Cheat-Proof Playout for Centralized and Distributed Online Games

Transcription

1 Cheat-Poof Playout fo Centalized and Distibuted Online Games Nathaniel E. Baughman Bian Neil Levine Depatment of Compute Science Univesity of Massachusetts Amhest, MA 3 1 Abstact We exploe exploits possible fo cheating in eal-time, multiplaye games fo both client-seve and distibuted, seveless achitectues. We offe the fist fomalization of cheating in online games and popose an initial set of stong solutions. We popose a potocol that has povable anti-cheating guaantees, but suffes a pefomance penalty. We then develop an extended vesion of this potocol, called asynchonous synchonization, which avoids the penalty, is seveless, offes povable anti-cheating guaantees, is obust in the face of packet loss, and povides fo significantly inceased communication pefomance. This technique is applicable to common game featues as well as clusteing and cell-based techniques fo massively multiplaye games. Ou pefomance claims ae backed by analysis using a simulation based on eal game taces. I. INTRODUCTION Cheating is as old a concept as game playing. Fo netwoked games, cheating is closely tied to thee majo factos that affect the quality of the game: timely playout of eal-time inteaction; scalability of communication and game achitectues to lage numbes of uses; and the pevention o detection of cheating playes. Online, eal-time, stategy games [1], fist-peson shootes [2], [3], and massively-multiplaye vitual wolds [4], [5] all ely on simila techniques fo simulation. Ideally, all playes acoss a netwok ae able to synchonize game events and actions such that playe contol and inteaction is consistent acoss all playe viewpoints. Howeve, games often tade pecise contol fo communication pefomance gains to peseve the ealtime quality of the game playout. Most popula today ae centalized, client-seve game achitectues, which offe a single point of game coodination, but ceate a bottleneck of pocessing and signaling as the size of and numbe of playes in online wolds inceases. Moving to a distibuted, seveless achitectue inceases scalability and pefomance, but complicates playe inteaction and inceases the aleady toubling potential fo cheating extant in centalized appoaches. Cheating abounds in cuent game play on the Intenet, yet thee is little o no eal secuity to pevent cheating in online games. Cheats ae simple to download and use. In this pape, we make cheat-poof inteaction and fai playout of inteactions a necessay condition of game communication. We show that the common synchonization techniques used to peseve the ealtime quality of online games ae detimental to game play and even ceate iesolvable situations that destoy the coodination of the game. We uncove the potential fo cheating unde common synchonization techniques and show that cheating playes ae indistinguishable fom non-cheating playes. We then popose a potocol fo multiplaye game communication that has anti-cheating guaantees. The potocol is shown to be sufficient to offe pecise playe inteaction coodination, but it is not scalable to lage vitual wolds. We then extend the potocol with a new technique fo online game synchonization in a way that peseves coodination and secuity while betteing scalability and pefomance. Ou potocol is also the fist to ensue fai playout of events unde distibuted, seveless achitectues, i.e., achitectues without a tusted thid paty. Section II pesents backgound infomation on game achitectues. Section III consides the potential fo cheating duing game synchonization. Section IV pesents new potocols fo cheat pevention. Section V pesents an analysis of the pefomance of the potocols. Section VI looks how ou techniques may be combined with clusteing and cell-based techniques fo scaling to massively multiplaye scenaios. Section VII concludes. II. ASSUMPTIONS AND TERMINOLOGY In this pape, we gant to cheates the ability to ead, inset, modify, and block messages involved with the game potocols. We develop techniques to guad against attacks on such vulneable application-level signaling. Potecting against attacks on existing tanspot-laye and netwok-laye potocols, such as denial-of-sevice attacks, is beyond the scope of this pape. We assume application softwae is eadable by the use and will pefom its functions as oiginally intended. Moeove, any infomation available to the client is available to the playe, e.g., game state o cyptogaphic keys. This assumption pecludes any attempt to employ secuity by obscuity, which is the pedominant model in games today [6]. Have a compomised client is possible but equies access to and undestanding of the oiginal souce code o the ability to change the compiled vesion of the application. Peventing all cheats available because of client modifications ae beyond the scope of this initial study and ae left fo futue wok. Howeve, the specific techniques in this pape pesented fo cheat-poof playout ae toleant against modifications to the client. We efe to the set of infomation needed to descibe the game at any time as game state, which is composed of entity states. An entity may consist of seveal in-game objects (e.g., militay toops) and is contolled by a playe. We may efe to a playe as a peson playing a game as well as the objects that peson contols in the game. The patitioning of game state is depicted in Figue 1. Automated playes ae possible. s make decisions, that is they decide on events that change thei own states. When an inteaction occus, multiple playes decisions must be

2 2 Game Seve Game Wold Fig. 3. Decentalized-contol client-seve Fig. 1. Game state patitioning Host Game Host Game Seve Local Game change equest Game View change equest Game View change equest Game View Wold Host Game Local Local Wold Wold Wold Fig. 2. Centalized-contol client-seve Fig. 4. Distibuted esolved by computing the esulting state. We conside simulatos whee the pogession of in-game time, called a fame, is distinct fom wallclock time, and the simulato computes game state fo each fame. s take exactly one tun duing each fame. Such simulatos offe pecise game contol, but may appea slow to a playe if the simulato cannot compute each successive unit of in-game time quickly enough. A playe may also peceive slowe game play, in tems of wallclock time, if it must wait fo s fom a playe acoss the netwok. Multiplaye games ae coodinated though eithe centalized client-seve o decentalized distibuted achitectues. The achitectues diffe by whee game state is maintained, which involves effecting changes and coodinating inteactions. Unde a client-seve achitectue, all entity states ae maintained by the seve, which computes game state based on input fom clients and infoms clients of the cuent game state. In a centalizedcontol client-seve achitectue, illustated in Figue 2, a client sends equests fo the seve to change the client s entity state. In a decentalized-contol client-seve achitectue, illustated in Figue 3, a client infoms the seve of decisions that have affected the client s entity state, and the seve esolves inteactions between game objects and coodinates global game state. Unde a distibuted achitectue, whee clients ae efeed to as hosts, each host maintains its own entity state, infoms othe hosts of decisions, and esolves any