Patent Description:
A variety of counteractive measures have been taken to deter the growing practice of cheating in competitive online gameplay. For instance, game mechanics and game designs have been restructured to rule out certain types of cheats. The tracking and sharing of a player's reputation for fair play can also provide a social angle for deterring cheating. Among many other techniques, some more sophisticated methods for detecting or deterring cheating have recently become available. Such methods include: the use of heuristics to determine potential cheats, determining and detecting the digital signature of certain well-known cheats, and even sandboxing game application processes to preclude injection techniques or processes that may modify game processes or memory.

<CIT>, discloses mechanisms for booting a service processor; <CIT>, discloses a secure anti-cheat system.

Embodiments of the present disclosure relate to anti-cheat detection. More specifically, embodiments relate to systems and methods for protecting a system state and memory during boot time of a gaming device. In essence, the described embodiments facilitate the ability to load an anti-cheat kernel driver into an operating system of the computing device at boot time, so that the system state and memory cannot be modified and masqueraded in a way that conventional anti-cheat technologies cannot detect.

The invention provides computer storage mediums according to claims <NUM> and <NUM> and a computer-implemented method according to claim <NUM>.

Embodiments of the present disclosure are described in detail below with reference to the attached drawing figures, wherein:.

The subject matter of the present disclosure is described with specificity herein to meet statutory requirements. However, the description itself is not intended to limit the scope of this patent.

Moreover, although the terms "step" and/or "block" may be used herein to connote different elements of methods employed, the terms should not be interpreted as implying any particular order among or between various steps herein disclosed unless and except when the order of individual steps is explicitly described.

The online multiplayer video gaming industry has gained immense popularity across all demographics around the globe. As online multiplayer video games take stage in mainstream media, new industries such as eSports attracts a vast number of gamers (i.e., users with user accounts) having a desire to increase their gaming clout, stand out above others, and win competitive gaming events. As competition grows fierce, many gamers will rise above others in skill and tactical know-how. Others, however, may utilize unfair technical strategies to attain undeserved successes. While there are many different reasons why gamers may utilize cheating technologies in online multiplayer games, game developers look to stop these cheaters in order to provide an even playing field for those who play according to the rules.

There are many types of technical cheats developed and utilized by hackers and gamers. Game exploits, automated user actions, game overlays, and manipulation of game states, are just a few well-known types of cheating technologies. To this end, anti-cheat developers have created anti-cheat tools and services, which can generally fall into the categories of cheat detection or cheat prevention, among others.

The art of anti-cheat detection includes, in essence, methods or strategies that may determine whether a player is cheating, or a likelihood that the player is cheating. In one example, signatures of certain cheat programs can be identified and added to an anti-cheat library, so that much like an anti-virus program, a gaming device's runtime memory can be scanned to determine whether a cheat program is being executed during gameplay. Unfortunately, because a cheat technology or program's signature must be known in order for it to be identified, such anti-cheat detection methods generally tend to be one step behind the hackers or developers of these cheating technologies.

Another cheat detection method includes the analysis of heuristics to determine a likelihood that a cheat program is being utilized. More specifically, even if the signature of a cheat program is unknown, certain code flow behaviors can be analyzed to determine whether indicators of cheating are present. This cheat detection method, however, isn't full-proof, as more advanced cheating techniques can still go undetected.

Cheat prevention methods, on the other hand, can include techniques for obfuscating game application code, making it difficult for hackers to utilize many of the standard tools available for creating cheats. In addition, developers have learned to sandbox game application processes to prevent common injection techniques, or to prevent external processes from getting a hold of gaming application processes or memory, among other things.

Generally speaking, anti-cheats running on the application layer of a gaming device's operating system can be easily detected. Hackers can thus reverse engineer such anti-cheats and develop workarounds, easily circumventing any detection or prevention strategies employed. To this end, anti-cheat developers have developed anti-cheat kernel driver technologies, which can facilitate their ability to execute anti-cheat detection and prevention modules on the kernel layer of an operating system loaded on the gaming device. While running on the kernel layer, kernel layer anti-cheat modules can validate the state of the gaming device (e.g., its operating system or memory), or in other words, determine that the operating system is safe (e.g., system files are not corrupted, kernel debuggers are not attached, virtual environments are not present, certain high-risk software is not present, self-integrity checks are not failing). Running anti-cheat modules on the kernel layer have thus made it significantly more difficult for hackers to detect and reverse engineer the anti-cheat processes being performed.

While kernel-based anti-cheat technologies have demonstrated success, they now present some loop holes, which are unfortunately being taken advantage of by hackers-to circumvent these kernel level detection and prevention mechanisms. More specifically, in conventional anti-cheat technologies, anti-cheat kernel drivers typically aren't loaded (and thus operating system safety checks aren't performed) until the gaming application or associated anti-cheat application is launched, or in other words executed. A major disadvantage of loading an anti-cheat kernel driver on an ad hoc basis, is that the time between system boot and the launch of the gaming application remains unchecked. In essence, hackers are given the opportunity to tamper with the operating system and memory at any point starting from initial boot until the gaming application is launched and the anti-cheat kernel driver is loaded. Hackers have thus learned to clean up their tracks just prior to the point the anti-cheat kernel driver is loaded, so that the system state is checked and validated at the point in time when the anti-cheat kernel driver is loaded and system validity checks are performed.

