Update README

Signed-off-by: Drasko DRASKOVIC <[email protected]>

README.md

@@ -13,10 +13,20 @@ make
 ```
 
 ## Architecture
-mProxy starts TCP, UDP and WS servers, offering connections to devices. Upon the connection, it establishes
-a session with a remote MQTT and CoAP brokers.
+mGate is an API gateway that embeds [mProxy](https://github.com/mainflux/mproxy), which starts TCP, UDP and WS servers, offering connections to devices.
+Upon the connection, it establishes a session with a remote MQTT and CoAP brokers.
 
-Lorem ipsum...
+To follow the highest security standards, embedded mProxy starts mTLS and DTLS connection and encryption handlers, and these can be tuned via configuraion. That way mGate can be used for TLS/DTLS termination.
+
+<p align="center"><img src="docs/img/mgate.png"></p>
+
+Here is the flow in more details:
+- Device connects to mGate's TCP (for MQTT, WS and/or HTTP) or UDP (for CoAP) server
+- mGate accepts the inbound (IN) connection and estabishes a new session with remote MQTT broker or CoAP server
+(i.e. it dials out to MQTT broker / CoAP server only once it accepted new connection from a device.
+This way one device-mProxy connection corresponds to one mGate-MQTT broker or mGate-CoAP server connection.)
+- Every packet is inspected for authorization credentials (either via tokens or certificates), and requests are sent to Auth microservice. If authorized, then the packets are proxied to servers behind.
+- Additionally, every packet is forwarded to NATS broker as well, which is an enterprise bus to which applications can be subscribed
 
 ## Deployment
 mProxy does not do load balancing - just pure and simple proxying. This is why it should be deployed