inteactions without the use of any centalized authoity. A distibuted achitectue, illustated in Figue 4, is seveless and is also efeeed to peeto-pee gaming. -seve achitectues offe a single point of game coodination at the seve. In the decentalized-contol client-seve achitectue, the seve maintains an entity model that epesents the last known entity state as d by a client. In the face of missing s, the seve uses the entity model to esolve any inteactions, which may esult in conflicting views of game state between the seve and affected client. Howeve, since the seve has authoity ove maintaining game state, the client must accept these discepancies and confom to the seve s view of the game wold. These simplifications, among othe benefits, have made the client-seve achitectue popula. An entity model is also used by distibuted hosts fo emote entities. Howeve, inteaction decisions cannot be made in the face of missing entity state without potentially coupting the oveall game state. We exploe this futhe in the next section. Each achitectue pesented esults in vaious potentials fo cheating. Cheating occus when a playe causes s to game state that defy the ules of the game o gains an unfai advantage. Fo example, playes may cheat by using some piece of game state that a playe is not pemitted to have knowledge of accoding to game ules. A. Related Wok Dead eckoning is a technique that compensates fo vaiable communication latency and loss acoss a netwok by allowing a host to guess the state of anothe playe when s ae missing based on the last known vectos. Dead eckoning is a pat of the Distibuted Inteactive Simulation (DIS) and High-level Achitectue (HLA) standads [7], [8], and is commonly used by eseaches and developes [9], [1], [11], [12], [13], [14], [15]. In its simplest fom, the pedicted position of a playe is equal to the pevious position plus the velocity times the elapsed time. Singhal and Cheiton have efined this basic fomulation [13]. Diot, Gautie, and Kuose have evaluated the pefomance of bucket synchonization with dead eckoning in a simple, distibuted game called MiMaze [11], [12]. Bucket synchonization povisions a seies of buckets at each host, one bucket pe

3 3 discete time unit in the game. Each bucket collects s sent fom each emote playe. When it is time to pocess a bucket (i.e., the game time has eached that bucket s assigned time unit), any missing s ae dead eckoned. That is, the absent playe s entity model is guessed using the playe s state fom the pevious bucket. Pevious wok places dead eckoning as a necessay technology fo timely game play but lagely leaves the esulting poblem of entity inteaction esolution as a futue enhancement. In this pape, we show that employing a dead eckoning scheme and esolving entity inteactions ae mutually exclusive. Also not addessed in pevious wok is the potential fo cheating unde synchonization schemes. We show that cheating is possible in a dead eckoning system. We povide solutions to the cheating poblem in late sections of this pape. The next section shows that any fom of dead eckoning leads to iesolvable playe inteactions, especially with a distibuted achitectue. Ou wok is also elated to inteest management techniques fo massively multiplaye games and applications [16], [17], [18], [19], [2], [21]. Typically, inteest gouping is done on the basis of (x,y) gid-coodinates, a natual inteest clusteing fo the application aea of vitual envionments. Section VI discusses how ou wok can leveage these techniques. Lastly, ou wok is elated to paallel simulation techniques [22], [23], [8]. Paallel simulations opeate with eithe consevative o optimistic event pocessing. In consevative pocessing, no entity may be out of synchonization with othe entities and theefoe no lookahead and pocessing of events is possible. Optimistic techniques allow fo entities to execute events asynchonously, but then must be toleant of incoect state o computation duing execution. Typically, once it is ealized that such incoect state exists, the computation is undone, o olled back, to the last coect point. This method equies that states ae saved. Such techniques ae not useful fo eal-time multiplaye games as it would not be pactical to foce human paticipant to estat to pevious points in the game. In this pape we allow fo optimistic pocessing without the need fo ollback. III. FAIR PLAYOUT We define an online game as fai if state as peceived by evey playe is consistent with evey othe playe s expectations, including the seve, as defined by game ules. Fai esolution of game events can be complicated by the use of dead eckoning in seveal ways. A. Iesolvable Inteactions As stated, a playe cheats by causing s to game state that defy ules of the game o gains an unfai advantage. Coect playout of eal-time inteaction means that the game state is identically peceived by evey playe. A Fai game is one whee playes see events occus as would be expected by games ules and taken action. The goal of this pape is to achieve cheatpoof, coect, and fai gameplay. The solutions must be scalable to many playes in tems of signaling costs, and maintain playout such that delays in the advance of in-game time is minimally peceivable to playes. Dead eckoning can be used in client-seve o distibuted envionments [11], [12] and the opeation is the same. In the centalized case, inteactions ae esolved by the seve unifomly, but unfaily. That is, the seve is the sole authoity ove game state that is used to esolve inteactions, so all clients ae d with the same esulting view of the wold. Howeve, if the seve uses dead-eckoned state to esolve an inteaction, the decision may diffe fom the expectation of the dead-eckoned playe. Thus, a dead-eckoned playe may view the seve s decision as unfai, since the playe s tue actions wee not used by the seve. The esulting discepancy in playout may cause jumpiness in game play o othe atifacts. Due to the uneliability and latency vaiability of the Intenet, this client-seve unfainess is unfavoably toleated by game playes. The annoyance of unfai decisions becomes damaging in a distibuted achitectue, as inteactions based on dead-eckoned state may coupt the global game state as seen by each host. Since dead-eckoned state may not be consistent between hosts, using dead-eckoned state to esolve inteactions esults in an unfai decision, accoding to othe playes. In the distibuted context, fainess includes coectness. The esult of esolving an inteaction based on dead-eckoned state in a distibuted achitectue is the potential fo incoectness of oveall game state. Fo example, say playes and dead eckon playe to take no actions, when in eality destoyed (eality is defined as the game state when inteactions ae esolved faily and coectly). If playe then destoys playe befoe s actions ae esolved, then game play is coupted. Game time could be estoed to a state befoe the inteaction, but this is clealy not a fai o pactical solution, although it is exactly the appoach taken by the High Level Achitectue s optimistic time management sevice [8]. An iesolvable inteaction poblem esults when dead eckoning is used and inteactions ae eithe detemined unfaily by a seve o potentially incoectly by a distibuted host. B. Cheating Unde Dead Reckoning The possibility of cheating is widely disegaded