Office of Liquor Gaming and Regulation Principles for Remotely Upgradeable Gaming Machines Version (draft)

Transcription

1 Department of Employment, Economic Development and Innovation Office of Liquor Gaming and Regulation Principles for Remotely Upgradeable Gaming Machines Version (draft)

2 The State of Queensland, Department of Employment, Economic Development and Innovation, Copyright protects this publication. The State of Queensland has no objection to this material being reproduced but asserts its right to be recognised as author of its original material and the right to have its material remain unaltered. Inquiries should be addressed to The information contained herein is subject to change without notice. The copyright owner shall not be liable for technical or other errors or omissions contained herein. The reader/user accepts all risks and responsibility for losses, damages, costs and other consequences resulting directly or indirectly from using this information. Enquiries about reproduction, including downloading or printing the web version, should be directed to or telephone OLGR Technical Unit is independently certified to ISO 9001:2008 by SAI Global Ltd Principles for Remotely Upgradeable Gaming Machines Version draft 2

3 Contents 1 Introduction 4 2 Glossary / Abbreviations 4 3 Principals 5 4 Revision History 13 Principles for Remotely Upgradeable Gaming Machines Version draft 3

4 1 Introduction Purpose To propose and publish possible technical frameworks for remotely upgradeable Electronic Gaming Machines for the purpose of eliciting industry feedback and comments, with the long term objective of laying the foundation for remotely upgradeable Electronic Gaming Machines or similar devices. Scope This document may be of interest to any organisations with an interest in electronic gaming manufacturing, operation or regulation. A working technical knowledge of Electronic Gaming Machines, protocols, Public Key Encryption techniques, infrastructures and the X509 and PGP standards is required in order to fully understand all the concepts proposed in this document. 2 Glossary / Abbreviations Central Monitoring System Operator (CMS Operator) In Queensland clubs and hotels, it is the gaming venues Licensed Monitoring Operator (LMO). In Queensland Casinos., it is the casino operator. Electronic Gaming Machine (EGM) Standard industry definition applies. However, in this document the abbreviation EGM can also be taken to refer to any type of electronic jackpot or prize triggering device used for gaming. Game Content In this document, Game Content refers to any type of data that an EGM may utilise as software, graphics or sound, or any for other purpose. Game Content Provider (GCP) Game Content Provider refers to organisation(s) that will be authorised to physically download EGM upgrades or new game content into EGMs. Game Content Computer (GCC) Game Content Computer refers to any computer/server which stores EGM software locally at a gaming venue until subsequently downloaded to the EGMs. A GCC may or may not be required depending on the GCP. Principles for Remotely Upgradeable Gaming Machines Version draft 4

5 3 Principals The most important item this document tries to propose at this time is an additional new gaming venue LAN topology for supporting remotely upgradeable EGMs. The following diagram outlines a proposed new EGM network topology to facilitate the download of new game content to remotely upgradeable capable EGMs. Please refer to the above diagram when reading the remainder of this document. 3.1 The LAN To support the possible increased demand on bandwidth required by remotely upgradeable EGMs, a new LAN which will be specified by the OLGR which all Game Content Providers will share and use for the purpose of delivering new or upgraded game content to the EGMs. Refer to previous diagram. The intent on having a generic LAN is to minimise cost The LAN will be Ethernet based. The OLGR will approve all LAN content and protocols to ensure a standardised LAN can be maintained It is proposed the new LAN be physically maintained and installed by QLD Licensed Repairers and Service Contractors as this requires no change to the existing regulatory framework. Principles for Remotely Upgradeable Gaming Machines Version draft 5

