JP2006103290A - Image formation device - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To provide an image formation device capable of restoring a program without mounting a rescue on a device. <P>SOLUTION: An RRU application receiving a start address of an updated data area and the area size of the updated data area by a ROM update mode thread of MCS eliminates network information and develops an updated data packet from the start address of the updated data area given by the ROM update mode thread of MCS (S11), and then reads the setting of a net boot address of NVRAM. An access is actually made by using a tftp protocol to check if the net boot address is authentic (S12). In a case of success, a copy of a usual system from a program storing medium is put by using the tftp protocol (S14). When the program storing medium is a flash memory, the copy is put after retrieval from the memory. When the program storing medium is a flash card, the copy is put with leaving a file as it is. <P>COPYRIGHT: (C)2006,JPO&NCIPI

Description

  The present invention relates to an image forming apparatus that can quickly cope with error recovery in program update using a network.

In recent years, multi-function machines in which a printer, a copy machine, a facsimile machine, and a scanner are housed in a single housing have become widespread.
In such a multifunction machine, it has been required to update the program irregularly and frequently because it is necessary to realize a large number of functions.
Therefore, the applicant has proposed the following invention as a technique for quickly, accurately, and easily performing a program update operation.
JP 2003-182191 A

By the way, when updating the firmware remotely, there is a problem that the system cannot be restarted if the system is rewritten incorrectly.
On the other hand, in addition to a program for operating as an image forming apparatus, it is possible to use a program recovery program (rescue) for recovery when an update is interrupted separately. Rescue to restore is always necessary, and the required capacity of the storage medium has increased. In addition, there is a limit to size reduction because the current rescue is equipped with a part of the platform.
Therefore, an object of the present invention is to provide an image forming apparatus capable of restoring a program without mounting a rescue using a platform in the image forming apparatus.

According to the first aspect of the present invention, program storage means for storing a program, update data receiving means for receiving update data relating to the program stored in the program storage means, and the update received by the update data receiving means A network-compliant image forming apparatus having a composite function comprising: a program updating means for updating a corresponding program recorded in the program storage means based on data, wherein the image forming apparatus is activated Update interruption determination means for determining whether or not the program update by the program update means is interrupted, and OS activation means for starting the corresponding operating system according to the determination result in the update interruption determination means. The OS starting means has a transmission / reception function. To.
According to a second aspect of the present invention, in the first aspect of the present invention, before the program is updated by the program update means, another image processing apparatus having means capable of receiving data from the image forming apparatus is determined. A determination unit; and a transmission unit configured to transmit the program before being updated to a storage medium of the other image processing apparatus according to a determination result of the determination unit; Receives the pre-update program from the storage medium in the other image forming apparatus, starts the received program, the started program receives the update data again, and rewrites it with the program included in the update data It is characterized by.

According to a third aspect of the present invention, in the second aspect of the present invention, the determination means includes a confirmation function for confirming that a bootable program is present in a storage medium in the other image forming apparatus. Features.
According to a fourth aspect of the present invention, in the first, second, or third aspect of the invention, the OS booting unit further performs electronic authentication using the bootable program and a corresponding electronic signature. And

According to a fifth aspect of the present invention, in the fourth aspect of the present invention, the electronic signature is transmitted simultaneously with the transmission of the program before the transmission means is updated.
According to a sixth aspect of the invention, in the fifth aspect of the invention, when the OS activation unit receives the pre-update program from the storage medium in the other image forming apparatus, the electronic signature is received at the same time. Features.

According to the first and second aspects of the present invention, since no program recovery means is required in the storage medium of the image forming apparatus, the size of the storage medium can be reduced.
According to the third aspect of the present invention, unnecessary programs are not transmitted to other image forming apparatuses, so that the load on the network can be reduced and the capacity of the storage medium need not be reduced.
In the invention described in claim 4, since the alteration of the program can be confirmed, the activation of the alteration program can be prevented.

In the invention described in claim 5, since it can be confirmed that the program has not been tampered with during transmission, it is possible to prevent the program from being tampered with.
In the invention described in claim 6, since it can be confirmed that the program has not been tampered with during reception, it is possible to prevent the program from being tampered with.

