JP2008112297A - Electronic device, program and recording medium - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To avoid update to a program not based on a security standard. <P>SOLUTION: A CPU 1 of an MFP 100 acquires an update program from an external device 26 or the like on a network 25, decides whether the update program and an update target program installed to the MFP 100 are respectively based on the prescribed security standard or not, and prohibits the program update when a decision result thereof shows that the update target program is based on the security standard and that the update program is not based on the security standard. In that case, the CPU 1 notifies the outside about the effect, or notifies the outside about inquiry information about whether to continue the program update or not. The program update is continued when an instruction to continue the program update is performed to the notification, and the program update is stopped when an instruction to stop the program update is performed. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to an electronic apparatus such as a digital copying machine, a printer (hereinafter also referred to as “LP”), a facsimile apparatus, a digital multifunction peripheral (hereinafter also referred to as “MFP”), and a computer (CPU) for controlling the electronic apparatus. The present invention relates to a program to be executed and a computer-readable recording medium on which the program is recorded.

In recent years, with the security consciousness, in the image forming apparatus market such as MFP / LP, there has been a movement to secure security of products by formulating a security standard in which a certain security requirement is compiled by each vendor or a plurality of vendors.
On the other hand, image forming apparatuses are capable of updating firmware and application programs (hereinafter also simply referred to as “applications” or “applications”) after being put on the market. Many of such programs (software) are composed of, for example, a plurality of modules (see, for example, Patent Document 1).
JP-A-2005-301968

  However, in such an image forming apparatus, when a non-compliant update program (new program) is installed in an image forming apparatus in which a program (update target program) that complies with security standards is installed. The following problems arise.

In other words, even in an image forming apparatus whose safety has been guaranteed in conformity with the security standard (hereinafter simply referred to as “security standard”), the program to be updated in units of programs or modules by installing the update program. Is updated (changed) into an update program, and when the update program is executed, there is a problem that the security standard is not satisfied and the safety is not guaranteed.
The present invention has been made in view of the above problems, and an object of the present invention is to avoid an update to a program that does not comply with security standards in an electronic apparatus such as an image forming apparatus.

In order to achieve the above object, the present invention provides an electronic device, a program to be executed by a computer that controls the electronic device, and a computer-readable recording medium on which the program is recorded.
An electronic apparatus according to a first aspect of the present invention is an electronic apparatus having update program acquisition means for acquiring an update program and program update means for performing program update to the update program acquired by the update program acquisition means as follows: It is characterized by that.

That is, security compliance determination means for determining whether or not the update program acquired by the update program acquisition means and the update target program installed in the electronic device comply with specified security standards, and the security compliance determination The determination result of the means is a program update prohibiting means for prohibiting program update by the program update means when the update target program conforms to the security standard and the update program does not comply with the security standard; Is provided.
An electronic device according to a second aspect of the present invention is the electronic device according to the first aspect, further comprising a program update prohibition notification means for notifying the outside when a program update is prohibited by the program update prohibition means. is there.

  The electronic device according to the invention of claim 3 notifies the outside of the electronic device of claim 1 or 2 inquiry information as to whether or not to continue the program update when the program update prohibition means prohibits the program update. Inquiry information notifying means for performing the program update, and when instructed to continue the program update from the outside, the program update means is provided if the program update means is instructed to continue the program update and stop the program update. Is provided with program update control means for stopping the program update.

According to a fourth aspect of the present invention, there is provided an electronic apparatus according to any one of the first to third aspects, wherein communication means for connecting to a network is provided, and the update program acquisition means acquires the update program by the communication means. To do.
An electronic device according to a fifth aspect of the present invention is the electronic device according to any one of the first to fourth aspects, wherein the update program acquisition unit includes an update program that has not been acquired after the program update unit performs the program update. If there is an update program, the update program is acquired.