As such, various embodiments of the present disclosure are directed to loading an anti-cheat kernel driver while booting a gaming device to prevent tampering of operating system and memory states at any point in time the gaming device is in operation. By loading the anti-cheat kernel driver at boot, the gaming device can assuredly sustain a secure and untampered execution environment in which a gaming application, or anti-cheat tools, can be executed. In some embodiments, this secured execution environment can be utilized to initialize an anti-cheat application that can communicate with a remote anti-cheat server. The remote anti-cheat server can communicate a variety of anti-cheat modules to the gaming device so that the anti-cheat modules can be executed within the secured execution environment in an "on demand" or ad hoc basis. By storing anti-cheat modules remotely on an anti-cheat server, and by sending anti-cheat modules to the gaming device to be executed ad hoc, the opportunity for such modules to be analyzed and reverse engineered on the gaming device is vastly reduced. Further, the anti-cheat modules can generate results that are communicated back to the remote anti-cheat server for analysis. Based on the analysis, the anti-cheat server can determine that a cheating technology has been detected on the gaming device, consequently causing a gaming server to ban or otherwise prohibit further online gameplay for the gaming device or a user account associated with the gaming device.

Turning now to <FIG>, a schematic depiction is provided illustrating an exemplary system <NUM> in which some embodiments of the present disclosure may be employed. It should be understood that this and other arrangements described herein are set forth only as examples. Other arrangements and elements (e.g., machines, interfaces, functions, orders, groupings of functions, etc.) can be used in addition to or instead of those shown, and some elements may be omitted altogether. Further, many of the elements described herein are functional entities that may be implemented as discrete or distributed components or in conjunction with other components, and in any suitable combination and location. Various functions described herein as being performed by one or more entities may be carried out by hardware, firmware, and/or software. For instance, various functions may be carried out by a processor executing instructions stored in memory.

The system in <FIG> includes a gaming server <NUM> that can communicate with a gaming device <NUM> over a network <NUM>, such as a LAN, WAN, the Internet, or any combination thereof, by way of non-limiting example. The gaming server <NUM> can host, among other things, an online multiplayer game for a plurality of gaming devices, such as gaming device <NUM>. The gaming server <NUM> can also communicate with an anti-cheat server <NUM> over the network <NUM>, and similarly, the anti-cheat server <NUM> can communicate with each gaming device, such as gaming device <NUM>. In some aspects, the gaming device <NUM> can establish network connection(s) with each of the gaming server <NUM> and the anti-cheat server <NUM> responsive to or based on a game application (e.g., an online multiplayer game) installed on the gaming device <NUM> being launched. In accordance with various embodiments described herein, each of gaming server <NUM>, gaming device <NUM>, or anti-cheat server <NUM> can include one or more computing devices as described in more detail with respect to <FIG>.

The gaming device <NUM> is preferably associated with a user account that is associated with a user (i.e., a gamer). In some embodiments, the gaming device <NUM> includes anti-cheat technology that ensures, among other things, that an operating system and memory of the gaming device is not tampered with. Unlike conventional anti-cheat technologies where an anti-cheat kernel driver is loaded at the time a game application is launched (i.e., run, started, executed), the gaming device <NUM> can load an anti-cheat kernel driver to a memory of the gaming device <NUM> while an operating system (e.g., Microsoft Windows) is loaded to the memory of the gaming device (i.e., at boot time). The gaming device <NUM>, having the anti-cheat kernel driver loaded during boot, can ensure the integrity of the gaming device <NUM> (e.g., its operating system and memory) better than conventional anti-cheat technologies, because loading of the anti-cheat kernel driver at boot ensures that operating system or memory tampering cannot take place on the gaming device <NUM> before a game application is launched.

When the anti-cheat kernel driver is loaded upon boot of the gaming device <NUM>, the gaming device <NUM> can create a secured environment to run anti-cheat detection or prevention operations, either in a kernel layer or an application layer of the gaming device's <NUM> operating system. In some embodiments, the gaming device <NUM> can continuously or periodically perform a variety of measurements and checks, starting upon boot, to ensure a valid system state. In some aspects, if the gaming device <NUM> determines that its system state is not valid, it can prevent connectivity to either or both the anti-cheat server <NUM> or gaming server <NUM>.

In some embodiments, the gaming device <NUM> can establish a session with the anti-cheat server <NUM> via the network <NUM>. With the secured environment in place, the gaming device <NUM> can receive, from the anti-cheat server <NUM> over the network <NUM>, one or more anti-cheat modules. The anti-cheat modules can include, among other things, binaries or executable code that can be executed on the application layer or the kernel layer of the gaming device <NUM>. In some aspects, the anti-cheat server <NUM> can dynamically select the anti-cheat module of any type (e.g., application mode module, kernel mode module) from a plurality of anti-cheat modules stored in a memory or database coupled to the anti-cheat server <NUM>, and communicate the selected anti-cheat module to the gaming device <NUM>.

In some embodiments, the gaming device <NUM> can execute the received anti-cheat module. In some aspects, if the anti-cheat module is a kernel mode module, the gaming device <NUM> can send the received anti-cheat module to the loaded anti-cheat kernel driver, so that the anti-cheat module can be executed on the kernel layer of the gaming device <NUM>. In some other aspects, if the anti-cheat module is a user mode module, the gaming device <NUM> can simply execute the received anti-cheat module on the application layer of the gaming device <NUM>. Once executed, the gaming device <NUM> can generate a result from executing the anti-cheat module, and communicate the result back to the anti-cheat server <NUM> via the network <NUM>.

