What exploits does my system allow for that I can't solve or did not account for?
I'm researching on a design for multiplayer RPG that can safely allow players to have their character files and play solo offline and reliably check they haven't cheated using fully deterministic game engine, action history (replays) and cryptographic signatures. I do this in attempt to deliver much wanted from players true ownership of their characters, lag free gameplay and cheat-free economy at the same time.
So far I have established the following facts and processes:
FACT: The game is fully deterministic with life-long RNG seeds embedded in characters upong creation.
FACT: Game records and replays user actions (not keystrokes and mouse clicks, but rather "attack enemy ID-42". Game client CD-KEY hash is embedded in each action sequence between saves
EVALUATE AND SIGN: After offline solo play, character file and action history are uploaded to server, where action history is replayed headlessly and end-state is compared with candidate-end-state. If they match, the end-state is signed with X509 private key and signature is downloaded and appended to the character file. Action history is required for play sessions since last signed state.
- FACT: Signing requires account authentication to prove owning the character. Characters are tied to accounts online, but can be shared between players for offline play.
- FACT: Hashed CD-KEY of the client is embedded in the character, so the server knows on which game client the play session happened
VERIFYING: When attempting multiplayer, either LAN or developer-hosted, character signatures are verified. If latest state is not signed - go to step 3. Only signed characters can participate in official servers.
- If a character loses action history for whatever reason they can still play solo offline, but not on official servers.
- Illegal actions like use a wrong ID or attack an enemy outside your reach invalidate the action history and the character is not signed
- Server tracks how long (in game ticks) a CD-Key has played and verify if it's possible to have played that much since the CD-Key is issued. You could not have played 3000 hours on a CD-Key that has been issued 1000 hours ago. With multiple CD-Keys, their play-time-budget is verified for overlapping play-time with other characters that used it. E.g. if a CD-Key has been issued 1000 hours ago, someone has played for 700 hours using it and the candidate applies for a 500 hours-long play time then the candidate is rejected (500+700 = 1200 > 1000).
FACT: Trade is only allowed online (no LAN) to cut off many hard-to-solve cheat scenarios.
Assume common sense security like logging, network setup and server configuration has been planned for.
Issues I have accounted for
Most concerning issue I see with offline solo play is that hackers will completely reverse-engineer the file format and/or the game and forge game-valid godly characters, ruining the economy and the community. Solution: This takes very long time and concentrated effort from experienced professionals to do.
- Small patches and updates can force you to constantly do RE work and if consistent enough, RE clients may never be up-to-date.
- If the incentive doesn't come (game is not popular enough, gameplay offers what you would cheat for anyway, cheats are hard to monetize) hackers won't spend the effort.
- Anyway, assuming they could produce legit characters the damage to the economy (for which I care the most) would be minimal because CD-Keys play-time budget (fact 4.3) would limit how much hours the character could have played. Furthermore, since the game is deterministic, the character will only have whatever items the RNG says (and they cared to stash). If a character is destined by RNG to get lucky at kill number 294 942 953 291 it will happen exactly then and that may be way past the timeline that has been forged. Even using oldest possible CD-Keys won't help since they would have play-hours logged already. This also discourages exploring alternate decision making to hit the best RNG outcome.
Impersonation and theft
Cheater may acquire with or without permission somebody elses character file, then transfer his belongings or attempt to impersonate him online. Either of these won't work, because you need to authenticate online.
Cheater may copy character file to duplicate the items, but we established trade can only happen online for that reason. Trading on LAN is possible but too problematic for this very reason and is thus unavailable
Character file size
A character state would only be few kilobytes without action history or states from the past. However, I have estimated a full year of non-stop playing - 96 hours a week with APM of 200 and action being 17 bytes (which is pretty generous) the file would be ~1GB which can be problematic for storage on the server. While charactrs only need their last signed state (few KB) and action history since (~180 KB/h), the server needs it all for forensics and analysis. E.g. server may want to check players for a known bot signature.
Storing replay data can be very helpful for identifying botting. However, botters have the same edge against the developer that the developer has against reverse-engineers - can consistently change their behavior footprint and make very hard to detect. The best ones would only read game memory or even screen colors to identify game state and simulate player input at the OS level which is honestly untraceable.