  According to a sixth aspect of the present invention, there is provided a program for an update program acquisition function for acquiring an update program in a computer for controlling an electronic device that performs control by executing the program, and a program for the update program acquired by the update program acquisition function means. Program update function for performing update, and security compliance determination function for determining whether the update program acquired by the update program acquisition function and the update target program installed in the electronic device comply with specified security standards. When the update target program conforms to the security standard and the update program does not conform to the security standard, the program update function updates the program using the program update function. Is a program for realizing the program update prohibition function to stop.

The program according to the invention of claim 7 also realizes a program update prohibition notification function for notifying the outside of the program in the program of claim 6 when the program update prohibition function is prohibited by the program update prohibition function. It is a program to make it.
A program according to an eighth aspect of the invention is the program according to the sixth or seventh aspect, wherein when the program update is prohibited by the program update prohibition function, the computer receives external inquiry information as to whether or not to continue the program update. If there is an inquiry information notification function for notifying the program and an instruction to continue the program update from the outside, the program update function is continued, and if the instruction to stop the program update is given, the program This is a program for realizing a program update control function that causes the update function to stop program update.

A program according to a ninth aspect of the invention is a program according to any one of the sixth to eighth aspects, wherein the computer also realizes a communication function for connecting to a network. The update program is acquired by the communication function.
A program according to a tenth aspect of the invention is the program according to any one of the sixth to ninth aspects, wherein the update program acquisition function checks whether there is an unacquired update program after the program update is performed by the program update function. If there is the update program, the update program is acquired.
A recording medium according to an invention of claim 11 is a computer-readable recording medium on which the program according to any one of claims 6 to 10 is recorded.

  According to the present invention, the electronic device determines whether or not the acquired update program and the update target program installed in the electronic device comply with specified security standards, and the determination result is the update target. When the program conforms to the security standard and the update program does not conform to the security standard, the program update is prohibited, so that an update to a program that does not conform to the security standard can be avoided.

  Hereinafter, the best mode for carrying out the present invention will be specifically described with reference to the drawings. In this embodiment, an example will be described in which an image forming apparatus, in particular, an MFP (digital multifunction peripheral) having a plurality of functions such as a copying machine, a scanner device, a printer, and a facsimile device is used as an electronic device.

[Hardware configuration example of MFP]
First, a hardware configuration example of an MFP according to an embodiment of the present invention will be specifically described with reference to FIG.
FIG. 1 is a block diagram showing a hardware configuration example of an MFP according to an embodiment of the present invention.

In this MFP 100, the CPU 1 controls the entire MFP 100, and under the control, the ROM 2, RAM 3, NV-RAM 4, panel control unit 5, engine control unit 6, disk driver 7, modem 8, external interface (hereinafter referred to as "the interface"). An “interface” is abbreviated as “I / F”) 9 and a communication control unit 10 are connected via a data bus 11.
The ROM 2 is a read-only memory that stores programs including a boot loader (boot program), fonts, and other static data.

The RAM 3 is a readable / writable memory used as a temporary storage location, that is, a work memory in which the CPU 1 performs data processing, an application memory that stores an application (application program) described later, a firmware memory that stores firmware, and the like.
The NV-RAM 4 is a non-volatile memory that stores data such as various parameters.
The panel control unit 5 controls an interface with the operation panel (operation unit) 21. The panel control unit 5 and the operation panel 21 serve as an interface with the user.
The engine control unit 6 constitutes an input / output unit for image data together with the scan / print engine 22, and controls the scan / print engine 22 to execute reading of a paper document and printing on a sheet (transfer sheet). .

  The disk driver 7 controls reading and writing of data with respect to the storage device 23 such as a hard disk, and can write and accumulate a large amount of image data in the storage device 23 and read it out as necessary. The storage device 23 can also be used as a storage location for an OS (operating system), applications, firmware, databases, and the like. In this embodiment, it is assumed that the OS, application, and firmware are stored in the storage device 23. These programs (software) are given an electronic signature encrypted with a security standard compliant key. However, when one program is composed of a plurality of modules, an electronic signature encrypted with a security standard compliant key is assigned to each module.

The modem 8 is a communication means, and is connected to a public line and can communicate with an external device having a modem (not shown).
The external I / F 9 is a communication unit, and interfaces with an external storage medium such as an SD card or an external device 24 such as a PC (personal computer) using an interface such as USB, IEEE 1394, Centronics, or RS-232C. be able to.
The communication control unit 10 is connected to a network 25 such as Ethernet (registered trademark) and can communicate with an external device 26 such as a PC.
The data bus 11 can perform communication between various devices and between the CPU 1 and devices.

  Here, when the MFP 100 is powered on, the CPU 1 reads the OS in the storage device 23 according to the boot loader in the ROM 2, loads it into the RAM 3, expands it, and then activates the OS. Furthermore, other programs such as applications and firmware in the storage device 23 are loaded into the RAM 3 and expanded as necessary. Then, the program in the RAM 3 is executed as necessary, and the apparatus including the operation panel 21 is controlled to obtain an update program acquisition unit, a program update unit, a security standard determination unit, a program update prohibition unit, a program update prohibition notification. Functions as means, inquiry information notification means, and program update control means can be realized.

Examples of applications include a copy application, a printer application, a FAX (fax) application, and a scanner application.
The copy application is for realizing a copy function. The copy function is to cause a scanner engine (a part of the scan / print engine 22) to read an image of an original and send the image information to the printer engine of the scan / print engine 22 (a part of the scan / print engine 22). This is a function for printing as a visible image on paper.
The printer application is for realizing a printer function. The printer function is a function of printing information from a PC (not shown) as it is or after performing conversion processing and sending it to a printer engine to print it as a visible image on paper.

The FAX application is for realizing a FAX function. The FAX function causes the scanner engine to read an image of an original and transmits the image information by FAX to a preset external device or the image information stored in the storage device 23 to a preset external device in the same manner. This is a function for performing FAX transmission, receiving image information transmitted by FAX from an external device and storing it in the storage device 23, or sending it to a printer engine to print it as a visible image on paper.
The scanner application is for realizing a scanner function. The scanner function is a function of causing the scanner engine to read an image of a document, and of course transmitting (distributing) image information of the read document to an external device set in advance by e-mail or file transfer.

[Configuration example of program update control system in MFP]
Next, a configuration example of a program update control system in MFP 100 shown in FIG. 1 will be specifically described with reference to FIG.
FIG. 2 is a block diagram showing a configuration example of a program update control system in MFP 100 shown in FIG. For convenience, it is assumed that the program itself performs processing.

This program update control system includes a program update module 31, a program determination module 32, a program storage area 33, and an update program 34.
When the program update module 31 acquires an update program (a program such as the latest version installed in the MFP 100) from the external devices 24 and 26 on the network 25 or an external storage medium (external device 24) such as an SD card, the program update module 31 updates the program. This is a program for updating a program.

The program determination module 32 determines whether or not the acquired update program 34 and the update target program installed in the MFP 100 (currently updatable program) comply with specified security standards. It is a program.
The program storage area 33 is a program storage destination and corresponds to the storage device 23 and the like.
The update program and the update target program are various programs such as an OS, an application, and firmware. For convenience of illustration, here, the update program and the update target program are a plurality of applications such as a copy application, a printer application, a FAX application, and a scanner application.

[Functional configuration example of MFP in this embodiment]
Next, a configuration example of the program determination module 32 in FIG. 2 will be specifically described with reference to FIG.
FIG. 3 is a block diagram illustrating a configuration example of the program determination module 32 of FIG.
The program determination module 32 includes a program reading unit 41, a signature / decryption key reading unit 42, a security standard compliance determining unit 43, and an electronic authentication library 44.

