JP2016212545A - Printing device, program update system, and control method - Google Patents

Abstract

PROBLEM TO BE SOLVED: To provide a printing device that needs to ensure the validity of a program and can appropriately update a program for a sub-CPU by communication.SOLUTION: A printing device includes: a communication unit for communicating with an external device; a first CPU for controlling the communication unit; and a second CPU for communicating with the first CPU. After confirming the validity of update data which is to update a program for the second CPU and received by the communication unit, the first CPU updates the program for the second CPU by using the update data.SELECTED DRAWING: Figure 1

Description

  The present invention relates to a printing apparatus or the like that needs to ensure the validity of a program, and more particularly to a printing apparatus or the like that can appropriately update a program for a sub CPU by communication.

  In an electronic device such as a so-called fiscal printer that requires security performance, it is necessary to prevent fraud such as falsification of data and to ensure data validity. Accordingly, it is important to ensure the validity of the data processing program (firmware) itself.

  Therefore, conventionally, measures have been taken to prevent such devices from having an update function or prohibit writing to a memory storing a program. Further, when such a device is provided with a plurality of CPUs, the specifications for the sub CPU program can be updated only in the manufacturing process.

  Patent Document 1 below proposes an invention that can perform an update operation at high speed even when the number of CPUs to be updated is increased in a multi-CPU system capable of updating a program.

JP 2009-64317 A

  Even in the electronic devices that require the above-mentioned security performance, it is necessary to update the program by correcting bugs (defects) in the program, adding functions according to user requests, changing specifications due to legal revisions, etc., and these program updates can be performed via communication. This is highly convenient for both users and vendors (providers), and is advantageous in terms of cost. Therefore, a communication method is strongly desired for program update for the sub CPU. In that case, it is necessary to ensure the validity of the update program itself.

  In addition, although the above-mentioned patent document 1 describes the program update of the sub CPU, it does not describe how to ensure the validity of the data itself of the update program.

  SUMMARY OF THE INVENTION An object of the present invention is to provide a printing apparatus that needs to ensure the validity of a program and that can appropriately update a program for a sub CPU by communication.

  In order to achieve the above object, according to one aspect of the present invention, a printing apparatus includes a communication unit that communicates with an external device, a first CPU that controls the communication unit, and a second CPU that communicates with the first CPU. And the first CPU confirms the validity of the update data received by the communication unit for updating the program for the second CPU, and then uses the update data for the program for the second CPU. Is to update.

  In the above-mentioned invention, a preferable aspect further includes a first storage unit that stores a program executed by the first CPU, a second storage unit that stores a program executed by the second CPU, and the update data temporarily. And a third storage unit that stores the information in the storage device.

  Furthermore, in the above invention, a preferred aspect is that the first CPU stores the update data received by the communication unit in the third storage unit, and the first CPU confirms the validity of the stored update data. The update data is transmitted to the second CPU, and the second CPU updates the program stored in the second storage unit with the transmitted update data.

  Further, in the above invention, a preferred aspect is that the update data includes update program data and validity determination information, and the first CPU determines the validity of the update program data based on the validity determination information. It is characterized by that.

  Furthermore, in the above invention, a preferred aspect is characterized in that the second CPU controls a fiscal memory.

  In order to achieve the above object, another aspect of the present invention provides a program update system having a host device and a printing device, wherein the host device sends update data for updating a program of the printing device to the printing device. An update unit that transmits to the host device, and the printing apparatus includes a communication unit that communicates with the host device, a first CPU that controls the communication unit, and a second CPU that communicates with the first CPU. The 1 CPU updates the program for the second CPU using the update data after confirming the validity of the update data received by the communication unit.

  In order to achieve the above object, still another aspect of the present invention provides a communication unit that communicates with an external device, a first CPU that controls the communication unit, and a second CPU that communicates with the first CPU. In the method for controlling a printing apparatus provided, after the first CPU confirms the validity of update data for updating the program for the second CPU received by the communication unit, the update data is used for the second CPU. Update the program.

  Further objects and features of the present invention will become apparent from the embodiments of the invention described below.

It is a block diagram which concerns on the example of embodiment of the program update system to which this invention is applied. 5 is a flowchart illustrating an example of an update process procedure performed by the program update system 100. It is a figure for demonstrating the production | generation procedure of the update data 14, and a validity judgment procedure.

  Embodiments of the present invention will be described below with reference to the drawings. However, such an embodiment does not limit the technical scope of the present invention. In the drawings, the same or similar elements are denoted by the same reference numerals or reference symbols.

