We are wondering what's a good networking design for mobile games that have real time single player battles like Clash of Clans.

One option is to do the battle completely on client side, and send the result back to the server when the battle is done. However it seems this will allow cheating. Is there any security model to handle this? Technically hackers can do anything that your client can do, so

The other option is to do real time networking between client and server. But I'm not sure whether this is a good idea for mobile games considering various network conditions.

Does anyone know what's a good design here? How does Clash of Clans do it?

I don't know how Clash of Clans does it.

One option (some games do this) is to run a simulation that the player can't really affect -- and thus, the entire battle can run much faster than real-time on the server, and is pre-determined before the player even sees it play out.

In CoC, if you are not online, can you play a battle? Can you actually affect the outcome (direct where units go, add reinforcements, etc) in real time? If so, they run the battle on the client. One option to do that, yet be cheating resistant, is to record all the client commands, and re-play the battle on the server; if the server finds a different outcome than the client, it can assume the client is cheating (or has a bug.)

I'm almost positive CoC does the battles on the client-side initially. They may also recreate the battle on the server later (using the client's commands during battle as input), but, I don't know that for sure.

They probably collect the user commands and the time they were issued. Mobile devices are limited on internet access, so it's easier on the developer and the user to just download the defender's base information the attacker's troop information, and the attacker's commands than to try to step through it with a server. This is how we can view the replays of the attacks.

If i was to approach this problem, i would have the battle completely played out from one or two initial random seeds sent by the server. This goes under the assumption that the game has a relatively simple battle system where the player just picks some troop types and a place to attack, and clicks 'go'.

The battle itself could be determinstic, so that unless there is cheating going off the server and client would agree on the battle outcome and what happens when just based on this initial number. Cheating would be detected as the client and server would be out of synch, making it pointless to cheat by just altering the random seeds you are sent and expecting the server to store anything differently.

I have read in some books that a lot of games make things deterministic in this way to ease testing, as by feeding exactly the same seed in at the start of the game enemy spawns, pickups from chests etc are always the same if done properly.

Something to look out for though is that if someone reverse engineers your algorithm, you might find they create some form of 'battle calculator' to work out ways to win more often, and this is bad news for you and your game!

Let me know if this helps at all!

I don't know Clash of Clans, but Boom Beach, made by the same developer, allows you to send limited commands during a battle. For example, you can launch flares (to direct all your troops, not individual units), or launch a barrage of rockets to the defender's towers in the midst of the battle.

This looks like that the battle is played out from the server. Client devices shouldn't be able to cheat, i.e. you can't send 10 rockets while you only have 5 to begin with. My guess is that the client can only issue commands like "Trigger Rockets to X, Y", and server keeps track how many rockets you have left, whether to process it or not, and the outcome of the command.