Problem
I want a way to allow players to be securely tracked through different games using different names. This could be used to assist a player in building a reputation without concern of imposters.
Solution
Build a system that allows a user to visit a website to create a profile. Upon completion, the site sends the player a small application, containing a personal "key". When the player joins a game, they can run their application, feeding it:
The server name
The server port
The game letter
The player's name
to generate an identification token the user broadcasts by making a game announcement.
The other part to this solution involves a bot that, every hour, connects to a game and retrieves game information including messages. The bot provides collected information back to the original website. Someone can then view the profile of a player and browse any games that player has participated in.
Since only the player has the application that generates an identification token and is the only one that can make a game announcement for themself, the system cannot be spoofed.
Not Covered
A player would still be able to create any number of profiles, as well I think they should be. This system only secures the tracking of a created profile and doesn't try to track players themselves.
Technical Details
The backbone of the security lies in an RSA-generated asymmetric key pair. The server retains the public key, while the private key is included in the authentication token-generating application provided to the player. The game information collected by the application is concatinated into a string, which is encrypted with the player's private key to produce the authentication token. The token can only, then, be unencrypted with the public key, allowing the server to extract and verify its contents.
Another important goal of this proposal is providing profile information (including public keys) and bot-collected game data to any other application that wants to use it. The profile information could be exposed via LDAP or URL (encoded in XML), and the game data can be provided via URL in XML.
Existing Technologies
I've already developed a bot, kokua-bot ( http://www.twdata.org/kokua-bot ), that extracts game information, including game messages, from TWGS servers and stores the result in XML. The registration and tracking web application would be pretty straight forward as I've already developed similiar solutions in my day job, including the use of the asymmetric algorithms.
Feedback
Any feedback is welcome. Do you think it would be valuable? Would it be too hard to use? Do you see a better way to solve the problem? Is it a problem?
