arxiv.orgpaperYou Shall Not Pass into Ring-0! A User Privacy-Friendly Anti-Cheat Architecture for Personal Computers
This arXiv paper introduces Tirith, an anti-cheat architecture that runs games inside Protected Virtual Machines instead of trusting kernel-level (ring-0) anti-cheat drivers that root-admin players must install. It uses a virtualization monitor trusted by both players and developers to detect malicious drivers/cheating from outside the sandbox, and proposes a security-focused Library OS and graphics-sharing pipeline to make this practical with near-native performance, aiming to match kernel anti-cheat detection efficacy without the associated user privacy/attack-surface risk of untrusted privileged code.
TL;DR A research architecture (Tirith) replaces kernel-mode anti-cheat drivers with VM-sandboxed games and a trusted virtualization monitor to preserve detection efficacy while removing ring-0 privacy/security risk.
Technologies named here
- Tirith
- x86 architecture
- Personal computers
- Competitive video games
Techniques named here
- Kernel-level anti-cheat monitoring
- Protected Virtual Machine sandboxing
- Trusted virtualization monitor behavior checking
- Security-focused Library OS kernel for games
- Efficient graphics sharing pipeline
Related in other
eprint.iacr.orgpaperRerandomizable Garbling for Arithmetic Circuits
aseemshrey.inarticle