6 3.1.4 There will be the requirement for remote LAN configuration, QoS control and intrusion monitoring The gaming venue must own the LAN hardware as per the existing QCOM fibre optic LAN Game Content Providers may use any TCP/IP based protocol on the LAN, however all ports utilised must be first approved by the OLGR to ensure there is no contention over port numbers since the network will most likely be shared. In addition, all the content and functionality of the protocols utilised on the LAN must be approved by the OLGR as some content and functionality must be restricted for security and integrity reasons. (For example, it would be unacceptable for a Game Content Provider to upload meters for the gaming venue, or similar statistics, or any data that is not actually the property of the Game Content Provider. Exceptions may be granted in cases where the owner of the data has granted specific permission to do so in writing.) The LAN (where not stated otherwise) must be at least 100 Mb/s (minimum) UTP Ethernet Typically, there should be no more than 24 EGMs per switch UTP cable must be category 5 or better No UTP cable is to be run through ceilings of gaming venues (Fibre optic links must be used in this case). Exemptions may be granted if the gaming venue is considered to have has adequate lightning protection Links between switches must be via fibre optic cable. For example, gigabit single mode or multi-mode fibre ring. All fibre optic cables must be run through vermin resistant conduit Encrypting communication on the LAN is recommended but is not mandatory as the mandated Digital Signatures will provide the required overall security and authentication. Refer following sections in this document for more information. It is a commercial decision for each EGM manufacturer as to whether or not to encrypt packages to be sent to their EGMs The routers and switches shown in the above diagram must be approved by the OLGR under the Machine Gaming Act. Exact requirements will be published at a later date. For example, it is expected that all routers will be remotely configurable and have at least the following built in functionality: NAT, Firewall & QoS There will be some options with regard to the LAN configuration (e.g. such as p2p or ring wiring and equipment). Options chosen will be at the discretion of the Gaming Venue who may make their own decision in this regard based on cost, performance and reliability LAN Intrusion Monitoring Requirements There will be the requirement for the active monitoring of the LAN. All MAC addresses must be authenticated by a trusted party; unauthorised MAC addresses must not be assigned an IP. Communications attempts on closed ports must be logged. All ports must be closed except for those ports approved by the OLGR to be left open. Principles for Remotely Upgradeable Gaming Machines Version draft 6

7 QoS Requirements, The OLGR along with port control will specify the minimum QoS parameters with respect to allowable ports. 3.2 WAN Requirements At this stage requirements in this area are still to be finalised, but it is likely the requirements will be a set of high level principles only. It is intended that more than one type of WAN connection to a gaming venue will be permitted, but for cost reasons, it makes sense to try to build a framework that only requires only WAN connection per venue. Following is a list of mandates that will be used for drafting the set of WAN principles Minimising cost. (i.e. all Game Content Providers sharing the WAN could be a possibility) Connection may be shared by a number of Game Content Providers and organisations. Security is specifically not a factor in the physical wide area delivery of new game content to EGMs, because of the proposed security requirements placed on game content upgrade data described elsewhere in this document. The Gaming Venue must own the WAN connection at the venue if any. The OLGR must have access to the WAN, if any. PSTN must also be supported as this is still the best connection option for many QLD gaming venues. Further to the above, another possible and very cheap and convenient method to facilitate the delivery of new game content to EGMs is via surface delivery. There is no reason why large scale upgrades could not also be performed by the mailing of new or upgraded game content on portable media (such as CD, DVD or flash) directly to the gaming venues. Once received, the gaming venue would simply insert the media into the GCC or EGMs and the upgrade would then occur automatically in accordance with approved arrangements with the gaming venues central monitoring system operator. Depending how frequently upgrades are performed in many cases this would still be cheaper in comparison to a dedicated WAN. Referring to the OLGR audit computers shown in the diagram, it is the intended that OLGR will have access to any WAN used in the delivery of game content to the EGMs, for the purpose of EGM software audits and integrity checks on EGMs as required. Principles for Remotely Upgradeable Gaming Machines Version draft 7