in multiplaye games. Many games ae designed aound the clientseve achitectue, which povides some implicit secuity along with centalized contol of game state. Distibuted games ae much moe pone to cheating, but cheats ae possible within a client-seve game. One secuity flaw unde bucket synchonization is what we tem the suppess-coect cheat, which allows a host to gain an advantage by puposefully dopping messages. Suppose that unde some dead eckoning policy, buckets ae allowed to be dead eckoned befoe the playe is consideed to have lost connection and is emoved fom the game (coodinating the emoval of a playe in a distibuted game is beyond the scope of this pape). With such a policy, a cheating playe can puposefully dop packets while playing. The playe then uses knowledge of the cuent game state to constuct an packet fo the th bucket that povides some advantage. A simple example allows a sluggish playe,, to chase a moe agile playe,. begins pusuit, then dops s; meanwhile, dead eckons s missing state but cannot confim whee eally is. Fo the th bucket, sends a fabicated that places on the heels of. As long as sends plausible s evey th bucket, cannot confim that is

4 4 cheating o not cheating; simply claims to be on a congested, lossy link. This cheat applies both to client-seve as well as distibuted games. We can conclude that fai play is indistinguishable fom cheating when dead eckoning is used. In the following sections of this pape, we povide stong guaantees of cheat pevention and detection. IV. CHEAT-PROOF GAME INTERACTION Most eal-time stategy games equie inteaction esolution at each discete unit of time, o tun, in the game. A stopand-wait-type potocol simila to those used fo eliable tanspot [24] can fulfill this equiement fo client-seve o distibuted achitectues: befoe time advances in the game, the state change decisions made by each playe must be available. In othe wods, fo a game at fame, all playes stop and wait fo all othe playes to decide and announce thei tun fo fame, and eceive the announcements of all othe playes, befoe continuing on to fame. Because no dead eckoning is allowed, the suppess-coect cheat is eliminated. Moeove, since all state decisions ae known at each tun, all inteactions can be esolved by each host. Such a scheme expects that each playe will make a next-tun decision based on the cuent tun state, then send that decision to each othe playe. Howeve, this epesents anothe oppotunity fo cheating: a cheating playe can simply wait until all othe playes have sent thei decisions, which we call the lookahead cheat. Fo example, may take a lethal shot towads that could not be defended against in nomal human eaction times. Howeve, using the lookahead cheat, playe may have a cheating agent that sends the decision to aise shields in time. When a stop-and-wait-type potocol is employed, playes that appea to be slowe may actually be implementing a lookahead cheat, which can be seious depending on such game featues. In this section, fist we pesent a potocol whee lookahead cheats and suppess-coect cheats ae not possible. This potocol has pefomance dawbacks as all playes ates ae esticted to that of the slowest playe. In the second pat of this section, we povide enhancements to allow fai play while allowing playes to not wait fo all playes befoe advancing in game time. A. Lockstep Potocol To counte the lookahead cheat, we popose a stop-and-waittype potocol with a decision commitment step. We call this secued vesion the lockstep potocol, which is sufficient fo implementing lockstep synchonization as descibed below. Suppose tun is complete. Each playe decides but does not announce its tun. Each playe instead announces a cyptogaphically secue one-way hash of its decision as a commitment, including andomized padding if necessay to avoid ecognizable hashed decisions and avoid collisions [25]. Once all playes have announced thei commitments, playes then eveal thei decisions in plaintext. Hosts can easily veify evealed decisions by compaing hashes of plaintext to the peviously sent committed value. Because each host has only the cuent tun infomation to make its next-tun decision, the lookahead cheat is pevented. Waiting is no longe beneficial. As an optimization, the last host is not equied to commit its decision if all othe hosts have aleady committed theis; the last playe may eveal its decision immediately. The two-phase commitment and equied waiting peiod fo all playes in the lockstep potocol intoduces a pefomance penalty. Although coect playout is peseved with lookahead cheat pevention, the game and all playes will un at the speed of slowest playe. The eception of othe playe s packets is likely to be delayed by cuent netwok conditions. The next section pesents a synchonization mechanism and potocol that etains the desiable popeties of the lockstep potocol and allows the game to un at a speed independent of all playes wheneve possible. A.1 Poof of Coectness A safety and liveness poof of the lockstep potocol shows that it fulfills its equiements by not poducing an eo condition and always pogessing [24]. We make a numbe of assumptions: thee exists a eliable channel between all playes; all playes know of all othe playes; playes ae able to authenticate messages fom each othe playe; and all playes wait only a finite time befoe making decisions and evealing commitments. 1 Theoem: The lockstep potocol is safe: no host eve eceives the state of anothe host befoe the game ules pemit; an eo occus if knows s state fo fame befoe has committed to events at, whee and ae any two playes. The lockstep potocol is live: the fames each playe esolves monotonically advance with wallclock time. Poof: The safety of the lockstep popety follows diectly fom the potocol specification. Let be equal to the cuent fame being esolved by an abitay playe. Initially,. As pe the potocol desciption, announces a hashed vesion of the decision it has made fo once it has eceived commitments fom all othe playes fo the same fame. will not announce its committed decision fo time until decisions fo time fom evey othe playe ae evealed, eceived, and veified against commitments. No playe, including, may alte announced events because of the hash commitments. Because may not advance, thee is no possibility that anothe paticipant will lean s decision fo a late fame ealie than the one cuently being esolved. Fo liveness, let be the wallclock time at which abitay playe stats to esolve fame of the game. Let be the wallclock time at which all playes lean the evealed decisions of all othe playes fo fame ; let if this neve occus. Let be the wallclock time at which playe advances to time fame ; let if this neve occus. We will show that and that is finite. Assume playe is not the last playe to commit. Let equal the value of vaiable at playe at wallclock time. Let!" # %$. By definition of the potocol, we know!"& ' ($. Because all playes wait only a finite time befoe committing to decisions, and because all communication takes place ove a eliable channel, we know the commitment of the last playe will be eceived within a finite time, and theefoe, ) All assumptions can be implemented in pactice. Fo example, playes not evealing o committing decisions within a bounded time would be eleased fom game play.

