Printing apparatus, control method of printing apparatus, and network system

A printing apparatus includes: a printing apparatus storage unit that stores firmware to which a public key is added, the public key being information related to a public key encryption method; a printing apparatus network-communication unit that receives signature information obtained by encrypting a hash value of overwriting firmware with a private key corresponding to the public key, from the management server, and that receives the overwriting firmware from the file providing server; and a printing apparatus control unit that determines validity of the overwriting firmware by comparing a hash value generated by decrypting the signature information which is received from the management server with the public key stored in the printing apparatus storage unit, and a hash value of the overwriting firmware which is received from the file providing server.

BACKGROUND

1. Technical Field

The present invention relates to a printing apparatus, a control method of a printing apparatus, and a network system.

2. Related Art

In the related art, as a printing apparatus (image forming apparatus1) connected to a server (server2), a printing apparatus that determines validity of overwriting firmware by checking whether or not the overwriting firmware is tampered with when overwriting firmware with the overwriting firmware received from the server, is known (for example, refer to JP-A-2006-185063).

As in the printing apparatus described above, in a printing apparatus that executes overwriting of firmware with the overwriting firmware received from the server, there is a need to more accurately determine the validity of the overwriting firmware using characteristics of a configuration of the server which communicates with the printing apparatus.

SUMMARY

An advantage of some aspects of the invention is to provide a printing apparatus and a network system including the printing apparatus that can accurately determine the validity of the overwriting firmware using characteristics of the configuration of the server which communicates with the printing apparatus, the printing apparatus executing overwriting of firmware with the overwriting firmware received from the server.

According to an aspect of the invention, there is provided a printing apparatus that can communicate with a management server and a file providing server, the apparatus including: a printing apparatus storage unit that stores firmware to which a public key is added, the public key being information related to a public key encryption method; a printing apparatus communication unit that receives signature information obtained by encrypting a hash value of overwriting firmware with a private key corresponding to the public key, from the management server, and that receives the overwriting firmware from the file providing server; and a printing apparatus control unit that determines validity of the overwriting firmware by comparing a hash value generated by decrypting the signature information which is received from the management server by the printing apparatus communication unit with the public key stored in the printing apparatus storage unit, and a hash value generated from the overwriting firmware which is received from the file providing server by the printing apparatus communication unit.

According to this configuration of the aspect of the invention, an apparatus (file providing server) as a transmission source of the overwriting firmware is different from an apparatus (management server) as a transmission source of signature information used for determining the validity of the overwriting firmware. Accordingly, a possibility that a third party acquires both of the overwriting firmware and the signature information, can be effectively reduced. Thus, it is possible to effectively reduce a possibility that a third party decrypts the private key by using both of the overwriting firmware and the signature information. Therefore, the printing apparatus can accurately determine the validity of the overwriting firmware. That is, according to this configuration, in the printing apparatus that executes overwriting of firmware with the overwriting firmware received from the server, it is possible to accurately determine the validity of the overwriting firmware using characteristics of the configuration of the server which communicates with the printing apparatus.

In the aspect of the invention, the printing apparatus control unit may execute overwriting of the firmware with the overwriting firmware, in a case where it is determined that the overwriting firmware has validity, the firmware being stored in the printing apparatus storage unit, and the printing apparatus control unit may not execute overwriting of the firmware with the overwriting firmware, in a case where it is determined that the overwriting firmware does not have validity, the firmware being stored in the printing apparatus storage unit.

According to this configuration of the aspect of the invention, it is possible to prevent the firmware stored in the printing apparatus from being overwritten with firmware which may be tampered with.

In the aspect of the invention, the printing apparatus control unit may determine that the overwriting firmware has validity, in a case where the hash value generated by decrypting the signature information which is received from the management server by the printing apparatus communication unit with the public key stored in the printing apparatus storage unit is the same as the hash value generated from the overwriting firmware which is received from the file providing server by the printing apparatus communication unit.

According to this configuration of the aspect of the invention, the printing apparatus can accurately determine the validity of the overwriting firmware.

The printing apparatus according to the aspect of the invention may further include a printing unit that performs printing on a printing medium, in which the printing apparatus control unit may print information indicating that the overwriting firmware may be tampered with, on the printing medium, by controlling the printing unit, in a case where it is determined that the overwriting firmware does not have validity.

According to this configuration of the aspect of the invention, by visually confirming the information printed on the printing medium, a user can accurately recognize that the overwriting firmware may be tampered with.

In the aspect of the invention, the printing apparatus control unit may permit modification of the public key by overwriting of the firmware with the overwriting firmware, and on the other hand, may prohibit modification of the public key by another method, the public key being stored in the printing apparatus storage unit.

According to this configuration of the aspect of the invention, it is possible to prevent the public key from being illegally modified.

Further, according to another aspect of the invention, there is provided a control method of a printing apparatus that can communicate with a management server and a file providing server, the method including: storing firmware to which a public key is added, the public key being information related to a public key encryption method; receiving signature information obtained by encrypting a hash value of overwriting firmware with a private key corresponding to the public key, from the management server, and receiving the overwriting firmware from the file providing server; and determining validity of the overwriting firmware by comparing a hash value generated by decrypting the signature information which is received from the management server with the stored public key, and a hash value generated from the overwriting firmware which is received from the file providing server.

According to this configuration of the aspect of the invention, an apparatus (file providing server) as a transmission source of the overwriting firmware is different from an apparatus (management server) as a transmission source of signature information used for determining the validity of the overwriting firmware. Accordingly, a possibility that a third party acquires both of the overwriting firmware and the signature information, can be effectively reduced. Thus, it is possible to effectively reduce a possibility that a third party decrypts the private key by using both of the overwriting firmware and the signature information. Therefore, the printing apparatus can accurately determine the validity of the overwriting firmware. That is, according to this configuration, in the printing apparatus that executes overwriting of firmware with the overwriting firmware received from the server, it is possible to accurately determine the validity of the overwriting firmware using characteristics of the configuration of the server which communicates with the printing apparatus.

Furthermore, according to still another aspect of the invention, there is provided a network system including: a management server; a file providing server; and a printing apparatus that can communicate with the management server and the file providing server, in which the printing apparatus stores firmware to which a public key is added, the public key being information related to a public key encryption method, in which the management server generates signature information by encrypting a hash value of overwriting firmware for the firmware with a private key corresponding to the public key, and transmits the generated signature information to the printing apparatus, in which the file providing server transmits the overwriting firmware to the printing apparatus, and in which the printing apparatus receives the signature information from the management server and receives the overwriting firmware from the file providing server, and determines validity of the overwriting firmware by comparing a hash value generated by decrypting the signature information which is received from the management server with the stored public key, and a hash value generated from the overwriting firmware which is received from the file providing server.

According to this configuration of the aspect of the invention, an apparatus (file providing server) as a transmission source of the overwriting firmware is different from an apparatus (management server) as a transmission source of signature information used for determining the validity of the overwriting firmware. Accordingly, a possibility that a third party acquires both of the overwriting firmware and the signature information, can be effectively reduced. Thus, it is possible to effectively reduce a possibility that a third party decrypts the private key by using both of the overwriting firmware and the signature information. Therefore, the printing apparatus can accurately determine the validity of the overwriting firmware. That is, according to this configuration, in network system including the printing apparatus that executes overwriting of firmware with the overwriting firmware received from the server, it is possible to accurately determine the validity of the overwriting firmware using characteristics of the configuration of the server which communicates with the printing apparatus.

DESCRIPTION OF EXEMPLARY EMBODIMENTS

Hereinafter, an embodiment according to the invention will be described with reference to the drawings.

FIG. 1is a diagram illustrating a configuration of a network system1according to the embodiment.

As illustrating inFIG. 1, the network system1includes a server unit2(server) and a plurality of store systems3. The server unit2is configured to include a printing apparatus control server2a(first server), a management server2b(second server), and a file providing server2c(third server). In the network system1, the server unit2and each of the store systems3are connected to each other so as to communicate with each other via a global network GN which is configured to include the Internet and other networks.

Configurations and functions of the printing apparatus control server2a, the management server2b, and the file providing server2cwill be described later.