8 3.3 EGM Hardware The EGM must have at least one UTP Ethernet Port. (The port must have extra fast transient protection to at least 4.5kv). Minimum supported speed is 100 Mbit/sec The EGM manufacturer must not physically enable any Ethernet, TCP or IP protocols, on any port in the EGM or allow game or game variation downloads until they have firstly successfully implemented to the OLGR satisfaction, remote upgrades with respect to the EGM s OS/Kernel and base/shell software and that the GCPs are on-line and ready to deliver new game content to the EGMs as required The EGM must utilise electrically re-writable PSDs for all its programs and software. Note that the EGM must also contain enough free space on its PSDs to store its current software set plus a newer version during a download. The PSDs must also still be able to be easily removed from the EGM, or easily directly readable (without running code of the PSDs themselves), for isolated manual verification of the current contents when required for when a higher level of security for verification is warranted EGMs must implement the requirements contained in the OLGR document Electronic Seal Minimum Requirements (v 1.0), 2001, available for download from EGM manufacturers will also be required to securely seal their gaming machine software out of the factory. Refer section 3.5 following for more information With the security imposed on remotely upgradeable EGMs, it is also feasible that EGMs will be allowed to have removable media device interfaces such as CD/DVD/flash drives to allow upgrades to be loaded directly into the EGM for subsequent authentication and activation. The advantage of this is with regard to very small or remote gaming venues With the use of PKE, much longer hashing algorithms and new RAM clear procedures (refer section 3.5.2), it may become a requirement for EGMs to have either a touchscreen otherwise the facility to be able to plug in a keyboard or mouse in order to input data into the EGM (such as lengthy seeds, keys or passwords) in a more timely fashion. 3.4 EGM Software To ensure uninterrupted play, any downloads to the EGM must be performed in background by the EGM while it maintains all other operations, including game-play In regards to Program Hashes, a remotely upgradeable EGM must calculate its overall program hash (as required by QCOM) by calculating an individual hash for every subsystem and game in the EGM and then combining them into an overall program hash result by XOR ing each hash result together. This ensures independence with respect to the order in which the hashes are performed in the EGM which is highly desirable for remotely upgradeable EGMs. 3.5 Security and Authentication The intent of this section is to propose a framework to ensure that all software upgrades downloaded and activated by the EGMs are highly secure and auditable. The requirements which Principles for Remotely Upgradeable Gaming Machines Version draft 8

9 follow are an example of one methodology to illustrate the level of security expected in an EGM with remote upgradeability, but are by no means a mandate at this time. The security is founded upon the use of Public Key Encryption techniques and Infrastructures. It is proposed that all the security regarding new or updated game content delivered to a gaming venue s EGMs will be located in the EGMs. Each EGM will ensure via Digital Signatures that no received downloads can be either activated or permanently stored in the EGM, unless the EGM has successfully authenticated the download with at least two Digital Signatures: one from the OLGR which denotes the content has been approved and one from the EGM manufacturer which authenticates that the content has come from the EGM manufacturer i. Other authorities must be able to be added if required. The methodology used must also securely handle a change of individuals involved in the authorisation of EGM production code. X509 or PGP are examples of an authentication standard that can support this kind of arrangement. At this time, any security implementation not based on X509 or PGP standards or principals is unlikely to be approved. In addition, as the implementation of the above standards is an extremely complicated task and taking into account that there are freely and readily available implementations of X509 & PGP, any organisation not using an implementation of X509 or PGP which does not have a demonstrated track record of secure and reliable operation may not be approved. Using the above proposed methodology, the physical download mechanism to the EGM or GCCs (if present) does not need to be secure, as the EGM will simply not retain or activate any downloads that do not authenticate with the correct Digital Signatures. The LMO via the QCOM Protocol will still be used as the final control as to whether any software on an EGM is enabled or otherwise in clubs and hotels. In the case of casinos, the casino operator will be expected to have a system of control which will ensure that only approved software is enabled and operated. Refer QCOM Version for more information and requirements in this area. One possible example of a methodology for the delivery of authenticated game content for an EGM manufacturer in a secure and accountable manner is: The manufacturer must maintain a root certificate authority in a secure manner to the OLGR s satisfaction which it uses to issue certificates to its personnel. A Software Engineer or game designer working for a manufacturer completes some production code, or new game content. They sign their deliverable content package with their private key/certificate. A peer reviews the content and if ok then they also sign the code. Similarly the individual at the manufacturer s testing department does the same. Other authorities within the EGM manufacturer may also sign the production code/package as seen fit. It must be clear (by means of a signed declaration) that each individual understands what every piece of content they sign means. Once the code is approved for use the code is submitted with all signatures attached to a trusted computer or entity * that verifies the signatures. If ok, the trusted computer or i Concept first publicly published by the OLGR in the Jackpot System Min. Req. Document v1.0 released 9/2000. Principles for Remotely Upgradeable Gaming Machines Version draft 9