5 5 is finite. Because the potocol is safe, we know that the value of is incemented to $ only at time. It is clea fom the statement of the algoithm that is a non-deceasing value ove time. Because " is non-deceasing,. Because all playes eveal commitments within a finite time ove a eliable channel, is also finite. A simila poof can be constucted if playe is the last playe to commit. In that case, it is s communication that ensues and ae finite. Local base delta Remote base B. Asynchonous Synchonization In this section, we pesent a new synchonization technique with guaanteed fai playout called asynchonous synchonization (AS) that elaxes the equiements of lockstep synchonization by decentalizing the game clock. Each host advances in time asynchonously fom the othe hosts, but entes into a lockstep-style mode when inteaction is equied. Coect playout and fainess ae guaanteed. Asynchonous opeation of the lockstep mechanism povides a pefomance advantage because at times playes can advance in game time even without contact fom all othe playes. This elaxed contact equiement may ovecome intemittently slow netwok signaling, packet loss, o slow host pocessing. We do not expect AS to be used to allow playes with completely diffeent netwok and host esouces to play togethe. Instead, fo this initial design, AS is meant as a technique to isolate the effects of tempoaily poo connections between playes who play at the same ate fo a lage majoity of time and to educe the time it takes to esolve inteactions. B.1 Sphees of Influence Using AS, each playe s host keeps tack of each othe playe s advance in game time and space duing game play. The aea of the game that can possibly be affected by a playe in the next tun and theefoe potentially equie esolution with othe playe decisions is called the playe s sphee of influence (SOI). We define influence as any in-game infomation that affects a playe s decisions, and theefoe the outcome of a playe s decisions; whee in-game efes to pats of the game wold, as opposed to extenal knowledge that the playe may have, e.g., that a cetain opponent typically follows some stategy. Accodingly, a sphee of influence is the in-game aea that encompasses all souces of potential influences on a playe s upcoming decisions. It follows that anything outside of a playe s cuent SOI is immateial to the playe s gameplay decisions and esulting events. Fo example, if a playe is not within eashot of a foest, then the playe caes not if a falling tee made any sound, no if it fell. In AS, each playe consides the intesection of two types of SOI. Fist, a playe s own SOI, which indicates a geometic aea wheein decisions made contibute to and must be esolved with the playe s decisions fo the next tun. Second, SOI of emote playes, which indicate the aeas that can be affected by the othe playes on thei next tun. Accodingly, if two playes SOI do not intesect fo a cetain tun, thei decided events will not affect each othe when esolving game state fo that tun. In AS-based games, each host may be making decisions fo a diffeent time fame and advancing its time fame independent of othe hosts; details ae descibed subsequently. Theefoe, a Fig. 5. Base and delta sphees of influence Local host The set of all emote hosts A emote host in The cuent fame at the local host of host at fame Hash of state fo host fo fame Potential influence of host at fame Fig. 6. Table of vaiables. 1. Compute 2. Send 3. Pocess accepted messages that have aived 4. foeach Take next if any have aived whee Let fame of latest state taken be compute, and dilated fom if ( ) then ecod is not waiting fo else if! accepted then is not waiting fo else is waiting fo 5. if not waiting fo any then send esolve any inteactions finalize and ende tun advance to tun #"%$ Fig. 7. AS at the local playe fo each game tun. SOI is composed of two pats. The base SOI is the maximum aea that may influence o be influenced on any one tun. The delta SOI is the change in influence aea that may occu in subsequent tuns. Base and delta ae epesented as adii, as illustated in Fig. 5, and delta is added to base to compute subsequent tuns. 2 B.2 Asynchonous Synchonization Potocol Ou desciption of the AS potocol is fom the point of view of one host in a distibuted, seveless achitectue. The potocol can be easily adapted to a centalized achitectue. A fomal desciption of the potocol is given in Figues 6 and 7 as it would take place fo an abitay tun at a playe &. If a playe has eached tun, then we assume it has aleady evealed state fo tun. Fo simplicity, we assume in-ode, fully eliable delivey of packets. We extend the potocol to out-of-ode, uneliable delivey of messages late in this section. Not shown is an initial- ' The figues illustate 2D play only, but clealy, AS mechanisms exist fo 3D coodinate systems.

6 6 fame numbe 12 lt 2 t lt 3 t l p t3 l p t p t3 p t2 p t1 p t4 p t 3 p t2 p t1 Fig. 8. (Left) Dilation to. (Right) Dilation to and intesection at. ization phase that occus befoe the game begins: evey playe leans the full set of emote othe playes,, and stats each emote playe,, in lockstep with evey othe playe until the initial positions of the othe playes ae eceived ove the netwok. Fo an abitay tun, a playe fist detemines its decision fo that tun (Step 1), and second announces the commitment of the decision to all playes (Step 2). Thid, commitments that ae one fame past the last evealed fame of a emote playe ae accepted (Step 3). Befoe evealing its commitment, the local playe must detemine which emote playes it is waiting fo (Step 4). A emote playe is not in the wait state only if thee is no intesection with the SOI dilated fom the last evealed fame of the emote playe, o if a commitment fom the emote playe has been accepted by the local playe. Each othe emote playe s SOI is computed using the base adius of the last known position plus a delta adius fo each time fame that the local playe is ahead of the emote playe s last known time fame. If the local host is in the futue elative to anothe playe, then the othe playe s potential to influence the local playe s next decision is dilated to the local playe s next time fame (Fig. 8a). If the local host is not in the futue of a emote host, then no dilation is pefomed. Intesection of the SOI as the local playe moves to the next time fame without eceiving evealed state fom the emote playe since fame is illustated in Fig. 8b. Finally, if no emote hosts ae in the wait state, the local host eveals its state fo tun, s its local entity model of each othe playe with thei last known state, including the emote host s last known time fame (no dead eckoning is pefomed), and advances to the next tun (Step 5). The potocol then epeats fo the next tun. AS allows a host to advance in time at a ate independent of othe hosts, until thee is potential influence fom a slowe playe which might esult in inteactions that must be esolved. As an illustative example, conside the case depicted in Figs 9 and 1, dawn fom simulation esults. Fig. 9 shows a pai of playes cossing each othe in the -plane of the game. The -axis epesents the fame of each playe fo a coesponding -coodinate. Both playes paths stat at fame zeo and end at fame 111. Conside anothe set of playes, C and D, that take the same paths in the game, but must poceed in lockstep synchonization. s C and D have the same fame-vesus y coodinates x coodinates Fig. 9. position vesus game fames. Top lines:playes A, B, C, and D. Bottom lines: paths in the! -plane. wallclock time y coodinates x coodinates Fig. 1. position vesus wallclock time. Top lines:playes C and D. Middle lines: playes A, and B. Bottom lines: paths in the! -plane. -coodinate gaph as playes A and B. Fig. 1 shows the same paths in the -plane, but the -axis epesents the wallclock time of the playes fo each coodinate. s C and D ae epesented by the two lines advancing slowly in wallclock time (highe in the -plane). In contast, playes A and B poceed accoding to the AS algoithm: they may advance in time as quickly as possible, only poceeding in lockstep when thei SOI intesect. Fig. 1 shows playes A and B only having a shap incease in slope as the two appoach each othe in the -plane. s A and B need not wait to hea fom the othe playe to continue with the game othewise, and theefoe ae not affected by netwok delays. In contast, playes C and D must constantly wait fo each othe, and so netwok delays affect evey moment of the game. With AS, lookahead cheats ae pevented similaly to the lockstep potocol: by committing to a hash of the next-tun decision until all hosts have committed at the same time fame

7 7 o have evealed past decisions that emove the potential fo cheating (i.e., the potential fo inteaction). AS eliminates the suppess-coect cheat also in the same way as in the lockstep potocol. The host cannot advance in time until all potential influences fo one tun have been esolved. The lookahead cheat might appea to be moe seious than in lockstep synchonization: a host may puposely lag behind othe hosts in ode to peview futue infomation. Howeve, a host cannot advance in time past the point whee a potential influence is detected, hence cheating is useless as no playe would be affect by the cheat. (Note simple jumps in position ae easily detectable as being located outside a dilated SOI fom a known position). By definition of SOI, the futue infomation eleased by the advancing host is immateial to any othe playe s game decisions. Note that AS signaling may give a playe advance location infomation about anothe playe, which will not allow cheating of game playout but may possibly alte a playe s stategy. Howeve, we pesent a solution to this situation fo centalized and distibuted achitectues in Section VI. The AS potocol also peseves lockstep synchonization s guaanteed coect and fai playout, since all inteactions ae esolved with pefect infomation fo each tun in the game. The pefomance incease is the ability to advance in time independent of emote hosts when no inteactions ae possible. We demonstate such pefomance gains by simulation in Section V. A host in a distibuted game using the AS potocol can execute as fast as possible until a potential influence ovelap is detected. To peseve a set game play fame ate, designes may impose a maximum game speed. (Simulation esults in Section V make use of a simila type of capped ate.) At best, once a SOI intesection is detected, a host will have to wait fo only one fom anothe playe, which will estict its potential SOI and allow the local host to continue. At wost, the potentially inteacting playe must catch up in time to a faste host in ode to esolve an actual inteaction. This wost case occus, fo example, when the lagging playe moves diectly towad the futue position of anothe playe at the maximum delta ate. Othewise, the past playe s dilated SOI will not intesect the futue playe s SOI, and the futue playe may continue. B.3 AS with Packet Loss Although ou poof of AS assumed the existence of a eliable channel between all playes, this assumption can be elaxed. Simply stated, playes can skip missing packets and accept new, out-of-ode packets fom othe playes when the missing packets epesent state outside a SOI intesection. Missing packets that epesent intesection of SOI cannot be dopped o skipped. We do not pesent a new poof hee, howeve, one can be easily constucted by examining if the dilated SOI esulting fom missing packets esult in an intesection; if they do not, the packet may be skipped. It is clea the potocol has enough infomation to detemine if missing infomation would possibly esult in SOI intesection if eventually eceived. We can conclude that AS epesents a pefomance advantage ove lockstep. Rathe than contact evey playe