InFIG. 1, although each of the printing apparatus control server2a, the management server2b, and the file providing server2cis expressed by one block, this does not mean that each of the servers is configured with a single server apparatus. For example, the printing apparatus control server2amay be configured to include a plurality of server apparatuses.

The store system3is a system provided in a store such as a supermarket, a convenience store, a department store, or a restaurant at which merchandise, a service, or the like is provided and accounting is performed according to the provision.

As illustrated inFIG. 1, the store system3includes a local network LN. One or a plurality of printing apparatuses10, one or a plurality of host computers11corresponding to each of the printing apparatuses10, and a communication apparatus12are connected to the local network LN.

The communication apparatus12is an interface apparatus that connects the local network LN and the global network GN. The communication apparatus12has a function as a modem (or an optical network unit (ONU)), a function as a router, a network address translation (NAT) function, a function as a dynamic host configuration protocol (DHCP) server, and the like. The communication apparatus12transfers data which is transmitted and received between an apparatus connected to the local network LN and an apparatus connected to the global network GN when communication is performed between the apparatuses. InFIG. 1, although the communication apparatus12is represented by one block, the communication apparatus12may be configured to include a plurality of apparatuses according to the function.

As illustrated inFIG. 1, proxy servers13provided in a demilitarized zone (DMZ) segment SG are connected to the local network LN via a fire wall FW. The proxy server13is configured to include a relay server, a DNS server, a web server, or the like. Illegal access from the global network GN to the apparatus connected to the local network LN is prevented by functions of the firewall FW and the proxy server13provided in the DMZ segment SG.

The printing apparatus10and the host computer11are provided at a checkout counter at which a customer performs accounting in a store. The host computer11issues a receipt by controlling the printing apparatus10according to accounting performed at the checkout counter. The receipt issued by the printing apparatus10is handed over to the customer by a person in charge of the checkout counter.

The printing apparatus10has a function of accessing the global network GN and communicating with the apparatus connected to the global network GN (including the printing apparatus control server2a, the management server2b, and the file providing server2c). Secure communication is performed between the printing apparatus10and the server unit2by using a technique related to encryption, such as a virtual private network (VPN), or a technique related to a virtual dedicated line (which may be a physical dedicated line).

A configuration and a function of the printing apparatus10will be described later.

FIG. 2is a block diagram illustrating a functional configuration of the printing apparatus10.

The printing apparatus10is an apparatus that has a function of accommodating roll paper (print medium), transporting the accommodated roll paper, printing an image on the accommodated roll paper, and cutting the roll paper. A printing method of the printing apparatus10may be any one of a thermal method, an ink jet method, and the like.

As illustrated inFIG. 2, the printing apparatus10includes a printing apparatus control unit20, a printing apparatus storage unit21, a printing unit22, a printing apparatus network-communication unit23(printing apparatus communication unit), and a printing apparatus device-communication unit24.

The printing apparatus control unit20includes an system on a chip (SOC)201on which a first processor201aand a second processor201bare mounted, a ROM, a RAM, an ASIC, a signal processing circuit, and the like, and controls each unit of the printing apparatus10.

The printing apparatus storage unit21includes a nonvolatile memory, and stores first firmware21a, second firmware21b, and other data.

The first firmware21ais firmware which has at least a function of printing an image by controlling the printing unit22to be described and a function of performing communication with the host computer11by controlling the printing apparatus device-communication unit24to be described. The printing apparatus control unit20reads and executes the first firmware21aby the first processor201a, and controls the printing unit22and the printing apparatus device-communication unit24by the function of the first firmware21a. The second firmware21bis firmware which has at least a function of communicating with an apparatus connected to the global network GN by controlling the printing apparatus network-communication unit23to be described. The printing apparatus control unit20reads and executes the second firmware21bby the second processor201b, and controls the printing apparatus network-communication unit23by the function of the second firmware21b.

The printing unit22has at least a printing mechanism, a transporting mechanism, and a cutting mechanism. The printing mechanism includes a printing head and other elements related to printing. The transporting mechanism includes a transporting roller for transporting the roll paper accommodated in the printing apparatus10in a predetermined direction, and other elements related to the transporting of the roll paper. The cutting mechanism includes a cutter for cutting the roll paper and other elements related to the cutting of the roll paper. Under the control of the printing apparatus control unit20, the printing unit22transports the roll paper in a predetermined direction, prints an image on the roll paper by the printing mechanism, and cuts the roll paper at a predetermined position by the cutting mechanism. Thus, a piece of paper on which the image is printed, is issued.

Under the control of the printing apparatus control unit20, the printing apparatus network-communication unit23communicates with an apparatus connected to the global network GN according to a predetermined communication standard. Any communication standard may be used for communication between the printing apparatus10and the apparatus connected to the global network GN. The communication standard which is used when the printing apparatus10communicates with the printing apparatus control server2a, the management server2b, and the file providing server2cof the server unit2will be described later.

The printing apparatus device-communication unit24communicates with the host computer11according to a predetermined communication standard under the control of the printing apparatus control unit20. The communication standard which is used for communication between the printing apparatus10and the host computer11may be a wired communication standard or a wireless communication standard. The wired communication standard is, for example, USB, a serial communication standard such as RS232C other than USB, a parallel communication standard such as IEEE1284, or Ethernet (registered trademark). In addition, the wireless communication standard is, for example, a wireless LAN communication standard such as Wi-Fi (registered trademark), or a near-field communication standard such as Bluetooth (registered trademark).

FIG. 3is a block diagram illustrating functional configurations of the printing apparatus control server2a, the management server2b, and the file providing server2c.

As illustrated inFIG. 3, the printing apparatus control server2aincludes a first server control unit30, a first server communication unit31, and a first server storage unit32.

The first server control unit30includes a CPU, a ROM, a RAM, an ASIC, a signal processing circuit, and the like, and controls each unit of the printing apparatus control server2a.

Under the control of the first server control unit30, the first server communication unit31communicates with an apparatus connected to the global network GN according to the predetermined communication standard.

The first server storage unit32includes a nonvolatile memory, and stores various types of data. The data stored in the first server storage unit32will be described later.

As illustrated inFIG. 3, the management server2bincludes a second server control unit40, a second server communication unit41, and a second server storage unit42.

The second server control unit40includes a CPU, a ROM, a RAM, an ASIC, a signal processing circuit, and the like, and controls each unit of the management server2b.

Under the control of the second server control unit40, the second server communication unit41communicates with an apparatus connected to the global network GN according to the predetermined communication standard.

The second server storage unit42includes a nonvolatile memory, and stores various types of data. The data stored in the second server storage unit42will be described later.

As illustrated inFIG. 3, the file providing server2cincludes a third server control unit50, a third server communication unit51, and a third server storage unit52.

The third server control unit50includes a CPU, a ROM, a RAM, an ASIC, a signal processing circuit, and the like, and controls each unit of the file providing server2c.

Under the control of the third server control unit50, the third server communication unit51communicates with an apparatus connected to the global network GN according to the predetermined communication standard.

The third server storage unit52includes a nonvolatile memory, and stores various types of data. The data stored in the third server storage unit52will be described later.

Next, operations of the printing apparatus10, the printing apparatus control server2a, and the management server2bafter the printing apparatus10is powered on, will be described.

FIG. 4is a flowchart illustrating operations of the printing apparatus10, the printing apparatus control server2a, and the management server2bat the time of startup of the printing apparatus10after the printing apparatus10is powered on. InFIG. 4, a flowchart FA illustrates operations of the printing apparatus10, a flowchart FB illustrates operations of the printing apparatus control server2a, and a flowchart FC illustrates operations of the management server2b.

For example, in a store provided with the printing apparatus10, the printing apparatus10is powered on by a user at a predetermined timing before the store is open.

As illustrated in the flowchart FA ofFIG. 4, when the printing apparatus10is powered on (step S1), the printing apparatus control unit20of the printing apparatus10acquires first server access address information J1(step SA1). The first server access address information J1is information indicating an address of the printing apparatus control server2a. The first server access address information J1is registered in advance in the printing apparatus10, and is stored in a predetermined storage area of the printing apparatus storage unit21.

