You Shall Not Pass into Ring-0! A User Privacy-Friendly Anti-Cheat Architecture for Personal Computers
Tirith replaces invasive kernel-level game anti-cheats with protected VMs and a dual-trusted virtualization monitor, preserving detection and near-native performance.
Researchers present Tirith, an anti-cheat architecture that runs video games in Protected Virtual Machines, sandboxing computations from untrusted root admins, and uses a virtualization monitor trusted by both players and developers to watch for malicious drivers. This removes the need for privacy-invasive ring-0 kernel anti-cheat components while matching their protection against a wide range of cheating mechanisms. To overcome VM stack limitations, the work contributes a security-focused Library OS kernel for games and an efficient graphics sharing pipeline for near-native rendering performance.
- Games run in Protected Virtual Machines, sandboxed from root-owning players
- Dual-trusted virtualization monitor replaces untrusted kernel-level anti-cheat drivers
- Security-focused Library OS and graphics sharing pipeline achieve near-native performance
Full article230 words · extracted from arxiv.org · click to collapse
Kernel-level anti-cheats are effective against malicious player behavior in competitive video games, but raise significant user privacy concerns regarding installing unverifiable components at privileged modes (i.e., ring-0 in x86). While existing research has focused on improving the effectiveness of anti-cheats, the user privacy concern has been largely ignored. Tirith is an anti-cheat architecture that addresses this problem using two key ideas. First, instead of running video games within regular processes that players (as root admins) have control over, Tirith executes video games in Protected Virtual Machines that naturally sandbox computations from untrusted admins. Second, to monitor user behavior outside the sandbox (e.g., see if they are running malicious drivers), Tirith leverages a virtualization monitor that is trusted by both players and developers. Together, these ideas remove the need to run untrusted kernel-level anti-cheats, while providing the same level of protection compared to such solutions against a wide-range of common cheating mechanisms. The main challenge we face in implementing these ideas, however, is that the existing software stack for virtual machines is not designed to run video games and creates significant security and performance problems. We address these problems by proposing a security-focused Library OS kernel for games and an efficient graphics sharing pipeline for near-native rendering and display performance. In summary, without compromising on cheating behavior detection or performance, this work makes user privacy a first-class citizen in personal computers.
Text extracted automatically; images, tables and formatting may be missing. Original: https://arxiv.org/abs/2609.17525