evey tun, with AS, playes need only contact playes that have SOI intesection. In othe wods, a playe 2 SOI adii away need be only head fom afte 2 tuns to be sue thee is no SOI intesection. Othe pefomance benefits ae exploed in moe detail in the next section. C. Secet Possessions Many games include the notion of secet infomation, which is valuable in-game state that may only be known to a subset of the playes. One type is secet possessions, which ae objects that a playe chooses not to eveal immediately to othe playes, with the condition that no actions ae taken with the object until it is evealed. s in a distibuted game may wish to hide an object, such as a weapon o key, fo a late use. Howeve, opponents may desie poof that the object was in fact acquied ealie and within game ules. Fo example, in a captue-the-flag game, playe may captue an opponent s flag to bing back to a home base to win the game. may hide which of its game soldies has the flag causing the opponent to have to neutalize all of playe s soldies unning fo home base when it is unclea which has the flag. To solve this dilemma, we define a pomise as a place holde fo secet possessions with the condition that the emote playe claims no potential inteaction exists with the hidden possession. Pomises can be easily implemented in the fom of a hashed o encypted commitment sent to the opponent and late evealed. The opponent must sign the commitment to pevent epudiation that the secet was not pomised. The pomising playe may choose to not continue on with the game until the pomise is signed by the opponent. To povide local playe the confidence that secetive, emote playe is acting honestly, we pesent a cheat detection scheme, which does not pevent cheating but allows it to be discoveed. Along with the pomise, must commit to its cuent (secet) state, fo example, using a one-way hash function as in the lockstep potocol. ecods the committed state. The state is evealed and veified at a designated time, eithe afte the game has been completed o based on some expiation afte which old secet infomation is consideed declassified, o no longe impotant to be kept secet. We define the logge sevice as a mechanism that esides in each host and ecods pomised infomation to be veified late. To povide a moe eal-time cheat detection solution, we define the obseve sevice as a tusted, centalized entity that eceives secet infomation though secue channels and veifies it duing gameplay. If cheating is detected, a potocol can alet playes and pompt some action to be taken; e.g., emoval fom the cuent game and banishment fom a tounament. If neve knows the position of, then asynchonous opeation is not povided fo because can only advance in time at the ate of s pomises, assuming can only issue one pomise pe time fame. If wishes to advance in time faste than, then must be cetain that s dilated, potential SOI does not intesect with its own, o potential inteactions may be iesolvable. To peseve the benefit of asynchonous time advance, we povide a centalized solution. A pomise sevice is a tusted, centalized entity that eceives secet and non-secet infomation in the same way as the obseve sevice. The pomise sevice dilates s SOI to s time fame and issues a pomise to if no inteaction exists. Assuming the pomise sevice host can execute at least as fast as s host, pomises can be issued

8 8 to even in the case that has not advanced in time. No secet infomation is evealed to, and inteaction esolution is guaanteed since the pomise sevice in enacting the AS potocol. The pomise sevice also solves the situation in which no playe may know the entity state of anothe. SOI ae dilated and pomises issued on behalf of each playe by the pomise sevice. Intoducing such a centalized solution countemines the potential fo AS to be deployed fo lage, distibuted simulated envionments, and a distibuted solution is left as futue wok. pecentage of tuns playe Xpilot Simulation Lockstep soi-4x soi-2x soi V. PERFORMANCE ANALYSIS We analyzed the pefomance of the AS potocol compaed to the lockstep potocol by simulation. We did not compae against dead eckoning techniques as it is clea dead eckoning will pefom bette but intoduces unfai actions fo centalized achitectues and iesolvable events in distibuted achitectues. We ae unawae of any wok that pesents analytical models of typical game play. Theefoe, we took taces fom a epesentative game, XPilot [26], a netwoked, multiplaye game whee playes contol ships in a two-dimensional space. Accodingly, we cannot claim the esults pesented in this section ae geneic. Howeve, ou hope is that they ae epesentative. We built a custom simulato that contolled each playe in the game based on taces fom eal XPilot sessions. We configued XPilot to un fo about 4 fames of game play with vaious numbes of automated playes on a 3-by-3 size map 3, and modified the game to log -coodinate infomation to a file. Logging did not begin until all playes had joined the game. Ou simulato took the logs as input fo each playe, and each -coodinate in the log was consideed a tun decision taken by each playe. Each unit of simulato time epesented 1 milliseconds of wallclock time. Each unit of time in the simulato, playes could ead fom the logs fo thei next tun and send that tun to othe playes. Howeve, sending of a decision would be blocked appopiately by the lockstep o AS potocol accoding to anticheating constaints. We assumed a sta topology between playes. Each playe s netwok connection had a delay to the cente point of the sta topology that was dawn each tun fom an exponential distibution with a mean of 5 simulato time units. A simple exponential distibution was suitable fo this peliminay investigation; ou futue wok will include simulation on moe vaied distibutions and netwok topologies. The sta topology has two intepetations. The fist is that packets wee multicast fom each playe to each othe playe. The second is that packets wee unicast to a non-playing seve located at the cente of the sta, which then immediately and simultaneously unicast the packets to each othe playe. s could not take tuns moe often than evey 4 units of the simulation so that we wee consistent with constaints on human eaction times assumed by pevious simulation wok [11], [12]; we temed this the lowe cap. Additionally, playes had an uppe cap: they could not advance in tuns moe than once fo evey 1 units of simulato time that had passed. This was This value is the XPilot map size, but the ganulaity of the playe position coodinate system is much fine, on the ode of 5,-by-5,. pecentage of tuns pecentage of tuns pecentage of tuns ms between fames playe Xpilot Simulation Lockstep soi-4x soi-2x soi ms between fames playe Xpilot Simulation Lockstep soi-4x soi-2x soi ms between fames playe Xpilot Simulation Lockstep soi-4x soi-2x soi ms between fames Fig. 11. Distibution of milliseconds stalled between fames due to lockstep inteaction.

