WO2008009040A1

WO2008009040A1 - A method and arrangement for protecting data

Info

Publication number: WO2008009040A1
Application number: PCT/AU2007/000941
Authority: WO
Inventors: Brian Johnson; David Airlie; David Spicer
Original assignee: Stargames Corporation Pty Limited
Priority date: 2006-07-18
Filing date: 2007-07-09
Publication date: 2008-01-24

Abstract

Data is protected from unauthorized access by altering the address of one or more data blocks. The addresses may be altered according to a reversible process such as tabular translation, algorithm etc. The reversible process is protected by encryption. A decryption key can be provided to enable the reversible process to be used by the system to determine the correct address.

Description

A Method And Arrangement For Protecting Data

Field of the invention

[001 ] This invention relates to a method and arrangement for protecting data and software in a memory.

[002] The invention is applicable to storage protection generally, and can be used to with various memory types including flash memory and disc memory.

[003] The invention can be applied in circumstances where the integrity of the data in a mass storage device must be ensured. Electronic gaming machines are one such application, where regulations require high standards of data integrity.

Background of the invention

[004] In this specification unless the contrary is expressly stated, where a document, act or item of knowledge is referred to or discussed, this reference or discussion is not an admission that the document, act or item of knowledge or any combination thereof was at the priority date, publicly available, known to the public, part of common general knowledge; or known to be relevant to an attempt to solve any problem with which this specification is concerned.

[005] Operating code for gaming machines must be protected from tampering. In the past, EPROM memories have been used as these could not be overwritten. However, with the increasing requirement for additional storage capacity, such devices have become inadequate or impractical. Large capacity rewritable mass storage memory devices, such as flash memory, are now available. However, because of the ease with which these devices can be rewritten, they are not inherently as secure as EPROM memories.

[006] Where large amounts of data are required to be stored, such as for casino games including motion video etc., ROM does not provide sufficient storage capacity at a viable cost. In addition, physical authentication for such large amounts of data is difficult.

[007] In some jurisdictions where electronic gaming machines are used, there is a need to verify the authenticity of the game machine code when a major prize is won by removing the game memory and checking it against a secure reference at a different location within the gaming venue. The fact that the game memory can be removed opens up the possibility of the code in the game memory being altered or a substitute memory with an altered program being reinserted into the gaming machine. With the expansion of network communications, the potential to verify the game code over a LAN or other communication system is possible. However, such capabilities also open the system to hacking. It is therefore desirable to provide a means of inhibiting the alteration of the game code or related information.

[008] AU758204 discloses a casino game data set stored in ROM and a signature which are encrypted from an original message digest computed from the original computer game dataset, an unalterable read only memory device storing a message digest computing program corresponding to the original message digest computing program used to compute the original message digest, and a decryption program and decryption key corresponding to the encryption program and encryption key used to prepare the encrypted signature of the original message digest. The message digest is produced using a hash function. This involves a computation that produces a fixed size string of bits (a hash value) from a variable sized digital input. Where the hash value is difficult to invert, the hash function is called a message digest function, and the result is known as a message digest. A message digest is unique to the variable sized data set from which it was derived. AU758204 transfers part of the game data to another memory and subjects it to a one-way hash function to produce a message digest, decrypts a previously generated and encrypted message, and compares the two message digests.

Summary of the invention

[009] In this specification the term "data" is used to refer collectively to both passive information and to computer program code, unless the context clearly requires otherwise, or unless expressly stated otherwise. The term "information" or "passive data" will be used where passive data is intended. Similarly, "code" will be used where program code is intended.

[010] The address of the location of data stored in a memory is not necessarily tied to its physical location. Physical data storage is divided into blocks. When data is stored, data blocks are assigned addresses and the physical location of the data block is mapped against the address to enable the operating system to retrieve the data from the data map. In flash memories, when a block of data is changed, it is written to a different block and the address is remapped to identify the location of the new data. The map is used by the computer operating system to locate the required blocks of data.

[011] The invention proposes to protect data from unauthorized access by altering the address of one or more data blocks. The addresses may be altered according to a reversible process such as tabular translation, algorithm etc. The reversible process is protected by encryption. A decryption key can be provided to enable the reversible process to be used by the system to determine the correct address.

[012] The decryption key can be a public key.

[013] The invention provides a method of rearranging the location of at least some of the data blocks relative to corresponding ostensible location identifiers associated with each block.

[014] Consequently, the data has an ostensible location identifier, which can be, for example, the location identifier assigned by a memory management system, and an actual location identifier which identifies where the data is stored.

[015] A concordance is provided between the ostensible location and the actual location.

[016] According to an embodiment of the invention, data is stored in memory in association with location identifiers which identify the location of the data on the storage medium. When accessing the data, and when writing to the memory, use is made of a "translated" address lookup table.

[017] The table can also be encrypted.

[018] The invention provides a method of protecting stored data in a memory having a plurality of blocks of data, each block being stored at a location associated with a corresponding location identifier, the method including the steps of : preparing an address concordance including a first address table corresponding to first location identifiers of the data and a second address table including second location identifiers; each second location identifier being associated with a first location identifier, wherein one or more of the second location identifiers is changed to differ from its associated first location identifier.

[019] The invention also provides a method of protecting data stored in a memory, the method including the steps of: providing an address concordance having a first list of first location identifiers and a second list of second location identifiers; at least one location identifier in the second list of identification identifiers; each second location identifier being associated with a first location identifier; at least one second location identifier differing from its associated first location identifier; and storing data in accordance with the second list of identification identifiers.

[020] The invention also provides a method of protecting data by altering the location identification of one or more blocks of the data according to a known algorithm or known pattern.

[021] The algorithm or pattern can be encrypted.

[022] The second address list can be encrypted.

[023] The address concordance can be encrypted.

[024] The memory can be a flash memory.

[025] The identification identifier can be implicit.

[026] A digital signature can be added to the concordance.

[027] An overall checksum can be associated with the data.

[028] A block checksum can be associated with at least one block of data.

[029] A block checksum can be associated with each block of data.

[030] The overall checksum can be formed by the addition of the block checksums.

[031 ] The invention also provides a method of writing the data to the memory blocks in accordance with the concordance. [032] The data can be written in accordance with the actual location identifiers.

[033] The invention also provides a protected memory arrangement including a memory in which data is stored in blocks, each block having an ostensible location identifier, the data blocks being stored in the memory at locations identified by actual location identifiers, each actual location identifier being associated with an ostensible location identifier, wherein at least one actual location identifier differs from its associated location identifier.

Brief description of the drawings

[034] An embodiment or embodiments of the present invention will now be described, by way of example only, with reference to the accompanying drawings, in which:

[035] Figure 1 is a block diagram representing some of the functional elements of a computer controlled gaming machine;

[036] Figure 2 is a conceptual diagram illustrating the principle of the invention;

[037] Figure 3 illustrates the layout of data in memory;

[038] Figure 4 illustrates the rearrangement of some blocks of data in a memory.

[039] Figure 5 is a flow diagram illustrating an embodiment of an operation implementing the address shifting method.

[040] Figure 6 illustrates a data retrieval operation.

Detailed description of the embodiments of the invention

[041] The invention will be described with reference to the accompanying drawings.

[042] Figure 1 is a conceptual block diagram illustrating a computer controlled apparatus such as an electronic gaming machine.

[043] A processor 102 is connected to a memory 104, a boot ROM 106, and bus 110 via a bridge 108. Other devices such as peripherals 1 12, disk 114, and compact flash memory port 118 may be connected to the bus. A compact flash memory 116 is connectable to the compact flash port 118 and includes data stored in blocks. A mapping table identifying the ostensible addresses of the data blocks is also stored in the compact flash memory 1 16, In accordance with the invention, one or more of the addresses are altered so that they do not indicate true address of the associated data. In one embodiment, the changed addresses can indicate blank or unused blocks.

[044] Where only some of the addresses are to be changed, the addresses to be changed can be chosen to provide a high degree of security by preventing access to critical data associated with those addresses.

[045] Figure 2 illustrates the concept of the invention. Data Dj to D_n is stored in blocks 208 of data store 204. The notional addresses of the data blocks Ai to A_n are shown in column 206, so that the address subscripts would normally correspond with the data with the same subscript. However, in accordance with an embodiment of the invention, the addresses of the data blocks have been changed by the use of an algorithm or other suitable means. For the purposes of illustration in this example, it is assumed that the data addresses of the data have been inverted, so that address Ai points to data the data D_n, and so on, so that A_n points to Di.

[046] Thus, in the absence of a means for coordinating the addresses, such as an address concordance or reverse algorithm, when the processor calls for data located at address A₂ to and expects to receive data D₂ , it will receive data D_{n- 1}.

[047] The invention provides a means for reversing the address changes to enable access to the correct data. This is illustrated conceptually in Figure 2 by the address conversion table 202 which is illustrated with a first column of addresses 210, and a corresponding second set of addresses 212. The first column of addresses 210 corresponds to the address from which the system is seeking to retrieve the data. However, because the addresses have been changed, it is necessary to convert these addresses to actual addresses where the required data is stored. Thus, the address in column 212 is substituted for the address in column 1, and the correct data can be retrieved using the address in column 212. Thus a call for A'2 in column 210 translates to A"_n-i in column 212 and this points to the block whose address is A_n-I in column 206. [048] While Figure 2 illustrates a lookup table to provide the correct address, other means of changing the data and deriving the required address can be used. For example, the address can be changed by the use of a first algorithm, and the correct address can be derived from the changed address by a second algorithm which reverses the change produced by the first algorithm. For example, the first algorithm may add a certain number to the address, and the second algorithm can then deduct that number to provide the correct address.

[049] Preferably, the means to reverse the address changes is encrypted.

[050] The addresses can be implicit.

[051] Figure 3 shows a memory map which is arranged in an ordered sequence.

[052] Figure 4 shows a memory map which has been changed in accordance with an embodiment of the invention.

[053] Figure 5 is a flow diagram illustrating an operation implementing the address shifting method embodying the invention.

[054] The BIOS or operating system initially verifies the disk at 502.

[055] The operating system then searches for the encrypted remapping table at 504.

[056] The operating system then reads the encrypted remapping table and decrypts it at 506. The remapping table of Figure 4 is an example of the decrypted remapping table.

[057] The decrypted table is then verified at 508 and, if it fails, the operating system stops processing at 510.

[058] If the decrypted table is verified, the operating system stores the table for use in the reading process at 512.

[059] Figure 6 illustrates a data retrieval operation.

[060] The operating system requests disk sector read from device driver at

602. The read request is directed to sector 3 at 604, which is translated using the remapping table to 24124 at 606, i.e., the third row of the remapping table in Figure 4 and read at 608. [061] Where ever it is used, the word "comprising" is to be understood in its

"open" sense, that is, in the sense of "including", and thus not limited to its "closed" sense, that is the sense of "consisting only of. A corresponding meaning is to be attributed to the corresponding words "comprise", "comprised" and "comprises" where they appear.

[062] It will be understood that the invention disclosed and defined herein extends to all alternative combinations of two or more of the individual features mentioned or evident from the text. All of these different combinations constitute various alternative aspects of the invention.

[063] While particular embodiments of this invention have been described, it will be evident to those skilled in the art that the present invention may be embodied in other specific forms without departing from the essential characteristics thereof. The present embodiments and examples are therefore to be considered in all respects as illustrative and not restrictive, and all modifications which would be obvious to those skilled in the art are therefore intended to be embraced therein.

Claims

1. A method of protecting electronic gaming machine data from unauthorized access, the data being stored in blocks in the memory, each block having a corresponding address, the method including the steps of: changing the address of one or more data blocks; and providing a reversible process for reversing the change of address.

2. A method as claimed in claim 1, wherein the reversible process includes changing the addresses using an algorithm.

3. A method as claimed in claim 1, wherein the reversible process includes a tabular translation.

4. A method as claimed in any one of claims 1 including the step of encrypting at least part of the reversible process is protected by encryption.

5. A method as claimed in claim 4, including the step of providing a decryption key to decrypt the encrypted part of the reversible process.

6. A method as claimed in claim 5, wherein the decryption key is a public key.

7. A method as claimed in claim 1 wherein the addresses are implicit addresses.

8. A method of protecting electronic gaming machine data from unauthorized access, the data being stored in blocks in the memory, each block having a corresponding address, the method including the steps of: rearranging the location of at least some of the data blocks relative to corresponding ostensible location identifiers associated with each block.

9. A method of protecting electronic gaming machine data from unauthorized access, the data being stored in blocks in the memory, each block having a corresponding address, the method including the steps of: preparing an address concordance including a first address table corresponding to first location identifiers of the data and a second address table including second location identifiers; each second location identifier being associated with a first location identifier, wherein one or more of the second location identifiers is changed to differ from its associated first location identifier,

10. A method of protecting electronic gaming machine data from unauthorized access, the data being stored in blocks in the memory, each block having a corresponding address, the method including the steps of: providing an address concordance having a first list of first location identifiers and a second list of second location identifiers; at least one location identifier in the second list of identification identifiers; each second location identifier being associated with a first location identifier; at least one second location identifier differing from its associated first location identifier; and storing data in accordance with the second list of identification identifiers.

11. A method as claimed in claim 10 wherein the memory is a flash memory.

12. A method as claimed in claim 10 including the step of adding a digital signature the encrypted reversible process.

13. A method as claimed in claim 10 including the step of adding a checksum associated the data.

14. A method as claimed in claim 13, wherein the checksum is associated with at least one block of data.

15. A method as claimed in claim 13, wherein a block checksum is associated with each block of data.

16. A method as claimed in claim 13, wherein an overall checksum is formed by the addition of the block checksums.

17. A protected memory arrangement including a memory in which data is stored in blocks, each block having an ostensible location identifier, the data blocks being stored in the memory at locations identified by actual location identifiers, each actual location identifier being associated with an ostensible location identifier, wherein at least one actual location identifier differs from its associated location identifier.