Hereinafter, a preferred embodiment of the present invention will be described in detail with reference to FIGS.
FIG. 1 is a diagram illustrating a network configuration example surrounding the image forming apparatus according to the present embodiment. In this network, the server 50, the remote host 60, and the multifunction device 100 are connected so as to be able to transmit and receive data.
The server 50 has various network settings such as a ftp server. For security reasons, a directory accessible by ftp is specified.
An OS (operating system) such as Windows (registered trademark) is installed in the remote host 60, and the tftp application can be used.
The multifunction peripheral 100 that is an image forming apparatus is connected by a network I / F (interface). The multifunction device 100 has a standard network protocol such as tftp.

FIG. 2 is a block diagram illustrating the configuration of the multifunction machine 100. FIG. 2 shows an example of the configuration of the multifunction machine when the general-purpose OS 121 is activated by the ROM monitor 410 described later.
As illustrated in FIG. 2, the multifunction peripheral 100 includes a plotter 101, a scanner 102, an FCU (Fax Control Unit) 103, other hardware resources 104, a general-purpose OS 121, a platform 120, an application 130, and the like. , And a multifunction machine starting unit 140 that is executed when the power is turned on.

The MFP activation unit 140 is first executed when the MFP 100 is turned on, and when update information is not stored in update suspension information described later, or when a maintenance flag is stored in update suspension information, The general-purpose OS 121, the platform 120, and the application 130 shown in FIG.
The platform 120 interprets a processing request from the application 130 and generates a hardware resource acquisition request, and a system resource that manages one or a plurality of hardware resources and arbitrates the acquisition request from the control service. A manager (SRM) 123.
The control service is formed of a plurality of service modules, and includes an SCS (system control service) 122, an ECS (engine control service) 124, an MCS (memory control service) 125, an OCS (operation panel control service) 126, and an FCS. (Fax Control Service) 127 and NCS (Network Control Service) 128.
The platform 120 has an application program interface (API) that can receive a processing request from the application 130 using a predefined function.

The general-purpose OS 121 is a general-purpose operating system such as UNIX (registered trademark), and executes the software of the platform 120 and the application 130 in parallel as processes.
The general-purpose OS 121 shown in FIG. 2 executes the normal mode thread of each process first when the normal mode thread and the ROM update mode thread exist in the process.
The MCS 125 is activated as a process for controlling the memory. The process of the MCS 125 includes normal mode threads for performing complex services such as acquisition and release of image memory, use of a hard disk drive (HDD), copying and compression of image data, printers, facsimiles, scanners, etc., and a remote ROM described later A ROM update mode thread for performing processing such as securing an update data area in the SDRAM 203 or the like for storing update data developed from the update data packet by the update application 117;

The process of the OCS 126 performs a normal mode thread for controlling the operation panel (operation panel 1310) serving as information transmission means between the operator and the main body control, processing for displaying information related to ROM update, and the like on the operation panel 1310. ROM update mode thread.
The process of FCS127 includes facsimile transmission / reception using PSTN / ISDN network from each application layer of the system controller, registration / quotation of various facsimile data managed by BKM (backup SRAM), facsimile reading, facsimile reception printing, and composite transmission / reception. It has a normal mode thread that performs processing such as providing an API for performing, and a ROM update mode thread that is simply activated without executing such a function.

The NCS 128 is a process for providing a service that can be used in common to applications that require network I / O. It has a normal mode thread that performs processing such as distributing data received from the network side according to each protocol to each application and mediating when transmitting data from the application to the network side.
Further, in the normal mode thread of the NCS 128, the ROM update data packet of the flash memory is further received from a remote host such as a host computer of the multifunction device developer or a third vendor of the application developer connected to the network.
The NCS 128 process also has a ROM update mode thread for performing processing such as passing update data included in the ROM update data packet of the flash memory to the remote ROM update application 117 described later.

The process of the SRM 123 performs system control and resource management together with the SCS 122. The SRM123 process uses the hardware resources of the scanner, printer, etc. engines, memory, HDD files, and host I / O (Centronics I / F, IEEE 1394 I / F, USB I / F, NIC I / F, etc.). It has a normal mode thread that performs processing such as arbitration and execution control according to a request from an upper layer to be used, and a ROM update mode thread that is simply activated without executing such resource management.
Specifically, the normal mode thread of the SRM 123 determines whether the requested hardware resource is available (whether it is not used by another request), and if so, the requested hardware resource is requested. Tell the upper layer that the hardware resource is available.
In addition, the normal mode thread of the SRM 123 performs use scheduling of hardware resources in response to a request from an upper layer, and directly requests contents (for example, paper conveyance and image forming operation, memory allocation, file generation, etc. by the printer engine). We are carrying out.

The process of the SCS 122 has a normal mode thread that performs processing such as application management, operation unit control, system screen display, LED display, resource management, and interrupt application control.
Further, the normal mode thread of the SCS 122 is based on a request from the remote ROM update application 117 described later, the printer application 111, the copy application 112, the fax application 113, the scanner application 114, the net file application 115, the ECS 124, the MCS 125, and the OCS 126. , Notifies the ROM update mode thread activation request to FCS 127, NCS 128, and the like.
The process of the SCS 122 also has a ROM update mode thread. The ROM update mode thread corresponds to the configuration of the application 130 operating on the multifunction peripheral 100 and the platform 120 from the update data expanded in the SDRAM 203 or the like. A process of selecting update data or a process of starting a ROM update unit 430 described later is performed.

The process of the ECS 124 is simply started without performing such engine control, and a normal mode thread that performs processing such as engine control of the plotter 101, the scanner 102, the FCU (Fax Control Unit) 103, and other hardware resources 104. And a ROM update mode thread that can only be done.
As described above, all the ROM update mode threads of the SRM 123, the ECS 124, and the FCS 127 are simply activated, but this is activated to indicate the existence of a control service that operates inside the MFP during the ROM update process. It has come to be.

On the other hand, the ROM update mode threads of the SCS 122, MCS 125, OCS 126, and NCS 128 are also activated to indicate the existence of a control service that operates inside the multi-function peripheral and performs processing necessary for ROM update. .
The application 130 includes a printer application 111 that is a printer application having a page description language (PDL), PCL, and PostScript (PS), a copy application 112 that is a copy application, and a fax application 113 that is a facsimile application. The scanner application 114 as a scanner application, the network file application 115 as a network file application, and the update data packet received via the network by the NCS 128 are expanded into update data, and the update data is read into the ROM update mode thread of the MCS 125. Remote ROM update application (hereinafter referred to as RRU application) 117 that performs processing to be stored in an update data area such as SDRAM 203 secured by , The has.

  Each of these apps is also started as a process, like the platform 120, and each app other than the RRU app 117 is started to indicate a normal mode thread that performs the processing as described above and the presence of the app itself. ROM update mode thread.

FIG. 3 is a block diagram illustrating a hardware configuration of the multifunction machine. Hereinafter, an example of a hardware configuration of the multifunction peripheral 100 will be described with reference to FIG.
As illustrated in FIG. 3, the multifunction peripheral 100 includes an operation panel 1310, an FAX control unit (FCU) 103, an engine unit 1350 to which the scanner 102 and the like are connected, and a plotter 101 and an ASIC 1301 of the controller 1300. An interconnect) bus 1309 and the like are connected.

The controller 1300 connects the NVRAM 208, SDRAM 203, flash memory 204, HDD (Hard Disk Drive) 1303, etc. to the ASIC 1301. In addition, the ASIC 1301 and the CPU 1304 are connected via the NB 1305 of the CPU chip set.
Thus, the reason for connecting via the NB 1305 is that the interface of the CPU 1304 itself is not disclosed.
Here, the ASIC 1301 and the NB 1305 are not connected via the PCI, but are connected via the AGP 1308. The reason for the connection via the AGP 1308 is that the MFP 100 is connected to the platform 120 and the application 130 shown in FIG. This is because the performance is degraded.

The CPU 1304 controls the entire MFP 100. Specifically, the SRM 123 and the SCS 122, ECS 124, MCS 125, OCS 126, FCS 127, and NCS 128 forming the platform 120 are started as processes on the general-purpose OS 121, respectively. At the same time, the printer application 111, the copy application 112, the fax application 113, the scanner application 114, the net file application 115, and the RRU application 117 forming the application 130 are activated and executed.
For example, when the MFP 100 has a configuration as shown in FIG. 10 (described later), the CPU 1304 starts and executes the SRM 123, the SCS 122 and the MCS 125 forming the platform 120 as processes on the general-purpose rescue OS 131, respectively. .

The NB 1305 includes a CPU 1304, a system memory 1306, an SB 1307, a NIC (Network Interface Card) 1341, a USB (Universal Serial Bus) 1330, an IEEE 1394 1340, a Centronics 1342, a driver I / F 1343, an ASIC 1301, and an ASIC 1301. It is a bridge to do.
A system memory 1306 is a memory used as a drawing memory or the like of the multifunction peripheral, and an SB 1307 is a bridge for connecting the NB 1305 and peripheral devices. The SB 1307 has an RTC (Real Time Clock) that measures time in the controller 1300. The SB 1307 has a USB host inside, and can capture image data by connecting a USB-connected camera, for example, and can also receive data from other USB targets.

A driver I / F (interface) 1343 is an I / F that is used to read a program or an application from a recording medium in which the inserted program or application is stored and mount the program or application on the multifunction peripheral 100. For example, an SD memory card, smart media, multimedia card, compact flash (registered trademark), or the like is used as a recording medium.
The SDRAM 203 is a non-volatile memory that secures an update data area for storing update data developed from the received update data packet when the update data packet is received via the network.
The NVRAM 208 is a non-volatile memory that stores, for example, update interruption information described later.
A flash memory (hereinafter referred to as “flash ROM”) 204 stores the above-described applications, the control services constituting the platform, and the programs of the SRM 123. The MFP 100 is shipped with each of these programs pre-installed in the flash ROM 204, and a remote ROM update process is executed in which the program in the flash ROM 204 is updated upon receipt of the ROM update data packet. It has become.

The HDD 1303 is a storage that stores image data, programs, font data, forms, and documents. The operation panel 1310 receives input operations from the operator and displays them for the operator. It is an operation part which performs.
The ASIC 1301 is provided with a RAM interface for connecting the NVRAM 208 and the SDRAM 203, a ROM interface for connecting the flash ROM 204, and a hard disk interface for connecting the HDD 1303. When inputting / outputting data, the input / output destination is switched to the RAM interface, ROM interface, or hard disk interface.
The AGP 1308 is a bus interface for a graphics accelerator card that has been proposed for speeding up graphics processing. The AGP 1308 speeds up the graphics accelerator card by directly accessing the system memory 1306 with high throughput.

Hereinafter, an example of the entire process of remote ROM update will be described with reference to FIGS. FIG. 4 is a diagram for explaining the entire process of remote ROM update.
As shown in FIG. 4, when the multifunction peripheral 100 is executing a normal composite service operation, each application, each control service, and the like having a normal mode thread and a ROM update mode thread are Both are running normal mode threads.
In this state, when an update data packet is transmitted from a remote host such as the host computer of the multifunction device developer or the third vendor host computer of the application developer via the network, the normal mode thread of the NCS 128 transmits the update data packet. Receive (sequence SQ1).
The normal mode thread of the NCS 128 determines the content of the received packet, and if it is determined that it is an update data packet, notifies the RRU application 117 that the ROM update data packet has been received (sequence SQ2).

The RRU application 117 that is notified that the ROM update data packet has been received from the normal mode thread of the NCS 128 requests the normal mode thread of the SCS 122 to issue a ROM update mode thread transition request notification (sequence SQ3). .
The normal mode threads of the SCS 122 requested to issue the ROM update mode thread transition request notification from the RRU application 117 are the printer application 111, the copy application 112, the fax application 113, the scanner application 114, the net file application 115, the ECS 124, the MCS 125, A ROM update mode thread transfer request is notified to each of the OCS 126, FCS 127, and NCS 128 normal mode threads (sequence SQ4).

FIG. 5 is a diagram for explaining the entire process of remote ROM update.
According to the sequence SQ4 in FIG. 4, the printer application 111, the copy application 112, the fax application 113, the scanner application 114, the net file application 115, the ECS 124, the MCS 125, which are notified of the transfer request of the ROM update mode thread from the normal mode thread of the SCS 122. The OCS 126, FCS 127, and NCS 128 each shift from the normal mode thread to the ROM update mode thread as shown in FIG.
In addition, the RRU application 117 requests the ROM update mode thread of the MCS 125 to secure an update data area in order to obtain an area necessary for expanding the update data packet (sequence SQ5).

The ROM update mode thread of the MCS 125 requested to secure the update data area by the RRU application 117 secures the update data area on the SDRAM 203, for example, and the start address of the update data area and the area size of the update data area Are returned to the RRU application 117 (sequence SQ6).
The RRU application 117, which has received the start address of the update data area and the area size of the update data area from the ROM update mode thread of the MCS 125, removes the network information and decompresses the compressed data packet. Are expanded from the start address of the update data area notified from the ROM update mode thread of the MCS 125.

Hereinafter, an example of the update data packet developed in the update data area will be described with reference to FIG. FIG. 6 is a data structure diagram after development of the update data packet received by the multifunction machine.
As shown in FIG. 6, the expanded update data packet includes a header portion 302 and a data portion 303.
The header section 302 is divided into header blocks for each module so as to correspond to the module to be updated. Each header block includes a next header offset that is an offset to the next header block, an update data offset that is an offset to module update data, a size of the update data, a module ID that is module identification information, An update destination address indicating a relative address of the module on the flash ROM 204 and an update destination area length which is the size of the module are provided.
The data unit 303 stores update data for each module. The head of the update data of each module can be referred to by the update data offset of the header block corresponding to the module.

Returning to FIG. 5, the RRU application 117 notifies the normal mode thread of the SCS 122 of the start address of the update data area in which the update data packet is expanded, and requests selection of update data (sequence SQ8).
The normal mode thread of the SCS 122 that has received the update data selection request from the RRU application 117 activates the ROM update mode thread of the SCS 122, performs processing as shown in FIG. 12 to be described later, and selects update data (sequence SQ9). .
Further, the ROM update mode thread of the SCS 122 activates a ROM update unit 430 shown in FIG. 8 described later, and performs a ROM update process as shown in FIG. 13 described later (sequence SQ10).

Hereinafter, an example of the configuration of the multifunction machine starting unit 140 will be described with reference to FIGS. 7 and 8. FIG. 7 is a block diagram illustrating an example of the configuration of the multifunction machine starting unit.
As shown in FIG. 7, the multi-function peripheral activation unit 140 includes a ROM monitor 410 and a program activation unit 420.
The ROM monitor 410 activates the general-purpose OS 121 shown in FIG. 2 when update information is not stored in update interrupt information, which will be described later, or when a maintenance flag is not stored in update interrupt information. When update information is stored, or when a maintenance flag is stored in the update interruption information, the general-purpose rescue OS 131 is started as shown in FIG.
The program activation unit 420 is called from the general-purpose OS 121 or the general-purpose rescue OS 131, and includes a service layer activation unit 422, an application activation unit 423, and an activation information setting unit 424.

When the program activation unit 420 is called from the general-purpose OS 121, the service layer activation unit 422 acquires the activation information of the general-purpose OS 121 and activates the platform 120. On the other hand, when the program activation unit 420 is called from the general-purpose rescue OS 131, the service layer activation unit 422 acquires the activation information of the general-purpose rescue OS 131 and, as shown in FIG. 10 described later, for example, the SRM 123, the MCS 125, The platform 120 including the SCS 122 is activated.
The application activation unit 423 is executed when the program activation unit 420 is called from the general-purpose OS 121, acquires activation information of each application, and activates each application. Note that, as shown in Example 4 described later, the application activation unit 423 is executed even when the program activation unit 420 is called from the general-purpose rescue OS 131, and acquires activation information of the RRU application 117 to obtain the RRU. The application 117 may be activated.
The activation information setting unit 424 is activated when the ROM update mode thread of each control service, SRM 123, and application 130 included in the platform 120 is executed. The activation information setting unit 424 activates each control service, SRM 123, and each application. Acquire information and set the acquired startup information in the environment variable. The activation information setting unit 424 is activated also when a rescue mode thread of each application included in each control service, SRM 123, and application 130 described later is executed, and activation information of each control service, SRM 123, and each application. May be acquired, and the acquired activation information may be set as an environment variable.

Hereinafter, an example of the memory configuration of the multifunction peripheral 100 will be described with reference to FIG.
As shown in FIG. 8, for example, the update interruption information is included in the NVRAM space, and in the ROM space, the program corresponding to the ROM monitor 410 or the program of the platform 120 as shown in FIG. An application 1, an application 2, and the like corresponding to the system and the program of each application are included. The ROM monitor 410 in the ROM space is normally used for a recovery operation when the update of the system is interrupted, and therefore cannot be rewritten.
Hereinafter, as shown in FIG. 8, an example of the layout of the update interruption information when the update interruption information is stored in the NVRAM space will be described with reference to FIG. FIG. 9 is a diagram for explaining the layout of the network information stored in the NVRAM.
As shown in FIG. 9, the network information includes a local station IP address, a subnet mask, a gateway address, and a network boot address of 4 bytes each, and 1 byte of a net boot flag that instructs the ROM monitor to perform a net boot. ing.