The program reading unit 41 is responsible for reading a program object that is a program stored in the storage device 23 of the MFP 100 or an external storage medium (external device 24) such as an SD card and its signature information (electronic signature). The reading unit 42 is responsible for reading it from a storage medium in which a security standard conforming key, which is a signature decryption key (key information holding an electronic signature), is stored.
The security standard conformity determination unit 43 receives information obtained by the program reading unit 41 and the signature decryption key reading unit 42, performs electronic authentication, and determines whether the target program conforms to the security standard. Take responsibility.
The electronic authentication library 44 is a library that actually performs electronic authentication and returns a result.

[Processing related to program update in MFP]
Next, processing related to program update in MFP 100 shown in FIG. 2 will be specifically described with reference to FIG.
FIG. 4 is a flowchart illustrating an example of processing related to program update in MFP 100.

The program update module 31 of the MFP 100 first obtains an update program in step S1, and uses the program determination module 32 in step S2 to determine whether or not the update target program in the program storage area 33 complies with security standards. To do.
If it is determined in step S3 that the update target program does not comply with the security standard, the update program is installed in the program storage area 33 in step S8 regardless of whether the update program conforms to the security standard. Then, program update (update target program → update program) is executed. Thereby, when the update program conforms to the security standard, the program after the update execution satisfies the security standard. If the update program is not compliant with the security standard, the security standard of the program after the update execution remains noncompliant.

If it is determined in step S3 that the update target program conforms to the security standard, it is determined in step S4 whether the update program conforms to the security standard using the program determination module 32.
If it is determined in step S5 that the update program conforms to the security standard, the program is updated in step S8. As a result, the updated program will continue to meet security standards.
If it is determined in step S5 that the update program does not comply with the security standards, the program update is not executed (program update is stopped), and the program cannot be updated in step S6 as shown in FIG. ) To the outside.

In this notification example, since the update program (FAX application) does not comply with the security standards, a “confirm” key is displayed on the operation panel 21 together with a message that the program cannot be updated.
The display is deleted when the content of the message is confirmed by the user and the “confirm” key is pressed.
After canceling the program update and notifying the outside that the program cannot be updated, or after executing the program update, the presence or absence of an unacquired update program (module) is checked in step S7. The program is acquired, and thereafter the same processing as described above is performed. When all the update programs have been acquired and there are no unacquired update programs, the processing in FIG. 4 ends.

Next, the determination as to whether or not the update target program and the update program in steps S2 and S4 in FIG. 4 comply with security standards will be described with reference to FIG.
FIG. 5 is a flowchart showing an example of processing by the program determination module 32 of FIG. 2 (processing related to determination of whether or not the update target program and the update program comply with security standards in steps S2 and S4 of FIG. 4). is there.

  The program determination module 32 of the MFP 100 first reads the determination target program in step S11 in order to determine compliance with security standards. The read destination is instructed by the program update module 31. If the target program is an update target program already installed in the MFP 100, it is read from the program storage area 33. If the target program is an update program, it is read out.

  If reading of the program is completed, the signature decryption key is read out in step S12. Since the key information is information that needs to be stored in a storage device (not shown) in the MFP 100 that is securely managed (cannot be taken out of the MFP 100), a dedicated LSI for increasing the security strength of the MFP 100 A security chip (TPM: Trusted Platform Module) or the like is a suitable storage device. There, a signature decryption key for security standard conformance (security standard conformity key) is stored in advance, and is read out when necessary. Note that the signature decryption key may be stored in an external device on the network 25, not on the control board of the MFP 100, as long as it can be secured.

Next, in steps S13 and S14, the read information is used as an input parameter, and electronic authentication of the electronic signature is executed using the electronic authentication library 44. The electronic authentication is performed using a signature decryption key for security standard compliance.
That is, first, in step S13, electronic authentication is performed with a security standard conforming key (signature decryption key), and in step S14, it is determined whether the electronic authentication has succeeded or failed.

