AU2014253517B2

AU2014253517B2 - A gaming machine

Info

Publication number: AU2014253517B2
Application number: AU2014253517A
Authority: AU
Inventors: Drazen Lenger
Original assignee: Aristocrat Technologies Australia Pty Ltd
Current assignee: Aristocrat Technologies Australia Pty Ltd
Priority date: 2008-03-26
Filing date: 2014-10-23
Publication date: 2016-11-03
Anticipated expiration: 2029-03-26
Also published as: AU2019202693A1; AU2017200604A1; AU2014253517A1; AU2017200604B2

Abstract

Abstract A method of conducting a software update of a gaming 5 machine, comprising: starting a boot process of the gaming machine; determining during the boot process that a memory device potentially containing at least one software component more recent than a corresponding software component currently stored in gaming machine memory is in 10 data communication with the gaming machine; determining that the memory device contains at least one authentic, more recent software component; and updating gaming machine memory with each more recent software component. 5886194_1 (GHMatters) P76824.AU.3 DEBORAM START BOOT PROCESS30 USB MEMORY N ATTACHED? MOUNT USB DRIVE 31 MACHINE NEROPOCS DOOR OPEN? EROPOCS y 340 LOGIC CAGE NEROPO S OPEN?EROPRCS CONTAINS 305520 25 AUTHENTIC N REOEyCONTINUE DEON SOFTWARE i EOE BOOT DEON COMPONENT(S) USB DRIVE PROCESS USB DRIVE MORE RECENT COMPONENT(S) STRE MORE RECENT 3 5 370Figure 3 R E BO T yR E -B O O T ?

Description

1 2014253517 11 Oct 2016

A GAMING MACHINE

Related Application 5 This application is a divisional application of Australian application no. 2011253943, the disclosure of which is incorporated herein by reference.

Field 10

The present invention relates to a gaming machine and a method of conducting a software update of a gaming machine. 15 Background to the Invention

Program code to be run on gaming machines sometimes needs to be updated to address problems with existing code or to add a capability. Given the nature of gambling 20 regulations, there is a need for a high degree of confidence in the security of electronic gaming machines. Accordingly, current software updates are performed by physically swapping memory components of a gaming machine. There is a need for alternative techniques for updating 25 software which provides and a high degree of security.

Summary of the Invention

In a first aspect, the invention provides a method of 30 conducting a software update of a gaming machine, comprising: starting a boot process of the gaming machine; mounting a USB port of the gaming machine only for the duration of the boot process; 35 determining during the boot process that a memory device potentially containing at least one software component more recent than a corresponding software 8288950J (GHMatters) P76824.AU.3 2014253517 11 Oct 2016 2 component currently stored in gaming machine memory is connected to the USB port; determining that the memory device contains at least one authentic, more recent software component; and 5 updating gaming machine memory with each more recent software component.

In an embodiment, updating the gaming machine comprises replacing each corresponding software component with each 10 more recent software component.

In an embodiment, determining that the memory device contains at least one authentic software component which is more recent than a corresponding software component 15 currently stored in a memory of the gaming machine comprises : authenticating each software component stored on the memory device; and determining that a version number of each 20 authenticated software component stored on the memory device is indicative of a more recent version of the software component than a corresponding software component stored in the memory of the gaming machine. 25 In an embodiment, authenticating each software component stored on the memory device by using a public key stored at the gaming machine to verify that the software component has been signed with the corresponding public key. 30

In an embodiment, the method comprises determining that the version number is more recent if it is higher than a version of the corresponding software component. 35 In an embodiment, the method comprises determining that a main door of the gaming machine is open prior to updating each more recent authentic software component. 8288950J (GHMatters) P76824.AU.3 3 2014253517 11 Oct 2016

In an embodiment, the method comprises determining that a logic door of the gaming machine is open prior to updating 5 each more recent authentic software component.

In an embodiment, the method comprises restarting the boot process subsequent to completion of the update.

In an embodiment, the method comprises continuing the boot 10 process subsequent to completion of the update.

In an embodiment, conduct of the boot process is caused by a processor of the gaming machine executing instruction stored in gaming machine memory. 15

In a second aspect, the invention provides a gaming machine comprising: a processor; a USB port; 20 gaming machine memory storing updateable software components and storing instructions to cause the processor to conduct a boot process, the gaming machine arranged to: mount the USB port only for the duration of the boot process; 25 determine during the boot process that a memory device potentially containing at least one software component more recent than a corresponding software component currently stored in gaming machine memory is connected to the USB port; 30 determine that the memory device contains at least one authentic, more recent software component; and conduct an update process of gaming machine memory in respect of each more recent software component. 35 In an embodiment, the gaming machine comprises a main door and arranged to determine that the main door is open prior to updating each more recent authentic software component. 6266950.1 (GHMatters) P76824AU.3 2014253517 11 Oct 2016 4

In an embodiment, the gaming machine comprises a logic door and arranged to determine that the logic door is open prior to updating each more recent authentic software 5 component.

In an embodiment, the gaming machine is arranged to only mount the USB drive for the duration of the boot process. 10 In an embodiment, the gaming machine is arranged to update the gaming machine by replacing each corresponding software component with each more recent software component. 15 In an embodiment, the gaming machine is arranged to determine that the memory device contains at least one authentic software component which is more recent than a corresponding software component currently stored in a memory of the gaming machine by: 20 authenticating each software component stored on the memory device; and determining that a version number of each authenticated software component stored on the memory device is indicative of a more recent version of the 25 software component than a corresponding software component stored in the memory of the gaming machine.

In an embodiment, the gaming machine is arranged to authenticate each software component stored on the memory 30 device by using a public key stored at the gaming machine to verify that the software component has been signed with the corresponding public key.

In an embodiment, the gaming machine is arranged to 35 determine that the version number is more recent if it is higher than a version of the corresponding software component. 8288950J (GHMatters) P76824AU.3 2014253517 11 Oct 2016 5

Brief Description of the Invention

Exemplary embodiments of the invention will now be 5 described in relation to the following drawings in which:

Figure 1 is a perspective view of a gaming machine;

Figure 2 is a schematic diagram of the main components of 10 the gaming machine of a first embodiment that relate to implementation of a boot process featuring software update; and

Figures 3 is a flow chart of the software update process. 15

Detailed Description

Referring to the drawings, there is shown an embodiment of an electronic gaming machine arranged to implement a 20 software update process. A gaming machine 10 is illustrated in Figure 1. The gaming machine 10 includes a console 12 having a display 14 on which is displayed representations of a game 16 that can 25 be played by a player. A mid-trim 20 of the gaming machine 10 houses a bank of buttons 22 for enabling a player to interact with the gaming machine, in particular during game play. The mid-trim 20 also houses a credit input mechanism 24 which in this example includes a coin 30 input chute 24A and a bill collector 24B. Other credit input mechanisms may also be employed, for example, a card reader for reading a smart card, debit card or credit card. A reading device may also be provided for the purpose of reading a player tracking device, for example 35 as part of a loyalty program. The player tracking device may be in the form of a card, flash drive or any other portable storage medium capable of being read by the 8288950.1 (GHMatters) P76824.AU.3 2014253517 11 Oct 2016 6 reading device. A top box 26 may carry artwork 28, including for example pay tables and details of bonus awards and other 5 information or images relating to the game. Further artwork and/or information may be provided on a front panel 29 of the console 12. A coin tray 30 is mounted beneath the front panel 29 for dispensing cash payouts from the gaming machine 10. 10

The display 14 shown in Figure 1 is in the form of a video display unit, particularly a cathode ray tube screen device. Alternatively, the display 14 may be a liquid crystal display, plasma screen, any other suitable video 15 display unit, or the visible portion of an electromechanical device. The top box 26 may also include a display, for example a video display unit, which may be of the same type as the display 14, or of a different type. 20

Figure 2 illustrates one embodiment of a boot process which is described in more detail in Australian patent application 2007203243, the disclosure of which is incorporated herein by reference. The electronic gaming 25 machine has a central processing unit (CPU) 210. Boot program code is stored in BIOS 220. Logically the boot program code consists of a BIOS loader, a boot-loader and a BlOS-control-program. 30 The different portion of code contains components for different security features. Specifically: BIOS loader contains an RSA master public key; and the BIOS control program contains an RSA signature of the BIOS control program SHA 1 hash that is signed by the RSA master 35 private key corresponding to the RSA master public key.

When the electronic gaming machine is reset such that a 8288950J (GHMatters) P76824.AU.3 2014253517 11 Oct 2016 7 boot process is started, the CPU (processor) 210 of electronic gaming machine begins executing the first instruction of the BIOS loader stored in the BIOS 220.

The monitoring device 230 snoops every read access to the 5 BIOS loader to thereby monitor reading of the BIOS loader by the CPU 210. The monitoring device is implemented by a field programmable gate array and contains a duplicate copy of the BIOS loader and monitors access to the BIOS 220 that provides validation code that can be used to 10 determine that the BIOS loader is valid. The monitoring device verifies that the BIOS loader read out by the CPU matches the validation copy of the BIOS loader stored in the monitoring device. If it does not match, the monitoring device halts operation in such a manner that 15 this will ultimately cause the electronic gaming machine to fail booting. This ensures that the electronic gaming machine is running a valid, unmodified copy of the BIOS loader and hence that the code to check the validity of the BIOS control program (as described in further detail 20 below) is still present and will be executed by CPU 210.

The BIOS loader calculates a hash of the BIOS control program and copies the BIOS control program to RAM. The BIOS loader then retrieves a RSA signature from the BIOS-25 control-program and retrieves the RSA master public key from the BIOS loader. The BIOS loader decrypts the signature of the BlOS-control-program hash and determines whether the hashes match. If the hashes fail to match booting is failed. Otherwise the verification is 30 successful and execution is transferred to the BIOS-control-program now stored in RAM. The BlOS-control-program then seeks to verify any external BIOSes 240 by reference to a signed table of external BIOS hashes 250. The CPU 220 calculates a hash of each external BIOS 360. 35 It decrypts the signed table of external BIOS hashes 250 using RSA and the RSA master public key contained in the boot-loader. Each external bios 240 is hashed and 8288950.1 (GHMatters) P76824.AU.3 2014253517 11 Oct 2016 8 compared to the now decrypted stored hash 365. Any external BIOSES not matched are ignored. Otherwise control is transferred to the external BIOSes. 5 These steps ensure the electronic gaming machine is running a BIOS control program that has been signed by a master private key.

Before the BIOS-control-program transfers control to the 10 master boot record of the active boot partition on the active boot device 260 it verifies the active boot partition and boot cylinder by calculating a hash of the active boot partition and the hash of the boot cylinder and verifying the hash against the RSA signature stored on 15 the active boot device using the RSA master key and RSA.

If they do not match the boot is failed.

The active boot partition is comprised of a number of different partitions including a game partition, a 20 platform partition and an operating system partition, each of which are verified independently. The operating system may be Linux.

If the verification is successful, the process proceeds to 25 load the master boot record which in turn loads the boot loader in the boot cylinder. The boot loader verifies the contents of the game, platform and operating system partition using the RSA public keys stored in the boot loader against the RSA signatures stored in files in each 30 of the partitions. If the verification is successful, the process proceeds to load and execute the operating system. These steps ensure the electronic gaming machine is running an operating system and system software that had previously signed by the RSA master key. The operating 35 system then loads the platform software from main memory 220 being software components specific to the hardware on which the operating system is running and the game is 8288950_1 (GHMaUers) P76824.AU.3 2014253517 11 Oct 2016 9 expected to run. Once the platform is established, the game software is loaded.

As described in Figure 3, at an appropriate point after 5 the boot process is started 305 an update process is started. In this embodiment, early in the process of the operating system loading the platform software, the update process 300 involves checking 310 whether a USB memory device 290 is attached to the USB port 280 and mounting 10 any such USB drive 315. If no memory device 290 is attached, the boot process is continued 320.

In this embodiment, if a memory device 290 is attached a number of additional checks are made before any code can 15 be stored to a memory of the gaming device. These checks have the advantage of increasing the likelihood that the software update is legitimate and not an attempt to illegitimately access the gaming machine. In this respect, the memory to which the code is ultimately stored will 20 vary depending on the specific embodiment and the type of code being updated, for example, it could be used to update code in BIOS 220 or main memory 295 (which may be compact flash, for example). Herein, "gaming machine memory" is used to refer to memory normally resident 25 within the gaming machine including the BIOS 220 and main memory 295.

In this embodiment, it is assumed that the memory device 290 is to be manually attached to a USB port 280 of the 30 gaming machine. In other embodiments, a memory device may be placed in data communication with the gaming machine in some other manner, for example, the gaming machine may have a network card and be configured to check for a memory device at a particular network address during the 35 update process .

The first check 330 is that the main door of the gaming 8288950.1 (GHMatters) P76824.AU.3 2014253517 11 Oct 2016 10 machine 10 is open. If it is not open, an error process 335 is initiated which can be resolved by removing the USB memory device (the USB port may be externally accessible) in which case the boot process continues 320. 5

The second check 340 is that the door of the logic cage is open. (The logic cage contains the main board of the gaming machine.) Again an error process can be resolved in by removing the USB memory device 290 (the USB port may io externally accessible of the logic cage when the main door is open) in which case the boot process continues 320. The first and second checks are designed to ensure that the person attaching the USB drive is a technician authorised to access the logic cage and has done so in the correct 15 manner.

The third check 350 is to determine whether the memory device contains any "authentic" software components, e.g. which pass a digitally signed authentication test which 20 demonstrates that they have been signed by a private key corresponding, for example to the RSA master public key stored in the boot-loader. If there are no authentic software components, a message is displayed to ask the technician to remove the USB drive 355 so that the boot 25 process can continue 320. If there are one or more authentic software components, the process proceeds to the fourth check 360.

The fourth check 360 involves checking whether any of the 30 authentic software components is more recent than the current version of the software component stored in a memory of the gaming machine. In this embodiment, code is more recent if it has a higher version number. If there are no more recent components, a message is displayed to 35 ask the technician to remove the USB drive 355 so that the boot process can continue 320. If there are one or more authentic and more recent software components the process 8288950_1 (GHMatters) P76824.AU.3 2014253517 11 Oct 2016 11 proceeds to storing 365 the more recent components, typically by overwriting the previous version but the previous version may be kept, for example, by renaming it to allow a restore. It is then determined 370 whether a 5 re-boot is necessary based on the nature of the upgraded code and either the gaming machine is re-booted 375 or the boot process continues 320. After any re-boot, the method involves performing a manual RAM reset. If a reboot is not necessary, the boot process continues 320 and the USB 10 drive is demounted 325. Advantageously, this protects against the possibility that a person will attempt to illegitimately access the gaming machine via the USB port while it is running. That is, USB drives will only be mounted during the boot process. 15

The program code may be comprised of different code elements, depending on the particular implementation and what it is desired to update, for example it may contain the most up to date boot loader code, the most up to date 20 code for the boot partition, the most up to date system code, and or the most up to date game code for the gaming machine. Indeed, it may include some or all of the above such that irrespective of the current state of code of the gaming machine, it is brought completely up to date by 25 virtue of the update process 300.

Persons skilled in the art will appreciate that there may be variations on the above boot and update processes. For example, while the above embodiment employs SHA-1 hashes 30 and RSA signatures, other cryptographic hashes and signatures maybe employed. For example SHA-1 HMAC or DSA or a mixture of techniques. There may also be some additional steps carried out before software is executed. For example, the signature of system and game software 35 components may be checked by checking the entire disk partitions, directories or individual files. Such checks may be performed on demand, that is immediately prior to a 8288950_1 (GHMatters) P76824AU.3 2014253517 11 Oct 2016 12 component being loaded or in advance, that is prior to any components being accessed. Further in some instances it may be appropriate to check components with multiple signatures. This allows the loading of a component to be 5 prevented if it has not be signed by all required parties which may include the manufacture of the gaming machine, a regulatory body or a third party developer.

Further, certificates rooted in the master public key may 10 be stored with the software components rather than public keys. These and other variations will be apparent to persons skilled in the art and should be considered as falling within the invention described herein. It will also be appreciated that other embodiments of the 15 invention can be formed from the features described above.

In the claims which follow and in the preceding description of the invention, except where the context requires otherwise due to express language or necessary 20 implication, the word "comprise" or variations such as "comprises" or "comprising" is used in an inclusive sense, i.e. to specify the presence of the stated features but not to preclude the presence or addition of further features in various embodiments of the invention. 25

Further, any reference herein to prior art is not intended to imply that such prior art forms or formed a part of the common general knowledge in Australia or any other country. 30 8288950J (GHMatters) P76824.AU.3

Claims

THE CLAIMS DEFINING THE INVENTION ARE AS FOLLOWS:

1. A method of conducting a software update of a gaming machine, comprising: starting a boot process of the gaming machine; mounting a USB port of the gaming machine only for the duration of the boot process; determining during the boot process that a memory device potentially containing at least one software component more recent than a corresponding software component currently stored in gaming machine memory is connected to the USB port; determining that the memory device contains at least one authentic, more recent software component; and updating gaming machine memory with each more recent software component.
2. A method as claimed in claim 1, wherein updating the gaming machine comprises replacing each corresponding software component with each more recent software component.
3. A method as claimed in claim 1 or claim 2, wherein determining that the memory device contains at least one authentic software component which is more recent than a corresponding software component currently stored in a memory of the gaming machine comprises: authenticating each software component stored on the memory device; and determining that a version number of each authenticated software component stored on the memory device is indicative of a more recent version of the software component than a corresponding software component stored in the memory of the gaming machine.
4. A method as claimed in claim 3, comprising authenticating each software component stored on the memory device by using a public key stored at the gaming machine to verify that the software component has been signed with the corresponding public key.
5. A method as claimed in claim 4 or claim 5, comprising determining that the version number is more recent if it is higher than a version of the corresponding software component.
6. A method as claimed in any one of claims 1 to 5 comprising determining that a main door of the gaming machine is open prior to updating each more recent authentic software component.
7. A method as claimed in any one of claims 1 to 6 comprising determining that a logic door of the gaming machine is open prior to updating each more recent authentic software component.
8. A method as claimed in any one of claims 1 to 7 comprising restarting the boot process subsequent to completion of the update.
9. A method as claimed in any one of claims 1 to 7 comprising continuing the boot process subsequent to completion of the update.
10. A method as claimed in any one of claims 1 to 10, wherein the conduct of the boot process is caused by a processor of the gaming machine executing instruction stored in gaming machine memory.
11. A gaming machine comprising: a processor; a USB port; gaming machine memory storing updateable software components and storing instructions to cause the processor to conduct a boot process, the gaining machine arranged to: mount the USB port only for the duration of the boot process; determine during the boot process that a memory device potentially containing at least one software component more recent than a corresponding software component currently stored in gaming machine memory is connected to the USB port; determine that the memory device contains at least one authentic, more recent software component; and conduct an update process of gaming machine memory in respect of each more recent software component.
12. A gaming machine as claimed in claim 11, comprising a main door and arranged to determine that the main door is open prior to updating each more recent authentic software component.
13. A gaming machine as claimed in claim 11 or claim 12, comprising a logic door and arranged to determine that the logic door is open prior to updating each more recent authentic software component.
14. A gaming machine as claimed in any one of claims 11 to 13, arranged to update the gaming machine by replacing each corresponding software component with each more recent software component.
15. A gaming machine as claimed in any one of claims 11 to 14, arranged to determine that the memory device contains at least one authentic software component which is more recent than a corresponding software component currently stored in a memory of the gaming machine by: authenticating each software component stored on the memory device; and determining that a version number of each authenticated software component stored on the memory device is indicative of a more recent version of the software component than a corresponding software component stored in the memory of the gaming machine.
16. A gaming machine as claimed in claim 15, arranged to authenticate each software component stored on the memory device by using a public key stored at the gaming machine to verify that the software component has been signed with the corresponding public key.
17. A gaming machine as claimed in claim 15 or claim 16, arranged to determine that the version number is more recent if it is higher than a version of the corresponding software component.