Next, the processing procedure of the RRU application will be described with reference to the flowchart of FIG.
First, the RRU application requests the MCS ROM update mode thread to secure an update data area in order to obtain an area necessary for expanding the update data packet (step 10).
The RRU application that has received the start address of the update data area and the area size of the update data area by the MCS ROM update mode thread removes the network information and sends the update data packet from the ROM update mode thread of the MCS. Development starts from the start address of the notified update data area (step 11).
Next, the setting of the NVRAM net boot address is read. Whether the read net boot address is valid or not is actually accessed by the tftp protocol (step 12). Here, it is assumed that the net boot address is the IP address of the server, and the tftp server setting is made and the access is successful.
If the access is successful (step 13), a copy of the normal system is put out from the program storage medium using the tftp protocol (step 14).

If the program storage medium is a flash memory, the put is performed after the memory is dumped. If the program storage medium is a flash card, the file is put as it is. Furthermore, if there is a file that has already been put, there is no need to put the system in the normal state.
After that, if Put ends normally, the NVRAM net boot flag is set (step 15).
Finally, the start address of the update data area in which the update data packet is expanded is notified to the SCS normal mode thread, and the selection of update data is requested (step 16).

Next, a reboot process procedure after the ROM update process by the SCS ROM update unit will be described with reference to the flowchart of FIG.
First, the NVRAM net boot flag set in the RRU application ROM update pre-processing sequence is cleared (step 20). Thereafter, a system reboot is performed as usual (step 21).

Next, the OS switching processing procedure at the time of booting by the ROM monitor will be described with reference to the flowchart of FIG.
After power-on (step 30), the ROM monitor 410 is activated (step 31), and the ROM monitor 410 determines whether the NVRAM net boot flag is set. When the ROM monitor 410 determines that the NVRAM net boot flag is not set (step 32; N), the ROM monitor 410 starts the general-purpose OS 121 (step 40).
Then, the activated general-purpose OS 121 activates the program activation unit 420 (step 41). Thereafter, the service layer activation unit 422 included in the program activation unit 420 activates the platform 120 (step 42).
Here, the application activation unit 423 included in the program activation unit 420 activates the application 130 (step 43), while the ROM monitor 410 performs a normal system get via tftp (step 44).

On the other hand, if it is determined that the NVRAM net boot flag is set (step 32; Y), the normal system is acquired from the net boot server (step 33), and the general-purpose OS 121 in the acquired normal system is started (step 34). ).
Then, the activated general-purpose OS 121 activates the program activation unit 420 in the normal system acquired in step 33 (step 35), and the service layer activation unit 422 included in the program activation unit 420 activated here is a platform 120 is started (step 36).
Then, the application activation unit 423 included in the program activation unit 420 activated in step 36 activates the application 130 (step 37), and subsequently activates as a multifunction machine (step 38).
Thereafter, when the SCS confirms that the NVRAM net boot flag is set and storage of the update interruption information, the SCS notifies the service and application of the multifunction peripheral function stop, and the RRU application 117 enters an update packet reception standby state. In the standby state, the SCS displays the reception standby screen shown in FIG. 13 (step 39).

Next, a second embodiment will be described.
Hereinafter, an example of the memory configuration of the multifunction peripheral 100 will be described with reference to FIG.
As shown in FIG. 14, for example, the update interruption information is included in the NVRAM space, and in the ROM space, the program corresponding to the ROM monitor 410 or the program of the platform 120 as shown in FIG. The system includes an electronic signature and a public key corresponding to the system, an application 1 and an application 2 corresponding to each application program, and an electronic signature and a public key corresponding to the application. The ROM monitor 410 in the ROM space is normally used for a recovery operation when the update of the system is interrupted, and therefore cannot be rewritten.

  FIG. 15 is a flowchart showing the processing procedure of the electronic signature check performed by the program activation unit. The program starting unit first creates MDa (step 51). MDa is a message digest of a program such as a normal system or an application. Next, the program starting unit creates MDb (step 52). MDb is a message digest obtained by decrypting an electronic signature (usually a message digest of a program such as a system or an application using a secret key) with a public key. Then, the program activation unit determines the validity of the electronic signature of the program such as the normal system or application by comparing MDa and MDb (step 53). Here, if MDa and MDb match (step 53; Y), it is determined that the electronic signature of the program such as the normal system or application is valid (step 54). On the other hand, if MDa and MDb do not match (step 53; N), it is determined that the electronic signature of the program such as the normal system or application is not valid (step 55).

