Privacy friendly anti cheat system protects video games without ring 0 access
You Shall Not Pass into Ring-0! A User Privacy-Friendly Anti-Cheat Architecture for Personal Computers
Cryptography and Security
Summary
Many cheat detection programs for video games work by running with the highest system permissions, which can invade user privacy. The authors present Tirith, a new approach that runs games in special protected mini computers (virtual machines) to isolate them from the rest of the system and uses a trusted monitor to check for cheating without needing risky system-level software. This design keeps players’ computers safer while still catching most common cheats. To make this work smoothly and perform well for gaming, the authors built a lightweight game-specific operating system and a new way to handle graphics.
What this means in practice
- •For game developers: Integrate Tirith’s virtualization-based anti-cheat to secure games without compromising player privacy or performance.
- •For cybersecurity teams: Deploy virtualization monitors to detect unauthorized drivers and cheats while maintaining system security boundaries.
Authors
Santosh Gokul Narayanan, Giovanni Paladino, Chuqi Zhang, Sangho Lee, Zhenkai Liang, Adil Ahmad
Abstract
Kernel-level anti-cheats are effective against malicious player behavior in competitive video games, but raise significant user privacy concerns regarding installing unverifiable components at privileged modes (i.e., ring-0 in x86). While existing research has focused on improving the effectiveness of anti-cheats, the user privacy concern has been largely ignored. Tirith is an anti-cheat architecture that addresses this problem using two key ideas. First, instead of running video games within regular processes that players (as root admins) have control over, Tirith executes video games in Protected Virtual Machines that naturally sandbox computations from untrusted admins. Second, to monitor user behavior outside the sandbox (e.g., see if they are running malicious drivers), Tirith leverages a virtualization monitor that is trusted by both players and developers. Together, these ideas remove the need to run untrusted kernel-level anti-cheats, while providing the same level of protection compared to such solutions against a wide-range of common cheating mechanisms. The main challenge we face in implementing these ideas, however, is that the existing software stack for virtual machines is not designed to run video games and creates significant security and performance problems. We address these problems by proposing a security-focused Library OS kernel for games and an efficient graphics sharing pipeline for near-native rendering and display performance. In summary, without compromising on cheating behavior detection or performance, this work makes user privacy a first-class citizen in personal computers.