Data encryption and privacy protection methods and systems for the gaming industry

Abstract

This invention provides a data encryption and privacy protection method and system for the gaming industry, belonging to the field of data security technology. The method includes: acquiring dynamic classification tags, real-time threat alerts, game scene information, and user behavior context information; calculating data sensitivity indicators, attack threat indicators, and contextual risk factors based on these and performing weighted adjustments, obtaining a comprehensive risk value through adaptive weighted fusion; when the comprehensive risk value exceeds a dynamic threshold, activating a memory non-resident protection strategy, deleting the original data from regular memory and storing it in an isolated area; verifying the legitimacy of access, instantly decrypting and loading the data after successful access, and immediately erasing it; exiting the strategy when the comprehensive risk value is below the threshold and remains stable for a preset time. This invention achieves dynamic adaptive adjustment of the encryption strategy, eliminating the risk of memory data being scanned and stolen at the physical level, and achieving a balance between security and system performance.

Description

Technical Field

[0001] This invention relates to the field of data security technology, and in particular to data encryption and privacy protection methods and systems for the gaming industry. Background Technology

[0002] With the booming development of the online gaming industry, game data security faces increasingly severe challenges. Cheating software scans the game process's memory space, directly reading or modifying critical data objects such as character health, in-game currency, and item attributes, severely undermining game fairness and harming player experience and the commercial interests of game operators. Statistics show that popular games often face attacks from dozens or even hundreds of different cheat variants after launch, with some cheating tools even adapting to game updates within hours. The secure protection of game memory data has become a recognized technical challenge in the industry.

[0003] Current game data encryption technologies primarily employ static classification encryption methods, categorizing data into different levels based on their sensitivity and using high-strength encryption algorithms to protect highly sensitive data. While this approach increases the difficulty of static data analysis, its encryption strategy is typically determined at game startup and remains unchanged during runtime, forming a static defense model. Cheaters, through extensive memory analysis and reverse engineering, can determine the timing of data decryption, storage location, and data transformation patterns in memory, thereby developing targeted cheating tools. Furthermore, static encryption strategies cannot dynamically adjust their defense strength based on real-time attack dynamics, often leaving them vulnerable to new types of cheat attacks.

[0004] Another type of existing technology attempts to identify cheating behavior through anomaly detection, such as statistically analyzing memory access frequency per unit time or detecting specific API call sequences. However, these methods suffer from significant lag, typically triggering alerts only after the attack has occurred and caused some impact, making preventative defense difficult. Furthermore, anomaly detection relies on preset rules or historical behavior models, limiting its ability to identify zero-day vulnerabilities and new cheat variants, and is prone to false positives, impacting the gaming experience for legitimate players.

[0005] Furthermore, existing technologies for protecting high-value data typically employ only encrypted storage, leaving the data residing in plaintext or ciphertext in regular memory. This fails to fundamentally eliminate the risk of theft by memory scanning tools. While some research has proposed temporarily removing critical data from physical memory, several key technical challenges remain: how to intelligently determine when to enable and disable such robust protection strategies; how to comprehensively assess multi-dimensional risk factors such as game scenarios, user behavior, and real-time threats; and how to achieve a dynamic balance between security and system performance. Summary of the Invention

[0006] The purpose of this invention is to provide a data encryption and privacy protection method and system for the gaming industry, in order to solve the technical problems of static and single encryption strategies in the prior art, which cannot be dynamically adjusted according to the real-time attack situation, overcome the limitations of traditional encryption methods in fundamentally eliminating the risk of memory data theft, and achieve a dynamic balance between security protection strength and system performance overhead.

[0007] To achieve the above objectives, this invention provides a data encryption and privacy protection method for the gaming industry, comprising the following steps: Step S1: Obtain dynamic classification tags of key data objects in the game process, real-time threat alerts for the game process, and current game scene information and user behavior context information; Step S2: Calculate data sensitivity index, attack threat index, and contextual risk factor; Step S3: Use contextual risk factors to correct the data sensitivity index and attack threat index respectively, to obtain the corrected data sensitivity index and the corrected attack threat index. Step S4: Input the two corrected indicators into the preset multi-indicator fusion model, and calculate the comprehensive risk value through the adaptive weighted fusion algorithm; Step S5: Compare the comprehensive risk value with the preset dynamic threshold. If it exceeds the threshold, start the memory non-resident protection strategy; otherwise, use the conventional encryption strategy. Step S6: During the startup of the non-resident memory protection policy, when an access request to the original data logical address is detected, the access request is intercepted and the legitimacy of the accessor is verified. Step S7: If the verification passes, the data is decrypted from the isolated memory area and instantly loaded into the execution unit for the accessor to use. After use, the data in the execution unit is immediately erased; if the verification fails, access is denied and an alarm is triggered. Step S8: During the activation of the memory non-resident protection policy, continuously monitor the comprehensive risk value. When the comprehensive risk value drops below the dynamic threshold and remains stable for more than the preset time window, exit the memory non-resident protection policy, restore the data to reside in regular memory, and use a regular encryption strategy for protection.