Next, the printing apparatus control unit20accesses the printing apparatus control server2aaccording to WebSocket based on the first server access address information J1by controlling the printing apparatus network-communication unit23, and establishes a WebSocket connection with the printing apparatus control server2a(step SA2).

The WebSocket is one communication standard which allows asynchronous bidirectional communication between a server connected via a network (in this example, the printing apparatus control server2a) and a client (in this example, the printing apparatus10). The WebSocket connection is a logical communication path for transmitting and receiving data according to a WebSocket protocol and a WebSocket procedure between a server (in this example, the printing apparatus control server2a) and a client (in this example, the printing apparatus10), the server and the client being connected to each other by the WebSocket connection.

After the WebSocket connection is established in step SA2, the printing apparatus10and the printing apparatus control server2aperform the asynchronous bidirectional communication (WebSocket communication) via the WebSocket connection.

As described above, when the power is on, the printing apparatus10accesses the printing apparatus control server2a, and establishes the WebSocket connection with the server. Thereby, a state where the printing apparatus10and the server can perform asynchronous bidirectional communication, is established.

Although a detailed description is omitted, when establishing the WebSocket connection, authentication of the printing apparatus10may be appropriately performed by the printing apparatus control server2a, and authentication of the printing apparatus control server2amay be appropriately performed by the printing apparatus10, based on an existing technology.

In this embodiment, although the WebSocket is used as a communication standard for communication between the printing apparatus10and the printing apparatus control server2a, this is only an example, and another communication standard may be used.

After establishing the WebSocket connection, the printing apparatus control unit20generates printing apparatus startup information J2(step SA3).

The printing apparatus startup information J2is information including at least printing apparatus identification information J3and startup notification information J4.

The printing apparatus identification information J3is identification information for uniquely identifying the printing apparatus10, and the printing apparatus identification information J3having a different value is assigned for each printing apparatus10. As the printing apparatus identification information J3, a serial number which is assigned for the printing apparatus10at a manufacturing stage of the printing apparatus10, can be used. The printing apparatus identification information J3is registered in advance in the printing apparatus10, and is stored in a predetermined storage area of the printing apparatus storage unit21. The startup notification information J4is information for notifying startup of the printing apparatus10by power-on of the printing apparatus10.

After generating the printing apparatus startup information J2in step SA3, the printing apparatus control unit20transmits the printing apparatus startup information J2obtained in step SA3to the printing apparatus control server2avia the WebSocket connection by controlling the printing apparatus network-communication unit23(step SA4).

As illustrated in the flowchart FB ofFIG. 4, the first server control unit30of the printing apparatus control server2areceives the printing apparatus startup information J2by controlling the first server communication unit31(step SB1).

Next, the first server control unit30generates second server access password information J5(step SB2).

The second server access password information J5is information indicating a password which is used when the printing apparatus10accesses the management server2b. As will be described later, when accessing the management server2b, the printing apparatus10notifies the management server2bof the second server access password information J5. The management server2bauthenticates the printing apparatus10as an access source based on the second server access password information J5.

A value of the second server access password information J5is not a fixed value but a variable value which changes each time the information is generated. In step SB2, the first server control unit30generates the second server access password information J5using a predetermined algorithm.

Next, the first server control unit30generates printing apparatus authentication information J6(step SB3).

The printing apparatus authentication information J6is information including at least the printing apparatus identification information J3and the second server access password information J5.

Next, the first server control unit30transmits the printing apparatus authentication information J6generated in step SB3to the management server2bby controlling the first server communication unit31(step SB4).

As illustrated in the flowchart FC ofFIG. 4, the second server control unit40of the management server2breceives the printing apparatus authentication information J6by controlling the second server communication unit41(step SC1).

Next, the second server control unit40updates a content of a corresponding record of a printing apparatus authentication information management database DB2astored in the second server storage unit42(step SC2).

The printing apparatus authentication information management database DB2ais a database including records for each printing apparatus10. Each record of the printing apparatus authentication information management database DB2aincludes the printing apparatus identification information J3and the second server access password information J5.

In step SC2, the second server control unit40specifies, from records of the printing apparatus authentication information management database DB2a, a record which includes printing apparatus identification information J3having the same value as a value of the printing apparatus identification information J3included in the received printing apparatus authentication information J6. Here, the specified record corresponds to the “corresponding record”. Next, the second server control unit40updates a value of second server access password information J5of the specified record with the value of the second server access password information J5included in the received printing apparatus authentication information J6.

In this embodiment, the management server2bstores the printing apparatus authentication information management database DB2a, and the management server2bupdates the database. On the other hand, it is not always necessary that the management server2bstores the printing apparatus authentication information management database DB2a. The printing apparatus authentication information management database DB2amay be in a location that can be referred to by the management server2b, and the database may be updated by the printing apparatus control server2a.

As illustrated in the flowchart FB ofFIG. 4, after transmitting the printing apparatus authentication information J6to the management server2b, the first server control unit30generates second server access relevant information J7(step SB5).

The second server access relevant information J7is information including at least the second server access password information J5and second server access address information J8.

The second server access address information J8is information indicating an address of the management server2b.

The second server access address information J8is registered in advance in the printing apparatus control server2a, and is stored in a predetermined storage area of the first server storage unit32.

In addition, in a case where the management server2bis configured to include a plurality of server apparatuses having different addresses from each other, the first server control unit30executes the following processing in step SB5. That is, the second server access address information J8of each of the plurality of server apparatuses constituting the management server2bis registered in advance in the printing apparatus control server2a, and is stored in a predetermined storage area of the first server storage unit32. In step SB5, the first server control unit30selects one management server2bthat will be notified of the second server access address information J8such that accesses are not concentrated on a specific management server2b, and includes the second server access address information J8corresponding to the selected management server2binto the second server access relevant information J7. The printing apparatus10accesses the printing apparatus control server2awhen the power is on. Thus, by performing such processing using the access appropriately, it is possible to effectively distribute a load of the management server2b.

After generating the second server access relevant information J7, the first server control unit30transmits the second server access relevant information J7to the printing apparatus10by controlling the first server communication unit31(step SB6).

As illustrated in the flowchart FA ofFIG. 4, the printing apparatus control unit20of the printing apparatus10receives the second server access relevant information J7by controlling the printing apparatus network-communication unit23(step SA5).

Next, the printing apparatus control unit20stores the received second server access relevant information J7in a predetermined storage area of the printing apparatus storage unit21(step SA6). In a case where stored second server access relevant information J7already exists in the printing apparatus storage unit21, in step SA6, the printing apparatus control unit20overwrites the existing second server access relevant information J7with the received second server access relevant information J7, and stores the overwritten second server access relevant information J7.

As described above, when the power is on, the printing apparatus10accesses the printing apparatus control server2a, receives the second server access relevant information J7from the printing apparatus control server2a, and stores the received information.

Next, operations of the printing apparatus10, the management server2b, and the file providing server2cduring a period for which the printing apparatus10is started up and is operated, will be described.

FIGS. 5A and 5Bare flowcharts illustrating operations of the printing apparatus10, the management server2b, and the file providing server2cduring an operation period of the printing apparatus10. InFIGS. 5Aand5B, a flowchart FD illustrates operations of the printing apparatus10, a flowchart FE illustrates operations of the management server2b, and a flowchart FF illustrates operations of the file providing server2c.

Here, the operation period of the printing apparatus10refers to, for example, a period from a time when the printing apparatus10is powered on and is started up to a time when the printing apparatus10is powered off and is stopped.

As illustrated in the flowchart FD ofFIG. 5A, the printing apparatus control unit20of the printing apparatus10monitors whether or not it is time to transmit periodic printing apparatus information J9to be described later to the management server2b(step SD1).

Here, during the operation period, the printing apparatus10periodically transmits the periodic printing apparatus information J9to be described later, to the management server2bat a predetermined time interval (for example, one hour). In step SD1, in a case where it is detected that the predetermined time interval elapses after previous transmission of the periodic printing apparatus information J9, the printing apparatus control unit20determines that it is time to transmit the periodic printing apparatus information J9. When the printing apparatus10is powered on, the printing apparatus control unit20receives the second server access relevant information J7from the printing apparatus control server2a. At this time, in response to the reception of the second server access relevant information J7, the printing apparatus control unit20transmits the first periodic printing apparatus information J9.

