1

As I understand it, a sandbox is an isolated environment on a machine, used to protect the host from the programs in the sandbox.

Is there something similar but in reverse, for running important programs on a potentially hostile host?

For example, you need to run some very important program on a potentially hostile host and you don't want to get your data stolen, and for some reason, you have to use that host.

Improve this question
3
  • Windows Virtual Secure Mode is similar to what you ask
    – paj28
    Commented Feb 5 at 9:49
  • 1
    There need to be some trust in the host system because this system is providing the runtime, including the CPU to execute your isolated environment. But if you can trust the CPU then confidential computing can provide some protection from a hostile OS, i.e. so that it cannot read or modify anything happening inside the virtual machine. Of course you also need attestation that you actually run the intended VM image and not something manipulated before execution - confidential computing allows for such remote attestation too.
    – Steffen Ullrich
    Commented Feb 9 at 9:29
  • Would bootable removable media work in your situation? You are running on the hardware but not the OS. And you have full control over what OS you are using. This method means the OS isn't involved at all, but you need to trust the hardware.
    – schroeder ♦
    Commented Feb 9 at 9:43

1 Answer 1

Reset to default
1

Technically yes, though the way you describe the idea is fundamentally incoherent. The OS inherently controls all software running in the context of that OS, and this is unavoidable.

The thing that exists instead is the ability to, using dedicated hardware, run certain extremely-high-trust programs outside of the OS entirely. This is part of the premise of devices like hardware security modules (HSMs), though also many processors have what is often called a "secure enclave". It is possible to write software for such a "secure execution environment", sign it (so that the HSM/enclave will accept it and also so that the OS can't tamper with it without breaking the signature), and load it into the secure hardware. The secure hardware then executes it completely independently of the OS and the main CPU/RAM/etc. that the OS and all of its software runs on, or at least isolated from that hardware (though physically different hardware is better than even hardware-mediated isolation on shared RAM, etc. due to risk of side-channel attacks and other vulnerabilities).

Note that you still need trusted execution somewhere, to create the signed image for the trusted execution hardware. Also, while the OS can't tamper with the signed image, it could in theory either refuse to load it, or replace it wholesale with a different signed image. The only way you can actually do this reliably is if the program is already loaded into the trusted environment before the untrusted OS is introduced.

Improve this answer

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .