You Shall Not Pass into Ring-0! A User Privacy-Friendly Anti-Cheat Architecture for Personal Computers
Tirith replaces invasive kernel-level game anti-cheats with protected VMs and a dual-trusted virtualization monitor, preserving detection and near-native performance.
Researchers present Tirith, an anti-cheat architecture that runs video games in Protected Virtual Machines, sandboxing computations from untrusted root admins, and uses a virtualization monitor trusted by both players and developers to watch for malicious drivers. This removes the need for privacy-invasive ring-0 kernel anti-cheat components while matching their protection against a wide range of cheating mechanisms. To overcome VM stack limitations, the work contributes a security-focused Library OS kernel for games and an efficient graphics sharing pipeline for near-native rendering performance.
- Games run in Protected Virtual Machines, sandboxed from root-owning players
- Dual-trusted virtualization monitor replaces untrusted kernel-level anti-cheat drivers
- Security-focused Library OS and graphics sharing pipeline achieve near-native performance
From the original article
1 min read at arxiv.orgKernel-level anti-cheats are effective against malicious player behavior in competitive video games, but raise significant user privacy concerns regarding installing unverifiable components at privileged modes (i. e. , ring-0 in x86).
By Santosh Gokul Narayanan · arxiv.org
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.