I'm working on a small management game. The player manage his hospital where he can collect items and new characters. Each player can visit others players hospital and gives collected entities.

I would like to save game state on the server side to allow this "multiplayer" part and check data to avoid cheating players.

I'm a little bit curious about the server side. Should I send all the game save file to the server then parse it to check his integrity?

My game will call specific routes to update the amount of data each 30 seconds/1 minutes.

I have made few games by the past but without the network part.

  • \$\begingroup\$ You've asked two separate questions. One about database design and the other about network protocol design. Please post every question separately. I removed the database part because it was the question which lacked the most information in order to be answerable. When you repost it, please add more information about your data structures. In order to create a proper database schema one needs to know all entities which need to be persisted and how they are related to each other. \$\endgroup\$
    – Philipp
    Nov 27, 2017 at 11:35

1 Answer 1


I assume you know how you're going to send the file to the server and how your going to store it...

To check integrity of the file you can do a few things:

Check the the values in the file are possible. let's say you save the score/currency in steps of 2 so every time you increase it the smallest amount is 2 and you never add an odd number. If you get a save file which ends in an odd number you have a cheater. You have characters with statistics, let's say that you're saving those stats in the save file because of experience gain or something. If there is a maximum value for each of those stats, check for it. If it's greater than the max for that character you have a cheater.

Compare the previous save file to the new one You already have the previous save file in the server, so you can look at the differences in them to try and figure out if the player is suddenly gaining a spike in resources. So it the player had 500 money last save game and 60 seconds have passed and they now have 300,000 money they might be cheating. This will depend on your game but if you can figure out what the maximum change in values are over a given amount of time you can catch people out that way. Just make sure that you keep in mind all possible ways of making money, if microtransactions give people 1,000,000 instantly it is probably going to be faster than the maximum amount you can earn in 30 seconds. you don't want to mark them as cheaters for it. You can apply the same strategy to your character statistics, work out the maximum stat difference and compare save files.

Include a save game counter, so every time you update the save game you increase the counter by one. This will essentially mean that every valid save file will be greater than the last and that there shouldn't be any collisions in save file numbers. If the number is the same or lower as the last one, there is a high chance that it is a cheater. Since they will have had to grab or write the save file change it and upload it. If the number is greater than the last time by more than the iteration amount. it could be a cheater but there is also a chance that the save file wasn't uploaded properly the last time they tried. This really depends on how you handle fail cases, if there is a server error do you keep iterating the number or do you skip iteration until the next successful upload.

The above will somewhat try to prevent people who have apps that look at other apps variables in memory and modify them. So when they do you can send a message to the game telling it to reload the last cloud save, putting them in the last known good state.

There are also people who will look at the data that your app is sending and will piece together the full save file from captured packets. For those you should encrypt your save files. Put the public key in the app and the private in the server then decrypt all of the save file and check them for integrity. If you couple this with the save game counter you can get good at throwing away bad save files since it will be hard to modify them in the app itself and the server can keep track of good save files.

Before you encrypt your save file you could also generate a hash of the save file. If you include that hash in the save file before you upload it you can compare the hashes you get server side after decrypting the save (keep in mind you don't want to include the hash in the server hash otherwise they will never match). If the hashes don't match throw the save away.

If you want to get really fancy you can use the possible value checks to move players from the general population to the cheating population. So that the general population play with people who are probably not cheating.

With all this said keeping cheating at bay is a cat and mouse game, they will figure out how your detecting them and try to work around it. It's inevitable, best you can do is make it as hard as possible for them.


You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .