US20100122076A1 - Security method - Google Patents

Security method Download PDF

Info

Publication number
US20100122076A1
US20100122076A1 US12/569,883 US56988309A US2010122076A1 US 20100122076 A1 US20100122076 A1 US 20100122076A1 US 56988309 A US56988309 A US 56988309A US 2010122076 A1 US2010122076 A1 US 2010122076A1
Authority
US
United States
Prior art keywords
client device
cryptographic
boot
verification
response
Prior art date
Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
Abandoned
Application number
US12/569,883
Inventor
Nigel Martin Witty
Current Assignee (The listed assignees may be inaccurate. Google has not performed a legal analysis and makes no representation or warranty as to the accuracy of the list.)
Aristocrat Technologies Australia Pty Ltd
Original Assignee
Aristocrat Technologies Australia Pty Ltd
Priority date (The priority date is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the date listed.)
Filing date
Publication date
Priority to AU2008905085A priority Critical patent/AU2008905085A0/en
Priority to AU2008905085 priority
Application filed by Aristocrat Technologies Australia Pty Ltd filed Critical Aristocrat Technologies Australia Pty Ltd
Assigned to ARISTOCRAT TECHNOLGIES AUSTRALIA PTY LIMITED reassignment ARISTOCRAT TECHNOLGIES AUSTRALIA PTY LIMITED ASSIGNMENT OF ASSIGNORS INTEREST (SEE DOCUMENT FOR DETAILS). Assignors: WITTY, NIGEL MARTIN
Publication of US20100122076A1 publication Critical patent/US20100122076A1/en
Application status is Abandoned legal-status Critical

Links

Images

Classifications

    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F9/00Arrangements for program control, e.g. control units
    • G06F9/06Arrangements for program control, e.g. control units using stored programs, i.e. using an internal store of processing equipment to receive or retain programs
    • G06F9/44Arrangements for executing specific programs
    • G06F9/4401Bootstrapping
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/50Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
    • G06F21/57Certifying or maintaining trusted computer platforms, e.g. secure boots or power-downs, version controls, system software checks, secure updates or assessing vulnerabilities
    • G06F21/575Secure boot
    • GPHYSICS
    • G06COMPUTING; CALCULATING; COUNTING
    • G06FELECTRIC DIGITAL DATA PROCESSING
    • G06F21/00Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
    • G06F21/60Protecting data
    • G06F21/64Protecting data integrity, e.g. using checksums, certificates or signatures
    • G06F21/645Protecting data integrity, e.g. using checksums, certificates or signatures using a third party

Abstract

A security method for verifying a client device comprising: loading and executing a boot loader at the client device which establishes a connection to a boot compliance server; sending a first cryptographic element from the boot compliance server to the client device; generating a first cryptographic response with the first cryptographic element based on at least part of the boot loader and sending the first cryptographic response to the boot compliance server for verification; and continuing the boot process upon successful verification of the first cryptographic response.

