1

I've got several C++ and Python scripts containing proprietary algorithms, which are latency-sensitive and hence need to be on a system near the data center serving data to them. While a VPS is economical, I worry that the administrators may snoop. Perhaps a dedicated server (esp colocated in the data center) which I deliver myself for deployment, is the best option. But, what do you think about having a virtual machine on the VPS (Hyper-V in Windows, or Virtualbox) which adds another layer of password protection (not encryption per se)?

And yes, I know that most/any legit hosting co has thousands of VPS instances, which would be very cumbersome to comb through. But I've got to plan for the outlier scenarios.

Improve this question
1
  • 1
    I assume your C++ programs are compiled and ship without source code. As for Python it can be compiled AFAIK. Code can be further obfuscated through different mechanisms. Do you think your proprietary algorithms are still at risk if someone was going to attempt disassembling your code ?
    – Kate
    Commented Jan 3, 2022 at 19:19

3 Answers 3

Reset to default
3

If you don't control the hardware, you don't control anything running inside it.

Even if you have a virtualized environment inside another, it won't protect anything. The host can dump the memory of the guest, and dump whatever virtual environment you have inside.

Your protection is the reputation of your provider. Find a provider that hosts private information and have a large consumer base, and that's it. They have pretty stringent rules on what their staff can do, and will not damage their reputation for snooping on your code.

Improve this answer
2
  • I would not say what the staff can do, because an admin always has absolute control, but what the staff is allowed to do... The security is in the contracts between you and your provider and between your provider and its staff.
    – Serge Ballesta
    Commented Jan 2, 2022 at 17:19
  • You're right: "can do" here is in the sense of "is allowed to do." Admins have the capability do anything, but they won't because breaking the rules would destroy their careers, and damage the reputation of their employer.
    – ThoriumBR
    Commented Jan 2, 2022 at 18:34
1

Not all providers allow nested virtualization. You'd maybe make analysis a bit harder but running your own hardware is the better option when you don't trust the VPS provider.

Improve this answer
0
1

It is technically possible to do this in a secure way. Someone has already built a Brainfuck VM that can run encrypted programs using homomorphic encryption. You could theoretically run your algorithm inside a similar VM, but the performance penalty would almost certainly make it not worth it.

If you are tolerant of a lower level of security, Intel SGX or AMD SEV can provide reasonably performant computing while still making it really difficult for someone to read the memory of your program even if they have physical access to the computer.

Note that there is a big difference in usability between Intel and AMD's implementation here. Intel intends you to only encrypt the data from certain confidential parts of your program, though you can use it to encrypt the program as well. There is a paper on this use of SGX here, complete with a sample implementation. AMD's implementation is designed to encrypt the memory of an entire VM, and so is much easier to use. Google sells this as a service, which sounds like what you want.

Improve this answer
1
  • Thanks for your thoughts, 907. All of the source code would be on this VPS, so even if the host couldn't deploy a 'supervised classification algorithm' on the network messages/data/etc in memory, they'd still be able to see IP-sensitive files, I suppose. I'm going to err on the side of caution and deploy my own hardware.
    – CB001
    Commented Dec 18, 2021 at 17:02

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .