processes data on a higher-security level, and (ii) includes a hardware-based trusted executed environment (TEE) running a formally verified microkernel. The lower-security domain (i) processes data on a lower-security level having lower security than the higher-security level, and (ii) includes a trusted computer base (TCB). The TCB operates in the higher-security domain and the lower-security domain to pass data from the lower-security domain to the higher-security domain through a first data diode, and to pass data from the higher-security domain to the lower-security domain through a second data diode.