Information indicating the predetermined time interval at which the printing apparatus10transmits the periodic printing apparatus information J9is registered in advance in the printing apparatus10, and is stored in a predetermined storage area of the printing apparatus storage unit21.

In step SD1, in a case where it is determined that it is time to transmit the periodic printing apparatus information J9(YES in step SD1), the printing apparatus control unit20generates the periodic printing apparatus information J9(step SD2).

The periodic printing apparatus information J9is information including at least the printing apparatus identification information J3, the second server access password information J5, first firmware version information J10, second firmware version information J11, and printing apparatus model information J12. The periodic printing apparatus information J9corresponds to “printing apparatus information”.

In step SD2, the printing apparatus control unit20refers to the second server access relevant information J7which is stored in the predetermined storage area of the printing apparatus storage unit21in step SA6of the flowchart FA ofFIG. 4, acquires the second server access password information J5included in the second server access relevant information J7, and includes the acquired second server access password information J5into the periodic printing apparatus information J9.

The first firmware version information J10is information indicating a version of the first firmware21a. The first firmware version information J10is described in a data portion of the first firmware21a. In step SD2, the printing apparatus control unit20refers to the data portion of the first firmware21a, acquires the first firmware version information J10, and includes the acquired first firmware version information J10into the periodic printing apparatus information J9.

The second firmware version information J11is information indicating a version of the second firmware21b. The second firmware version information J11is described in a data portion of the second firmware21b. In step SD2, the printing apparatus control unit20refers to the data portion of the second firmware21b, acquires the second firmware version information J11, and includes the acquired second firmware version information J11into the periodic printing apparatus information J9.

The printing apparatus model information J12is information indicating a model of the printing apparatus10. The printing apparatus model information J12is registered in advance in the printing apparatus10, and is stored in a predetermined storage area of the printing apparatus storage unit21.

After generating the periodic printing apparatus information J9in step SD2, the printing apparatus control unit20executes the following processing (step SD3). That is, the printing apparatus control unit20refers to the second server access relevant information J7stored in the predetermined storage area of the printing apparatus storage unit21, and acquires the second server access address information J8included in the second server access relevant information J7. Next, the printing apparatus control unit20transmits the generated periodic printing apparatus information J9, to a destination with an address indicated by the acquired second server access address information J8(address of the management server2b), by controlling the printing apparatus network-communication unit23.

In step SD3, according to a hypertext transfer protocol (HTTP), the printing apparatus control unit20transmits the periodic printing apparatus information J9as an HTTP request, to the management server2b.

Here, as described above, in the store system3, illegal access from the global network GN to the apparatus connected to the local network LN is prevented by functions of the firewall FW and the proxy server13provided in the DMZ segment SG. For this reason, in a situation where connection is not established between the management server2band a specific printing apparatus10provided in the store system3, the management server2bcannot transmit information directly to the specific printing apparatus10. Based on this fact, between the printing apparatus10and the management server2b, information as an HTTP request is transmitted from the printing apparatus10functioning as a client to the management server2bfunctioning as a sever, and information as an HTTP response to the HTTP request is transmitted from the management server2bto the printing apparatus10. Thus, information is transmitted and received between the printing apparatus10and the management server2b.

As illustrated in the flowchart FE ofFIG. 5A, the second server control unit40of the management server2breceives the periodic printing apparatus information J9by controlling the second server communication unit41(step SE1).

Next, the second server control unit40acquires the printing apparatus identification information J3and the second server access password information J5included in the received periodic printing apparatus information J9, and executes authentication processing based on the acquired information (step SE2). The authentication processing is processing of trying to authenticate the printing apparatus10as an access source and determining whether or not the authentication is successful.

More specifically, in step SE2, the second server control unit40refers to the printing apparatus authentication information management database DB2a, and specifies the corresponding record in the records of the database. Next, the second server control unit40determines whether or not a combination of a value of the printing apparatus identification information J3and a value of the second server access password information J5in the specified corresponding record matches with a combination of a value of the printing apparatus identification information J3and a value of the second server access password information J5included in the received periodic printing apparatus information J9. In a case where it is determined that the combinations match with each other, the second server control unit40determines that the authentication of the printing apparatus10is successful. In a case where it is determined that the combinations do not match with each other, the second server control unit40determines that the authentication of the printing apparatus10is failed.

Although a detailed description is omitted, in a case where the authentication of the printing apparatus10is failed, the second server control unit40executes processing corresponding to the failure of the authentication instead of executing step SE3and subsequent processes. For example, the second server control unit40notifies a person having legitimate authority such as an operator of the management server2bthat the authentication is failed, by using a predetermined method.

In a case where it is determined that the authentication is successful in the authentication processing of step SE2, the second server control unit40refers to a firmware version management database DB2b(step SE3). The firmware version management database DB2bis a database for managing the latest firmware version of each of the first firmware21aand the second firmware21b, for each model of the printing apparatus10. The firmware version management database DB2bincludes records for each model of the printing apparatus10. In the firmware version management database DB2b, a record corresponding to one model includes the printing apparatus model information J12of the one model, the first firmware version information J10indicating a version of the “latest” first firmware21athat can be installed in the printing apparatus10of the one model, and the second firmware version information J11indicating a version of the “latest” second firmware21bthat can be installed in the printing apparatus10of the one model.

The contents of the firmware version management database DB2bare updated at an appropriate timing by a predetermined method.

Next, the second server control unit40determines whether or not a first condition (predetermined condition) is satisfied (step SE4).

The first condition is a condition for the first firmware21aor the second firmware21bin that there is a new version of the firmware that is newer than the version of the firmware currently installed in the printing apparatus10. “There is a new version of the firmware that is newer than the version of the firmware currently installed in the printing apparatus10” means that the firmware version management database DB2bmanages a new version of the firmware which can be installed in the printing apparatus10and is newer than the version of the firmware currently installed in the printing apparatus10. For example, in a case where the first firmware version information J10is stored in the firmware version management database DB2bin correlation with the printing apparatus model information J12indicating one model, the first firmware version information J10indicating a new version of the first firmware21athat is newer than the version of the first firmware21acurrently installed in one printing apparatus10of the one model, there is a new version of the first firmware21athat is newer than the version of the first firmware21acurrently installed in the one printing apparatus10.

Processing of step SE4will be described in detail. The second server control unit40acquires the printing apparatus model information J12included in the periodic printing apparatus information J9which is received in step SE1. Next, the second server control unit40specifies a record which includes printing apparatus model information J12having the same value as a value of the acquired printing apparatus model information J12. Next, the second server control unit40compares a value of the first firmware version information J10in the specified record with a value of the first firmware version information J10included in the received periodic printing apparatus information J9, and based on the comparison result, determines whether or not there is a new version of the first firmware21athat is newer than the version of the first firmware21acurrently installed in the printing apparatus10. Similarly, the second server control unit40compares a value of the second firmware version information J11in the specified record with a value of the second firmware version information J11included in the received periodic printing apparatus information J9, and based on the comparison result, determines whether or not there is a new version of the second firmware21bthat is newer than the version of the second firmware21bcurrently installed in the printing apparatus10. For both of the first firmware21aand the second firmware21b, in a case where there is not a new version of the firmware that is newer than the version of the firmware currently installed in the printing apparatus10, the second server control unit40determines that the first condition is not satisfied. Otherwise, the second server control unit40determines that the first condition is satisfied.

In step SE4, in a case where it is determined that the first condition is not satisfied (NO in step SE4), the second server control unit40generates non-execution instruction information J13including information for instructing non-execution of update of the firmware (step SE5).

Next, the second server control unit40transmits the non-execution instruction information J13as an HTTP response to the printing apparatus10, by controlling the second server communication unit41(step SE6).

In step SE4, in a case where it is determined that the first condition is satisfied (YES in step SE4), the second server control unit40refers to update management database DB2cstored in the second server storage unit42(step SE7).

The update management database DB2cincludes records for each printing apparatus10. In the update management database DB2c, a record corresponding to one printing apparatus10includes the printing apparatus identification information J3of the one printing apparatus10, update permission information J14for the one printing apparatus10, and update-executable time period information J15for the one printing apparatus10.