In some embodiments, the anti-cheat server <NUM> can receive the result from the gaming device <NUM> over the network. The anti-cheat server can analyze the result, and determine if the result indicates that the executed anti-cheat module detected a cheating attempt or a form of cheating technology on the gaming device <NUM>. In some aspects, the anti-cheat server <NUM> can communicate, to the gaming device <NUM> via the network <NUM>, an instruction to disconnect with the gaming server <NUM>. In some other aspects, the anti-cheat server <NUM> can communicate, to the gaming server <NUM> via the network <NUM>, an instruction to take anti-cheat mitigation measures against the gaming device <NUM>. Anti-cheat mitigation measures may include, by way of non-limiting example, banning a user account associated with the gaming device <NUM>, forcing termination of a network connection with the gaming device <NUM>, banning recognized hardware or hardware addresses associated with the gaming device <NUM> or the like.

Referring now to <FIG>, a block diagram <NUM> is provided, illustrating an exemplary gaming device <NUM> (as similarly depicted in <FIG>) for creating a secured environment to run anti-cheat detection or prevention operations, in which some embodiments of the present disclosure may be employed. In various embodiments, the gaming device <NUM> can include at least one computing device as depicted in <FIG>, a gaming console, a handheld gaming device, a mobile device (e.g., a phone, a tablet), or the like. It is contemplated that various components disclosed herein can be implemented in specialized hardware, firmware, software, or a combination thereof, to facilitate the disclosed embodiments. At initial boot (e.g., power on, start-up), the gaming device <NUM> can load, into a memory of the gaming device <NUM>, an operating system having at least a kernel layer and an application layer. The gaming device <NUM>, once booted, can present a graphical user interface (GUI) to the operating system, and facilitate the launch (e.g., start, execution) of a gaming application, such as an online multiplayer game, installed in a memory of the gaming device <NUM>. In various embodiments, the gaming device <NUM> can include components and modules that facilitate anti-cheat detection and prevention, as will be described herein. As is also described in accordance with <FIG>, the gaming device <NUM> can initialize such anti-cheat mechanisms in response to a detected launch of the gaming application, and can further establish a session between each of a gaming server <NUM> and an anti-cheat server <NUM> based on the detected launch.

In some embodiments, the gaming device <NUM> can include a kernel driver initializing component <NUM> that loads, into a memory of the gaming device <NUM>, an anti-cheat kernel driver. Although kernel drivers are typically utilized for translating instructions between hardware devices and applications that utilize them, embodiments of the present disclosure load an anti-cheat kernel driver that enables anti-cheat detection and prevention modules to be loaded and executed at the kernel layer. By doing so, anti-cheat detection and prevention operations performed on the kernel layer make it significantly more difficult for hackers to detect and/or reverse engineer such operations. The kernel driver initializing component <NUM>, while loading the anti-cheat kernel driver at boot, can monitor the state of the operating system and memory to determine whether loading of the anti-cheat kernel driver causes system instability or performance issues. In some embodiments, if the kernel driver initializing component <NUM> detects system instability or performance issues (e.g., a kernel crash), the kernel driver initializing component <NUM> can dynamically unload, or dynamically prevent from further loading at boot, the anti-cheat kernel driver so that future boots of the gaming device <NUM> do not result in additional instability or performance issues.

In some embodiments, the gaming device <NUM> can include a system state validating component <NUM> that can continuously, periodically, or on an ad hoc basis, validate a state of the loaded operating system and memory for executing a gaming application installed on the gaming device <NUM>, among other things. In other words, with the anti-cheat kernel driver loaded at boot, the system state validating component <NUM> can perform a variety of checks and measurements on the operating system and memory to ensure that: the operating system's system files are valid at the time of boot, or changes to the operating system's system files weren't tampered with after boot. In some embodiments, the system state validating component <NUM> can prevent changes to (e.g., sandbox) the operating system's system files.

In some embodiments, the gaming device <NUM> can include an anti-cheat detection component <NUM> that can continuously, periodically, or on an ad hoc basis, ensure that no system files have been corrupted or tampered with, no kernel debuggers are being utilized, no virtual environments are being utilized, no high risk or well-known cheating software is being executed, or self-integrity checks of the anti-cheat kernel driver aren't failing, among other things. The anti-cheat detection component <NUM>, with the anti-cheat kernel driver loaded at boot, can scan the operating system and memory for known behaviors and markers associated with such cheating technologies. In some embodiments, if a cheating technology is detected, the anti-cheat detection component <NUM> can prevent the installed game application from being launched or played until the issue is resolved. In some aspects, the issue can be resolved by removing the offending cheating technology and restarting the gaming device <NUM>.

In some embodiments, the gaming device <NUM> can include a kernel module executing component <NUM> that, with the anti-cheat kernel driver loaded at boot, can receive anti-cheat modules to be loaded and executed on the kernel layer or application layer of the gaming device <NUM>. In some aspects, the anti-cheat modules can be executed in either one of a kernel mode or a user mode, depending on the type of module received. In various embodiments, an anti-cheat module received by the kernel module executing component <NUM> can include an anti-cheat binary or other executable that can be loaded and executed on the kernel layer for detecting specific anti-cheat technologies. The kernel module executing component <NUM> can, as a result of its execution of a received anti-cheat module, generate a result that can be analyzed to determine whether a specific cheat technology is detected on the gaming device <NUM>.

