1

The root cause of my problem stems from the fact that I need to run untrustworthy software on a bare metal windows machine, which means that I can't just have it in a VM because of major performance hits which make the software unusable.

At the same time I need to have some kind of secured area (namely VM) where I have sensitive data and safe software running in a way where I can be absolutely sure that the host machine does not have any way to access it. The sensitive part of my system does not require bare metal perfomance neither Windows as its OS, although it needs to have a safe way to transfer data between unsafe bare metal <> secured area.

I realize that simply having 2 seperate physical machines would solve this but my workstation is a Intel 12900kh/128GB DDR5 RAM/RTX 2080 which i specifically purchased with the intention of designing a setup where this is possible.

I feel rather stumped with this issue because I'm not completely sure if the simplest solution that comes to mind is actually safe and works. How would you approach this?

Improve this question
6
  • welcome - you're on the back foot because the untrustworthy platform is also the host platform .. to clarify, do you need to access the sensitive data as part of using the untrustworthy software? is this host on the network? can you connect to a remote host, ie. using rdp, and curate your sensitive data on this host instead?
    – brynk
    Jan 3 at 23:14
  • what version of windows are you using? what sort of activities are you performing with the sensitive data?
    – brynk
    Jan 3 at 23:16
  • Hello - No, the untrustworthy software platform does not require anything from the sensitive area to run normally-to be more specific: consider a video editor program on the untrustworthy platform where the user only needs to input the files (from sensitive area) to perform edits on and send these final files back to sensitive area - The programs are entirely self-contained, only source and final files pass the safe/unsafe barrier. All of this on Windows 10
    – NocturnalMoon
    Jan 3 at 23:35
  • 2
    have you considered pci passthrough of your gpu to the guest vm running windows and the untrusted software?
    – brynk
    Jan 3 at 23:40
  • @NocturnalMoon, it would be better if you edited the question to provide more details. Comments do get pruned.
    – Rohit Gupta
    Jan 4 at 0:58

1 Answer 1

Reset to default
0

Despite you are saying you expect "major performance hits", I'd suggest to install your application in a Hyper-V VM and then to check what is the actual performance.

See details how to enable Hyper-V and how to create a VM.

You can consider different setups:

  1. A single Hyper-V VM that runs the insecure application, sensitive data are in the host system.
  2. A single Hyper-V VM that contains sensitive data. The insecure application is running in the host system. This would be not quite secure, because the application can potentially affect the host system and then the Hyper-V VM.
  3. Two Hyper-V VMs: One for the insecure application and one for sensitive data. The advantage would be that not only the application is isolated, but also sensitive data are isolated from the application as well as from the host system.
Improve this answer
2
  • Legit question here, wouldn't you need an ssh access or some kind of FTP server going on no matter what (running on another machine) ? If you consider the VM to be compromised wouldn't that ultimately mean the host is at risk ? It has been discussed on this forum already that a VM can compromise the host, which sounds to me like OP is right to assume the need of a second, separated host for the critical data.
    – xoxel
    Jan 4 at 10:10
  • 1) The connection would be done not from the VM with insecure application. Thus there is no problem at all. 2) No, compromised VM is not a risk for a host, if the host has all the updates. 3) Sure, having two separates PCs. But then the author would not this question at all. This is namely the question in the OP, what can be done on a single PC.
    – mentallurg
    Jan 4 at 11:15

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .