Say for example that I was a digital video game provider, and my games were played via a virtual machine. Lets also say that the code for this virtual machine were open source, and that this VM was designed to run on somebody's computer.
When I launch this VM, it would check itself for updates, then the user would log in, and be funneled to my online store where they could purchase new games or launch games they had purchased. Those game binaries would be stored on the user's hard-drive and be fed into that same VM. Game binaries, much like binaries composed of Java bytecode, are not necessarily open-source.
Obviously I want a few conditions upon this VM's operation.
- Users should only be able to launch games associated with their own accounts.
- My VM has anti-cheat built in. I don't want users to circumnavigate this.
I would think to solve this issue via a reported checksum; the VM binary should match the latest official version before an attempted log-in is accepted by the service, but open-source code means that a savvy user could modify the
report_checksum function to return whatever matches the official version.
How could a service in such a relationship with its clients authenticate those who tried to query it?