As will be described, the kernel module executing component <NUM> can receive any one of a plurality of anti-cheat modules sent from an anti-cheat server (e.g., anti-cheat server <NUM> of <FIG>) to the gaming device <NUM> via a network, such that the anti-cheat module is remotely executed by the gaming device <NUM> "on demand," or in other words, at the request of the anti-cheat server. In some further embodiments, the anti-cheat module can be deleted by the kernel module executing component <NUM> immediately upon completion of its execution, so that hackers aren't given the opportunity to analyze the anti-cheat module. It is contemplated that this ad hoc approach for communicating anti-cheat modules, to the gaming device <NUM> to be executed, makes it difficult for hackers to reverse engineer and analyze the anti-cheat methodologies being utilized.

In various embodiments, the gaming device <NUM> can include a game application processing component <NUM> that loads a game application into memory, responsive to a launch of the game application. The game application can include, by way of example, an online multiplayer game. The game application processing component <NUM> can store, to a memory of the gaming device <NUM>, game states, user account information, and a variety of code or data that facilitates game play. In some further embodiments, game application processing component <NUM> can communicate with a gaming server interfacing component <NUM> that establishes a session with a gaming server (e.g., gaming server <NUM> of <FIG>) via a network. The game application processing component <NUM> can communicate, via the gaming server interfacing component <NUM>, user account information (e.g., user name, password), among other things, to obtain access to the gaming server. The game application processing component <NUM> can exchange game data with the gaming server, and also receive a variety of instructions, notifications, or alerts, via the gaming server interfacing component <NUM>. In some embodiments, a notification or alert can be received from the gaming server via the gaming server interfacing component <NUM> in response to a determination that an anti-cheat module executed on the gaming device <NUM> has detected a cheating technology. To this end, the game application processing component <NUM> can provide for display the notification or alert in a graphical user interface (e.g., via the game application).

In various embodiments, the gaming device <NUM> can include an anti-cheat managing component <NUM> that can interface with an anti-cheat kernel driver loaded at boot, exchange data (e.g., anti-cheat modules, results) with an anti-cheat server, and/or execute or delete anti-cheat modules received from the anti-cheat server. In some embodiments, the anti-cheat managing component <NUM> can include a kernel driver interfacing component <NUM> that can activate the anti-cheat kernel driver loaded at boot of the gaming device <NUM>. It is contemplated that the kernel driver interfacing component <NUM> can also load and activate the anti-cheat kernel driver in the event the anti-cheat kernel driver is not loaded at boot. In some embodiments, the kernel driver interfacing component <NUM> can facilitate the exchange of data between the anti-cheat managing component <NUM> and one or more components of the gaming device <NUM>, such as the system state validating component <NUM>, the anti-cheat detection component <NUM>, or the kernel module executing component <NUM>, among other things. In essence, the anti-cheat managing component <NUM> can initialize or start operations (e.g., state validation, anti-cheat detection) that are performed by other such components of the gaming device <NUM>. In some aspects, the kernel driver interfacing component <NUM> can be employed by anti-cheat managing component <NUM> to send, to the kernel module executing component <NUM>, anti-cheat modules and instructions to execute the anti-cheat modules. In some further aspects, the kernel driver interfacing component <NUM> can be employed by anti-cheat managing component <NUM>, to receive results of the executed anti-cheat modules generated by kernel module executing component <NUM>.

In some embodiments, the anti-cheat managing component <NUM> can include an anti-cheat server interfacing component <NUM> that establishes a network session between the gaming device <NUM> and an anti-cheat server, such as anti-cheat server <NUM> of <FIG>. It is contemplated that the network session is established based on a detected launch of a gaming application installed on the gaming device <NUM>. It is also contemplated that the gaming application may be associated with the anti-cheat managing component <NUM>. The network session established there between can be employed to exchange data in a continuous, periodic, or ad hoc manner. In some aspects, the anti-cheat server interfacing component <NUM> can receive an anti-cheat module communicated from the anti-cheat server <NUM> via the network. In some further aspects, the anti-cheat server interfacing component <NUM> can send one or more results generated based on the received anti-cheat module being executed on the gaming device <NUM>. In some embodiments, the anti-cheat server interfacing component <NUM> can receive instructions from the anti-cheat server <NUM> that define which anti-cheat module(s) are to be executed, when such anti-cheat module(s) are to be executed, or when such anti-cheat module(s) are to be deleted by the gaming device <NUM>.

In some embodiments, the anti-cheat managing component <NUM> can include a module managing component <NUM> that manages anti-cheat modules received from the anti-cheat server <NUM> based on the instructions received from the anti-cheat server <NUM> via anti-cheat server interfacing component <NUM>. In some aspects, and as briefly discussed above, the instructions received can include specific tasks (e.g., module execution, timing, disposal) to be performed on the gaming device <NUM>. In this regard, the module managing component <NUM> can interpret instructions received from the anti-cheat server <NUM> and accordingly manage the anti-cheat modules received therefrom. It is contemplated that the anti-cheat managing component <NUM> can communicate with at least the kernel driver interfacing component <NUM> to load, execute, or unload modules from the kernel layer of the gaming device <NUM>.

Looking now to <FIG>, a block diagram <NUM> is provided illustrating an exemplary anti-cheat server <NUM>, as is similarly depicted in <FIG>, for remotely managing the receipt, loading, execution, and/or deletion of anti-cheat modules on a gaming device (e.g., gaming device <NUM> of <FIG> and <FIG>) in which some embodiments of the present disclosure may be employed. In various embodiments, the anti-cheat server <NUM> can include at least one computing device as depicted in <FIG>. It is contemplated that various components disclosed herein can be implemented in specialized hardware, firmware, software, or a combination thereof, to facilitate the disclosed embodiments.

