2
\$\begingroup\$

We have an app with several mini-games in it and in each a highscore can be achieved. The score gets submitted by requesting an endpoint and passing the score as a json in the body. How can we be sure that the client is sending us the correct score? Our current solutions:

  • we're using wss, so man in the middle should be not possible
  • the client can access the endpoint only after authenticating with his device (over gamesparks)
  • at least on Android we're obfuscating the code
  • we're saving each score in two different variables and comparing them before sending one of them

Is there anything more we can do to secure the game? It seems to be quite effective to just submit the player interactions and calculate the scores server-side, but that seems - because of our several completely different games - to complicated in our case. What is about creating a hash of the score and comparing it on the server?

\$\endgroup\$
2
  • 2
    \$\begingroup\$ If a sufficiently motivated player reverse-engineered your game and located any secret information it uses to authenticate with gamesparks and connect to your server, then they could forge phony sign-ins and report arbitrary scores. To validate the scores themselves, you need to include some kind of "proof of work," some signature of the gameplay leading to that score that the server can validate is at least possible in-game (in the time elapsed). If you describe more of your game's mechanics, we may be able to help suggest what kind of evidence in them the server could use for this purpose. \$\endgroup\$
    – DMGregory ♦
    Commented Apr 18, 2017 at 3:58
  • \$\begingroup\$ you can take a look on an older version of the app here: bitduel.de, so mainly small arcade mini games \$\endgroup\$
    – dabo248
    Commented Apr 18, 2017 at 13:07

3 Answers 3

Reset to default
1
\$\begingroup\$

Ultimately you can't, unless you execute all game mechanics on your server. The app runs on the user's device. Any code running on the user's device is under their control. The best you could try which might buy you a few days of cheater-free competition is using cryptographic signatures.

  1. Generate an RSA keypair
  2. Add a private key to the app
  3. Sign each score update with that private key
  4. Use the public key to verify the signature on the server

This will work until a hacker extracts your private key from your app. Then they can build their own app to submit fake scores.

\$\endgroup\$
2
  • \$\begingroup\$ so couldn't you just request a magic string based on the score and account ( like email ) from the server. So we haven't written anything yet, then use that magic string as a pass phrase to allow writing. uploadeScore(score, magicstring). Only the server can create these strings and are temporary. So once the user saves the score, the magic string is removed server side so the user must request a new string every time before saving. Assuming there are additional handshake checks. \$\endgroup\$
    – Sidar
    Commented Aug 11, 2017 at 19:38
  • 1
    \$\begingroup\$ That wouldn't work because the false score submission program could just request a magic string from the server just like the actual client would. You basically can not verify the integrity or identity of a program via network. That means the server can never assume that the program it is talking with is actually the unmodified game client. \$\endgroup\$
    – Philipp
    Commented Aug 11, 2017 at 21:24
0
\$\begingroup\$

One way might be to detect abnormal increments in score. For example, if you know the max score attainable per time-step is 15, then the score cannot increment more than 15 per time-step. This can be done locally, and on server-side periodically via interpolation (since it's expensive to send messages every time-step).

\$\endgroup\$
2
  • \$\begingroup\$ You mean we measure the time the game was played and compare it server-side with the score, so we know if it is a realistic score? Getting the score / time-step value for four of our games should be easy, but for two others it gets difficult, because these are just about the players reaction time. \$\endgroup\$
    – dabo248
    Commented Apr 18, 2017 at 13:15
  • \$\begingroup\$ Yeps. For those about reaction time ... you mean like mouse movements? Idk if it's possible to check if the movements are mechanically realistic or more like an aimbot. \$\endgroup\$
    – Cardin
    Commented Apr 19, 2017 at 17:33
0
\$\begingroup\$

Maybe instead of sending a score, you can send an action to the server, then the server will calculate the new score and resend it to the client, with this approach you can make some statistics like how much time is taking for a player to complete a task and make some averages

\$\endgroup\$

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .