2
$\begingroup$

Is there a way to have a secure by design client-server communication in a sense that the server can check if the client is not a modified version?

What I'd like to do is give the user access to both the client's and the server's source code, but keep him from communicating with a modified version.

As a practical example, let's suppose a multiplayer race game. Is there a way to give the user access to the source (and to compiling it and playing it on the server if he wants) but keeping him from, let's say, altering the speed of his car to 2x normal speed and using this new version to play?

As I understand, the compiled program could generate some hash and send it together for the server to verify. But then there also comes stuff like being able to get this code and making another version send it, etc.

If this is a known problem, please also provide further information about it. (Any recommendations on books or papers related to that are also welcome)

$\endgroup$
  • 1
    $\begingroup$ Any reason you are asking here rather than on Security.SE, where there are more security experts? (If you prefer to see this there, you can flag it for moderator attention and ask them to migrate it.) Are you familiar with TPMs? $\endgroup$ – D.W. Mar 30 '15 at 8:00
  • $\begingroup$ @D.W. The question is also on-topic here. Alvaro, we can migrate your question to Information Security, but it's fine here too (however do not repost: we don't want to have two copies of the question). $\endgroup$ – Gilles Mar 30 '15 at 10:50
  • $\begingroup$ I wasn't familiar with Security.SE and the question seemed on topic to me (since it's kinda theoretical and cs related). I think there's no need to migrate it, since D.W.'s answer covers what I wanted. Thanks! $\endgroup$ – Alvaro Dec 1 '15 at 22:25
2
$\begingroup$

The short answer is: No, you can't verify what code is running on the client. As a result, you should never trust what is running on the client.

You could use all sorts of hashes, but nothing prevents a malicious client from lying to you about its hash and telling you what you want to hear. Asking the client to hash itself and tell you its hash would be like having airport security ask passengers "Are you a terrorist?" and then believing them when they say "No".

In principle this problem could be solved with trusted hardware on the client, such as a a TPM. Currently, a TPM is about the only way to check that the client is running unmodified code. However, in practice using TPMs for this has major issues that typically render it not deployable in practice for the purpose you have in mind.

Therefore, in practice the answer is basically "no, there's no way to check". See https://security.stackexchange.com/q/72091/971 for an explanation why there is no way to do this without trusted hardware (like a TPM). As a result, the standard mantra is "you can't trust the client". See e.g., https://security.stackexchange.com/q/40378/971 for some discussion of alternative architectures don't rely on trusting the client.

For a partial explanation why TPM-based solutions are not really deployable in practice, see https://security.stackexchange.com/q/2459/971.

If you want to explore the TPM approach, see https://security.stackexchange.com/q/5570/971 and https://security.stackexchange.com/q/4008/971. However, I don't recommend it as a promising avenue. In the future, Intel will be releasing SGX technology, which might be a better way to achieve this -- but it has not yet been released, so it will be quite some time before you can count on all your clients to run on hardware that supports SGX.

$\endgroup$
  • $\begingroup$ A TPM wouldn't work for this kind of use case, not without going back to the TCPA days. It isn't just a matter of deployment. Using a TPM to control what runs on the computer requires that the user of the client computer gives up control of what runs on the computer to someone else that the server trusts. The player would have to allow Intel or some other central authority else to regulate what runs on their computer so that they can vouch that the computer is running the unmodified game. Otherwise the player could produce a fake attestation by running a fake TPM. $\endgroup$ – Gilles Mar 30 '15 at 10:52

Your Answer

By clicking "Post Your Answer", you acknowledge that you have read our updated terms of service, privacy policy and cookie policy, and that your continued use of the website is subject to these policies.

Not the answer you're looking for? Browse other questions tagged or ask your own question.