In some embodiments, the anti-cheat server <NUM> can include an anti-cheat client interfacing component <NUM> that facilitates communications with the gaming device <NUM>, so that, among other things, anti-cheat operations on the gaming device <NUM> can be remotely managed. The anti-cheat server <NUM> can employ anti-cheat client interfacing component <NUM> to establish a session with the gaming device <NUM>, via the network, based on a session request being received from the gaming device <NUM>. In accordance with some embodiments, the anti-cheat server <NUM> can employ the anti-cheat client interfacing component <NUM> to communicate, via the established network session, one or more anti-cheat modules to the gaming device <NUM> to be executed thereon. In return, the anti-cheat server <NUM> can receive result(s) of the executed anti-cheat modules, via the same or subsequently established session, for analysis and to make a subsequent determination on whether the gaming device <NUM> is utilizing cheating technology.

In some embodiments, at a high level, the anti-cheat server <NUM> can include an anti-cheat orchestrating component <NUM> that autonomously: selects an anti-cheat module for communication to the gaming device <NUM>; generates and communicates instructions that command the gaming device <NUM> how or when to load, execute, or delete the anti-cheat module; analyzes results of an anti-cheat module executed on the gaming device <NUM>; or generates and communicates instructions that command the gaming device <NUM> how to behave (e.g., standby, disconnect) after performing an anti-cheat module results analysis.

In accordance with some embodiments, the anti-cheat orchestrating component <NUM> can include a module selecting component <NUM> that selects an anti-cheat module from a plurality of anti-cheat modules. In various embodiments, the plurality of anti-cheat modules can include, among other things, kernel mode anti-cheat modules or user mode anti-cheat modules. The anti-cheat modules can be stored in a database or other memory device coupled to the anti-cheat server <NUM>. As is described herein above, the storage of anti-cheat modules apart from the gaming device <NUM> makes it difficult for hackers to anticipate the anti-cheat being executed, and also difficult to reverse engineer the anti-cheat. It is contemplated that the module selecting component <NUM> can select an anti-cheat module for communication and execution based on one or more selection rulesets. By way of example, a selection ruleset can be defined based on certain environments in which a particular set of online multiplayer games are to be played. For instance, the selection of one or more anti-cheat module(s) in a particular order, combination, or type may differ depending on whether a series of professional esports games are being played versus whether everyday users are playing the game.

In accordance with some embodiments, the anti-cheat orchestrating component <NUM> can include a module tasking component <NUM> that generates instructions to send to the gaming device <NUM> via a session established therewith. The instructions can be embodied as electronic messages that may include, among other things, binaries or other executables of an anti-cheat module, commands defining when or where (e.g., kernel layer, application layer) to execute the anti-cheat module, or other directives that task the gaming device <NUM> with certain operations that facilitate anti-cheat detection and prevention. In some aspects, the messages can include commands that instruct the gaming device to store or delete the anti-cheat module after execution, though in preferred embodiments, the gaming device can autonomously delete the anti-cheat module upon execution and/or communication of its results to the anti-cheat server <NUM>.

In accordance with some embodiments, the anti-cheat orchestrating component <NUM> can include a module result analyzing component <NUM> that receives, via the anti-cheat client interfacing component <NUM>, a report from the gaming device <NUM> in response to on an anti-cheat module, sent from the anti-cheat server <NUM>, having been executed on the gaming device <NUM>. In some embodiments, the report can include a binary result (e.g., cheating detected, cheating not detected) of the executed anti-cheat module, among other things. In some other embodiments, the report can include statistics or unstructured data collected by the executed anti-cheat module. In this way, certain heuristics or data analytics can be evaluated to determine a likelihood or to establish a confirmation of cheating on the gaming device <NUM>. The module result analyzing component <NUM> can thus analyze the report to determine whether cheating was detected or prevented on the gaming device <NUM> by the executed anti-cheat module. In some embodiments, if a determination is made that the gaming device <NUM> was cheating, the module result analyzing component <NUM> can perform various anti-cheat mitigation operations, as will be described.

In accordance with some embodiments, the anti-cheat orchestrating component <NUM> can include a gaming device controlling component <NUM> that can generate messages to be communicated, via anti-cheat client interfacing component <NUM>, to the gaming device <NUM> for controlling certain actions of the gaming device <NUM>. In some aspects, the messages can include commands that direct the gaming device <NUM> to perform specific operations. By way of example, a message can include a command that instructs the gaming device <NUM> to disconnect from the anti-cheat server <NUM> or the gaming server <NUM>. The disconnect command can be included in a new message generated in response to the module result analyzing component <NUM> making a determination that the gaming device <NUM> was utilizing cheating technology. It is contemplated that in some aspects, the command can also prevent the gaming device <NUM> from establishing future sessions with the anti-cheat server <NUM> or gaming server <NUM>. In another example, a message can include a command that instructs the gaming device <NUM> to standby and wait for another message, instruction, or command from the anti-cheat server <NUM>.