The update permission information J14is information indicating whether or not update to a new version of the firmware is permitted in a case where there is a new version of the firmware that is newer than the version of the firmware currently installed in the printing apparatus10. The update permission information J14has a value indicating that the update is permitted, or a value indicating that the update is not permitted.

In the following description, the first firmware21a, which is installed in the printing apparatus10when the printing apparatus control unit20transmits the periodic printing apparatus information J9in step SD3, is appropriately referred to as “existing first firmware” Also, at that time, the second firmware21b, which is installed in the printing apparatus10, is appropriately referred to as “existing second firmware”. The existing first firmware and the existing second firmware are collectively referred to as “existing firmware” in a case where it is not necessary to distinguish the firmware.

In addition, a new version of the first firmware21athat is newer than the version of the existing first firmware, is appropriately referred to as “new first firmware”. Also, a new version of the second firmware21bthat is newer than the version of the existing second firmware, is appropriately referred to as “new second firmware”. The new first firmware and the new second firmware are collectively referred to as “new firmware” in a case where it is not necessary to distinguish the firmware.

In a case of update of the existing first firmware, the printing apparatus10overwrites the existing first firmware with the new first firmware. Similarly, in a case of update of the existing second firmware, the printing apparatus10overwrites the existing second firmware with the new second firmware.

Here, even in a case where there is new firmware that can be installed in the printing apparatus10, update of the existing firmware to the new firmware may not be permitted in some cases. For example, in a case where an operation test of the new firmware is not completed or a result of the operation test is not normal, it is not appropriate to update the existing firmware with the new firmware. Also, for example, in some cases, there is a contract between users in that the existing firmware of one printing apparatus10cannot be updated with the new firmware. Further, for example, there is a case where a user does not want to update the existing firmware with the new firmware.

In a case where it is not permitted to update the existing firmware with the new firmware for one printing apparatus10, a value of the update permission information J14of the one printing apparatus10is set to a value indicating that update is not permitted. On the other hand, in a case where it is permitted to update the existing firmware with the new firmware for one printing apparatus10, a value of the update permission information J14of the one printing apparatus10is set to a value indicating that update is permitted.

The update-executable time period information J15is information indicating a time period during which the printing apparatus10can execute processing of updating the existing firmware with the new firmware.

Here, as described above, the printing apparatus10is provided at a checkout counter of a store, and issues a receipt according to accounting performed at the checkout counter. Thus, since a time period from an opening time of the store to a closing time of the store affects work to be performed at the store, during the time period, the printing apparatus10cannot execute the processing of updating the existing firmware with the new firmware. In addition, in some stores, the printing apparatus10may be used for another purpose other than issuing of a receipt. In this case, the time period during which the printing apparatus10is used for another purpose is a time period during which the printing apparatus10cannot execute the processing of updating the existing firmware with the new firmware. As described above, for each printing apparatus10, there is a time period during which the printing apparatus10can execute printing and a time period during which the printing apparatus10cannot execute printing excluding the time period.

For one printing apparatus10, the update-executable time period information J15of the one printing apparatus10is information indicating a time period during which the one printing apparatus10does not execute printing and the one printing apparatus10can execute the processing of updating the existing firmware with the new firmware.

In this embodiment, although a case where the printing apparatus10is provided at a store and is used for issuing of a receipt is described as an example, a location at which the printing apparatus10is provided is not limited to a store, and the use of the printing apparatus10is also not limited to issuing of a receipt. Based on this fact, a time period indicated by the update-executable time period information J15is appropriately determined according to an environment at which the printing apparatus10is provided and the use of the printing apparatus10.

The contents of the update management database DB2care updated at an appropriate timing by a predetermined method.

After referring to the update management database DB2cin step SE7, the second server control unit40determines whether or not a second condition (predetermined condition) is satisfied (step SE8).

The second condition is that the existing firmware of the printing apparatus10is permitted to be updated with the new firmware.

In step SE8, the second server control unit40specifies, from records of the update management database DB2creferenced in step SE7, a record which includes printing apparatus identification information J3having the same value as a value of the printing apparatus identification information J3included in the periodic printing apparatus information J9received in step SE1. Next, the second server control unit40refers to the update permission information J14included in the specified record. In a case where a value of the update permission information J14is a value indicating that update is permitted, the second server control unit40determines that the second condition is satisfied. On the other hand, in a case where a value of the update permission information J14is a value indicating that update is not permitted, the second server control unit40determines that the second condition is not satisfied.

In step SE8, in a case where it is determined that the second condition is not satisfied (NO in step SE8), the second server control unit40executes processing of step SE5and processing of step SE6.

On the other hand, in step SE8, in a case where it is determined that the second condition is satisfied (YES in step SE8), the second server control unit40determines whether or not a third condition is satisfied (step SE9).

The third condition is that the printing apparatus10is in the time period during which the printing apparatus10can execute the processing of updating the existing firmware with the new firmware.

In step SE9, the second server control unit40specifies, from records of the update management database DB2creferenced in step SE7, a record which includes printing apparatus identification information J3having the same value as a value of the printing apparatus identification information J3included in the periodic printing apparatus information J9received in step SE1. Next, the second server control unit40refers to the update-executable time period information J15included in the specified record. In a case where the printing apparatus10is in the time period indicated by the update-executable time period information J15, the second server control unit40determines that the third condition is satisfied. On the other hand, in a case where the printing apparatus10is not in the time period indicated by the update-executable time period information J15, the second server control unit40determines that the third condition is not satisfied.

In step SE9, in a case where it is determined that the third condition is not satisfied (NO in step SE9), as illustrated in the flowchart FE ofFIGS. 5A and 5B, the second server control unit40executes processing of step SE5and processing of step SE6.

In a case where all of the first condition, the second condition, and the third condition are satisfied, the second server control unit40determines that the existing firmware can be updated with the new firmware.

In step SE9, in a case where it is determined that the third condition is satisfied (YES in step SE9), as illustrated in the flowchart FE ofFIGS. 5A and 5B, the second server control unit40generates random URL information J16(step SE10).

The random URL information J16is information indicating a URL (address) of the file providing server2cwhich is accessed when the printing apparatus10downloads the new firmware from the file providing server2c.

The random URL information J16corresponds to “an address which designates a storage location of overwriting firmware”.

A value of the random URL information J16is not a fixed value but a variable value which changes each time the information is generated. In step SE10, the second server control unit40executes, for example, the following processing. That is, the second server control unit40sets a host name and a path name of a URL indicated by the random URL information J16, to predetermined values. In addition, the second server control unit40randomly generates a value, and adds the generated value to the URL indicated by the random URL information J16, as a parameter.

Next, the second server control unit40executes the following processing (step SE11). That is, the second server control unit40refers to the firmware version management database DB2b, and generates new firmware version notification information J23.

The new firmware version notification information J23is information that includes new firmware identification information for identifying the new firmware and new firmware version information indicating a version of the new firmware.

Processing of step SE11will be described in detail. The second server control unit40refers to the firmware version management database DB2b. In a case of updating the existing first firmware with the new first firmware, the second server control unit40includes a combination of the new first firmware identification information J17for identifying the new first firmware and the new first firmware version information J18indicating the version of the new first firmware, into the new firmware version notification information J23. In addition, the second server control unit40refers to the firmware version management database DB2b. In a case of updating the existing second firmware with the new second firmware, the second server control unit40includes a combination of the new second firmware identification information J20for identifying the new second firmware and the new second firmware version information J21indicating the version of the new second firmware, into the new firmware version notification information J23.

Next, the second server control unit40generates update relevant information J24(step SE12).

The update relevant information J24is information including at least the generated random URL information J16and the generated new firmware version notification information J23.

Next, the second server control unit40transmits the update relevant information J24to the file providing server2cby controlling the second server communication unit41(step SE13).

As illustrated in the flowchart FF ofFIGS. 5A and 5B, the third server control unit50of the file providing server2creceives the update relevant information J24(step SF1).

Next, the third server control unit50stores the update relevant information J24in a predetermined storage area of the third server storage unit52(step SF2). The update relevant information J24is cumulatively stored in the third server storage unit52.

