Game backend development

Transcript

1. Game server development BANDAI NAMCO Studios Vancouver Senior DevOps Engineer Yuichiro Mori
2. Topics to cover: - Basic components of game backend - How to scale backend - Protection against cheats
3. Basic components of backend
4. Game feature that require backend - Saving progress - Leaderboard - Chat - In game social graph - Features that uses in game social graph (Guild, Trading) - etc..
5. What tech stack to use? - All we need is CRUD against *centralized* server - Create - Read - Update - Delete
6. What tech stack to use? - What Protocol to use? - HTTP(S)? - TCP? - UDP?
7. What tech stack to use? - HTTP(S) - Pro: - Huge library base - Huge infrastructure support - PKI built in (=Secure) - Con: - Well know (= easy to hack)
8. What tech stack to use? - TCP - Pro: - Highly customizable - Con: - Potentially insecure
9. What tech stack to use? - UDP - Pro: - Highly customizable - Faster than TCP - Con: - No data ordering - No data correction
10. How to scale backend
11. Game backend version 1
12. Game backend version 1
13. Game backend version 2
14. Game backend version 2
15. Game backend version 3
16. Game backend version 3
17. Game backend version 4
18. Game backend version 4
19. Game backend version 5
20. And it continues.. Basic concept of scaling is simply “Divide and conquer”
21. And beyond.. - Horizontal sharding - Vertical sharding - Micro services
22. Horizontal sharding
23. Vertical sharding
24. Micro services
25. And beyond.. Example of dividing game backend features: - Authentication - Inventory (Shop / Currency / Items) - Social feature (Including Leaderboard) - Push notification - Chat
26. Case study: team battle Basic concept of scaling is simply “Divide and conquer”
27. Designer: Hey, don’t you think team vs team would be fun? Like 100 players vs 100 players
28. ???
29. 100 users updating single record VS Distributing update to scale
30. Simple solution: Queue
32. Protection against cheats
33. Backend related cheats - Repeat requests - Concurrent request - Modified request - Validation by simulation
34. Repeat requests - sample code app.post(‘/mission_end’, function (req, res) { const missionId = req.missionId; // NO VALIDATION! RewardService.grantMissionClearReward(missionId); res.send(‘ok’) });
35. Repeat requests Users peek the requests by using PC proxy Well known products: - Charles proxy - Burp proxy
36. Charles proxy example
37. Repeat requests - sample code app.post(‘/mission_end’, function (req, res) { const missionId = req.missionId; // NO VALIDATION! RewardService.grantMissionClearReward(missionId); res.send(‘ok’) });
38. Repeat requests - FIXED! app.post(‘/mission_end’, function (req, res) { const missionId = req.missionId; If (MissionService.missionRewardLeft(missionId)) { RewardService.grantMissionClearReward(missionId); MissionService.setMissionRewardFlag(missionId); } res.send(‘ok’) });
39. …really?
40. Concurrent request app.post(‘/mission_end’, function (req, res) { const missionId = req.missionId; If (MissionService.missionRewardLeft(missionId)) { RewardService.grantMissionClearReward(missionId); MissionService.setMissionRewardFlag(missionId); } res.send(‘ok’) });
41. app.post(‘/mission_end’, function (req, res) { const missionId = req.missionId; If (MissionService.missionRewardLeft(missionId)) { RewardService.grantMissionClearReward(missionId); MissionService.setMissionRewardFlag(missionId); } res.send(‘ok’) }); Concurrent request 5ISPX
    NVMUJQMF
    SFRVFTUT
    CFGPSF
    qBH
    HFUT
    NPEJpFE
42. Concurrent request - FIXED! app.post(‘/mission_end’, function (req, res) { const missionId = req.missionId; const userId = req.session.userId; const lockId = DataBaseService.lock(userId); If (MissionService.missionRewardLeft(missionId)) { RewardService.grantMissionClearReward(missionId); MissionService.setMissionRewardFlag(missionId); } DataBaseService.unlock(lockId); res.send(‘ok’) });
43. But, what if can’t validate?
44. Modified request - app.post(‘/mission_end’, function (req, res) { const missionId = req.missionId; const score = req.missionScore; const userId = req.session.userId; const lockId = DataBaseService.lock(userId); RewardService.grantScoreBasedReward(userId, missionId, score); DataBaseService.unlock(lockId); res.send(‘ok’) });
45. Modified request -
46. Modified request - FIXED! app.post(‘/mission_end’, function (req, res) { const missionId = req.missionId; const score = req.missionScore; if (sha256(`${score}_${SERVER_SECRET}`) !== req.signature) { return res.send(“Request tampered!”) } const userId = req.session.userId; const lockId = DataBaseService.lock(userId); RewardService.grantScoreBasedReward(userId, missionId, score); DataBaseService.unlock(lockId); res.send(‘ok’) });
47. Modified request - FIXED!
48. But, what if user opens up app, and find secret key?
49. Validation by simulation app.post(‘/mission_end’, function (req, res) { const missionId = req.missionId; const playInputSequence = req.playInputSequence; const simscore = Simulation.simulateGamePlay(playInputSequence); if (simscore != score) { return res.send(“Request tampered!”) } const userId = req.session.userId; const lockId = DataBaseService.lock(userId); RewardService.grantScoreBasedReward(userId, missionId, score); DataBaseService.unlock(lockId); res.send(‘ok’) });
50. Validation by simulation
51. Pros: - Really strong against cheat Cons: - Really hard to implement. Really. Validation by simulation
52. Build a scalable, secure backend!