10 entity then issues the code package with a final Digital Signature for the EGM manufacturer. *The trusted computer or entity that the EGM manufacturer uses to produce signed production code packages would have to be approved and sealed by the OLGR. This entity must also have the facility (in conjunction the OLGR s authorisation and authorised EGM personnel), to securely and revoke or add new authorised users. This trusted computer or entity could also lie with a trusted 3rd party or regulator. There are many options here. Another issue to be addressed by the EGM manufacturer is the process of securely installing an EGM s initial OS, or kernel, or bootstrap, or base production code onto a new production EGM and sealed by the EGM manufacturer with no opportunity for compromise on the production line or anywhere else in the process. There are a number of possible solutions to this issue and each manufacturer must come up with a secure, solution to the OLGR s satisfaction. In the solution there must be no single individual with the ability to substitute or alter approved production code that is installed onto the EGMs. The solution must be scalable in that any number of arbitrary individuals can sign off on the installation and sealing as required and it must take into account that individual persons in the process will change. The solution must be auditable. The process must have accountability in that all signatories must not be anonymous. The OLGR will be setting up its own X509 root certificate authority or equivalent in PGP which it will use to issue to issue the appropriate certificates for the purpose of signing approved content for download to EGMs. In some high risk cases, the OLGR will also wish to authenticate and issue certificates for particular individual gaming devices such as EGMs and Jackpot Triggering Devices. It will be a requirement that the Game Content Provider will securely issuing individual certificates for each EGM out of the factory Physical Security of EGM Production Code. The EGM manufacturer s approved systems controls will also have to be enhanced. Physical code security must be maintained right up until commissioning and a Licensed Repairer places their seal on the EGM. The EGM manufacturer must provide updated controls to the OLGR s satisfaction that ensures any potential harm to the EGM s approved production code, as a result of an attack from any source, has no possibility of success without detection or collusion on the part of multiple parties. In control systems where there is a human element in the delivery of production code, it is expected that no-less than two individuals must collude in order to compromise code delivered in EGMs software. (More may be required depending of the overall risk ($) associated with the EGM s application code) Under no circumstances, at any time may a single individual be in a position to compromise the code delivered in or to an EGM in the field (and assuming that all individuals have full technical capability in order to produce unauthorised code for the EGMs). Another case that will have to be covered in EGM manufacturer s internal controls will be the replacement of a non-serviceable sealed processor board of existing EGM in the field. Same requirements as commissioning will apply. To facilitate all this, EGM manufacturer will have to start sealing processor boards out of the factory with a manufacturer s seal. Existing requirements may have to change in order to allow a processor board to be removed from an EGM without breaking the seal, as the intent behind the old requirement of sealing processor boards into the overall EGMs becomes obsolete in a system Principles for Remotely Upgradeable Gaming Machines Version draft 10