As illustrated in the flowchart FE ofFIGS. 5A and 5B, the second server control unit40of the management server2bgenerates update instruction information J25(step SE14).

The update instruction information J25is information including at least information for instructing update of the firmware and the generated random URL information J16.

Next, the second server control unit40transmits the generated update instruction information J25as an HTTP response to the printing apparatus10, by controlling the second server communication unit41.

As illustrated in the flowchart FD ofFIGS. 5A and 5B, the printing apparatus control unit20of the printing apparatus10receives the non-execution instruction information J13transmitted by the management server2bin step SE6, or the update instruction information J25transmitted by the management server2bin SE15, by controlling the printing apparatus network-communication unit23(step SD4).

Next, the printing apparatus control unit20determines whether or not the received information is non-execution instruction information J13(step SD5).

In a case where the received information is the non-execution instruction information J13(YES in step SD5), the processing procedure of the printing apparatus control unit20transitions to step SD1. In this case, the firmware is not updated.

In a case where the received information is not the non-execution instruction information J13(NO in step SD5), in other words, in a case where the received information is the update instruction information J25, the printing apparatus control unit20executes firmware update processing (step SD6).

Hereinafter, the firmware update processing will be described in detail.

FIG. 6is a flowchart illustrating operations of the printing apparatus10, the management server2b, and the file providing server2cwhen the printing apparatus10executes the firmware update processing. InFIG. 6, a flowchart FG illustrates operations of the printing apparatus10, a flowchart FH illustrates operations of the management server2b, and a flowchart FI illustrates operations of the file providing server2c.

Processing of the flowchart FG corresponds to the firmware update processing.

In the following description, updating of the existing firmware with the new firmware is expressed as “updating of the firmware” as appropriate. Processing of updating the firmware corresponds to processing of overwriting the firmware.

As illustrated in the flowchart FG ofFIG. 6, the printing apparatus control unit20of the printing apparatus10determines whether or not it is possible to execute processing related to updating of the firmware (step SG1). For example, in a case where printing is being executed, in a case where a cover provided on a housing of the printing apparatus10is opened, or in a case where an error occurs in the printing apparatus10and thus processing related to updating of the firmware cannot be executed, the printing apparatus control unit20determines that the processing related to updating of the firmware cannot be executed.

In a case where the processing related to updating of the firmware cannot be executed (NO in step SG1), the printing apparatus control unit20executes corresponding processing (step SG2). For example, in a situation where the printing apparatus control unit20transitions from a waiting state to a state in which the processing related to updating of the firmware can be executed, in step SG2, the printing apparatus control unit20waits until transition to the state in which the processing related to updating of the firmware can be executed, and then transitions to step SG3. In addition, for example, in a situation where it is uncertain whether or not the printing apparatus control unit20transitions from a waiting state to a state in which the processing related to updating of the firmware can be executed, in step SG2, the printing apparatus control unit20notifies the management server2band other apparatuses of the fact, and notifies a user of the fact by a predetermined method.

In step SG1, in a case where it is determined that the processing related to updating of the firmware can be executed (YES in step SG1), an operation mode of the printing apparatus control unit20transitions to a firmware update mode (step SG3). During a period for which the operation mode is the firmware update mode, the printing apparatus control unit20prohibits execution of processing that may affect the processing related to updating of the firmware, such as processing related to printing.

Next, the printing apparatus control unit20prints information indicating start of firmware update on the roll paper by controlling the printing unit22(step SG4).

FIG. 7is a diagram illustrating an example of information printed on the roll paper in step SG4.

As illustrated inFIG. 7, information indicating that updating of the firmware is started, that a user will be notified when updating of the firmware is completed, and that it is not allowed to turn off the printing apparatus10until updating of the firmware is completed, is printed on the roll paper. By visually confirming the information printed on the roll paper, a user can accurately recognize start of firmware update and cautions.

In a case where the printing apparatus10does not include a display panel such as a liquid crystal display panel and thus the size of the printing apparatus10can be reduced, by performing processing of step SG4using a printing function of the printing apparatus10effectively, it is possible to notify a user of necessary information.

In addition, in a case where the printing apparatus10includes a display panel such as a liquid crystal display panel, the information may be displayed on the display panel.

Next, the printing apparatus control unit20notifies the management server2bof information indicating a state in which firmware update can be executed, as an HTTP request, by controlling the printing apparatus network-communication unit23(step SG5).

As illustrated in the flowchart FH ofFIG. 6, the second server control unit40of the management server2breceives the information transmitted by the printing apparatus10in step SG5by controlling the second server communication unit41(step SH1).

Next, the second server control unit40refers to a hash value management database DB2dstored in the second server storage unit42(step SH2).

The hash value management database DB2dis a database for managing a hash value of each version of firmware for each firmware. The hash value of firmware is a hash value which is obtained from file data of the firmware by using a predetermined hash function. For each version of each firmware, the hash value management database DB2dstores identification information for identifying each version of each firmware, identification information for identifying each version, and the hash value of each version of each firmware, in correlation with each other.

Next, the second server control unit40acquires a hash value of the new firmware for updating the existing firmware based on the hash value management database DB2d(step SH3). In step SH3, in a case of updating the existing first firmware with the new first firmware, the second server control unit40acquires a hash value of the new first firmware, based on the new first firmware identification information J17and the new first firmware version information J18. More specifically, the second server control unit40acquires the new first firmware identification information J17of the new first firmware that is included in the new firmware version notification information J23generated in step SE11of the flowchart FE ofFIGS. 5A and 5B, and acquires the new first firmware version information J18of the new first firmware based on the firmware version management database DB2b. Next, the second server control unit40acquires, from the hash value management database DB2d, a hash value which is correlated with a combination of identification information for identifying firmware having the same value as a value of the acquired new first firmware identification information J17and identification information for identifying a version having the same value as a value of the acquired first firmware version information J18.

In a case where there is new second firmware for updating the existing second firmware, the second server control unit40acquires a hash value of the new second firmware based on the new second firmware identification information J20and the new second firmware version information J21. The second server control unit40acquires the hash value of the new second firmware by the same method as a method of acquiring the hash value of the new first firmware.

Next, the second server control unit40acquires a private key (step SH4).

The private key is an encryption key corresponding to a public key encryption method. The private key is registered in advance in the management server2b, and is stored in a predetermined storage area of the second server storage unit42. As will be described later, a public key corresponding to the private key stored by the management server2bis stored in the printing apparatus10.

Next, the second server control unit40generates signature information J26by encrypting the hash value obtained in step SH3with the private key (step SH5). In a case where two hash values of the hash value of the new first firmware and the hash value of the new second firmware are acquired in step SH3, in step SH5, the second server control unit40generates two pieces of signature information J26based on each of the hash values.

Next, the second server control unit40transmits the one or two pieces of signature information J26generated in step SH5, as an HTTP response, to the printing apparatus10, by controlling the second server communication unit41(step SH6).

As illustrated in the flowchart FG ofFIG. 6, the printing apparatus control unit20of the printing apparatus10receives the signature information J26by controlling the printing apparatus network-communication unit23(step SG6).

Next, the printing apparatus control unit20acquires the public key (step SG7).

The public key is a decryption key corresponding to the public key encryption method. Here, the public key is described in the data portion of the first firmware21a. In step SG7, the printing apparatus control unit20acquires the public key by referring to the data portion of the first firmware21a.

Next, the printing apparatus control unit20generates a hash value by decrypting the signature information J26received in step SG6with the public key acquired in step SG7(step SG8). In step SG8, in a case of receiving the two pieces of signature information J26, the printing apparatus control unit20generates a hash value by decrypting each of the two pieces of signature information J26.

Next, the printing apparatus control unit20transmits information for requesting transmission of the firmware, as an HTTP request, to the file providing server2cwith a destination address (URL) indicated by the random URL information J16included in the update instruction information J25received in step SD4(step SG9).

As illustrated in the flowchart FI ofFIG. 6, the third server control unit50of the file providing server2creceives the information transmitted by the printing apparatus10in step SG9by controlling the third server communication unit51(step SI1).