When electronic authentication is successful with the security standard conforming key, it can be determined that the target program is a program that conforms to the prescribed security standard.
If electronic authentication fails with a security standard conforming key, it can be determined that the target program is not a program that complies with the specified security standard.
When electronic authentication is performed using a security standard conforming key, a process of decrypting an electronic signature attached to the program using the security standard conforming key is performed.

Next, another example of processing related to program update in MFP 100 shown in FIG. 1 will be specifically described with reference to FIG.
FIG. 7 is a flowchart illustrating an example of processing related to program update in MFP 100.
The program update module 31 of the MFP 100 performs the same processes as steps S1 to S5, S7, and S8 shown in FIG. 4 in steps S21 to S25, S28, and S29.

If it is determined in step S25 that the update program does not comply with the security standard, in step S26, inquiry information as to whether or not to continue the program update is notified to the outside as shown in FIG.
In the notification example, the update program (FAX application) does not comply with the security standards, but a “continue” key and a “stop” key are displayed on the operation panel 21 together with an inquiry message as to whether or not to continue the program update. It is a thing.

When the program update module 31 of the MFP 100 is instructed to continue the program update from the outside in step S27 (when the “Continue” key is pressed in the example of FIG. 8), the program update module 31 continues the program update, and step S29. Then, the update program is installed in the program storage area 33 and the program update (update target program → update program) is executed. As a result, if the update program is not compliant with the security standard, the security standard of the program after the update execution is non-compliant even if the security standard of the program before the update execution is compliant.
If an instruction to stop the program update is given from the outside in step S27 (in the example of FIG. 8, the “stop” key is pressed), the program update is not executed (program update is stopped).

According to the MFP of this embodiment, the following effects (1) to (3) can be obtained.
(1) It is determined whether the acquired update program and the update target program installed in the MFP comply with the prescribed security standards, and the determination result indicates that the update target program conforms to the security standards, In addition, when the update program does not comply with the security standard, it is possible to avoid updating to a program that does not comply with the security standard by prohibiting the program update. Therefore, a decrease in security can be avoided.

(2) When the program update is prohibited, the user can know that the program could not be updated by notifying the outside of the fact.
(3) When program update is prohibited, inquiry information on whether or not to continue program update is notified to the outside, and when an instruction to continue program update is given, program update is continued and program When an instruction to cancel the update is given, the user convenience is improved by canceling the program update.
(4) After updating the program, check whether there is an unacquired update program, and if there is an update program, acquire the update program to obtain all the update programs and update the program. Can be completed.

The embodiment in which the present invention is applied to the MFP has been described above. However, the embodiment of the present invention is not limited to this, and other image forming apparatuses such as a single digital copying machine, a printer, and a facsimile machine, as well as a scanner device. It can be applied to various electronic devices such as personal computers.
[Program in this embodiment]
This program is stored in a CPU (computer) that controls an electronic device such as an MFP, an update program acquisition unit, a program update unit, a security standard determination unit, a program update prohibition unit, a program update prohibition notification unit, an inquiry information notification unit, and a program This is a program for realizing the update control means, and the above-described effects can be obtained by causing the CPU to execute such a program.

Such a program may be stored in a storage means such as a ROM or a hard disk from the beginning, but a non-volatile recording medium (memory such as a CD-ROM or flexible disk, SRAM, EEPROM, memory card or the like as a recording medium). ) Can be recorded and provided. The above-described procedures can be executed by installing the program recorded in the nonvolatile recording medium in the MFP and causing the CPU to execute the program, or by causing the CPU to read and execute the program from the nonvolatile recording medium. .
Furthermore, it is also possible to download and execute an external device that is connected to a network and includes a recording medium that records the program, or an external device that stores the program in the storage unit.

  As is apparent from the above description, according to the present invention, it is possible to avoid updating to a program that does not comply with the security standards in the electronic device. Therefore, if this invention is utilized, a more reliable electronic device can be provided.