9 9 to simulate a game unning at 1 fames pe second, which is consistent with a typical XPilot game. Fo example, conside a playe at simulato time 3 who just ead and sent its decision fo game fame 3 to all othe playes. It must wait 4 steps befoe eading its next tun (the lowe cap), and may not send out the packet until simulato time 4 is eached (the uppe cap). Howeve, conside if, due to lockstep constaints, the playe was foced to wait until simulato time 51 to send the packet fo fame 4. Since fou time units had passed since it ead fame 4 fom the tace, and because time 5 had passed, it could immediately ead fame 5 fom the tace log and would be able to ty to send out the packet immediately (subject to lockstep constaints). We took taces of 1, 18, 3, and 37 playes. Ou futue wok will include the study of lage numbe of playes; XPilot is not a game suitable fo play with playes numbeing in the hundeds o lage. It is also suitable to conside ou simulation as that of one cell in a cell-based o clusteed game; this is discussed futhe in Section VI. Fo each tace, ou simulato used fou diffeent SOI sizes. The smallest SOI usable was set as the maximum distance any playe could move in a single tun. We expect this to be the size used in pactice. The lagest SOI simulated was of infinite size, coesponding exactly to a lockstep potocol. Fo compaison puposes, we also simulated twice the smallest SOI size (denoted soi-2x in the gaphs), and fou times the smallest SOI size (denoted soi-4x). Fig. 11 shows the esults fo taces of 1, 18, 3, and 37 playes. Each gaph shows a histogam epesenting the distibution of time stalled between fames fo an aveage playe due to lockstep anti-cheating constaints; i.e., the milliseconds stalled by an aveage playe befoe each tun s decision could be tansmitted ove the netwok as measued fom the last tun. Stall time due to the uppe and lowe caps ae not included in these esults as they ae not involved in AS calculations. The simulation esults clealy show the pefomance advantages of the AS potocol. With the lockstep potocol, playes always wait fo the slowest playe to send thei decision. With the AS potocol, even fo lage numbes of playes, at least 5% of the tuns can be taken without delay do to playe coodination while still guaanteeing cheat-poof game play. Even when a playe must be stalled, the AS potocol enables playes to stall fo less time. The simulations show that while AS pefomance degades slowly, so does the lockstep potocol, and that AS always maintains a lage advantage. We expect these esults to hold fo lage numbes of playes in lage envionments, and ou futue wok will be to test this theoy. Additionally, in the next section, we pesent a technique to suppot distibuted cellbased game play so that playes need only contact othe playes in thei own cell while still following anti-cheating constaints. VI. SUPPORTING CELL-BASED ARCHITECTURES a b c d In ode fo massively multiplaye games to scale to thousands of paticipants o moe it must be the case that the amount of communication and pocessing pe client must emain low fo all entities involved. This is tue fo seve-based and seveless achitectues. Rathe than employ client- o seve-based filteing, one appoach commonly used is to cluste paticipants into sepaate multicast addesses o sepaate seves based on geoe f g h Fig. 12. A game aena divided into cells. metic position. Accodingly, a vitual playing field may boken into cells to incease scalability [16], [17], [18], [19], [2], [21]. Cells ae tanspaent to the playe s view of the game. The AS technique couples togethe nicely with cell-based techniques. Cell sizes should be quite a bit lage than the SOI size. A playe must only pefom AS fo the playes inside the same cell. Unfotunately, a cheating playe may use infomation on cell position available in signaling necessay fo the coect opeation of AS (o dead eckoning o lockstep) in ode to lean of an upcoming ambush. While knowledge of the position of a emote ambush o hidden possession may not affect game esolution as discussed in Section III, it might affect playe stategy. In a client-seve achitectue, secet infomation does not pesent a poblem, as the seve may be tusted to esolve inteactions and advance playes without evealing secet infomation to playes. Fo distibuted achitectues, secet infomation pesents a difficult dilemma fo AS, dead eckoning, and lockstep appoaches. s must exchange positional infomation in ode to execute the potocols, but the signaling epesents an oppotunity fo cheating by poviding advance knowledge of position to playes, possibly alteing thei stategy. In this section, we pesent a solution to this poblem in the context of the AS potocol. The following technique allows playes to discove whethe they occupy the same simulation cell, without evealing to each othe thei cuent positions. 4 A. Hidden Positions Assume the game aena is divided into cells, as in Fig. 12. Let each cell of the game be assigned a numbe fom one to. Assume playe is in cell and playe is in cell. A playe would engage in this potocol wheneve it decided to ente a new cell. Unfotunately, it must pefom the exchange with all playes to detemine who is in the same cell. Optionally, once any playe is found in the same cell, the in-cell playe could infom the new paticipant of all othe cell membes. Howeve, we do not discuss the details of such an optimization hee. Assume the cyptosystem used below is commutative (e.g., RSA [27] o Pohlig-Hellman [28]), so that fo any message we have, whee denotes encyption of a message with key. This scheme also equies key exchanges between all playes, which we do not specify We ae indebted to Mikhail Atallah of Pudue Univesity fo suggesting the following technique fo secue multipaty computation used in ou solution.