In some embodiments, the anti-cheat server <NUM> can include a game server interfacing component <NUM> that can communicate electronic messages with a gaming server (e.g., gaming server <NUM> of <FIG>), and inform the gaming server <NUM> whether the gaming device <NUM> is approved or denied for online multiplayer gaming on the gaming server <NUM>. In some instances, the anti-cheat server <NUM> can send continuous or periodic messages to the gaming server <NUM>, informing the gaming server <NUM> the anti-cheat detection status of the gaming device <NUM>. In other words, if the anti-cheat server <NUM> determines, based on results received from the gaming device <NUM>, that the gaming device <NUM> is utilizing cheating technology, the anti-cheat server <NUM> can responsively communicate anti-cheat mitigation instructions to the gaming server <NUM>. It is contemplated that such instructions can include a confirmation or likelihood of cheating on the gaming device <NUM>, a user account associated with the gaming device <NUM>, hardware signature(s) associated with the gaming device <NUM>, characteristics and/or severity of the detected cheat, network information (e.g., IP address), and/or any other identifying information associated with the gaming device <NUM>, among other things.

Referring now to <FIG>, a flow diagram is provided that illustrates a method for anti-cheat detection. The method also facilitates blocking a gaming device (e.g., gaming device <NUM> of <FIG> and <FIG>) from accessing a gaming server (e.g., gaming server <NUM> of <FIG>) based on a detected compromised system state (i.e., a system determined to have been tampered with). As shown at block <NUM>, a gaming device can employ a kernel driver initializing component, such as kernel driver initializing component <NUM> of <FIG>, to load an anti-cheat kernel driver to memory during a booting process of the gaming device. In various embodiments, the gaming device can employ the kernel driver initializing component to perform stability checks while monitoring the operating system and memory to ensure that the anti-cheat kernel driver is properly loaded, stable, and will not cause system instability. For instance, the gaming device can track when kernel crashes or panics occur as a result of loading the anti-cheat kernel driver. To this end, the gaming device can employ the kernel driver initializing component to dynamically modify its boot process and prevent repeated kernel crashes or panics from occurring.

Based on the anti-cheat kernel driver being loaded to memory during the booting process, the gaming device, at block <NUM>, can employ a system state validating component (e.g., system state validating component <NUM> of <FIG>) to perform a series of checks on operating system files, the memory of the gaining device, and other aspects of the operating system, to determine a valid state of the gaming device. Preferably, these checks are performed prior to completion of the boot process of the gaming device. In this way, advanced attempts to thwart system state validations performed only at the time of launching a gaming application, as in conventional anti-cheat technologies, can be prevented.

At block <NUM>, the gaming device, having the anti-cheat kernel driver loaded during the booting process, can employ an anti-cheat detection component (e.g., anti-cheat detection component <NUM> of <FIG>) that includes a series of detection vectors or operations for detecting whether the system state (e.g., block(s) of memory or system files) are tampered with after the anti-cheat kernel driver is loaded. In some embodiments, the gaming device can continuously or periodically employ the anti-cheat detection component to track (e.g., store in memory, set flags, identify) and store characteristics of the system state or any attempts to tamper with the system state. More specifically, by virtue of the anti-cheat kernel driver being loaded at boot, the anti-cheat detection component can effectively sandbox block(s) of memory and/or system files before a variety of cheat technologies can tamper with the system state. However, if attempts are made to tamper with the system state after the anti-cheat kernel driver is loaded, the anti-cheat detection component can be employed to track these attempts and further track the tampered state of the gaming device. In some other embodiments, the gaming device can simply compare a first system state determined valid at the time of boot, to a state determined at a later time (e.g., when a gaming application is launched), for determining whether the state of the gaming device has changed.

At block <NUM>, the anti-cheat detection component of the gaming device can, based on a determination that the system state is invalid or has been tampered with, block access between the gaming device <NUM> and the gaming server <NUM>, effectively preventing the gaming device from participating in any online multiplayer games hosted on the gaming server. In various embodiments, the anti-cheat detection component can send a status of the system state to a game application processing component (e.g., game application processing component <NUM> of <FIG>), a game server interfacing component (e.g., gamer server interfacing component <NUM> of <FIG>), and/or an anti-cheat server interfacing component (e.g., anti-cheat server interfacing component <NUM> of <FIG>), to effectively prevent the gaming device from participating in online gameplay via the gaming server. By way of non-limiting example, online gaining participation can be prevented by blocking the host address of a gaming server or anti-cheat server, blocking network connections to the gaming server or anti-cheat server, preventing the gaming application from establishing outgoing connections to the gaining server, sending an invalid system state to the anti-cheat server, or any combination thereof. In some embodiments, the anti-cheat detection component <NUM> can independently, or through the game application processing component <NUM>, generate a notification that causes the gaming device to provide the notification for display to a display coupled to the gaming device. In some aspects, the notification can notify the user of the gaming device that the detected cheat technology needs to be uninstalled and the gaming device restarted so that online gaming participation can be enabled.

Referring now to <FIG>, a flow diagram is provided that illustrates a method for anti-cheat detection. As shown at block <NUM>, a gaming device (e.g., gaming device <NUM> of <FIG> and <FIG>) can employ a kernel driver initializing component (e.g., kernel driver initializing component <NUM> of <FIG>), to load an anti-cheat kernel driver to memory during a booting process of the gaming device. In various embodiments, the gaming device can employ the kernel driver initializing component to perform stability checks while monitoring the operating system and memory, to ensure that the anti-cheat kernel driver is properly loaded, stable, and will not cause system instability. For instance, the gaming device can track when kernel crashes or panics occur as a result of loading the anti-cheat kernel driver. To this end, the gaming device can employ the kernel driver initializing component to dynamically modify its boot process and prevent repeated kernel crashes or panics from occurring.