11 utilising PKE technology for software authentication and where mechanical meters are not being utilised EGM RAM Clears In EGMs capable of remote upgrades, physical seal breaks will only be performed on EGM as a result of either a total software or hardware failure inside the sealed cabinet area. Accordingly RAM clears in these EGMs will be instigated via minor addition to the QCOM protocol and require secure authentication via Digital Signatures before the EGM will accept a RAM clear command. One example of a proposed RAM clear process could be:- -> Monitoring System sends a RAM clear request to an EGM. <- The EGM will respond with a randomly chosen RAM clear authority code (this prevents re-use of RAM clear command following). -> Monitoring System makes RAM occur by sending a signed message containing the EGM s MID & serial number plus the EGM generated random authority code. The EGM will then clear its RAM provided the message s digital signature successfully authenticates. It will be possible to securely RAM clear an EGM via the new Ethernet LAN, via the QCOM protocol, or via audit mode on the EGM (using a similar RAM clear password entered into the EGM directly). 3.6 Game Content Computers The following requirements are only applicable to Game Content Providers whose remotely upgradeable EGMs require a Game Content Computer The GCC must utilise the LAN as specified in this document for the transfer of game content and other software upgrades to the EGMs in order to minimise cost The GCC must be an industrial type computer with a high maximum ambient operating temperature with adequate cooling and thermal protection, preferably located in one of the manufacturers EGMs or EGM consoles. Adequate ventilation and cooling must be provided for the GCC wherever it is located. In some cases ventilation fans will be added to consoles where required. It is preferred if GCCs are passively cooled devices in order to reduce maintenance costs. The reason for the preferred location of GCCs inside the EGM consoles is because space is a serious issue at many gaming venues. For example in a multi-game Content Provider environment where the GCCs were all desktop PCs, then a gaming venue could theoretically have to provide a location and suitable operating environment for numerous computer servers, possibly one for each Game Content Provider. Many gaming venues simply do not have the space to locate numerous servers. In some cases finding a suitable location for the existing EGM Site Controller used for EGM monitoring is difficult enough. Principles for Remotely Upgradeable Gaming Machines Version draft 11

12 3.6.3 GCCs must be remotely upgradeable by the Game Content Provider If a GCC or Game Content Providers host system is required to interact with gaming venue staff, then this must be via the Gaming Venue s own PC, preferably via the internet via an GUI application (typically a web browser) running on the Gaming Venues PC. Intent behind this requirement is twofold. 1. The gaming venue s PC is high risk from a security standpoint and therefore should be kept off the EGM LAN networks. 2. The space saving intent re section also applies A failure of a GCC at any time must not affect the continued operation of the EGMs. 3.7 Other Requirements To ensure critical patches can be applied in a timely manner, Game Content Providers must be capable of upgrading their entire download capable EGM s within 12 hours of an approval of a new EGM OS/Kernel and base/shell software by the OLGR Also refer to the QCOM Protocol document version regarding the section on remotely upgradeable EGMs Remote upgrades to EGM peripherals are also acceptable and encouraged. E.g. note acceptor, coin acceptor & jackpot display systems etc. This functionality could be delivered by either the Game Content Provider or the EGM manufacturer s EGM using a subset of the same principles outlines in this document EGM manufacturer s internal controls must be updated to include the following additional items and must be approved by the OLGR: EGM manufacturer X509/PGPsecurity procedures and controls The Game Content Provider s internal controls must be updated to include the following additional items and must be approved by the OLGR: GCC WAN software version and control. EGM manufacturer GCC host computer software maintenance and controls. Principles for Remotely Upgradeable Gaming Machines Version draft 12

13 4 Revision History Version Changes QIR Who Release Incept Date Date 1.0 Initial Draft RL 6/2005 N/A 1.1 Defined Game Content Provider RL DRAFT N/A 1.2 All document versions starting from v1.2 and onwards were made publicly available for industry feedback. Added proposed Network Hierarchy diagram. Minor corrections, clarifications. Added concept re Aust Post as a WAN RL 21/02/2006 N/A 1.3 Proposed the use of the X509 and PGP standards. RL 22/11/2006 N/A Updated to new DEEDI report document template QOGR->OLGR YL 20/08/2010 * Where not stated otherwise the incept date for new or changed minimum requirements in this version of the document is x months from the release date of the document in <clarify if only new submissions or everything> Todo Make generic (Separate out EGM specific requirements and make doc generic gaming equipment ) i.e. not specific to EGMs. Principles for Remotely Upgradeable Gaming Machines Version draft 13