10 1 hee, but seveal methods exist aleady that may be employed (Schneie lists seveal [25]). Step 1. geneates a andom numbe and sends playe a one-way hash of ; geneates a andom numbe and sends a one-way hash of. They now have both committed thei choices to each othe. Step 2. They both compute as the bitwise XOR of and. Step 3. sends the esult of encypting using a andom key geneated by and not known to. Step 4. sends the esult of encypting # andom key geneated by and not known to. using a Step 5. sends the esult of encypting the that she eceived in Step 3 using the key that she used in Step 2. Step 6. sends the esult of encypting the that he eceived in Step 2 using the key that he used in Step 3. Step 7. and both lean whethe by compaing to : if and only if, which is tue by the commutativity of the cyptosystem. could ty to cheat by asking to encypt seveal choices. Howeve, we equie each playe to late eveal thei commitments fom steps 4 and 6. In the wost case, this may be done at the end of a game. VII. CONCLUSIONS Fo the fist time, we have made cheat-poof playout a necessay condition fo the design of netwok game communication achitectues. We have shown that pevious methods of netwok game communication ae exploitable by cheating playes. We have poposed the fist potocol fo poviding cheat-poof and fai playout of centalized and distibuted netwok games. To impove upon the pefomance of this potocol, we have poposed the asynchonous synchonization potocol, which allows fo optimistic execution of events without the possibility of conflicting states due to packet loss o the possibility of cheating. Asynchonous synchonization does not equie oll back techniques o a centalized seve. Ou pefomance analysis shows it significantly impoves pefomance ove the lockstep potocol. Asynchonous Synchonization povides implicit obustness in the face of packet loss and allows educed signaling equiements to be used in combination with cell-based techniques, while always maintaining cheat pevention and detection, allowing fo massively multiplaye envionments. ACKNOWLEDGEMENTS We ae gateful to Andy Fagg of the Univesity of Massachusetts, Amhest and Mikhail Atallah of Pudue Univesity fo thei helpful insight. The technology contained within this document has been potected woldwide by a patent. REFERENCES [1] Blizzad Entetainment, Stacaft, [2] id Softwae, Doom, [3] id Softwae, Quake, [4] Heat.net, 1six, [5] Tubine Entetainment Softwae Copoation, Asheon s call, [6] M. Pitchad, How to hut the hackes, in Game Develope Magazine, pp June 2. [7] Standad fo infomation technology, potocols fo distibuted inteactive simulation, Tech. Rep. ANSI/IEEE Std , Institute of Electical and Electonics Enginees, Mach [8] F. Kuhl, R. Weathely, and J. Dahmann, Ceating Compute Simulation Systems: An Intoduction to the High Level Achitectue, Pentice Hall PTR, Uppe Saddle Rive, 2. [9] B. Blau, C. Hughes, M. Michael, and L. Cutis, Netwoked vitual envionments, in ACM SIGGRAPH, Symposium on 3D Inteactive Gaphics, Mach 1992, pp [1] E. Beglund and D. Cheiton, Amaze: a multiplaye compute games, [11] C. Diot and L. Gautie, A distibuted achitectue fo multiplaye inteactive applications on the intenet, in IEEE Netwoks magazine, vol. 13, pp Jul Aug [12] L. Gautie, C. Diot, and J. Kuose, End-to-end tansmission contol mechanisms fo multipaty inteactive applications on the intenet, in Poc. IEEE INFOCOM, [13] S.K. Singhal and D.R. Cheiton, Exploiting position histoy fo efficient emote endeing in netwoked vitual eality, Pesence: Teleopeatos and Vitual Envionments, vol. 4, no. 2, pp , 1995, Also as ACM SIGGRAPH 94 Couse 14. [14] A. Watt and F. Policapo, 3D Games: Real-time endeing and Softwae Technology, Addison-Welsey, 21, Ch. 2. [15] J. Aonson, Dead eckoning:latency hiding fo netwoked games, in Gamasuta magazine, Septembe , featues/ /aonson 1.htm. [16] D. Van Hook, S. Rak, and J. Calvin, Appoaches to elevance filteing, in Eleventh Wokshop on Standads fo the Inteopeability of Distibuted Simulations, Septembe [17] M. Macedonia, M. Zyda, D. Patt, D. Butzman, and P. Baham, Exploiting eality with multicast goups, IEEE Compute Gaphics and Applications, vol. 15, no. 5, Septembe [18] S. Rak and D. Van Hook, Evaluation of gid-based elevance filteing fo multicast goup assignment, in Poc. of 14th DIS wokshop, Mach [19] E. Léty and T. Tuletti, Issues in designing a communication achitectue fo lage-scale vitual envionments, in Poceedings of the 1st Intenational Wokshop on Netwoked Goup Communication, Novembe [2] K. L. Mose, An Adaptive, Distibuted Algoithm fo Inteest Management, Ph.D. thesis, Univesity of Califonia, Ivine, 2. [21] B.N. Levine, J. Cowcoft, C. Diot, J.J. Gacia-Luna Aceves, and J. Kuose, Consideation of Receive Inteest fo IP Multicast Delivey, in In Poc. IEEE Infocom 2, Mach 2. [22] R.M. Fujimoto, Paallel and Distibuted Simulation Systems, Wiley Intescience, Januay 2. [23] R.M. Fujimoto, Time management in the high level achitectue, Simulation, vol. 71, no. 6, pp , Decembe [24] D. Betsekas and R. Gallage, Data Netwoks, Pentice-Hall, Englewood Cliffs, [25] B. Schneie, Applied Cyptogaphy: Potocols, Algoithms, and Souce Code in C, John Wiley & Sons, Inc., New Yok, second edition, [26] B. Stabell and K.R. Schouten, The Stoy of XPilot, ACM Cossoads Student Magazine, Winte 1996, XPilot softwae available fom [27] L. Adleman, R. L. Rivest, and A. Shami, A method fo obtaining digital signatue and public-key cyptosystems, Communication of the ACM, vol. 21, no. 2, [28] S. C. Pohlig and M. E. Hellman, An impoved algoithm fo computing logaithms ove and its cyptogaphic significance, IEEE Tans. Infom. Theoy, vol. IT-24, pp , Jan