To develop a response to driushkin, you must use remote procedure calls (RPC) and an event queue. This works as in the image you posted, where each packet represents a command or RPC with some arguments (i.e., direction of movement). You will also need an event queue to ensure that RPCs are running in order and on time. For each command that needs to be executed (at some point in the future, in a simple scheme), and to synchronize the clock (World War II style), a time stamp or frame is required to execute.
You may notice one critical weakness in this scheme: RPC messages may be delayed (arrive after they should be applied) due to network latency, malicious users, etc. In a simple scheme, later RPCs are removed. This is normal, since all clients (even the creator!) Wait until the server sends RPC before acting (if the original client did not wait for the server message, its game state will not be synchronized with the server, and your game will be broken).
Consider the effect of lag on such a scheme. Say, the lag for client A to the server was 100 ms, and the return trip was also 100 ms. This means that client input looks like this:
- Client A presses a key and sends the RPC to the server, but does not add it locally (0ms)
- Server receives and relays RPC (100 ms)
- Client A receives its own event and now finally adds it to the event queue for processing (200 ms)
As you can see, the client responds to its event 1/5 second after pressing the key. This is a pretty good 100ms lag. Transoceanic lag can easily be more than 200 ms in each direction, and dial-up connections (rare but still existing today) can have spike delays> 500 ms. None of this matters if you play on the local network or something similar, but on the Internet this irresponsibility can be unbearable.
This is the concept of customer-side forecasting (CSP). CSP is designed as big and scary, but implemented correctly and thoughtfully, in fact it is very simple. An interesting feature of CSP is that clients can directly process their data (the client predicts what will happen). Of course, the client may (and often will) be wrong. This means that the client will need a way to fix it from the server. This means that you will need a way to check, reject or modify RPC requests from clients, as well as a way to serialize the game gametate (so you can restore it as a base point for alignment).
There are many good resources in this. I like http://www.gabrielgambetta.com/?p=22 in particular, but you really should look for a good multiplayer game.
I also need to suggest socket.io, even after reading your comments regarding Flex and AS3. The ease of use (and simple integration with node) makes it one of the best (best?) Options (s) for HTTP network games I've ever used. I would make all the necessary settings to be able to use it. I believe that AIR / AS3 has at least one WebSockets library, even if socket.io itself is not available.