[0008] Preferably, the calculation of the data sensitivity index in step S2 includes the following steps: Step S201: Extract data sensitivity dimension values ​​from dynamic classification labels. Data real-time requirements dimension values and behavioral context sensitivity dimension value ; Step S202: Assign basic weights to the three dimensions respectively. , , Calculate the initial sensitivity : ; Step S203: Smooth the historical sensitivity using the exponentially weighted moving average method to obtain the final data sensitivity index: ; in, This is the data sensitivity indicator for the current moment. The data sensitivity index for the previous moment. This is a smoothing factor.

[0009] Preferably, the calculation of the attack threat index in step S2 includes the following steps: Step S211: Count the number of abnormal accesses per unit time. Duration of abnormal access The size of the memory range involved in abnormal access ; Step S212, to , and Mapped to threat intensity components respectively , , ,in , , For the preset normalized mapping function, The threat component is the number of abnormal access attempts. For the threat component of abnormal access duration, This is a threat component related to abnormal access to memory range; Step S213: Weight and accumulate the historical threat components using a time decay factor to obtain the attack threat index: ; in, As an indicator of the current attack threat level, This represents the attack threat indicator from the previous moment. This is the time decay factor.

[0010] Preferably, the calculation of the contextual risk factor in step S2 includes the following steps: Step S221: Map the current game scene type to the scene risk coefficient. , ; Step S222: Calculate the degree of deviation between user behavior and historical behavior model, and map it to a behavioral risk coefficient. , ; Step S223: Use fuzzy logic reasoning to determine the scenario risk coefficient. and behavioral risk coefficient Integrating into contextual risk factors .

[0011] Preferably, the weighted correction in step S3 specifically includes the following steps: Step S31: Obtain the preset first weight factor Second weighting factor ; Step S32: Calculate the corrected data sensitivity index : ; in, As a data sensitivity indicator, For contextual risk factors; Step S33: Calculate the corrected attack threat index : ; in, As an indicator of attack threat; Step S34: Dynamically adjust the first weighting factor according to the game's running stage. Second weighting factor The formula is adjusted as follows: ; ; in, and Basic weight value, and To adjust the coefficient, This is a function that indicates the game's battle phase. It takes a value of 1 when the game is in battle, and a value of 0 otherwise. This is a function that indicates the game loading phase. It takes the value 1 when the game is in the loading phase, and 0 otherwise.

[0012] Preferably, the adaptive weighted fusion algorithm in step S4 specifically includes the following steps: Step S41: Obtain system load Network latency and the number of recent successful attacks As a state variable; Step S42: Calculate the system load membership degree respectively. Membership degree of network latency The calculation formula is: ; ; in, , For the low and high thresholds of system load, , These are the low and high thresholds for network latency; Step S43: Calculate the influencing factor of the number of successful attacks. The calculation formula is: ; in, A preset threshold for the number of successful attacks. This represents the number of recent successful attacks. Step S44: Based on system load membership Network latency membership Factors affecting the number of successful attacks Dynamically adjust and correct the data sensitivity index Fusion weights and revised attack threat indicators Fusion weights The formula is adjusted as follows: ; in, Based on the fusion weight, To maximize the adjustment step size, The fusion weights are those for the equilibrium state. Step S45: Calculate the comprehensive risk value : .

[0013] Preferably, the dynamic threshold in step S5 is adaptively adjusted based on the system operating status and the global attack situation, and the adjustment formula is as follows: ; in, The dynamic threshold at the current moment. Based on the threshold, The standard deviation of the historical composite risk value. This represents the proportion of idle resources in the system. This is a fluctuation index for the game's in-game economic system. , , This is the preset adjustment coefficient.

[0014] Preferably, verifying the visitor's legitimacy in step S6 includes the following steps: Step S61: Intercept access instructions to logical addresses; Step S62: Capture the context of the access instruction and calculate the hash value of the code segment that initiated the access. ; Step S63: Transfer the hash value With the pre-stored set of trusted code hash whitelists Perform a comparison, if If it is valid, it is considered a legitimate access request; otherwise, it is considered an illegitimate access request.

[0015] Preferably, in step S8, the exit condition is expressed as follows: And duration ; in, For the comprehensive risk value, The dynamic threshold at the current moment. This is a preset time window.

