Preventing cheating in online games

In computer security, there is a general rule which says that you should never trust anything sent to your server by client software running on a user's machine. No matter how many cryptographic checks and anti-tampering mechanisms you put into your code, you can never be sure that it's not running on an emulated machine over which the user has complete control, and any bits could be changed at any time to give the server an answer it accepts.

This a problem for online gaming, though, as cheaters can give themselves all sorts of capabilities that the game designer did not plan for. This (apparently - I am not much of a gamer) reduces the enjoyment of non-cheating players.

However, games do have one advantage here - they generally push the hardware to (something approximating) its limits, which means that running the entire game under emulation may not be possible.

So, what games can do is have the server transmit a small piece of code to the client which runs in the same process as the game, performs various checks and sends the results to the server so it can determine if the user is cheating or not. The Cisco Secure Desktop VPN software apparently uses this technique (which is how I came to think about it). I have heard this small piece of code referred to as a "trojan" in this context, although this terminology seems misleading because this particular kind of trojan doesn't run without the users knowledge and consent, and is only malicious in the sense that it doesn't trust the user (the same sort of maliciousness as DRM, which is not quite as bad as illegal malware).

The trojan for an online game could send things which are very computationally intensive to compute (such as the results of the GPU's rendering of the game). Because the server can keep track of time, doing these computations in anything less than real time would not suffice. To avoid too much load on the server, the computations would have to be things that are easier to verify correct than to compute in the first place (otherwise the server farm would need to have a gaming-class computer for every player, just to verify the results). And to avoid too much load on the client, it should be something that the game was going to compute anyway. I'm not quite sure how to reconcile these two requirements, but I think it should be possible.

The system should be tuned such that the fastest generally available computer would not be powerful enough to emulate the slowest computer that would be allowed to run the game. Depending on the pace of progress of computer technology and the lifespan of the game, it might eventually be necessary to change these requirements and force the users of the slowest computers to upgrade their hardware if they want to continue playing the game. While this would be frustrating for these players, I don't have a problem with it as long as there is a contract between the players and the game company that both agree to and are bound by - it would be part of the cost of playing without cheaters. Though I would hope that independent servers without these restrictions would also be available if there is demand for them.

2 Responses to “Preventing cheating in online games”

  1. Sung says:

    I have a question. Does online gaming software have memory to store the
    way I played to make me lose in certain games ? If it does, then cheating is involved. So, no matter how good math I have, I will still lose, just they are
    watching how I play. can you tell me how to prevent this? If games software
    does not function well, would that mean the online games software lose the
    storage memory and the chance of winning is higher. Please look into it and reply to me as soon as possible.

    • Andrew says:

      > Does online gaming software have memory to store the way I played to make me lose in certain games ?

      Certainly such a capability is technically possible. And I have heard of games adapting themselves to the players strengths to give more of a challenge to stronger players and to make themselves less frustrating to weaker players. An online component is not necessary though - offline games have been doing that for a long time.

      > If it does, then cheating is involved.

      I don't think that necessarily implies cheating, though - if it's part of the way the game works, then it's part of the way the game works.

      > So, no matter how good math I have, I will still lose, just they are watching how I play.

      Well, either it's a game of skill (in which case the computer has no influence) or a game of luck (in which case you can lose no matter how good your math is anyway). What kind of game are you talking about here anyway?

      > can you tell me how to prevent this?

      Yes, there is an absolutely foolproof way to prevent this. Don't play games which you find frustrating.

      > If games software does not function well, would that mean the online games software lose the storage memory and the chance of winning is higher.

      Not necessarily. Bugs in games can make the game easier, more difficult or have effects orthogonal to difficulty.

Leave a Reply