1 is a block diagram illustrating a hardware configuration example of an MFP according to an embodiment of the present invention. FIG. 2 is a block diagram showing a configuration example of a program update control system in MFP 100 shown in FIG. 1. FIG. 3 is a block diagram illustrating a configuration example of a program determination module 32 in FIG. 2. FIG. 2 is a flowchart showing an example of processing related to program update in MFP 100 shown in FIG. 1.

It is a flowchart which shows an example of the process by the program judgment module 32 of FIG. It is a figure which shows the example of notification of a program update impossibility. FIG. 10 is a flowchart showing another example of processing related to program update in MFP 100 shown in FIG. 1. It is a figure which shows the notification example of the inquiry information whether a program update is continued.

Explanation of symbols

1: CPU 2: ROM 3: RAM 4: NV-RAM 5: Panel control unit 6: Engine control unit 7: Disk driver 8: Modem 9: External I / F
10: Communication control unit 11: Data bus 21: Operation panel 22: Scan / print engine 23: Storage device 24, 26: External device 25: Network 31: Program update module 32: Program determination module 33: Program storage area 34: Update Program 41: Program reading unit 42: Signature decryption key reading unit 43: Security standard compliance determination unit 44: Electronic authentication library 100: MFP

Claims (11)

In an electronic apparatus having update program acquisition means for acquiring an update program, and program update means for performing program update to the update program acquired by the update program acquisition means,
Security compliance determination means for determining whether or not the update program acquired by the update program acquisition means and the update target program installed in the electronic device comply with specified security standards;
A program for prohibiting program update by the program update unit when the update target program conforms to the security standard and the update program does not comply with the security standard when the determination result of the security compliance determination unit is An electronic apparatus comprising an update prohibition unit. The electronic device according to claim 1,
An electronic apparatus comprising: a program update prohibition notifying unit for notifying the outside when a program update is prohibited by the program update prohibiting unit. The electronic device according to claim 1 or 2,
Inquiry information notification means for notifying outside of inquiry information as to whether or not to continue program update when program update is prohibited by the program update prohibition means;
A program that causes the program update unit to continue program update when an instruction to continue program update is given from outside, and causes the program update unit to stop program update when an instruction to stop program update is issued An electronic apparatus comprising an update control means. The electronic device according to any one of claims 1 to 3,
Provide communication means for connecting to the network,
The electronic device, wherein the update program acquisition unit acquires the update program by the communication unit. The electronic device according to any one of claims 1 to 4,
The update program acquisition means checks whether or not there is an unacquired update program after the program update is performed by the program update means, and if there is the update program, acquires the update program. machine. To a computer that controls an electronic device that executes a program and performs control,
An update program acquisition function for acquiring an update program;
A program update function for performing a program update to the update program acquired by the update program acquisition function means;
A security compliance determination function for determining whether or not the update program acquired by the update program acquisition function and the update target program installed in the electronic device comply with specified security standards;
A program for prohibiting program update by the program update function when the determination result of the security compliance determination function is that the update target program conforms to the security standard and the update program does not comply with the security standard. Program for realizing the update prohibition function. The program according to claim 6, wherein
In the computer,
A program for realizing a program update prohibition notification function for notifying the outside when program update is prohibited by the program update prohibition function. The program according to claim 6 or 7,
In the computer,
An inquiry information notification function for notifying outside of inquiry information as to whether or not to continue program update when program update is prohibited by the program update prohibition function;
A program that causes the program update function to continue program update when an instruction to continue program update is given from the outside, and causes the program update function to stop program update when an instruction to stop program update is given Program for realizing the update control function. In the program according to any one of claims 6 to 8,
In the computer,
It is a program for realizing a communication function for connecting to a network.
The update program acquisition function acquires the update program by the communication function. In the program according to any one of claims 6 to 9,
The update program acquisition function checks whether or not there is an unacquired update program after the program update is performed by the program update function, and if there is the update program, acquires the update program .   The computer-readable recording medium which recorded the program as described in any one of Claims 6 thru | or 10.

Images