[0016] This invention also provides a data encryption and privacy protection system for the gaming industry, used to implement the aforementioned data encryption and privacy protection method for the gaming industry, including: The data acquisition module is used to obtain dynamic classification labels of key data objects in the game process, real-time threat alerts for the game process, and information on the current game scene and user behavior context. The metrics calculation module is used to calculate data sensitivity metrics, attack threat metrics, and contextual risk factors. The indicator correction module is used to correct the data sensitivity indicator and the attack threat indicator respectively using contextual risk factors, so as to obtain the corrected data sensitivity indicator and the corrected attack threat indicator. The risk fusion module is used to input the two corrected indicators into a preset multi-indicator fusion model and calculate the comprehensive risk value through an adaptive weighted fusion algorithm. The strategy decision module is used to compare the comprehensive risk value with the preset dynamic threshold. If the threshold is exceeded, the memory non-resident protection strategy is activated; otherwise, the conventional encryption strategy is adopted. The access control module is used to intercept access requests and verify the legitimacy of the accesser when an access request to the original data logical address is detected during the startup of the non-resident memory protection policy. The data loading module is used to decrypt data from the isolated memory area and instantly load it into the execution unit for access when the verification is successful, and immediately erase the data in the execution unit after use; and to deny access and trigger an alarm when the verification fails. The strategy recovery module is used to continuously monitor the comprehensive risk value during the activation of the memory non-resident protection strategy. When the comprehensive risk value drops below the dynamic threshold and remains stable for more than a preset time window, the memory non-resident protection strategy is exited, and the plaintext or ciphertext data is restored to reside in regular memory.

[0017] Therefore, the present invention employs the above-mentioned data encryption and privacy protection method and system for the gaming industry, and the beneficial technical effects are as follows: (1) Achieving dynamic adaptive defense and overcoming the limitations of static encryption strategies. This invention constructs a multi-dimensional comprehensive risk assessment system by acquiring dynamic classification tags, real-time threat alerts, game scene information, and user behavior context information in real time. Unlike existing technologies where encryption strategies remain unchanged once determined, this invention uses contextual risk factors to weight and correct data sensitivity indicators and attack threat indicators, and dynamically calculates the comprehensive risk value through an adaptive weighted fusion algorithm. It can intelligently adjust the defense strength according to real-time attack trends and changes in the game environment, solving the technical problem that static defense cannot cope with new cheat variants and dynamic attack modes.

[0018] (2) Eliminating the risk of memory data theft at the physical level, breaking through the limitations of traditional encryption protection. When the comprehensive risk value exceeds the dynamic threshold, this invention activates a memory non-resident protection strategy, physically deleting the original data from the regular memory space of the game process and encrypting and storing it in an isolated memory area protected by the operating system. Unlike traditional encryption technology that only keeps data in memory in ciphertext form, this invention, through the mechanism of physical deletion, instant recovery, and immediate erasure, makes it impossible for attackers' memory scanning tools to locate valid data, fundamentally eliminating the possibility of direct theft of memory data and significantly improving the security of high-value data.

[0019] (3) Achieving a dynamic balance between security and system performance, optimizing the game experience. This invention employs a dynamic threshold adaptive adjustment mechanism, combining the standard deviation of historical comprehensive risk values, the proportion of idle system resources, and the volatility index of the in-game economic system to correct the threshold in real time. Simultaneously, it dynamically adjusts the fusion weights of data sensitivity indicators and attack threat indicators through fuzzy control rules, automatically activating high-intensity protection when encountering high threats, and smoothly exiting the memory non-resident protection strategy after the risk decreases and stabilizes for a preset time window. This intelligent dynamic decision-making mechanism can minimize the impact on system performance while ensuring data security, avoiding game lag or response delays due to excessive defense, and optimizing the game experience for normal players. Attached Figure Description

[0020] Figure 1 This is a flowchart of the data encryption and privacy protection method for the gaming industry according to the present invention; Figure 2 A comparison chart showing the time it takes for the risk value to exceed the threshold under different attack intensities; Figure 3 A comparison chart showing the activation time of protection strategies under different attack intensities; Figure 4 A comparison chart of total response latency under different attack intensities; Figure 5 This is an architecture diagram of the data encryption and privacy protection system for the gaming industry according to the present invention. Detailed Implementation

[0021] The technical solution of the present invention will be further described below with reference to the accompanying drawings and embodiments.

[0022] Unless otherwise defined, the technical or scientific terms used in this invention shall have the ordinary meaning as understood by one of ordinary skill in the art to which this invention pertains.

[0023] Example 1 like Figure 1 As shown, the data encryption and privacy protection methods for the gaming industry include the following steps: Step S1: Obtain dynamic classification labels for key data objects in the game process, real-time threat alerts for the game process, and current game scene information and user behavior context information.

[0024] In this step, key data objects include core game data such as player character health, mana, coordinates, gold, and item attributes. Dynamic classification tags are generated in real-time by the security module on the game client or server. These tags include three dimensions: data sensitivity (e.g., high, medium, low), data real-time requirement (e.g., real-time, near real-time, non-real-time), and behavioral context sensitivity (based on historical behavior models to determine if current behavior is abnormal). Real-time threat alerts are obtained by monitoring memory access behavior targeting the game process, such as the frequency of cross-process read / write operations by external processes and abnormal memory scanning patterns. An alert is generated when an abnormal access pattern matching preset rules is detected. Current game scene information includes game status (e.g., login lobby, matchmaking, battle, loading screen), while user behavior context information records player operation sequences and mouse / keyboard input frequencies to determine if behavior deviates from historical models.

[0025] Step S2: Calculate data sensitivity index, attack threat index and context risk factor.

[0026] (1) Calculation of data sensitivity index.