Description

    CROSS-REFERENCE TO RELATED APPLICATIONS
  • The present application claims the benefit of priority to Australian Provisional Patent Application No. 2008905085, filed on Sep. 30, 2008, entitled “A SECURITY METHOD”, which is herein incorporated by reference in its entirety.
  • FIELD
  • The disclosure relates to a security method, a verification system and a client device.
  • BACKGROUND
  • Devices having or associated with a high level of security, such as gaming devices which have to meet stringent regulations, often utilize a secure boot chain so that there is a high level of certainty that the device has booted without being tampered with. One prior art technique is to provide a separate device on the board of the device to monitor an early part of the boot sequence to check that the boot loader (or BIOS) has not been tampered with. Further elements in the boot chain then build on the corner stone of the initial part of the boot sequence being secure to conduct further security checks. A problem with this technique is that if there is a need to update the boot loader, it is also necessary to update the monitoring device. There is a need for an alternative security method.
  • BRIEF SUMMARY
  • In a first aspect, there is provided a security method for verifying a client device including:
      • loading and executing a boot loader at the client device which establishes a connection to a boot compliance server;
      • sending a first cryptographic element from the boot compliance server to the client device;
      • generating a first cryptographic response with the first cryptographic element based on at least part of the boot loader and sending the first cryptographic response to the boot compliance server for verification; and
      • continuing the boot process upon successful verification of the first cryptographic response.
  • In an embodiment, the method includes:
      • sending at least a second cryptographic element to the client device subsequent to the successful verification of the first cryptographic response;
      • generating a second cryptographic response with the second cryptographic element based on at least part of the operating system; and
      • loading the operating system upon successful verification of the second cryptographic response.
  • In an embodiment, the client device takes at least one protective action upon unsuccessful verification of the first cryptographic response.
  • In an embodiment, the first cryptographic element is a first hash key and generating the cryptographic response includes applying a corresponding hash function to the boot loader using the first hash key.
  • In an embodiment, sending at least a second cryptographic element includes sending a valid second cryptographic response to the client device whereby the client device can verify the operating system without further reference to the boot compliance server.
  • In an embodiment, the method includes sending a plurality of second cryptographic elements corresponding to respective ones of a plurality of possible operating versions to the client device and determining at the client device a relevant one of the second cryptographic elements to apply.
  • In an embodiment, establishing a connection includes establishing an encrypted connection.
  • In a second aspect, there is provided a verification system including:
      • a boot compliance server; and
      • a client device arranged to load and execute a boot loader at the client device to establish a connection to a boot compliance server, whereafter:
      • the boot compliance server sends a first cryptographic element from the boot compliance server to the client device;
      • the client device generates a first cryptographic response with the first cryptographic element based on at least part of the boot loader and sends the first cryptographic response to the boot compliance server for verification; and
      • the client device continues the boot process upon successful verification of the first cryptographic response.
  • In an embodiment, the boot compliance server sending at least a second cryptographic element to the client device subsequent to the successful verification of the first cryptographic response;
      • the client device generates a second cryptographic response with the second cryptographic element based on at least part of the operating system; and
      • the client device loads the operating system upon successful verification of the second cryptographic response.
  • In an embodiment, the client device takes at least one protective action upon unsuccessful verification of the first cryptographic response.
  • In an embodiment, the first cryptographic element is a first hash key and the client device generates the cryptographic response by applying a corresponding hash function to the boot loader using the first hash key.
  • In an embodiment, the boot compliance server sends a valid second cryptographic response to the client device whereby the client device can verify the operating system without further reference to the boot compliance server.
  • In an embodiment, the boot compliance server sends a plurality of second cryptographic elements corresponding to respective ones of a plurality of possible operating versions to the client device and the client device determines a relevant one of the second cryptographic elements to apply.
  • In an embodiment, establishing a connection includes establishing an encrypted connection.
  • In an embodiment, the client device is a gaming device.
  • In an embodiment, the gaming device is a player tracking module.
  • In an embodiment, the verification system further includes a boot loader update server adapted to communicate an updated boot loader to the client device, whereafter the client device replaces the current boot loader with the updated boot loader.
  • In an embodiment, the verification system further includes an operating system update server adapted to communicate an updated operating system to the client device, whereafter the client device replaces the current operating system with the updated operating system.
  • In a third aspect, there is provided a client device arranged to:
      • load and execute a boot loader at the client device to establish a connection to a boot compliance server;
      • receive a first cryptographic element sent from a boot compliance server to the client device;
      • generate a first cryptographic response with the first cryptographic element based on at least part of the boot loader and send the first cryptographic response to the boot compliance server for verification; and
      • continue the boot process upon successful verification of the first cryptographic response.
  • In an embodiment, the client device is arranged to:
      • receive a second cryptographic element to the client device subsequent to the successful verification of the first cryptographic response;
      • generate a second cryptographic response with the second cryptographic element based on at least part of the operating system; and
      • load the operating system upon successful verification of the second cryptographic response.
  • In an embodiment, the client device is arranged to take at least one protective action upon unsuccessful verification of the first cryptographic response.
  • In an embodiment, the first cryptographic element is a first hash key and the client device generates the cryptographic response by applying a corresponding hash function to the boot loader using the first hash key.
  • In an embodiment, the client device is arranged to receive a valid second cryptographic response to the client device whereby the client device can verify the operating system without further reference to the boot compliance server.
  • In an embodiment, the client device is arranged to receive a plurality of second cryptographic elements corresponding to respective ones of a plurality of possible operating versions and determine a relevant one of the second cryptographic elements to apply.
  • In an embodiment, establishing a connection includes establishing an encrypted connection.
  • In an embodiment, the client device is a gaming device.
  • In an embodiment, the gaming device is a player tracking module.
  • In a fourth aspect, there is provided a security method for verifying a client device including:
      • loading and executing a boot loader at the client device to establish a connection to a boot compliance server;
      • receiving a first cryptographic element sent from a boot compliance server to the client device;
      • generating a first cryptographic response with the first cryptographic element based on at least part of the boot loader and sending the first cryptographic response to the boot compliance server for verification; and
      • continuing the boot process upon successful verification of the first cryptographic response.
    BRIEF DESCRIPTION OF THE DRAWINGS
  • Certain exemplary embodiments of the invention will now be described with reference to the accompanying drawings in which:
  • FIG. 1 is a perspective view of a gaming machine;
  • FIG. 2 is a block diagram of a gaming machine;
  • FIG. 3 is a block diagram of the memory of a gaming machine;
  • FIG. 4 is a block diagram of a player tracking module of the of an embodiment;
  • FIG. 5 is a block diagram showing how a plurality of gaming machines are networked and in data communication with a boot compliance server;
  • FIG. 6 is a functional block diagram of a player tracking module;
  • FIG. 7 is a functional block diagram of a boot compliance server; and
  • FIG. 8 is a flowchart of a method of an embodiment.
  • Features, further aspects, and advantages of the present invention will become apparent from the following description of embodiments thereof, by way of example only, with reference to the accompanying drawings. Also, various embodiments of the aspects described in the preceding paragraphs will be apparent from the appended claims, the following description and/or the accompanying drawings. It should be understood, however, that the present invention is not limited to the arrangements and instrumentality shown in the attached drawings.
  • DETAILED DESCRIPTION
  • One example problem with using a secure boot chain technique is that if there is a need to update a boot loader, it is also necessary to update a related monitoring device. There is a need for an improved security method.
  • Referring to the drawings, there is shown a verification system which has a boot compliance server controller which participates in the verification of a client device, such as a gaming device. Advantageously, the verification system is provided so as to maintain a secure boot sequence while enabling the boot loader and operating system of the client device to be updated by downloading an updated boot loader or updated operating system to the client device. In the example embodiments described below, the client devices are gaming devices at gaming venues which require a high level of trust because of regulatory requirements.
  • Persons skilled in the art will appreciate that some venues have electronic gaming tables playable by a plurality of players under control of a controller. For the purpose of this specification, such a table should be understood as being within the meaning of “a gaming device”. Accordingly, within this specification “gaming device” includes any gaming device adapted to be coupled to a network, for example, a single player, electronic gaming machine arranged to play one or more games, a player tracking module adapted to be fitted to a gaming machine, an interactive video gaming terminal in a server based gaming system, a bonus controller, a jackpot controller, a display server etc.
  • A gaming device in the form of a typical stand alone gaming machine 10 is illustrated in FIG. 1. The gaming machine 10 includes a console 12 having a display 14 on which is displayed representations of a game that can be played by a player. A mid-trim 20 of the gaming machine 10 houses a bank of buttons 22 for enabling a player to interact with the gaming machine, in particular during game play. The mid-trim 20 also houses a credit input mechanism for example a coin input chute and/or a bill collector 24B. Other credit input mechanisms may also be employed, for example, a card reader for reading a smart card, debit card or credit card.
  • Artwork and/or information, for example pay tables and details of bonus awards and other information or images relating to the game may be provided on a front panel 29 of the console 12. A coin tray 30 is mounted beneath the front panel 29 for dispensing cash payouts from the gaming machine 10.
  • The display 14 shown in FIG. 1 is in the form of a video display unit, particularly a cathode ray tube screen device. Alternatively, the display 14 may be a liquid crystal display, plasma screen, any other suitable video display unit, or the visible portion of an electromechanical device. The top box 26 also includes a display which may be of the same type as the display 14, or of a different type.
  • Another gaming device in the form of a player tracking module (PTM) 50 (also known as a player marketing module) having a display 52 coupled to the gaming machine 10. One purpose of the PTM 50 is to allow the player to interact with a player loyalty system. The PTM has a magnetic card reader for the purpose of reading a player tracking device in the form of a magnetic swipe card, for example as part of a loyalty program. However other reading devices may be employed and the player tracking device may be in the form of a card, flash drive or any other portable storage medium capable of being read by a reading device.
  • FIG. 2 shows a block diagram of operative components of a typical gaming machine which may be the same as or different to the gaming machine of FIG. 1.
  • The gaming machine 100 includes a game controller 101 having a processor 102. Instructions and data to control operation of the processor 102 are stored in a memory 103, which is in data communication with the processor 102. Herein the term “processor” is used to refer generically to any device that can process game play instructions in accordance with game play rules and may include, for example, a microprocessor, microcontroller, programmable logic device or other computational device, a general purpose computer (e.g. a PC) or a server.
  • Typically, the gaming machine 100 will include both volatile and non-volatile memory and more than one of each type of memory, with such memories being collectively represented by the memory 103.
  • The gaming machine has hardware meters 104 for purposes including ensuring regulatory compliance and monitoring player credit, an input/output (I/O) interface 105 for communicating with peripheral devices of the gaming machine 100. The input/output interface 105 and/or the peripheral devices may be intelligent devices with their own memory for storing associated instructions and data for use with the input/output interface or the peripheral devices. A random number generator module 113 generates random numbers for use by the processor 102. Persons skilled in the art will appreciate that the reference to random numbers includes pseudo-random numbers.
  • In the example shown in FIG. 2, a player interface 120 includes peripheral devices that communicate with the game controller 101 has one or more displays 106, a touch screen 107, a card and/or ticket reader 108, a printer 109, a bill acceptor and/or coin input mechanism 110 and a coin output mechanism 111. Additional hardware may be included as part of the gaming machine 100, or hardware may be omitted based on the specific implementation.
  • In addition, the gaming machine 100 may include a network card 112 to enable the gaming machine to communicate over the network with the boot compliance server. The network card may also send status information, accounting information or other information to a central controller, server or database and receive data or commands from the central controller, server or database.
  • FIG. 3 shows a block diagram of the main components of an exemplary memory 103. The memory 103 includes RAM 103A, EPROM 103B and a mass storage device 103C. The RAM 103A typically temporarily holds program files for execution by the processor 102 and related data. The EPROM 103B may be a boot ROM device and/or may contain some system or game related code. The mass storage device 103C is typically used to store game programs, the integrity of which may be verified and/or authenticated by the processor 102 using protected code from the EPROM 103B or elsewhere.
  • It is also possible for the operative components of the gaming machine 100 to be distributed, for example input/output devices 106,107,108,109,110,111 to be provided remotely from the game controller 101.
  • FIG. 4 is a block diagram of a player tracking module 50. The player tracking module (PTM) 50 is coupled via input/output port 57 to a serial input output port of the input/output section 105 of the electronic gaming machine. The PTM 50 has a card reader 54 and a display 52 which may be a touch screen display. The PTM 50 may also have buttons 53 for receiving a player input (at least in embodiments where there is no touch screen display) and a speaker 51. Input received from the card reader 54 is processed by processor 55 based on the data stored in memory 56. The PTM 50 is coupled to the network by network card 58 enabling it to communicate with a loyalty system, the boot compliance server, and the update server. Thus, in the embodiment, the gaming machine 10 communicates with the loyalty system via the PTM. Processor 55 is also arranged to communicate with a gaming machine 10 via input output port 54 to cause locking of the gaming machine in response to an instruction received via the network card 58.
  • FIG. 5 shows an embodiment of a verification system 500 for verifying the boot sequence of a plurality of player tracking modules. A series of electronic gaming machines 10 have respective player tracking modules 50 coupled via communications network 510 to a boot compliance server 520. Persons skilled in the art will appreciate that if the gaming machines 10 have a network card they could be coupled to the network in the same manner. The communications network 510 may be any suitable communications network for example an Ethernet.
  • Verification system 500 also includes an update server 540 which has a first database 541A storing boot loader updates and the second database 541B storing operating system updates. The update server also stores in databases 541A to 541B the versions of each player tracking modules 50 so that it can control the update process to bring each player tracking machine up to the relevant version. In this manner, the update server provides both a boot loader update server and an operating system update server.
  • A person skilled in the art will appreciate that terms such as boot loader, boot strap or BIOS are used in different contexts to refer to a set of instructions to be operated by a processor upon start-up in order to initiate operation of the processor. Herein, the term boot loader is used to invoke all of these terms. Persons skilled in the art will appreciate that the actual files included within the boot loader may vary depending on the implementation and generally, the boot loader is split into a series of separate segments. Further, in some implementations some functions may be formed by the operating system rather than the boot loader. Accordingly, it will be appreciated that in many implementations in order to verify the boot loader it will only be necessary to verify a part of the boot loader and it may not be necessary to verify the entirety of it in order to be sure of having a secure platform. For example, in the example described in further detail below it may only be necessary to verify a part of the boot loader having the instructions which enable a connection with the boot compliance server to be made as well as the instructions which have been used as part of the verification process.
  • Referring to FIG. 8 the method 80 of the embodiment, involves starting the boot 805 at the player tracking module 50 and early in the boot sequence establishing 810 an Ethernet session to the boot compliance server. This session is established 810 by establishing a secure channel by obtaining the public key of the boot compliance server and encrypting further communications with the public key. Once a secure channel has been established, the boot compliance server 815 sends a cryptographic element in the form of a hash key to the client gaming device to enable it to compute a message digest. Persons skilled in the art will appreciate that if other techniques are employed other types of cryptographic responses could be generated, for example in one embodiment, the verification may be performed using a cyclic redundancy check or the like.
  • It will be appreciated from the above description that the boot compliance server either knows the version of the operating server run by this client or the gaming client device communicates the boot loader version when establishing a channel with the boot compliance server.
  • In one example, the key is for the MD5 message-digest algorithm provided by RSA Data Security, Inc. MD5 is a cryptographic hash function which produce a 128 bit hash value. Accordingly, the boot loader program includes the MD5 algorithm to enable the boot loader to calculate 820 the MD5 message digest of the boot loader program and sending 825 the message digest to the boot compliance server. A person skilled in the art will appreciate that other algorithms could be chosen such as RSA or DSA. In this embodiment MD5 is chosen because it enables different keys to be sent to the client each time it is necessary to compute a message digest. Advantageously, the server, determines 830 whether the message digest is valid. If it is invalid the boot compliance server informs 835A the client gaming device that it is invalid and the boot loader halts 840 the boot processor and outputs an appropriate error message on its display.
  • In the alternative, the boot compliance server informs 845 the client device that the message digest is valid upon which the boot process continues by the boot compliance server sending 850 a plurality of keys and digest results for all operating systems which could be installed on the client gaming device. Generally, there will only be a small number of valid operating systems and it is quicker for the boot compliance server to send the keys and digest results for all valid operating systems rather than initiate a cycle where the server requests the identity of the operating system and sends the relevant key and operating system digest.
  • The boot loader then calculates a hash 855 using the relevant key and compares this to the relevant result. If it is valid, the boot loader proceeds by loading the operating system 870. Alternatively, if it determined 860 that the result is invalid the boot process halts 865 and an error message is displayed.
  • An advantage of this process is that as the boot compliance server verifies the boot loader, the boot loader can be changed at the gaming device. Similarly, the operating system can be changed.
  • The modules which are instantiated by the player tracking module and the boot compliance server to carry out the above process are illustrated in FIGS. 6 and 7. The processor 55 of the player tracking module implements an encrypted communication module 55A within the boot loader which is established in order to carry out communications with the boot compliance server 520. It also has a hash calculation module 55B for calculating the message digest to be sent to the server and the case of the first message digest which is calculated and a comparison module 55C which compares the hash to the result sent by the boot compliance server in the case of the hash of the operating system. A preventive action module 55D is activated if either message is invalid. The example given above of a preventative action is to halt the boot process and issue an error message. A person skilled in the art will appreciate that other techniques can also be used to take preventative action, for example by disabling some functions of the player tracking module.
  • The boot compliance server 520 also has an encrypted communication module 522 and a verification module 523 for verifying any message digest sent to the boot compliance server 520 it has a crypto module 524 for generating any required hashes and database 521 stores digest of the live operating systems and boot loaders. Crypto module 524 generates the keys to be sent via encrypted communication module 522 to the gaming device. To this end a cryptographic element supply module 524 controls supply of the relevant keys.
  • Persons skilled in the art will appreciate that while hash key results are transmitted in this embodiment, other cryptographic elements could be transmitted in other embodiments to be used to generate a cryptographic result. For example, rather than sending a key, an alternative would be to use a signature or a certificate or the like.
  • Further aspects of the method will be apparent from the above description of the gaming system. Persons skilled in the art will also appreciate that the method could be embodied in program code. The program code could be supplied in a number of ways, for example on a tangible computer readable medium, such as a disc or a memory (for example, that could replace part of memory 103) or as a data signal (for example, by downloading it from a server).
  • It will be understood to persons skilled in the art of the invention that many modifications may be made without departing from the spirit and scope of the invention, in particular it will be apparent that certain features of embodiments of the invention can be employed to form further embodiments.
  • It is to be understood that, if any prior art is referred to herein, such reference does not constitute an admission that the prior art forms a part of the common general knowledge in the art in any country.
  • In the claims which follow and in the preceding description of the invention, except where the context requires otherwise due to express language or necessary implication, the word “comprise” or variations such as “comprises” or “comprising” is used in an inclusive sense, i.e. to specify the presence of the stated features but not to preclude the presence or addition of further features in various embodiments of the invention.
  • It will be appreciated by persons skilled in the art that numerous variations and/or modifications may be made to the invention as shown in the specific embodiments without departing from the spirit or scope of the invention as broadly described. The present embodiments are, therefore, to be considered in all respects as illustrative and not restrictive. Several embodiments are described above with reference to the drawings. These drawings illustrate certain details of specific embodiments that implement the systems and methods and programs of the present invention. However, describing the invention with drawings should not be construed as imposing on the invention any limitations associated with features shown in the drawings. It will be understood that the invention disclosed and defined in this specification extends to all alternative combinations of two or more of the individual features mentioned or evident from the text or drawings. All of these different combinations constitute various alternative aspects of the invention.
  • The present invention contemplates methods, systems and program products on any electronic device and/or machine-readable media suitable for accomplishing its operations. Certain embodiments of the present invention may be implemented using an existing computer processor and/or by a special purpose computer processor incorporated for this or another purpose or by a hardwired system, for example.
  • Embodiments within the scope of the present invention include program products comprising machine-readable media for carrying or having machine-executable instructions or data structures stored thereon. Such machine-readable media can be any available media that can be accessed by a general purpose or special purpose computer or other machine with a processor. By way of example, such machine-readable media may comprise RAM, ROM, PROM, EPROM, EEPROM, Flash, CD-ROM or other optical disk storage, magnetic disk storage or other magnetic storage devices, or any other medium which can be used to carry or store desired program code in the form of machine-executable instructions or data structures and which can be accessed by a general purpose or special purpose computer or other machine with a processor. When information is transferred or provided over a network or another communications connection (either hardwired, wireless, or a combination of hardwired or wireless) to a machine, the machine properly views the connection as a machine-readable medium. Thus, any such a connection is properly termed a machine-readable medium. Combinations of the above are also included within the scope of machine-readable media. Machine-executable instructions comprise, for example, instructions and data which cause a general purpose computer, special purpose computer, or special purpose processing machines to perform a certain function or group of functions.

Claims (28)

1. A security method for verifying a client device comprising:
loading and executing a boot loader at the client device which establishes a connection to a boot compliance server;
sending a first cryptographic element from the boot compliance server to the client device;
generating a first cryptographic response with the first cryptographic element based on at least part of the boot loader and sending the first cryptographic response to the boot compliance server for verification; and
continuing the boot process upon successful verification of the first cryptographic response.
2. A method as claimed in claim 1, comprising:
sending at least a second cryptographic element to the client device subsequent to the successful verification of the first cryptographic response;
generating a second cryptographic response with the second cryptographic element based on at least part of the operating system; and
loading the operating system upon successful verification of the second cryptographic response.
3. A method as claimed in claim 1, wherein the client device takes at least one protective action upon unsuccessful verification of the first cryptographic response.
4. A method as claimed in claim 1, wherein the first cryptographic element is a first hash key and generating the cryptographic response comprises applying a corresponding hash function to the boot loader using the first hash key.
5. A method as claimed in claim 2, wherein sending at least a second cryptographic element comprises sending a valid second cryptographic response to the client device whereby the client device can verify the operating system without further reference to the boot compliance server.
6. A method as claimed in claim 2, comprising sending a plurality of second cryptographic elements corresponding to respective ones of a plurality of possible operating versions to the client device and determining at the client device a relevant one of the second cryptographic elements to apply.
7. A method as claimed in claim 1, wherein establishing a connection comprises establishing an encrypted connection.
8. A verification system comprising:
a boot compliance server; and
a client device arranged to load and execute a boot loader at the client device to establish a connection to a boot compliance server, whereafter:
the boot compliance server sends a first cryptographic element from the boot compliance server to the client device;
the client device generates a first cryptographic response with the first cryptographic element based on at least part of the boot loader and sends the first cryptographic response to the boot compliance server for verification; and
the client device continues the boot process upon successful verification of the first cryptographic response.
9. A verification system as claimed in claim 8, wherein:
the boot compliance server sending at least a second cryptographic element to the client device subsequent to the successful verification of the first cryptographic response;
the client device generates a second cryptographic response with the second cryptographic element based on at least part of the operating system; and
the client device loads the operating system upon successful verification of the second cryptographic response.
10. A verification system as claimed in claim 8, wherein the client device takes at least one protective action upon unsuccessful verification of the first cryptographic response.
11. A verification system as claimed in claim 8, wherein the first cryptographic element is a first hash key and the client device generates the cryptographic response by applying a corresponding hash function to the boot loader using the first hash key.
12. A verification system as claimed in claim 9, wherein the boot compliance server sends a valid second cryptographic response to the client device whereby the client device can verify the operating system without further reference to the boot compliance server.
13. A verification system as claimed in claim 9, wherein the boot compliance server sends a plurality of second cryptographic elements corresponding to respective ones of a plurality of possible operating versions to the client device and the client device determines a relevant one of the second cryptographic elements to apply.
14. A verification system as claimed in claim 8, wherein establishing a connection comprises establishing an encrypted connection.
15. A verification system as claimed in claim 8, wherein the client device is a gaming device.
16. A verification system as claimed in claim 15, wherein the gaming device is a player tracking module.
17. A verification system as claimed in claim 8, further comprising a boot loader update server adapted to communicate an updated boot loader to the client device, whereafter the client device replaces the current boot loader with the updated boot loader.
18. A verification system as claimed in claim 8, further comprising an operating system update server adapted to communicate an updated operating system to the client device, whereafter the client device replaces the current operating system with the updated operating system.
19. A client device arranged to:
load and execute a boot loader at the client device to establish a connection to a boot compliance server;
receive a first cryptographic element sent from a boot compliance server to the client device;
generate a first cryptographic response with the first cryptographic element based on at least part of the boot loader and send the first cryptographic response to the boot compliance server for verification; and
continue the boot process upon successful verification of the first cryptographic response.
20. A client device as claimed in claim 19, arranged to:
receive a second cryptographic element to the client device subsequent to the successful verification of the first cryptographic response;
generate a second cryptographic response with the second cryptographic element based on at least part of the operating system; and
load the operating system upon successful verification of the second cryptographic response.
21. A client device as claimed in claim 19, arranged to take at least one protective action upon unsuccessful verification of the first cryptographic response.
22. A client device as claimed in claim 19, wherein the first cryptographic element is a first hash key and the client device generates the cryptographic response by applying a corresponding hash function to the boot loader using the first hash key.
23. A client device as claimed in claim 20, arranged to receive a valid second cryptographic response to the client device whereby the client device can verify the operating system without further reference to the boot compliance server.
24. A client device as claimed in claim 20, arranged to receive a plurality of second cryptographic elements corresponding to respective ones of a plurality of possible operating versions and determine a relevant one of the second cryptographic elements to apply.
25. A client device as claimed in claim 19, wherein establishing a connection comprises establishing a encrypted connection.
26. A client device as claimed in claim 19, which is a gaming device.
27. A client device as claimed in claim 26, wherein the gaming device is a player tracking module.
28. A security method for verifying a client device comprising:
loading and executing a boot loader at the client device to establish a connection to a boot compliance server;
receiving a first cryptographic element sent from a boot compliance server to the client device;
generating a first cryptographic response with the first cryptographic element based on at least part of the boot loader and sending the first cryptographic response to the boot compliance server for verification; and
continuing the boot process upon successful verification of the first cryptographic response.
US12/569,883 2008-09-30 2009-09-29 Security method Abandoned US20100122076A1 (en)

Priority Applications (2)

Application Number Priority Date Filing Date Title
AU2008905085A AU2008905085A0 (en) 2008-09-30 A security method
AU2008905085 2008-09-30

Applications Claiming Priority (1)

Application Number Priority Date Filing Date Title
US13/724,310 US9063752B2 (en) 2008-09-30 2012-12-21 Security method

Related Child Applications (1)

Application Number Title Priority Date Filing Date
US13/724,310 Continuation US9063752B2 (en) 2008-09-30 2012-12-21 Security method

Publications (1)

Publication Number Publication Date
US20100122076A1 true US20100122076A1 (en) 2010-05-13

Family

ID=42113890

Family Applications (2)

Application Number Title Priority Date Filing Date
US12/569,883 Abandoned US20100122076A1 (en) 2008-09-30 2009-09-29 Security method
US13/724,310 Active 2029-11-19 US9063752B2 (en) 2008-09-30 2012-12-21 Security method

Family Applications After (1)

Application Number Title Priority Date Filing Date
US13/724,310 Active 2029-11-19 US9063752B2 (en) 2008-09-30 2012-12-21 Security method

Country Status (2)

Country Link
US (2) US20100122076A1 (en)
AU (1) AU2009222577B2 (en)

Cited By (21)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20120042376A1 (en) * 2010-08-10 2012-02-16 Boris Dolgunov Host Device and Method for Securely Booting the Host Device with Operating System Code Loaded From a Storage Device
US20120210115A1 (en) * 2011-02-11 2012-08-16 Park Dong-Jin Secure Boot Method and Method for Generating a Secure Boot Image
US20130339734A1 (en) * 2011-08-12 2013-12-19 Power-One, Inc. Secure Method and System for Remote Field Upgrade of Power Device Firmware
US20140351584A1 (en) * 2011-08-12 2014-11-27 Power-One Italy S.P.A. Method and system for protected transmission of files
US20150033031A1 (en) * 2012-07-31 2015-01-29 Adobe Systems Incorporated System and Method for Detecting a Security Compromise on a Device
US20150121497A1 (en) * 2012-04-05 2015-04-30 Toucan System Method For Securing Access To A Computer Device
US20150134974A1 (en) * 2013-11-13 2015-05-14 Via Technologies, Inc. Apparatus and method for securing bios in a trusted computing system
US9063752B2 (en) 2008-09-30 2015-06-23 Aristocrat Technologies Australia Pty Limited Security method
US9195806B1 (en) * 2011-07-06 2015-11-24 The Boeing Company Security server for configuring and programming secure microprocessors
US20150339481A1 (en) * 2014-05-23 2015-11-26 Insyde Software Corp. Electronic device having wake up verification and electronic system having the electronic device
US9507942B2 (en) 2013-11-13 2016-11-29 Via Technologies, Inc. Secure BIOS mechanism in a trusted computing system
US9547767B2 (en) 2013-11-13 2017-01-17 Via Technologies, Inc. Event-based apparatus and method for securing bios in a trusted computing system during execution
US9600291B1 (en) * 2013-03-14 2017-03-21 Altera Corporation Secure boot using a field programmable gate array (FPGA)
US9767288B2 (en) 2013-11-13 2017-09-19 Via Technologies, Inc. JTAG-based secure BIOS mechanism in a trusted computing system
US9779243B2 (en) 2013-11-13 2017-10-03 Via Technologies, Inc. Fuse-enabled secure BIOS mechanism in a trusted computing system
US9779242B2 (en) 2013-11-13 2017-10-03 Via Technologies, Inc. Programmable secure bios mechanism in a trusted computing system
US9798880B2 (en) 2013-11-13 2017-10-24 Via Technologies, Inc. Fuse-enabled secure bios mechanism with override feature
US10049217B2 (en) 2013-11-13 2018-08-14 Via Technologies, Inc. Event-based apparatus and method for securing bios in a trusted computing system during execution
US10055588B2 (en) 2013-11-13 2018-08-21 Via Technologies, Inc. Event-based apparatus and method for securing BIOS in a trusted computing system during execution
US10095868B2 (en) 2013-11-13 2018-10-09 Via Technologies, Inc. Event-based apparatus and method for securing bios in a trusted computing system during execution
WO2019070239A1 (en) * 2017-10-03 2019-04-11 Hewlett-Packard Development Company, L.P. Identifier of a client device

Families Citing this family (2)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9489307B2 (en) * 2012-10-24 2016-11-08 Texas Instruments Incorporated Multi domain bridge with auto snoop response
US20180204007A1 (en) * 2017-01-13 2018-07-19 Vormetric, Inc. Bootloader level encryption for system boot data

Citations (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US20040177265A1 (en) * 2003-03-06 2004-09-09 International Business Machines Corporation Providing security based on a device identifier prior to booting an operating system
US6834351B1 (en) * 1999-10-29 2004-12-21 Gateway, Inc. Secure information handling system
US20060015717A1 (en) * 2004-07-15 2006-01-19 Sony Corporation And Sony Electronics, Inc. Establishing a trusted platform in a digital processing system
US20060129797A1 (en) * 2004-12-15 2006-06-15 Palo Alto Research Center, Inc. Hardware-supported secure network boot
US20060179293A1 (en) * 2005-02-07 2006-08-10 Dell Products L.P. Method to boot computer system only to a secure network
US20070266120A1 (en) * 2006-05-10 2007-11-15 Dell Products L.P. System and method for handling instructions in a pre-boot execution environment
US7299354B2 (en) * 2003-09-30 2007-11-20 Intel Corporation Method to authenticate clients and hosts to provide secure network boot
US20070268917A1 (en) * 2006-05-16 2007-11-22 Oracle International Corporation Methods and systems for enabling remote booting of remote boot clients in a switched network defining a plurality of virtual local area networks (VLANS)
US20080028052A1 (en) * 2006-07-25 2008-01-31 Andrew Currid System and method for operating system installation on a diskless computing platform
US20080028035A1 (en) * 2006-07-25 2008-01-31 Andrew Currid System and method for operating system installation on a diskless computing platform
US20080098100A1 (en) * 2002-04-18 2008-04-24 Myron Zimmerman System for and method of streaming data to a computer in a network
US20080140816A1 (en) * 2002-04-18 2008-06-12 Gintautas Burokas System for and method of network booting of an operating system to a client computer using hibernation
US20080147830A1 (en) * 2006-12-14 2008-06-19 Ridgill Stephen P Selective sub-net filtering in a pre-boot execution environment (pxe)
US20080155075A1 (en) * 2003-12-31 2008-06-26 Daryl Carvis Cromer Remote management of boot application
US20080183812A1 (en) * 2001-04-27 2008-07-31 International Business Machines Corporation Method and System for Fault-Tolerant Remote Boot in the Presence of Boot Server Overload/Failure with Self-Throttling Boot Servers
US20080201571A1 (en) * 2007-02-19 2008-08-21 Radhakrishnan Sethuraman System and method for managing boot images in a retail store environment
US20110145575A1 (en) * 2008-02-25 2011-06-16 Marc Blommaert Secure Bootstrapping Architecture Method Based on Password-Based Digest Authentication

Family Cites Families (18)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
JPH0859386A (en) 1994-08-22 1996-03-05 Mitsubishi Materials Corp Semiconductor single crystal growing device
US6189100B1 (en) * 1998-06-30 2001-02-13 Microsoft Corporation Ensuring the integrity of remote boot client data
US6484262B1 (en) * 1999-01-26 2002-11-19 Dell Usa, L.P. Network controlled computer system security
US7409546B2 (en) * 1999-10-20 2008-08-05 Tivo Inc. Cryptographically signed filesystem
US6978385B1 (en) * 2000-03-01 2005-12-20 International Business Machines Corporation Data processing system and method for remote recovery of a primary password
GB2348721A (en) 2000-07-15 2000-10-11 Ideagen Software Limited Automated software or data updating in distributed computing system
GB2373604B (en) 2001-03-23 2004-10-27 Ibm A method and system for controlling use of software programs
US7181620B1 (en) * 2001-11-09 2007-02-20 Cisco Technology, Inc. Method and apparatus providing secure initialization of network devices using a cryptographic key distribution approach
US20040242328A1 (en) * 2003-03-05 2004-12-02 Blackburn Christopher W. Boot service in a service-oriented gaming network environment
US7171555B1 (en) * 2003-05-29 2007-01-30 Cisco Technology, Inc. Method and apparatus for communicating credential information within a network device authentication conversation
US7313690B2 (en) 2003-06-27 2007-12-25 Microsoft Corporation Three way validation and authentication of boot files transmitted from server to client
US20060020810A1 (en) * 2004-07-24 2006-01-26 International Business Machines Corporation System and method for software load authentication
PL1854263T3 (en) * 2005-02-04 2011-10-31 Qualcomm Incorporated Secure bootstrapping for wireless communications
CN100456805C (en) 2006-01-27 2009-01-28 中国科学院声学研究所 A network upgrade method of the TFTP-based IPTV STB software
JP2007310508A (en) 2006-05-16 2007-11-29 Nippon Telegraph & Telephone East Corp Thin client system and program for thin client terminal
US20080082680A1 (en) 2006-09-29 2008-04-03 Karanvir Grewal Method for provisioning of credentials and software images in secure network environments
WO2008046101A2 (en) 2006-10-13 2008-04-17 Ariel Silverstone Client authentication and data management system
US20100122076A1 (en) 2008-09-30 2010-05-13 Aristocrat Technologies Australia Pty Limited Security method

Patent Citations (17)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US6834351B1 (en) * 1999-10-29 2004-12-21 Gateway, Inc. Secure information handling system
US20080183812A1 (en) * 2001-04-27 2008-07-31 International Business Machines Corporation Method and System for Fault-Tolerant Remote Boot in the Presence of Boot Server Overload/Failure with Self-Throttling Boot Servers
US20080098100A1 (en) * 2002-04-18 2008-04-24 Myron Zimmerman System for and method of streaming data to a computer in a network
US20080140816A1 (en) * 2002-04-18 2008-06-12 Gintautas Burokas System for and method of network booting of an operating system to a client computer using hibernation
US20040177265A1 (en) * 2003-03-06 2004-09-09 International Business Machines Corporation Providing security based on a device identifier prior to booting an operating system
US7299354B2 (en) * 2003-09-30 2007-11-20 Intel Corporation Method to authenticate clients and hosts to provide secure network boot
US20080155075A1 (en) * 2003-12-31 2008-06-26 Daryl Carvis Cromer Remote management of boot application
US20060015717A1 (en) * 2004-07-15 2006-01-19 Sony Corporation And Sony Electronics, Inc. Establishing a trusted platform in a digital processing system
US20060129797A1 (en) * 2004-12-15 2006-06-15 Palo Alto Research Center, Inc. Hardware-supported secure network boot
US20060179293A1 (en) * 2005-02-07 2006-08-10 Dell Products L.P. Method to boot computer system only to a secure network
US20070266120A1 (en) * 2006-05-10 2007-11-15 Dell Products L.P. System and method for handling instructions in a pre-boot execution environment
US20070268917A1 (en) * 2006-05-16 2007-11-22 Oracle International Corporation Methods and systems for enabling remote booting of remote boot clients in a switched network defining a plurality of virtual local area networks (VLANS)
US20080028052A1 (en) * 2006-07-25 2008-01-31 Andrew Currid System and method for operating system installation on a diskless computing platform
US20080028035A1 (en) * 2006-07-25 2008-01-31 Andrew Currid System and method for operating system installation on a diskless computing platform
US20080147830A1 (en) * 2006-12-14 2008-06-19 Ridgill Stephen P Selective sub-net filtering in a pre-boot execution environment (pxe)
US20080201571A1 (en) * 2007-02-19 2008-08-21 Radhakrishnan Sethuraman System and method for managing boot images in a retail store environment
US20110145575A1 (en) * 2008-02-25 2011-06-16 Marc Blommaert Secure Bootstrapping Architecture Method Based on Password-Based Digest Authentication

Cited By (33)

* Cited by examiner, † Cited by third party
Publication number Priority date Publication date Assignee Title
US9063752B2 (en) 2008-09-30 2015-06-23 Aristocrat Technologies Australia Pty Limited Security method
US8996851B2 (en) * 2010-08-10 2015-03-31 Sandisk Il Ltd. Host device and method for securely booting the host device with operating system code loaded from a storage device
US20120042376A1 (en) * 2010-08-10 2012-02-16 Boris Dolgunov Host Device and Method for Securely Booting the Host Device with Operating System Code Loaded From a Storage Device
US20120210115A1 (en) * 2011-02-11 2012-08-16 Park Dong-Jin Secure Boot Method and Method for Generating a Secure Boot Image
US8914627B2 (en) * 2011-02-11 2014-12-16 Samsung Electronics Co., Ltd. Method for generating a secured boot image including an update boot loader for a secured update of the version information
US9195806B1 (en) * 2011-07-06 2015-11-24 The Boeing Company Security server for configuring and programming secure microprocessors
US20130339734A1 (en) * 2011-08-12 2013-12-19 Power-One, Inc. Secure Method and System for Remote Field Upgrade of Power Device Firmware
US20140351584A1 (en) * 2011-08-12 2014-11-27 Power-One Italy S.P.A. Method and system for protected transmission of files
US9225692B2 (en) * 2011-08-12 2015-12-29 Abb Technology Ag Method and system for protected transmission of files
US20150121497A1 (en) * 2012-04-05 2015-04-30 Toucan System Method For Securing Access To A Computer Device
US9866553B2 (en) * 2012-04-05 2018-01-09 Toucan System Method for securing access to a computer device
US20150033031A1 (en) * 2012-07-31 2015-01-29 Adobe Systems Incorporated System and Method for Detecting a Security Compromise on a Device
US9619653B2 (en) * 2012-07-31 2017-04-11 Adobe Systems Incorporated System and method for detecting a security compromise on a device
US9600291B1 (en) * 2013-03-14 2017-03-21 Altera Corporation Secure boot using a field programmable gate array (FPGA)
US10089470B2 (en) 2013-11-13 2018-10-02 Via Technologies, Inc. Event-based apparatus and method for securing BIOS in a trusted computing system during execution
US9547767B2 (en) 2013-11-13 2017-01-17 Via Technologies, Inc. Event-based apparatus and method for securing bios in a trusted computing system during execution
US9367689B2 (en) * 2013-11-13 2016-06-14 Via Technologies, Inc. Apparatus and method for securing BIOS in a trusted computing system
US10095868B2 (en) 2013-11-13 2018-10-09 Via Technologies, Inc. Event-based apparatus and method for securing bios in a trusted computing system during execution
US9767288B2 (en) 2013-11-13 2017-09-19 Via Technologies, Inc. JTAG-based secure BIOS mechanism in a trusted computing system
US9779243B2 (en) 2013-11-13 2017-10-03 Via Technologies, Inc. Fuse-enabled secure BIOS mechanism in a trusted computing system
US9779242B2 (en) 2013-11-13 2017-10-03 Via Technologies, Inc. Programmable secure bios mechanism in a trusted computing system
US9798880B2 (en) 2013-11-13 2017-10-24 Via Technologies, Inc. Fuse-enabled secure bios mechanism with override feature
US9805198B2 (en) 2013-11-13 2017-10-31 Via Technologies, Inc. Event-based apparatus and method for securing bios in a trusted computing system during execution
US9507942B2 (en) 2013-11-13 2016-11-29 Via Technologies, Inc. Secure BIOS mechanism in a trusted computing system
US9836609B2 (en) 2013-11-13 2017-12-05 Via Technologies, Inc. Event-based apparatus and method for securing bios in a trusted computing system during execution
US9836610B2 (en) 2013-11-13 2017-12-05 Via Technologies, Inc. Event-based apparatus and method for securing BIOS in a trusted computing system during execution
US20150134974A1 (en) * 2013-11-13 2015-05-14 Via Technologies, Inc. Apparatus and method for securing bios in a trusted computing system
US9910991B2 (en) 2013-11-13 2018-03-06 Via Technologies, Inc. Event-based apparatus and method for securing bios in a trusted computing system during execution
US10049217B2 (en) 2013-11-13 2018-08-14 Via Technologies, Inc. Event-based apparatus and method for securing bios in a trusted computing system during execution
US10055588B2 (en) 2013-11-13 2018-08-21 Via Technologies, Inc. Event-based apparatus and method for securing BIOS in a trusted computing system during execution
US9824219B2 (en) * 2014-05-23 2017-11-21 Insyde Software Corp. Electronic device having wake up verification and electronic system having the electronic device
US20150339481A1 (en) * 2014-05-23 2015-11-26 Insyde Software Corp. Electronic device having wake up verification and electronic system having the electronic device
WO2019070239A1 (en) * 2017-10-03 2019-04-11 Hewlett-Packard Development Company, L.P. Identifier of a client device

Also Published As

Publication number Publication date
US9063752B2 (en) 2015-06-23
AU2009222577A1 (en) 2010-04-15
AU2009222577B2 (en) 2012-05-17
US20130117551A1 (en) 2013-05-09

Similar Documents

Publication Publication Date Title
US8287379B2 (en) Distributed game services
US7828653B2 (en) Gaming software authentication
US7294056B2 (en) Enhanced gaming system
AU2007296451B2 (en) Method of randomly and dynamically checking configuration integrity of a gaming system
AU2006291263B2 (en) Gaming machine update and mass storage management
US8323103B2 (en) Scan based configuration control in a gaming environment
US7831047B2 (en) Digital identification of unique game characteristics
AU782891B2 (en) Electronic security technique for gaming software
US7950996B2 (en) Methods and devices for gaming account management
AU2007207859B2 (en) Pass through live validation device and method
AU2007227234B2 (en) Universal game download system for legacy gaming machines using ROM and NVRAM emulation
KR101370020B1 (en) Systems and methods for using a domain-specific security sandbox to facilitate secure transactions
US8549276B2 (en) Universal operating system to hardware platform interface for gaming machines
US7328838B2 (en) Counterfeit cashless instrument detection methods and systems
AU2001285125B2 (en) Method and apparatus for software authentication
AU2009201555B2 (en) Process verification
CA2470326C (en) Gaming machine having hardware-accelerated software authentication
US20120115618A1 (en) Partition management in a wagering game system
US7108605B2 (en) EPROM file system in a gaming apparatus
US20100048304A1 (en) Network interface, gaming system and gaming device
EP1496419B1 (en) Gaming machine having targeted run-time software authentication
RU2302276C2 (en) Authentication in protected computerized game system
US9123204B2 (en) Secure smart card operations
US7600108B2 (en) Gaming machine having reduced-read software authentication
US20080214300A1 (en) Methods for electronic data security and program authentication

Legal Events

Date Code Title Description
AS Assignment

Owner name: ARISTOCRAT TECHNOLGIES AUSTRALIA PTY LIMITED,AUSTR

Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNOR:WITTY, NIGEL MARTIN;REEL/FRAME:023743/0989

Effective date: 20100106

STCB Information on status: application discontinuation

Free format text: ABANDONED -- FAILURE TO RESPOND TO AN OFFICE ACTION