In accordance with some embodiments, the gaming device can employ a system state validating component (e.g., system state validating component <NUM> of <FIG>) to perform a series of checks on operating system files, the memory of the gaming device, and other aspects of the operating system, to determine a valid state of the gaming device by virtue of the anti-cheat kernel driver being loaded to memory during the booting process. Such checks are preferably performed prior to completion of the boot process of the gaming device. In this way, advanced attempts to thwart system state validations performed only at the time of launching a gaming application, as in conventional anti-cheat technologies, can be prevented. The gaming device, having the anti-cheat kernel driver loaded during the booting process, can employ an anti-cheat detection component (e.g., anti-cheat detection component <NUM> of <FIG>) that includes a series of detection vectors or operations for detecting whether the system state (e.g., block(s) of memory or system files) are tampered with after the anti-cheat kernel driver is loaded. In some embodiments, the gaming device can continuously or periodically employ the anti-cheat detection component to track and store the system state or any attempts to tamper with the system state. More specifically, by virtue of the anti-cheat kernel driver being loaded at boot, the anti-cheat detection component can effectively sandbox block(s) of memory and/or system files before a variety of cheat technologies can tamper with the system state. However, if attempts are made to tamper with the system state after the anti-cheat kernel driver is loaded, the anti-cheat detection component can be employed to track these attempts and further track the tampered state of the gaming device.

The anti-cheat detection component of the gaming device can, based on a determination that the system state is valid, enable access between the gaming device <NUM> and the gaming server <NUM>, so that the gaming device can participate in online multiplayer games hosted on the gaming server. In various embodiments, the anti-cheat detection component can send a status of the system state to a game application processing component (e.g., game application processing component <NUM> of <FIG>), a game server interfacing component (e.g., gamer server interfacing component <NUM> of <FIG>), and/or an anti-cheat server interfacing component (e.g., anti-cheat server interfacing component <NUM> of <FIG>), to facilitate connectivity between the gaming device and the gaming server.

As shown in block <NUM>, in accordance with some embodiments, the gaming device can employ the anti-cheat server interfacing component to establish a session with the anti-cheat server via the network. In some aspects, the session can be established based on a detected launch of a gaming application associated with either or both the gaming server or anti-cheat server. In some aspects, the session with the anti-cheat server is established and/or active at the same time as another session established between the gaming device and the gaming server.

An anti-cheat managing component (e.g., anti-cheat managing component <NUM> of <FIG>) can facilitate communications between the anti-cheat server (e.g., via the anti-cheat server interfacing component) and the kernel of the gaming device, the gaming device employing a kernel driver interfacing component (e.g., kernel driver interfacing component <NUM>) to communicate with the loaded anti-cheat kernel driver. Thus, at block <NUM>, the gaming device can receive, via the anti-cheat server interfacing component and from the anti-cheat server over the network, an anti-cheat module selected for communication to the gaming device. In some embodiments, the kernel driver interfacing component can send the received anti-cheat module to a kernel module executing component (e.g., kernel module executing component <NUM> of <FIG>) of the gaming device.

In some embodiments, the kernel module executing component can generate a report or result based on the execution of an anti-cheat module. Thus, at block <NUM>, the kernel module executing component can send the result of the executed anti-cheat module from the kernel layer to the anti-cheat server interfacing component, so that the anti-cheat server interfacing component can communicate the result to the anti-cheat server over the network.

In accordance with some embodiments, the anti-cheat server (e.g., anti-cheat server <NUM> of <FIG> and <FIG>) can receive and analyze the result of the executed anti-cheat module. In some aspects, the anti-cheat server can make an absolute determination that a gaming device is utilizing cheating technologies, or a confident determination that a gaming device is utilizing cheating technologies based on a threshold level of confidence. In the event the anti-cheat server determines that the gaming device is utilizing cheating technology, the anti-cheat server can send a message to the gaming server, instructing the gaming server to boot, disconnect, or ban a user account associated with the gaining device, the gaming device itself, a network address of the gaming device, hardware signatures or addresse(es) associated with the gaming device, or the like. In some aspects, the anti-cheat server can send a message to the gaming device with an instruction to disconnect or prohibit access to the gaming server. It is contemplated that in order for a gaming device to maintain a gaming session, or in some aspects, maintain network connectivity with a gaming server to enable online play, the gaming device must also have an established connection or demonstrated ability to connect to the anti-cheat server upon request or on a periodic basis. In this way, tampering with the gaming device can have a reduced effect on anti-cheat mitigation measures taken by the anti-cheat server or gaming server.

As described herein, when the gaming server receives a message from the anti-cheat server-instructing the gaming server to take anti-cheat measures (e.g., boot, disconnect, or ban)-the gaming server can terminate the network session established between the gaming server and the gaming device. In some other embodiments, the gaming server can terminate any ongoing gaming sessions in which the gaming device is participating. In some even further embodiments, the gaming server can generate a notification that is communicated to the gaming device over the network, so that based upon the termination of the gaming session or upon termination of the established network session, the gaming device can provide for display the communicated notification. In various aspects, the displayed notification can include a notice that a cheating technology was detected or prevented on the gaming device. In some further aspects, the notification can indicate the punishment (e.g., temporary ban, permanent ban) imposed on the gaming device or user account associated therewith.

