[Disc/Help] Securing High Scores / Misc Info

I know there have been a few posts on Flash Kit regarding the security of high scores, etc, but the ones I found were all from a year and a half or more ago. I don't suspect that things have changed much since then, but I figured it wouldn't hurt to get some fresh perspectives. (Or maybe there's something in Flash 10 that could help out that I don't know about.)

So what do you guys know about security? What is the best approach? Aside from putting all of the game logic on the server.

I guess if you just start with the assumption that everything the client tells you is a lie, then it's not really possible to verify high scores without *some* amount of game logic on the server...

If we simplify things and just pretend there's a function in the client's flash that's named "add1Point", and every time it's called a point is added, even if it's sent to the server every time, unless the server has some way to check whether or not a point *should* be added, the haxor can just keep calling the function over and over again.

But if you have to include even a little bit of game logic on the server, there's no way to just set up a nice general security system that can handle all of your games, you have to specifically tailor a new system to every game, and that dog won't hunt.

I suppose one relatively general system would be to simply record every action by the user and save it to the server, along with including a replay option in every game you make. That way if a score looks suspicious, you can load up the replay data and verify that the scores are the same... Wouldn't prevent bots, but preventing bots is way out of my league.

EDIT: But then again, unless the game is completely deterministic, maybe the haxor can fake adding things to it... For example, one second he adds and then kills 5000 enemies. The replay would agree with him, if the adding enemy data was also fed in to it, even though it was obviously cheating. Now the only way I can think to get over that is to have any random changes to the game instigated by the server. And now you're getting the server involved in the gameplay again. I guess if the server seeds the random numbers in a game, that's as general as you could get with that...

I don't know, just thinking out loud.

Opinions/Ideas/Suggestions?

what about..

- audit trail. ingame. keep track of all the score additions in an array and total it up at the end and compare it to the end result. also track the times between each score.

- parallel scores.
keep an internal count that never gets displayed and is expected to be a function of the real count. if someone modifies the memory of the count they see, then it wont add up. theyd have to decompile work out the game logic.

- ip address store.
if someone is cheating, log it in the database with their ip. that way all other people can be shown a genuine score table, but they will see their cheat score and think that is has been accepted and then get bored and hack somewhere else.

- continuous time check.
check the clock. every frame.
if the internal clock has moved but the frame rate hasnt, then its an indication that the game has been frozen in memory while they run some hacking application.

just some suggestions