[0027] Step S201: Extract data sensitivity dimension values ​​from dynamic classification labels. Data real-time requirements dimension values and behavioral context sensitivity dimension value ,in For example, regarding health value data, it might be... =0.9、 =0.8、 =0.2; For gold coin data, it may be... =0.6、 =0.3、 =0.2.

[0028] Step S202: Assign basic weights to the three dimensions respectively. , , And satisfy In this embodiment, the values ​​are set to 0.5, 0.3, and 0.2 respectively to calculate the initial sensitivity. : .

[0029] Step S203: Smooth the historical sensitivity using the exponentially weighted moving average method to obtain the final data sensitivity index: ; in, This is the data sensitivity indicator for the current moment. The data sensitivity index for the previous moment. The smoothing factor has a value range of (0,1], and is set to 0.3 in this embodiment.

[0030] (2) Calculation of attack threat index.

[0031] Step S211: Count the number of abnormal accesses per unit time. Duration of abnormal access The size of the memory range involved in abnormal access .

[0032] Step S212, to , and Mapped to threat intensity components respectively , , ,in , , For the preset normalized mapping function, The threat component is the number of abnormal access attempts. For the threat component of abnormal access duration, This is a threat component related to abnormal access to memory range; Specifically: ; ; ; in, , , For example, a preset threshold. =100, =500, =1024 bytes.

[0033] Step S213: Weight and accumulate the historical threat components using a time decay factor to obtain the attack threat index: ; in, As an indicator of the current attack threat level, This represents the attack threat indicator from the previous moment. This is the time decay factor, with a value range of (0,1], and is set to 0.4 in this embodiment.

[0034] (3) Calculation of contextual risk factors.

[0035] Step S221: Map the current game scene type to the scene risk coefficient. , For example, the battle scene can be set to 0.9, the loading scene to 0.3, and the lobby scene to 0.5.

[0036] Step S222: Calculate the degree of deviation between user behavior and historical behavior model, and map it to a behavioral risk coefficient. , This can be obtained by statistically analyzing the deviation between current behavioral characteristics (such as operation frequency and path selection) and historical models (such as Gaussian mixture models). The greater the deviation, the better. The higher.

[0037] Step S223: Use fuzzy logic reasoning to determine the scenario risk coefficient. and behavioral risk coefficient Integrating into contextual risk factors Specifically, it includes: Step S2231: Assess the scenario risk coefficient and behavioral risk coefficient Fuzzification is performed, and the fuzzy set to which each member belongs is determined according to the preset membership function. The fuzzy set includes three levels: low, medium, and high. The membership function can be defined as: Low: When When the membership value is ≤0.3, the membership degree is 1; when it is 0.3 < When <0.5, it linearly decreases to 0; In the middle: when 0.4≤ When the membership degree is ≤0.6, it is 1, and decreases linearly to 0 on both sides; Gao: When When the membership degree is ≥0.7, the membership degree is 1; when it is 0.5 < It increases linearly when <0.7.

[0038] Step S2232: Based on a preset fuzzy inference rule base, infer the fuzzified scene risk coefficient and behavior risk coefficient to obtain a fuzzy output result. The fuzzy inference rule base includes: if High and High, then high; if High and In the middle, then high; if And High, then high; if And In the middle, then middle; if low and Low, then Low.

[0039] Other combination rules can be defined similarly, and are usually set to medium or low.

[0040] Step S2233: Defuzzify the fuzzy output results and calculate the accurate contextual risk factor using the centroid method. , .

[0041] Step S3: Use contextual risk factors to correct the data sensitivity index and attack threat index respectively, to obtain the corrected data sensitivity index and the corrected attack threat index.

[0042] The weighted adjustment specifically includes the following steps: Step S31: Obtain the preset first weight factor Second weighting factor ,in In this embodiment, the values ​​are set to 0.2 and 0.1 respectively.

[0043] Step S32: Calculate the corrected data sensitivity index : ; in, As a data sensitivity indicator, For contextual risk factors.

[0044] Step S33: Calculate the corrected attack threat index : ; in, This serves as an indicator of attack threat.

[0045] Step S34: Dynamically adjust the first weighting factor according to the game's running stage. Second weighting factor The formula is adjusted as follows: ; ; in, and The basic weight values ​​are 0.2 and 0.1 respectively. and These are adjustment factors (all 0.1). This is a function that indicates the game's battle phase. It takes a value of 1 when the game is in battle, and a value of 0 otherwise. This is a function that indicates the game loading phase. It takes the value 1 when the game is in the loading phase, and 0 otherwise.

[0046] Step S4: Input the two corrected indicators into the preset multi-indicator fusion model, and calculate the comprehensive risk value through the adaptive weighted fusion algorithm.

[0047] Step S41: Obtain system load Network latency and the number of recent successful attacks As a state variable. Step S42: Calculate the system load membership degree respectively. Membership degree of network latency The calculation formula is: ; ; in, , The low and high thresholds for system load are 0.3 and 0.8, respectively. , These are the low and high thresholds for network latency (0.2 and 0.6, respectively).

[0048] Step S43: Calculate the influencing factor of the number of successful attacks. The calculation formula is: ; in, A preset threshold for the number of successful attacks. This represents the number of recent successful attacks.

[0049] Step S44: Based on system load membership Network latency membership Factors affecting the number of successful attacks Dynamically adjust and correct the data sensitivity index Fusion weights and revised attack threat indicators Fusion weights The formula is adjusted as follows: ; in, Set the base fusion weight (to 0.5). The maximum adjustment step size is set to 0.2. The fusion weights are in equilibrium and range from [0,1].

[0050] Step S45: Calculate the comprehensive risk value : .

[0051] Step S5: Compare the comprehensive risk value with the preset dynamic threshold. If the value exceeds the threshold, the memory non-resident protection strategy is activated; otherwise, the conventional encryption strategy is adopted.

[0052] The dynamic threshold is adaptively adjusted based on the system's operating status and the overall attack situation. The adjustment formula is as follows: ; in, The dynamic threshold for the current moment (set to 0.6). Based on the threshold, The standard deviation of the historical composite risk value (reflects risk volatility; the greater the volatility, the higher the threshold, to avoid frequent triggering). This refers to the proportion of idle resources in the system (such as CPU idle rate; when resources are scarce, the threshold is increased to reduce performance overhead). The fluctuation index of the in-game economic system (such as the rate of change in the total amount of gold coins; when the economic fluctuations are large, the threshold is lowered to strengthen protection). , , The preset adjustment coefficients are (set to 0.2, 0.1, and 0.05 respectively).

[0053] when When this occurs, the memory non-resident protection policy is activated. This policy performs the following operations: The original data is physically deleted (zeroed out) from the game process's regular memory space, and the encrypted data is stored in an isolated memory region protected by the operating system, such as using an Intel SGX enclave or ARM TrustZone. Simultaneously, a protection flag is set at the original memory address so that any direct access to that address will trigger an exception.

[0054] like If so, a conventional encryption strategy is adopted, that is, the data resides in memory in ciphertext form and the key is changed periodically.

[0055] Step S6: During the startup of the non-resident memory protection policy, when an access request to the original data logical address is detected, the access request is intercepted and the legitimacy of the accessor is verified.

[0056] Verifying a visitor's legitimacy includes the following steps: Step S61: Intercept access commands to logical addresses.

[0057] Step S62: Capture the context of the access instruction and calculate the hash value of the code segment that initiated the access. (For example, using SHA-256 to hash the code page where the caller is located).

[0058] Step S63: Transfer the hash value With the pre-stored set of trusted code hash whitelists Perform a comparison, if If it is valid, it is considered a legitimate access request; otherwise, it is considered an illegitimate access request.

[0059] The whitelist contains the hashes of all legitimate game code modules, either built into the game upon release or distributed via security updates.

[0060] Step S7: If the verification passes, the data is decrypted from the isolated memory area and instantly loaded into the execution unit for the accessor to use. After use, the data in the execution unit is immediately erased; if the verification fails, access is denied and an alarm is triggered.

[0061] For legitimate access, the security proxy module reads the encrypted data from the isolated memory region, decrypts it using the key bound to the current session, temporarily loads the decrypted data into the CPU register, and then resumes instruction execution. Once the instruction execution is complete, the data in the register is immediately cleared. Throughout the entire process, the data never appears in regular memory, only briefly existing in the CPU register.

[0062] For unauthorized access, the security agent module denies access, logs alarm information, and can take further measures such as terminating suspicious processes or reporting to the server.

[0063] Step S8: During the activation of the memory non-resident protection policy, continuously monitor the comprehensive risk value. When the comprehensive risk value drops below the dynamic threshold and remains stable for more than the preset time window, exit the memory non-resident protection policy, restore the data to reside in regular memory, and use a regular encryption strategy for protection.

[0064] The exit condition is expressed as follows: And duration ; For the comprehensive risk value, The dynamic threshold at the current moment. A preset time window is defined. Once the conditions are met, the data is migrated from the isolated memory area back to regular memory (in encrypted form), and the special protection for that address is removed, restoring the regular encryption strategy. This mechanism ensures that the protection state is not frequently switched due to momentary risk fluctuations, avoiding system instability.

[0065] The invention will be further illustrated below with specific examples.

[0066] Test environment configuration.

[0067] Hardware configuration: Intel Core i7-12700K processor, 32GB DDR4 memory, NVIDIA GeForce RTX3070 graphics card, 512GB NVMe solid-state drive.

[0068] Software environment: Windows 11 operating system, Unity 2022.3 game engine, Visual Studio 2022 development environment. The test game uses a prototype of a multiplayer competitive shooting game, including key data objects such as player character health, ammunition quantity, gold balance, and 3D coordinates.

[0069] Comparison objects: Three comparison schemes were set up. Scheme A is the original state without encryption protection (baseline control group); Scheme B is the existing static encryption technology, which uses AES-256-GCM to encrypt highly sensitive data. The encryption strategy is determined at the start of the game and remains unchanged; Scheme C is the adaptive encryption protection method proposed in this invention.