Having described embodiments of the present disclosure, an exemplary operating environment in which embodiments of the present disclosure may be implemented is described below in order to provide a general context for various aspects of the present disclosure. Referring initially to <FIG> in particular, an exemplary operating environment for implementing embodiments of the present disclosure is shown and designated generally as computing device <NUM>. Computing device <NUM> is but one example of a suitable computing environment and is not intended to suggest any limitation as to the scope of use or functionality of the disclosed embodiments. Neither should the computing device <NUM> be interpreted as having any dependency or requirement relating to any one or combination of components illustrated.

The embodiments herein may be described in the general context of computer code or machine-useable instructions, including computer-executable instructions such as program modules, being executed by a computer or other machine, such as a personal data assistant or other handheld device. Generally, program modules including routines, programs, objects, components, data structures, etc., refer to code that perform particular tasks or implement particular abstract data types. The described embodiments may be practiced in a variety of system configurations, including hand-held devices, consumer electronics, generalpurpose computers, more specialty computing devices, etc. The described embodiments may also be practiced in distributed computing environments where tasks are performed by remoteprocessing devices that are linked through a communications network.

With reference to <FIG>, computing device <NUM> includes a bus <NUM> that directly or indirectly couples the following devices: memory <NUM>, one or more processors <NUM>, one or more presentation components <NUM>, input/output (I/O) ports <NUM>, input/output components <NUM>, and an illustrative power supply <NUM>. Bus <NUM> represents what may be one or more busses (such as an address bus, data bus, or combination thereof). Although the various blocks of <FIG> are shown with lines for the sake of clarity, in reality, delineating various components is not so clear, and metaphorically, the lines would more accurately be grey and fuzzy. For example, one may consider a presentation component such as a display device to be an I/O component. Also, processors have memory. The inventor recognizes that such is the nature of the art, and reiterates that the diagram of <FIG> is merely illustrative of an exemplary computing device that can be used in connection with one or more embodiments of the present disclosure. Distinction is not made between such categories as "workstation," "server," "laptop," "hand-held device," etc., as all are contemplated within the scope of <FIG> and reference to "computing device.

Computing device <NUM> typically includes a variety of computer-readable media. Computer-readable media can be any available media that can be accessed by computing device <NUM> and includes both volatile and nonvolatile media, and removable and non-removable media. By way of example, and not limitation, computer-readable media may comprise computer storage media and communication media. Computer storage media includes both volatile and nonvolatile, removable and non-removable media implemented In any method or technology for storage of information such as computer-readable instructions, data structures, program modules or other data. Computer storage media includes, but is not limited to, RAM, ROM, EEPROM, flash memory or other memory technology, CD-ROM, digital versatile disks (DVD) or other optical disk storage, magnetic cassettes, magnetic tape, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to store the desired information and which can be accessed by computing device <NUM>. Computer storage media does not comprise signals per se. Communication media typically embodies computer-readable instructions, data structures, program modules or other data in a modulated data signal such as a carrier wave or other transport mechanism and includes any information delivery media. By way of example, and not limitation, communication media includes wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media. Combinations of any of the above should also be included within the scope of computer-readable media.

Memory <NUM> includes computer-storage media in the form of volatile and/or nonvolatile memory. The memory may be removable, non-removable, or a combination thereof. Exemplary hardware devices include solid-state memory, hard drives, optical-disc drives, etc. Computing device <NUM> includes one or more processors that read data from various entities such as memory <NUM> or I/O components <NUM>. Presentation component(s) <NUM> present data indications to a user or other device. Exemplary presentation components include a display device, speaker, printing component, vibrating component, etc..

I/O ports <NUM> allow computing device <NUM> to be logically coupled to other devices including I/O components <NUM>, some of which may be built in. Illustrative components include a microphone, joystick, game pad, satellite dish, scanner, printer, wireless device, etc. The I/O components <NUM> may provide a natural user interface (NUI) that processes air gestures, voice, or other physiological inputs generated by a user. In some instances, inputs may be transmitted to an appropriate network element for further processing. An NUI may implement any combination of speech recognition, stylus recognition, facial recognition, biometric recognition, gesture recognition both on screen and adjacent to the screen, air gestures, head and eye tracking, and touch recognition (as described in more detail below) associated with a display of the computing device <NUM>. The computing device <NUM> may be equipped with depth cameras, such as stereoscopic camera systems, infrared camera systems, RGB camera systems, touchscreen technology, and combinations of these, for gesture detection and recognition. Additionally, the computing device <NUM> may be equipped with accelerometers or gyroscopes that enable detection of motion. The output of the accelerometers or gyroscopes may be provided to the display of the computing device <NUM> to render immersive augmented reality or virtual reality.

Claim 1:
A computer storage medium storing computer-useable instructions that, when used by one or more computing devices, cause the one or more computing devices to perform operations comprising:
loading (<NUM>) an anti-cheat kernel driver into a memory of a gaming device (<NUM>) during a booting process of the gaming device;
validating (<NUM>), via the loaded anti-cheat kernel driver, a system state of the gaming device prior to completion of the booting process;
determining (<NUM>), via the loaded anti-cheat kernel driver, that the system state is compromised after the booting process is completed, wherein the compromised system state is monitored by the loaded anti-cheat kernel driver; and
responsive to a game application associated with the anti-cheat kernel driver being launched, blocking (<NUM>) access to a gaming server (<NUM>) associated with the game application based on the determined compromised system state.