  FIG. 1 is a configuration diagram according to an embodiment of a program update system to which the present invention is applied. In the program update system 100 according to the present embodiment shown in FIG. 1, the main CPU 24 (first CPU) of the printer 2 (printing apparatus) is for the sub CPU 27 (second CPU) transmitted from the host computer 1 (external apparatus). After determining the validity of the update program itself included in the update data 14 based on the validity determination information included in the update data 14 (digital signature 143, see FIG. 3), the program for the sub CPU 27 is updated. Thereby, the program update for the sub CPU 27 of the printer 2 is appropriately performed by communication, and the convenience can be improved and the cost can be reduced.

  As shown in FIG. 1, the program update system 100 includes a printer 2 that requires security performance and a host computer 1 that is a host device of the printer 2. The host computer 1 and the printer 2 are communicably connected via a network. When updating the program (firmware) of the printer 2, the update program is transmitted from the host computer 1 to perform the work.

  The host computer 1 is composed of a personal computer or the like, and includes a CPU, a RAM, an HDD, a communication device, a display device, an instruction device, etc. (not shown). Further, as shown in FIG. 1, the host computer 1 includes an update unit 11 as a functional configuration.

  The update unit 11 is a part that instructs to update the program of the printer 2, and includes a data transfer unit 12 and a data storage unit 13.

  The data storage unit 13 stores update data 14 for updating the program of the printer 2. The update data 14 will be described later with reference to FIG. 3. The update data 14 is expressed in a predetermined format for writing to the ROM, and includes a header 141, update program data 142, and a digital signature 143. The header 141 is information describing the update data 14 such as information indicating the update destination, the update program data 142 is data of the update program itself, and the digital signature 143 indicates the validity of the update data 14 and the update program data 142. This is legitimacy judgment information for judgment. In the present embodiment, the update data 14 is update data for the sub control unit 22 (sub CPU 27) of the printer 2. The update data 14 may be generated by the host computer 1 or may be generated by another device. Further, the update unit 11 may have a function of generating the update data 14. The data storage unit 13 can be configured by a storage device such as an HDD.

  The data transfer unit 12 is a part that transmits the update data 14 stored in the data storage unit 13 to the printer 2. The data transfer unit 12 includes an application program for data transfer, a CPU that operates according to the program, a RAM, and the like.

  The printer 2 is a target device for program update by the host computer 1, and is a fiscal printer that is used by being connected to a checkout device (register) in a store as an example.

  The printer 2 includes an update mode for updating a program and a print mode for executing printing as operation modes.

  As shown in FIG. 1, the printer 2 includes a main control unit 21 and a plurality of sub-control units 22 (22a, 22b,...). Each control part 21 and 22 is comprised with the electronic substrate which mounted CPU, ROM, RAM, ASIC, etc. Moreover, although not shown in figure, each sub-control part 22 is provided with each operation | movement part which is a control object.

  The main control unit 21 is a part that controls the entire printer 2 and controls communication with external devices including the host computer 1. In addition, the main control unit 21 performs an update instruction and a validity determination of the update program when the program for the sub control unit 22 is updated.

  As shown in FIG. 1, the main control unit 21 includes a communication unit 23, a main CPU 24, a temporary storage unit 25, and a main storage unit 26. The communication unit 23 is a part that manages communication with an external device. For example, when the external device is the host computer 1 that controls the printing process of the printer 2, the communication unit 23 performs communication according to USB (Universal Serial Bus). The external device may be a server computer via a network.

  The main CPU 24 (first CPU) is a part that executes the control of the main control unit 21 described above in accordance with a program (firmware) for the main CPU.

  The temporary storage unit 25 (third storage unit) is a temporary memory used by the main CPU 24, and is configured by, for example, a flash ROM. The temporary storage unit 25 temporarily stores (holds) the update data 14 transmitted from the host computer 1.

  The main storage unit 26 (first storage unit) is a main memory used by the main CPU 24, and is configured by a flash ROM, for example. The main storage unit 26 stores a program executed by the main CPU 24.

  As shown in FIG. 1, the sub control unit 22 (22a, 22b,...) Has a sub CPU 27 (27a, 27b,...) (Second CPU) and a sub storage unit 28 (28a, 28b,. ..) (second storage unit). Each sub CPU 27 performs control by executing a program (firmware) for the sub CPU stored in each sub storage unit 28. These programs for the sub CPU are targets to be updated by the program update system 100. Each sub CPU 27 receives the update data 14 transmitted from the main CPU 24 and writes the update program data 142 (see FIG. 3) included in the update data 14 to each sub storage unit 28 to perform the program update. In addition, each sub memory | storage part 28 is comprised by flash ROM, for example.