Next, the third server control unit50acquires update relevant information J24corresponding to the URL accessed by the printing apparatus10, from the update relevant information J24stored in the predetermined storage area of the third server storage unit52(step SI2). As described above, the update relevant information J24is information including the random URL information J16and the new firmware version notification information J23. In step SI2, the third server control unit50acquires update relevant information J24which includes random URL information J16having the same value as a value of the URL accessed by the printing apparatus10.

As described above, the random URL information J16is not a fixed value but a variable value which is randomly generated. The random URL information J16is generated by the management server2b, and is notified to the printing apparatus10and the file providing server2c. The printing apparatus10accesses the file providing server2cbased on the random URL information J16, and thus validity of the printing apparatus10as an access source can be ensured.

Next, the third server control unit50refers to a file management database DB3astored in the third server storage unit52(step SI3).

The file management database DB3ais a database for storing file data of each version of firmware for each firmware. For each version of each firmware, the file management database DB3astores identification information for identifying each firmware, identification information for identifying each version, and file data of each version of each firmware, in correlation with each other.

Next, the third server control unit50acquires the file data of the new firmware, based on the new firmware version notification information J23included in the update relevant information J24acquired in step SI2and the file management database DB3areferred to in step SI3(step SI4). As described above, the new firmware version notification information J23is information that includes new firmware identification information for identifying the new firmware and new firmware version information indicating a version of the new firmware. That is, the new firmware version notification information J23includes identification information of the new firmware which is used for updating of the existing firmware of the printing apparatus10, and information indicating a version of the new firmware.

In step SI4, in a case of updating the existing first firmware, the third server control unit50acquires file data of the new first firmware which is used for updating of the firmware. In a case of updating the existing second firmware, the third server control unit50acquires file data of the new second firmware which is used for updating of the firmware. In a case of updating both of the existing first firmware and the existing second firmware, the third server control unit50acquires file data of the new first firmware and file data of the new second firmware.

Next, the third server control unit50transmits the file data of the new firmware that is acquired in step SI4, to the printing apparatus10, by controlling the third server communication unit51(step SI5).

The file data of the new firmware that is transmitted in step SI5corresponds to “overwriting firmware”.

As illustrated in the flowchart FG ofFIG. 6, the printing apparatus control unit20of the printing apparatus10receives the file data of the new firmware by controlling the printing apparatus network-communication unit23(step SG10).

Next, the printing apparatus control unit20generates a hash value based on the file data of the new firmware by using a predetermined hash function (step SG11). In step SG11, in a case where there are two pieces of file data, the printing apparatus control unit20generates a hash value for each of the two pieces of file data by using a predetermined hash function.

The predetermined hash function used in step SG11is the same as the hash function used when generating the hash value stored in the management server2b. The predetermined hash function is registered in advance in the printing apparatus10, and is stored in a predetermined storage area of the printing apparatus storage unit21.

Next, the printing apparatus control unit20compares the hash value which is generated by using the public key in step SG8with the hash value which is generated by using the predetermined hash function in step SG11(step SG12). In a case where the hash value which is generated by using the public key in step SG8is the same as the hash value which is generated by using the predetermined hash function in step SG11, it means that the file data of the new firmware received by the printing apparatus10from the file providing server2cis not tampered with (the file data has validity). Processing of step SG12corresponds to processing of determining the validity of the file data of the new firmware (overwriting firmware).

In particular, in this embodiment, an apparatus as a transmission source of the file data of the new firmware (file providing server2c) is configured to be separated from an apparatus as a transmission source of the signature information J26which is used for determining the validity of the file data (management server2b). With this configuration, as compared with a configuration in which the same apparatus transmits the file data of the new firmware and the signature information J26to the printing apparatus10, it is possible to effectively reduce a possibility that a third party may acquire both of the file data and the signature information J26. Accordingly, it is possible to effectively reduce a possibility that a third party decrypts a private key by using both of the file data and the signature information J26. Therefore, the validity of the file data can be accurately determined, and thus it is possible to prevent tampering with the file data.

Next, the printing apparatus control unit20determines whether or not the hash value which is generated by using the public key in step SG8is the same as the hash value which is generated by using the predetermined hash function in step SG11(step SG13).

In a case where the hash values are not the same (NO in step SG13), the printing apparatus control unit20executes corresponding processing, instead of performing firmware update (step SG14). In processing of step SG14, the printing apparatus control unit20executes at least the following processing. That is, the printing apparatus control unit20prints information indicating that the received file data of the new firmware may be tampered with, on the roll paper, by controlling the printing unit22. By referring to the information printed on the roll paper, a user can accurately recognize that the file data of the new firmware may be tampered with. In addition, the printing apparatus control unit20may notify the management server2band other apparatuses that the received file data of the new firmware may be tampered with. Further, in a case where the printing apparatus10includes a display panel such as a liquid crystal display panel, the printing apparatus control unit20may display information indicating that the received file data of the new firmware may be tampered with, on the display panel.

On the other hand, in a case where the hash values are the same (YES in step SG13), the printing apparatus control unit20updates the existing firmware with the file data of the new firmware that is received in step SG10(step SG15). In step SG15, in a case of receiving the file data of the new first firmware and the file data of the new second firmware, the printing apparatus control unit20updates the existing first firmware with the file data of the new first firmware, and updates the existing second firmware with the file data of the new second firmware. In addition, in a case of receiving either one of the file data of the new first firmware and the file data of the new second firmware, the printing apparatus control unit20updates the corresponding existing firmware with the received file data.

Here, the printing apparatus10according to this embodiment stores two pieces of firmware of the first firmware21aand the second firmware21b. As described above, in a situation where updating of one piece of firmware is necessary, only the file data of the one piece of firmware is transmitted from the file providing server2cto the printing apparatus10. With this configuration, a data amount of data to be transmitted from the file providing server2cto the printing apparatus10can be reduced. Thus, since the data amount is reduced, it is possible to improve communication efficiency and improve processing efficiency of the firmware update processing in the printing apparatus10.

Next, the printing apparatus control unit20prints information indicating completion of firmware update on the roll paper by controlling the printing unit22(step SG16).

FIG. 8is a diagram illustrating an example of information printed on the roll paper in step SG16.

As illustrated inFIG. 8, information indicating completion of firmware update and information prompting restart of the printing apparatus are printed on the roll paper. By visually confirming the information printed on the roll paper, a user can accurately recognize completion of firmware update and restart of the printing apparatus. In addition, in a case where the printing apparatus10includes a display panel such as a liquid crystal display panel, the information may be displayed on the display panel.

Next, the operation mode of the printing apparatus control unit20transitions to a normal mode from the firmware update mode (step SG17).

Next, another processing of the printing apparatus10will be described.

As described above, the public key which is used for decryption of the signature information J26is described in the data portion of the first firmware21a. The printing apparatus control unit20permits the public key to be modified by updating of the first firmware21a, and on the other hand, prohibits the public key from being modified by a method other than updating of the first firmware21a. Therefore, an external apparatus which is allowed to communicate with the printing apparatus10cannot modify the public key by transmitting a control command to the printing apparatus10. Accordingly, the following effects are obtained. That is, in this embodiment, when performing firmware update, the validity of the file data of the new firmware can be determined. Thus, it is possible to prevent updating of the existing firmware with tampered file data of new firmware. Therefore, the public key modified by firmware update can be regarded as a valid public key. Based on this fact, by permitting the public key to be modified by updating of the first firmware21a, and on the other hand, prohibiting the public key from being modified by a method other than the updating of the first firmware21a, it is possible to prevent the public key from being illegally modified.

As described above, the printing apparatus10according to this embodiment can be connected to the printing apparatus control server2a, the management server2b, and the file providing server2cof the server unit2(server). The printing apparatus10includes the printing apparatus network-communication unit23that transmits the periodic printing apparatus information J9(printing apparatus information) to the management server2band receives an address which designates a storage location of the file data of the new firmware (overwriting firmware) from the management server2bin a case where a predetermined condition is satisfied, and the printing apparatus control unit20that receives the file data of the new firmware from the file providing server2cbased on the address received by the printing apparatus network-communication unit23and executes overwriting (updating) of the firmware.