Next, the processing sequence of the RRU application is the same as that shown in FIG. Here, the difference from the first embodiment is only that the normal system electronic authentication and the public key are also put when the normal system is put in tftp.
Next, the OS switching process at the time of booting by the ROM monitor is the same as in FIG. The difference from the first embodiment is that the process proceeds to step 17 where the ROM monitor 410 obtains the normal system via ftp, and at this time, the electronic signature of the normal system and the public key are obtained, and the electronic signature of FIG. It is only a point to check.

1 is a diagram illustrating a network configuration example surrounding an image forming apparatus according to an embodiment. 1 is a block diagram illustrating a configuration of an image forming apparatus. FIG. 2 is a block diagram illustrating a hardware configuration of a multifunction machine. It is a figure for demonstrating the whole process of remote ROM update. It is a figure for demonstrating the whole process of remote ROM update. FIG. 10 is a data structure diagram after development of an update data packet received by the multifunction machine. 3 is a block diagram illustrating an example of a configuration of a multifunction machine starting unit. FIG. 2 is a diagram illustrating an example of a memory configuration of a multifunction peripheral. FIG. It is a figure for demonstrating the layout of the network information stored in NVRAM. It is the flowchart which showed the procedure of the ROM change update process of a RRU application. It is the flowchart which showed the procedure of the reboot process after the ROM update process by the ROM update part of SCS. It is a flowchart for demonstrating OS switching processing at the time of booting. It is the figure which showed the example of the reception waiting screen. It is the figure which showed an example of the structure of memory. It is a flowchart which concerns on the electronic signature check which a program starting part performs.

Explanation of symbols

100 MFP 101 Plotter 102 Scanner 103 FCU (Fax Control Unit)
104 Other hardware resources 110 Software group 111 Printer application 112 Copy application 113 Fax application 114 Scanner application 115 Net file application 117 Remote ROM update application (RRU application)
120 Platform 121 General-purpose OS (Operating System)
122 SCS
123 SRM
124 ECS
125 MCS
126 OCS
127 FCS
128 NCS
130 Application 140 Multifunction Device Startup Unit 203 SDRAM
204 Flash memory 208 NVRAM
410 ROM monitor 420 Program activation unit 422 Service layer activation unit 423 Application activation unit 424 Activation information setting unit 1300 Controller 1301 ASIC
1303 HDD (Hard Disk Drive)
1304 CPU
1305 NB
1306 System memory 1307 SB
1308 AGP
1309 PCI bus 1310 operation panel 1330 USB (Universal Serial Bus)
1340 IEEE 1394
1341 NIC
1342 Centronics 1343 Driver I / F
1350 engine

Claims (6)

Program storage means for storing a program;
Update data receiving means for receiving update data related to the program stored in the program storage means;
A network-compliant image forming apparatus having a composite function, comprising: a program update unit that updates a corresponding program recorded in the program storage unit based on the update data received by the update data reception unit. And
An update interruption determination unit that determines whether or not the program update by the program update unit is interrupted when the image forming apparatus is activated;
OS booting means for booting the corresponding operating system according to the determination result in the update interruption determination means,
An image forming apparatus, wherein the OS activation unit has a transmission / reception function. Determination means for determining another image processing apparatus having means capable of receiving data from the image forming apparatus before the program is updated in the program update means;
According to the determination result of the determination means, and a transmission means for transmitting to record the program before being updated to the storage medium of the other image processing apparatus,
The OS activation unit receives the pre-update program from the storage medium in the other image forming apparatus, activates the received program;
The image forming apparatus according to claim 1, wherein the activated program receives update data again and rewrites the program with a program included in the update data. The image forming apparatus according to claim 2, wherein the determination unit includes a confirmation function for confirming that there is a bootable program in a storage medium in the other image forming apparatus. The image forming apparatus according to claim 1, wherein the OS activation unit further performs electronic authentication using the bootable program and a corresponding electronic signature. The image forming apparatus according to claim 4, wherein the electronic signature is transmitted simultaneously with the transmission of the program before the transmission unit is updated. 6. The image forming apparatus according to claim 5, wherein when the OS activation unit receives the pre-update program from the storage medium in the other image forming apparatus, the electronic signature is also received at the same time.

Images