[0070] Test scenario design.

[0071] Three typical game scenarios were designed to comprehensively evaluate the effectiveness of the invention: Scenario 1 (Low-risk scenario): The game is in the login lobby, where players perform non-combat actions such as character customization and browsing the store for 5 minutes.

[0072] Scenario 2 (Medium-risk scenario): The game is in the matchmaking waiting stage and is about to enter the battle. Some data begins to preheat and load, which lasts for 2 minutes.

[0073] Scenario 3 (High-risk scenario): During the intense battle phase of the game, players perform high-frequency operations such as moving, shooting, and using items. At the same time, a memory scanning attack is launched by a simulated cheat program, lasting for 10 minutes.

[0074] Attack simulation settings.

[0075] Using a self-developed memory scanning tool to simulate cheat behavior, this tool can: (1) Scan the game process memory space at different frequencies: low frequency 1 time / second, medium frequency 10 times / second, high frequency 50 times / second; (2) Scan different memory ranges: local scan (scan only the vicinity of the code segment), full scan (scan the entire process space); (3) Try to read and write key data addresses to simulate the modification of game data by cheats.

[0076] Attack intensity is divided into three levels: light attack (low frequency + local scanning), medium attack (medium frequency + local scanning), and heavy attack (high frequency + full scanning + data read / write attempts).

[0077] Evaluation indicators.

[0078] The following indicators were used to comprehensively evaluate the performance of each scheme: (1) Data security indicators: number of times key data is successfully read, number of times it is successfully modified, and the probability of plaintext data being discovered by memory scanning tools.

[0079] (2) Performance overhead indicators: CPU utilization increase, memory utilization increase, and game frame rate (FPS) decrease.

[0080] (3) Response indicators: the delay time from the occurrence of the attack to the effective date of the protection policy, and the frequency of protection policy switching.

[0081] V. Experimental Results.

[0082] (1) Comparison of data security indicators.

[0083] As shown in Table 1, in the high-risk test of Scenario 3, Solution C immediately activated the memory non-resident protection strategy after detecting that the comprehensive risk value exceeded the dynamic threshold (within approximately 0.8 seconds), physically deleting the original data from regular memory. Subsequent scans by the attack tool failed to locate valid data, all access requests were intercepted and verified, and all illegal access was denied. Although Solution B employed encryption protection, the attacker, through long-term memory analysis, found an opportunity for the data to briefly reside in memory after decryption, successfully reading some of the data.

[0084] Table 1 Comparison of Data Security Indicators

[0085] (2) Comparison of performance overhead indicators.

[0086] As shown in Table 2, in the high-risk test of Scenario 3, Solution C, due to its non-resident memory protection strategy, no longer has data permanently residing in regular memory, resulting in a lower increase in memory usage compared to Solution B. The CPU increase mainly comes from access verification and instantaneous encryption / decryption operations. However, by dynamically adjusting the fusion weights using an adaptive weighted fusion algorithm, the weight of data sensitivity indicators is appropriately reduced when the system load increases, keeping performance overhead within an acceptable range. Solution B, due to its fixed encryption strategy, still needs to continuously maintain ciphertext data during the attack, and the frequent access attempts by attackers lead to a large amount of anomaly handling, resulting in higher performance overhead.

[0087] Table 2 Comparison of performance overhead metrics

[0088] (3) Response index test like Figure 2 As shown, the time for the risk value to exceed the threshold decreases significantly with increasing attack intensity: 2.3 seconds for a mild attack, 1.1 seconds for a moderate attack, and only 0.6 seconds for a severe attack. This indicates that Scheme C can dynamically accumulate the risk value based on the attack intensity; the more intense the attack, the faster the risk value reaches the threshold.

[0089] Depend on Figure 3 It can be seen that the protection strategy startup time remains stable at around 0.2 seconds under different attack intensities, indicating that once the risk value exceeds the threshold, the startup process of the non-resident memory protection strategy has a deterministic response and is not affected by the attack intensity.

[0090] Figure 4 The total response latency (the sum of the time the risk value exceeds the threshold and the protection policy activation time) decreases as the attack intensity increases: 2.5 seconds for a light attack, 1.3 seconds for a medium attack, and only 0.8 seconds for a heavy attack. This indicates that Solution C can complete the deployment of the protection policy faster when encountering high-intensity attacks.

[0091] The exit mechanism test showed that after the attack stopped, Scheme C continuously monitored the comprehensive risk value. After the risk value was below the threshold and remained stable for more than 5 seconds, it smoothly exited the memory non-resident protection and restored the normal encryption strategy. There were no frequent policy switching phenomena during this period.