  The sub-control unit 22 includes a print control unit (22a), a fiscal memory control unit (22b), a battery control unit, and the like.

  An operation unit (printing mechanism unit) (not shown) is connected to the printing control unit (22a), and the printing mechanism unit executes printing on a printing medium such as paper under the control of the printing control unit (22a). For example, when an inkjet method is used as a printing method, the printing mechanism unit includes a print head including a nozzle that ejects ink, a transport device that transports a print medium, and the like.

  An operation unit (fiscal memory) (not shown) is connected to the fiscal memory control unit (22b), and the fiscal memory stores fiscal data such as sales information processed by a settlement apparatus that issues a print instruction to the printer 2. The information stored in the fiscal memory cannot be deleted or edited, and falsification is prevented for tax collection. Fiscal memory can be composed of non-volatile memory.

  In the program update system 100 having the configuration as described above, the update processing of the program for the sub CPU is performed in the following procedure. FIG. 2 is a flowchart illustrating the procedure of update processing by the program update system 100.

  When the operator of the host computer 1 activates the data transfer unit 12, the data transfer unit 12 reads and acquires the update data 14 stored in the data storage unit 13 (step S1 in FIG. 2).

  Next, the data transfer unit 12 transmits the acquired update data 14 to the printer 2 via the network 3 (step S2 in FIG. 2).

  The host computer 1 receives the update data 14 transmitted by the communication unit 23. The received update data 14 is transferred to the main CPU 24.

  The main CPU 24 interprets the header 141 of the update data 14, determines that the update data 14 is update data for the sub CPU, and switches the operation mode to the update mode. Thereafter, the main CPU 24 stores (holds) the update data 14 in the temporary storage unit 25 (step S3 in FIG. 2).

  Next, the main CPU 24 determines the validity of the update data 14 stored in the temporary storage unit 24 (step S4 in FIG. 2). Although specific processing of the validity determination will be described later, in this embodiment, as an example, authentication processing by a digital signature method is performed. The validity determination process determines the validity of the update data 14 as a whole, in other words, the validity of the program update instruction and the validity of the update program data 142 included in the update data 14.

  If the validity of the update data 14 is not recognized as a result of the validity determination (NG in step S4 in FIG. 2), the main CPU 24 deletes the update data 14 from the temporary storage unit 25 (step S5 in FIG. 2). Thereafter, the main CPU 24 sends a response to the updating unit 11 of the host computer 1 that the validity of the update data 14 is not recognized and the program update by the update data 14 has not been performed, and the program update process is terminated. .

  On the other hand, if the validity of the update data 14 is recognized as a result of the validity determination (S4) (OK in step S4 in FIG. 2), the main CPU 24 reads the update data 14 from the temporary storage unit 24 and stores it in its header 141. The update data 14 is transmitted to the included update destination sub CPU 27 (step S6 in FIG. 2).

  The sub CPU 27 that has received the update data 14 receives the update data 14 and stores the update program data 142 included in the update data 14 in the sub storage unit 28 in accordance with the instruction of the update data 14. At the time of the storage, the sub CPU 27 erases the previous (current) program data stored in the sub storage unit 28 corresponding to the update program data 142, and the program update by the update data 14 is executed. (Step S7 in FIG. 2).

  When the update-destination sub-control unit 22 is the sub-control unit 22b (fiscal memory control unit), the sub CPU 27b receives the update data 14 for fiscal memory, and the program stored in the sub storage unit 28b is received. The update program data 142 included in the updated data 14 is updated.

  As described above, the program update process by the program update system 100 is executed.

  Next, the update data 14 generation process and the validity determination process will be described. FIG. 3 is a diagram for explaining the generation procedure and the validity determination procedure of the update data 14. When the update data 14 is generated, first, update program data 142, which is data of a program to be newly stored in the sub storage unit 28b, is prepared ((A) in FIG. 3). The update program data 142 is expressed in a predetermined format for writing to the ROM.

  Next, the update program data 142 is input to a predetermined hash function ((B) in FIG. 3), and the hash value of the update program data 142 is obtained ((C) in FIG. 3). Thereafter, the obtained hash value is encrypted with a secret key ((D) in FIG. 3), and a digital signature 143 is generated ((E) in FIG. 3). The generated digital signature 143 is expressed in the predetermined format.

