CosmicClash/docs/THREAT-MODEL.md

Cosmic Clash multiplayer threat model

This is the launch threat model for the control plane, dedicated servers and clients. It records the security boundary and the verification owner for each class of failure; it does not treat a trusted workload class as a trusted individual pod.

Threat	Prevention	Detection / response	Owner	Residual risk
Forged Steam identity or ticket	Backend calls Steam validation for the expected App ID; player ID comes from the verified SteamID mapping, never request JSON	Ticket rejection metrics, replay alerts, ban/revoke identity	Identity/API	Valve/Steam outage pauses new authenticated sessions
Ticket/session replay	Single-use ticket nonce; opaque short-lived session token; store token digest and revocation in PostgreSQL	Duplicate-ticket and revoked-session counters; incident revoke all sessions for identity	Identity/API	Stolen live session remains usable until expiry/revocation propagation
Queue/proposal flooding or duplicate claims	Body/rate limits, one active ticket partial unique index, idempotency keys, serializable participant fence	Per-identity/IP rate alerts, queue-depth and conflict dashboards, overload shedding	API/matcher	Distributed abusive identities can consume bounded capacity until automated bans act
Latency-evidence forgery	Opaque location, nonce/freshness checks, server-computed RTT, discrepancy quarantine; evidence affects placement only	Three-bad/five-clean counters and regional RTT SLO alerts	Matcher/networking	Colluding endpoints can bias placement within the accepted evidence window
Join-authorisation theft or slot hijack	Signed match-scoped authorisation binds verified SteamID/match/server/team/slot/protocol/expiry; server-owned generation fences old peers	Rejected-binding/generation metrics and audit events; revoke assignment	Allocator/game-server	A stolen valid authorisation remains usable until expiry unless the server revokes it
Forged or replayed match result	Short-lived HMAC workload token delivered through the allocated GameServer annotation; backend resolves its allocation ID to the durable match/server binding; canonical digest	Receipt conflict is inert and pages; duplicate is idempotent; result lag alerts at 5/30 minutes	Result/maintenance	A compromised authoritative pod, or a principal able to read its allocated GameServer metadata before expiry, can submit for that allocation
Workload/insider compromise	Per-workload service accounts, least RBAC, private stores, default-deny network, no publisher/root key in game pods; restrict GameServer metadata read access to the allocator and cluster operators	Credential-use audit, anomalous allocation/result pairing alerts, immediate workload drain/revoke	Platform/security	Cluster-admin/KMS compromise, or an authorized metadata reader acting before token expiry, is outside application controls
Gameplay/API DDoS and flood	Connection/body/WebSocket limits, token buckets, overload shedding, edge WAF/DDoS service, live-result priority	Saturation, 5xx, tick-backlog and dropped-work dashboards; shed new queue/allocation work first	SRE/platform	Volumetric attack may require provider mitigation capacity
SDR signing-key theft	Offline CA separated from online signer; non-exportable KMS/HSM key; signer allowlist and short-lived tickets	Signer audit and anomaly alerts; rotate/revoke certificates and tickets	Security/networking	Provider/Valve trust or HSM compromise requires external response
Dependency/image supply chain	Pin image/dependency digests, SBOM, vulnerability scan, artifact signature and admission verification	CI/admission failures and provenance inventory; critical-fix SLA	Release/security	Unknown zero-days remain possible until detection or patch
Denial of wallet / autoscaling abuse	Allocation quotas, budgets, warm-capacity limits, per-identity/IP controls and scale ceilings	Cost-per-match, allocation-rate and quota alerts; disable region/playlist safely	SRE/finance	Legitimate launch spikes can trigger conservative limits
Data loss or cache inconsistency	PostgreSQL backups/RPO <=5m, serializable transactions, transactional outbox; Redis is rebuildable only	Restore/failover rehearsal, cache-repair metrics, result reconciliation	Data/SRE	Recovery can pause new work; valid live matches must continue

Trust boundaries

• Clients are untrusted and cannot submit ratings, outcomes, penalties, allocation state or exemptions.
• Game servers are authoritative for simulation but are not trusted for identity, allocation ownership, or unrestricted result submission.
• PostgreSQL is the durable authority. Redis and Agones annotations are recoverable transport/cache state.
• The offline SDR CA and online leaf signer are separate; API, matcher, allocator and game-server workloads cannot read signer keys.

Every accepted residual risk above has an owner and a planned detection path. Security incidents fail closed for identity/result ownership. An allocated server remains in its results state and retries its idempotent result request until the control plane durably acknowledges it; it does not exit first and silently lose the authoritative outcome.