[0092] Example 2 like Figure 5 As shown, a data encryption and privacy protection system for the gaming industry includes: The data acquisition module is used to obtain dynamic classification labels of key data objects in the game process, real-time threat alerts for the game process, and information on the current game scene and user behavior context. The metrics calculation module is used to calculate data sensitivity metrics, attack threat metrics, and contextual risk factors. The indicator correction module is used to correct the data sensitivity indicator and the attack threat indicator respectively using contextual risk factors, so as to obtain the corrected data sensitivity indicator and the corrected attack threat indicator. The risk fusion module is used to input the two corrected indicators into a preset multi-indicator fusion model and calculate the comprehensive risk value through an adaptive weighted fusion algorithm. The strategy decision module is used to compare the comprehensive risk value with the preset dynamic threshold. If the threshold is exceeded, the memory non-resident protection strategy is activated; otherwise, the conventional encryption strategy is adopted. The access control module is used to intercept access requests and verify the legitimacy of the accesser when an access request to the original data logical address is detected during the startup of the non-resident memory protection policy. The data loading module is used to decrypt data from the isolated memory area and instantly load it into the execution unit for access when the verification is successful, and immediately erase the data in the execution unit after use; and to deny access and trigger an alarm when the verification fails. The strategy recovery module is used to continuously monitor the comprehensive risk value during the activation of the memory non-resident protection strategy. When the comprehensive risk value drops below the dynamic threshold and remains stable for more than a preset time window, the memory non-resident protection strategy is exited, and the plaintext or ciphertext data is restored to reside in regular memory.

[0093] It is worth noting that all contents not described in detail in this invention are existing technologies and are well known to those skilled in the art.

[0094] Therefore, the present invention adopts the above-mentioned data encryption and privacy protection method and system for the gaming industry, which can dynamically adjust the encryption strategy according to the real-time threat situation and game context information. When encountering the risk of high-value data theft, it automatically activates the memory non-resident protection mechanism, fundamentally eliminating the possibility of memory data being directly scanned and stolen. At the same time, through intelligent risk decision-making and threshold adaptive adjustment, it minimizes the impact on game performance while ensuring data security, and achieves synergistic optimization of security and user experience.

[0095] Finally, it should be noted that the above embodiments are only used to illustrate the technical solutions of the present invention and not to limit them. Although the present invention has been described in detail with reference to preferred embodiments, those skilled in the art should understand that modifications or equivalent substitutions can still be made to the technical solutions of the present invention, and these modifications or equivalent substitutions cannot cause the modified technical solutions to deviate from the spirit and scope of the technical solutions of the present invention.

Claims

1. A data encryption and privacy protection method for the gaming industry, characterized in that: Includes the following steps: Step S1: Obtain dynamic classification tags of key data objects in the game process, real-time threat alerts for the game process, and current game scene information and user behavior context information; Step S2: Calculate data sensitivity index, attack threat index, and contextual risk factor; Step S3: Use contextual risk factors to correct the data sensitivity index and attack threat index respectively, to obtain the corrected data sensitivity index and the corrected attack threat index. Step S4: Input the two corrected indicators into the preset multi-indicator fusion model, and calculate the comprehensive risk value through the adaptive weighted fusion algorithm; Step S5: Compare the comprehensive risk value with the preset dynamic threshold. If it exceeds the threshold, start the memory non-resident protection strategy; otherwise, use the conventional encryption strategy. Step S6: During the startup of the non-resident memory protection policy, when an access request to the original data logical address is detected, the access request is intercepted and the legitimacy of the accessor is verified. Step S7: If the verification passes, the data is decrypted from the isolated memory area and instantly loaded into the execution unit for access. After use, the data in the execution unit is immediately erased. If the verification fails, access will be denied and an alarm will be triggered. Step S8: During the activation of the memory non-resident protection policy, continuously monitor the comprehensive risk value. When the comprehensive risk value drops below the dynamic threshold and remains stable for more than the preset time window, exit the memory non-resident protection policy, restore the data to reside in regular memory, and use a regular encryption strategy for protection.

2. The data encryption and privacy protection method for the gaming industry according to claim 1, characterized in that, The calculation of the data sensitivity index in step S2 includes the following steps: Step S201: Extract data sensitivity dimension values ​​from dynamic classification labels. Data real-time requirements for dimension values and behavioral context sensitivity dimension value ; Step S202: Assign basic weights to the three dimensions respectively. , , Calculate the initial sensitivity : ； Step S203: Smooth the historical sensitivity using the exponentially weighted moving average method to obtain the final data sensitivity index: ； in, This is the data sensitivity indicator for the current moment. The data sensitivity index for the previous moment. This is a smoothing factor.

3. The data encryption and privacy protection method for the gaming industry according to claim 2, characterized in that, The calculation of the attack threat index in step S2 includes the following steps: Step S211: Count the number of abnormal accesses per unit time. Duration of abnormal access The size of the memory range involved in abnormal access ; Step S212, to , and Mapped to threat intensity components respectively , , ,in , , For the preset normalized mapping function, The threat component is the number of abnormal access attempts. For the threat component of abnormal access duration, This is a threat component related to abnormal access to memory range; Step S213: Weight and accumulate the historical threat components using a time decay factor to obtain the attack threat index: ； in, As an indicator of the attack threat at the current moment, This represents the attack threat indicator from the previous moment. This is the time decay factor.