  Thereafter, the header 141 including the update destination information and the like is generated in the predetermined format ((F) in FIG. 3), and the generated header 141, the update program data 142, and the digital signature 143 are combined and the update data 14 Is generated ((G) in FIG. 3). The generation of the update data 14 can be performed by using an update data generation program provided in the host computer 1 or another computer.

  The generated update data 14 is validated by the main CPU 24 of the printer 2 as described above. The main CPU 24 reads the update program data 142 included in the received update data 14 ((H) in FIG. 3). The main CPU 24 stores the hash function when the update data 14 is generated, and obtains a hash value by inputting the read update program data 142 to the hash function ((J) in FIG. 3).

  Further, the main CPU 24 reads out the digital signature 143 included in the received update data 14 ((I) in FIG. 3). The main CPU 24 stores a public key corresponding to the secret key used when generating the update data 14, and decrypts the digital signature 143 read using the public key to obtain a hash value (FIG. 3). (K)).

  After that, the main CPU 24 collates (compares) the hash value obtained by (J) in FIG. 3 with the hash value obtained by (K) in FIG. 3 ((L) in FIG. 3). The received update data 14 is determined to be valid. That is, the update instruction and the validity of the update program data 142 itself are recognized.

  On the other hand, if the two do not match, the main CPU 24 determines that the received update data 14 is not valid. In this case, there is a possibility that the update program data 142 has been tampered with. If the decryption using the public key described above ((K) in FIG. 3) cannot be performed, the main CPU 24 determines that the received update data 14 is not valid. In this case, it is suspected that the update instruction is not from a valid instructor.

  The validity determination process may be performed by a method other than the digital signature method described above.

  As described above, in the program update system 100 according to the present embodiment, the update data 14 for the sub CPU transmitted to the printer 2 includes the validity determination information (digital signature 143) and before the update process is performed. In addition, since the main CPU 24 determines the validity of the update data 14 using the validity determination information, the program update for the sub CPU of the device whose validity should be ensured can be appropriately performed using communication. . Therefore, it is possible to improve the convenience for users and vendors and reduce the cost for program update.

  In addition, since the update program data itself is used to determine the validity, fraud such as falsification of the update program can be effectively prevented.

  The present invention can be applied to electronic devices other than printers.

  The protection scope of the present invention is not limited to the above-described embodiment, but covers the invention described in the claims and equivalents thereof.

  1 host computer, 2 printer, 11 update unit, 12 data transfer unit, 13 data storage unit, 14 update data, 21 main control unit, 22 (22a, 22b) sub control unit, 23 communication unit, 24 main CPU, 25 temporary Storage unit, 26 Main storage unit, 27 (27a, 27b) Sub CPU, 28 (28a, 28b) Sub storage unit, 100 Program update system, 141 Header, 142 Update program data, 143 Digital signature

Claims (7)

A communication unit that communicates with an external device;
A first CPU for controlling the communication unit;
A second CPU that communicates with the first CPU;
The first CPU updates the program for the second CPU using the update data after confirming the validity of the update data for updating the program for the second CPU received by the communication unit. A printing device. In claim 1, further comprising:
A first storage unit for storing a program executed by the first CPU;
A second storage unit for storing a program executed by the second CPU;
And a third storage unit for temporarily storing the update data. In claim 2,
The first CPU stores the update data received by the communication unit in the third storage unit,
After confirming the validity of the stored update data, the first CPU transmits the update data to the second CPU,
The printing apparatus, wherein the second CPU updates a program stored in the second storage unit with the transmitted update data. In any one of Claims 1 thru | or 3,
The update data includes update program data and validity determination information,
The first CPU determines the validity of the update program data based on the validity determination information. In any one of Claims 1 thru | or 4,
The second CPU controls a fiscal memory. A program update system having a host device and a printing device,
The host device is
An update unit for transmitting update data for updating a program of the printing apparatus to the printing apparatus;
The printing apparatus includes:
A communication unit for communicating with the host device;
A first CPU for controlling the communication unit;
A second CPU that communicates with the first CPU;
The first CPU updates the program for the second CPU using the update data after confirming the validity of the update data received by the communication unit. A printing apparatus control method comprising: a communication unit that communicates with an external device; a first CPU that controls the communication unit; and a second CPU that communicates with the first CPU.
The first CPU updates the program for the second CPU using the update data after confirming the validity of the update data for updating the program for the second CPU received by the communication unit. Control method.

Images