4. The data encryption and privacy protection method for the gaming industry according to claim 3, characterized in that, The calculation of the contextual risk factor in step S2 includes the following steps: Step S221: Map the current game scene type to the scene risk coefficient. ; Step S222: Calculate the degree of deviation between user behavior and historical behavior model, and map it to a behavioral risk coefficient. ; Step S223: Use fuzzy logic reasoning to determine the scenario risk coefficient. and behavioral risk coefficient Integrating into contextual risk factors .

5. The data encryption and privacy protection method for the gaming industry according to claim 4, characterized in that, The weighted adjustment in step S3 specifically includes the following steps: Step S31: Obtain the preset first weight factor Second weighting factor ; Step S32: Calculate the corrected data sensitivity index : ； in, As a data sensitivity indicator, For contextual risk factors; Step S33: Calculate the corrected attack threat index : ； in, As an indicator of attack threat; Step S34: Dynamically adjust the first weighting factor according to the game's running stage. Second weighting factor The formula is adjusted as follows: ； ； in, and Based on the weight value, and To adjust the coefficient, This is a function that indicates the game's battle phase. It takes a value of 1 when the game is in battle, and a value of 0 otherwise. This is a function that indicates the game loading phase. It takes the value 1 when the game is in the loading phase, and 0 otherwise.

6. The data encryption and privacy protection method for the gaming industry according to claim 5, characterized in that, The adaptive weighted fusion algorithm in step S4 specifically includes the following steps: Step S41: Obtain system load Network latency and the number of recent successful attacks As a state variable; Step S42: Calculate the system load membership degree respectively. Membership degree of network latency The calculation formula is: ； ； in, , For the low and high thresholds of system load, , These are the low and high thresholds for network latency; Step S43: Calculate the influencing factor of the number of successful attacks. The calculation formula is: ； in, A preset threshold for the number of successful attacks. This represents the number of recent successful attacks. Step S44: Based on system load membership Network latency membership Factors affecting the number of successful attacks Dynamically adjust and correct the data sensitivity index Fusion weights and revised attack threat indicators Fusion weights The formula is adjusted as follows: ； in, Based on the fusion weight, To maximize the adjustment step size, The fusion weights are those for the equilibrium state. Step S45: Calculate the comprehensive risk value : 。 7. The data encryption and privacy protection method for the gaming industry according to claim 6, characterized in that, The dynamic threshold in step S5 is adaptively adjusted based on the system's operating status and the overall attack situation. The adjustment formula is as follows: ； in, The dynamic threshold at the current moment. Based on the threshold, The standard deviation of the historical composite risk value. This represents the proportion of idle resources in the system. This is a fluctuation index for the game's in-game economic system. , , This is the preset adjustment coefficient.

8. The data encryption and privacy protection method for the gaming industry according to claim 7, characterized in that, Step S6, verifying the visitor's legitimacy, includes the following steps: Step S61: Intercept access instructions to logical addresses; Step S62: Capture the context of the access instruction and calculate the hash value of the code segment that initiated the access. ; Step S63: Transfer the hash value With the pre-stored set of trusted code hash whitelists Perform a comparison, if If it is valid, it is considered a legitimate access request; otherwise, it is considered an illegitimate access request.

9. The data encryption and privacy protection method for the gaming industry according to claim 1, characterized in that, In step S8, the exit condition is expressed as follows: And duration ; in, For the comprehensive risk value, The dynamic threshold at the current moment. This is a preset time window.

10. A data encryption and privacy protection system for the gaming industry, characterized in that: A method for implementing data encryption and privacy protection for the gaming industry as described in any one of claims 1-9, comprising: The data acquisition module is used to acquire dynamic classification tags of key data objects in the game process, real-time threat alerts for the game process, and information on the current game scene and user behavior context. The metrics calculation module is used to calculate data sensitivity metrics, attack threat metrics, and contextual risk factors. The indicator correction module is used to correct the data sensitivity indicator and the attack threat indicator respectively using contextual risk factors, so as to obtain the corrected data sensitivity indicator and the corrected attack threat indicator. The risk fusion module is used to input the two corrected indicators into a preset multi-indicator fusion model and calculate the comprehensive risk value through an adaptive weighted fusion algorithm. The strategy decision module is used to compare the comprehensive risk value with the preset dynamic threshold. If the threshold is exceeded, the memory non-resident protection strategy is activated; otherwise, the conventional encryption strategy is adopted. The access control module is used to intercept access requests and verify the legitimacy of the accesser when an access request to the original data logical address is detected during the startup of the non-resident memory protection policy. The data loading module is used to decrypt data from the isolated memory area and instantly load it into the execution unit for access when the verification is successful, and immediately erase the data in the execution unit after use; and to deny access and trigger an alarm when the verification fails. The strategy recovery module is used to continuously monitor the comprehensive risk value during the activation of the memory non-resident protection strategy. When the comprehensive risk value drops below the dynamic threshold and remains stable for more than a preset time window, the memory non-resident protection strategy is exited, and the plaintext or ciphertext data is restored to reside in regular memory.

Images