With this configuration, in a case where the management server2bdetermines that the predetermined condition is satisfied, the printing apparatus10receives the address which designates the storage location of the file data of the new firmware, receives the file data of the new firmware based on the address, and performs overwriting of the firmware. Thus, in a case where the predetermined condition is not satisfied, it is possible to prevent the printing apparatus10from acquiring the address which designates the storage location of the file data of the new firmware. In addition, the management server2bcan control whether or not to permit overwriting of the firmware of the printing apparatus10, and control an execution timing of processing related to overwriting. That is, according to this embodiment, in the printing apparatus10that executes overwriting of the firmware by communication with the server unit2, overwriting of the firmware can be performed by an appropriate method based on communication with the server unit2.

In addition, in this embodiment, the periodic printing apparatus information J9includes the printing apparatus model information J12(model information indicating a model of a printing apparatus main body), the first firmware version information J10, and the second firmware version information J11(version information indicating a version of the firmware). Whether or not the predetermined condition is satisfied is determined by the management server2bbased on the information transmitted by the printing apparatus10.

With this configuration, since the periodic printing apparatus information J9transmitted by the printing apparatus10includes the printing apparatus model information J12, the first firmware version information J10, and the second firmware version information J11, the management server2bcan appropriately determine whether or not overwriting of the firmware of the printing apparatus10is necessary, based on the model of the printing apparatus10and the version of the existing firmware.

In addition, in this embodiment, the periodic printing apparatus information J9includes the printing apparatus identification information J3(identification information of the printing apparatus main body). Whether or not the predetermined condition is satisfied is determined by the management server2bbased on the printing apparatus identification information J3transmitted by the printing apparatus network-communication unit23.

With this configuration, since the periodic printing apparatus information J9transmitted by the printing apparatus10includes the printing apparatus identification information J3, by using the printing apparatus identification information J3of the printing apparatus10, the management server2bcan appropriately determine whether or not overwriting of the firmware of the printing apparatus10is necessary, based on specific circumstances of the printing apparatus10.

In this embodiment, whether or not the predetermined condition is satisfied is determined by the management server2b, based on whether or not overwriting of the firmware by the printing apparatus10is permitted.

With this configuration, the management server2bcan appropriately determine whether or not overwriting of the firmware is necessary in the printing apparatus10, based on whether or not overwriting of the firmware by the printing apparatus10is permitted.

In addition, in this embodiment, whether or not the predetermined condition is satisfied is determined, based on whether or not the printing apparatus10is in a time period during which overwriting of the firmware can be performed.

With this configuration, the printing apparatus10can execute processing related to overwriting of the firmware in the time period during which overwriting of the firmware can be performed.

In addition, in this embodiment, the time period during which overwriting of the firmware can be performed is a time period during which the printing unit22does not execute printing on the roll paper (printing medium).

With this configuration, the printing apparatus10can execute the processing related to overwriting of the firmware in the time period during which the printing unit22does not execute printing on the roll paper.

In addition, in this embodiment, the printing apparatus control unit20receives the file data of the new firmware from the file providing server2c, and determines the validity of the file data, before executing overwriting of the firmware.

With this configuration, in a case where the file data of the new firmware has validity, by performing overwriting of the firmware, for example, it is possible to prevent the firmware from being overwritten with tampered file data.

In addition, in this embodiment, in a case where it is determined that the file data of the new firmware is valid, the printing apparatus control unit20executes overwriting of the firmware with the file data. On the other hand, in a case where it is determined that the file data of the new firmware is not valid, the printing apparatus control unit20does not execute overwriting of the firmware with the file data.

With this configuration, it is possible to prevent the firmware stored in the printing apparatus10from being overwritten with firmware which may be tampered with.

In addition, as described above, in this embodiment, the network system1is configured to include the printing apparatus10and the server unit2(server) that can be connected to the printing apparatus10. The server unit2is configured to include the printing apparatus control server2a, the management server2b, and the file providing server2c. The management server2bof the server unit2receives the periodic printing apparatus information J9(printing apparatus information) from the printing apparatus10, and in a case where the predetermined condition is satisfied, transmits the address which designates the storage location of the file data of the new firmware (overwriting firmware) to the printing apparatus10. In a case where a request of transmission of the file data of the new firmware based on the address is received from the printing apparatus10, the file providing server2cof the server unit2transmits the file data of the new firmware to the printing apparatus10.

With this configuration, in a case where the predetermined condition is not satisfied, the server unit2can prevent the printing apparatus10from acquiring the address which designates the storage location of the file data of the new firmware. In addition, the server unit2can control whether or not to permit overwriting of the firmware of the printing apparatus10, and control an execution timing of processing related to overwriting. That is, according to this embodiment, in the network system1, the server unit2transmits the overwriting firmware of the firmware to the printing apparatus10, by communicating with the printing apparatus10. Thus, the server unit2can transmit the overwriting firmware to the printing apparatus10by using an appropriate method based on communication with the printing apparatus10.

In addition, in this embodiment, the periodic printing apparatus information J9includes the printing apparatus model information J12(model information indicating a model of the printing apparatus10), the first firmware version information J10, and the second firmware version information J11(version information indicating a version of the firmware). The management server2bof the server unit2determines whether or not the predetermined condition is satisfied, based on the periodic printing apparatus information J9received from the printing apparatus10, and the printing apparatus model information J12, the first firmware version information J10, and the second firmware version information J11, which are stored in the firmware version management database DB2bin correlation with each other.

With this configuration, the management server2bcan appropriately determine whether or not overwriting of the firmware is necessary in the printing apparatus10, based on the model of the printing apparatus10and the version of the existing firmware.

In addition, in this embodiment, the periodic printing apparatus information J9includes the printing apparatus identification information J3(identification information for identifying the printing apparatus10). The management server2bof the server unit2determines whether or not the predetermined condition is satisfied, based on the printing apparatus identification information J3received from the printing apparatus10.

With this configuration, the management server2bcan appropriately determine whether or not overwriting of the firmware is necessary in the printing apparatus10, based on specific circumstances of the printing apparatus10, using the printing apparatus identification information J3of the printing apparatus10.

In addition, in this embodiment, the management server2bdetermines whether or not the predetermined condition is satisfied, based on whether or not the printing apparatus10is in a time period during which overwriting of the firmware can be performed.

With this configuration, the management server2bcan cause the printing apparatus10to execute processing related to overwriting of the firmware in the time period during which overwriting of the firmware can be performed.

In addition, in this embodiment, the time period during which the printing apparatus10can execute overwriting of the firmware is a time period during which the printing apparatus10does not execute printing.

With this configuration, the management server2bcan cause the printing apparatus10to execute processing related to overwriting of the firmware in the time period during which the printing apparatus10does not execute printing.

In addition, in this embodiment, the server unit2is configured to include the printing apparatus control server2a(first server), the management server2b(second server), and the file providing server2c(third server). The printing apparatus control server2atransmits an address of the management server2baccording to the access from the printing apparatus10. In a case where the predetermined condition is satisfied, the management server2btransmits the random URL information J16(an address which designates the storage location of the overwriting firmware in the file providing server2c), based on the access from the printing apparatus10. The file providing server2ctransmits the file data of the new firmware to the printing apparatus10, based on the access from the printing apparatus10.

With this configuration, based on the fact that the server unit2is configured to include the printing apparatus control server2a, the management server2b, and the file providing server2c, by allocating functions to each server, it is possible to distribute the load of each server and reduce the data amount of data stored in each server.

In addition, in this embodiment, the printing apparatus control server2agenerates the second server access password information J5(password used when the printing apparatus10accesses the management server2b), and transmits the generated information to the printing apparatus10and the management server2b.

With this configuration, the management server2bcan authenticate the printing apparatus10, based on the second server access password information J5generated by the printing apparatus control server2a.

In addition, in this embodiment, the management server2brandomly generates the URL of the file providing server2cthat is indicated by the random URL information J16(address which designates the storage location of the overwriting firmware), and transmits the generated URL to the printing apparatus10and the file providing server2c.

With this configuration, it is possible to prevent an apparatus other than the valid printing apparatus10that receives the random URL information J16, from accessing the file providing server2cand acquiring the file data of the new firmware.

As described above, the network system1according to this embodiment is configured to include the printing apparatus10, the management server2bthat can communicate with the printing apparatus10, and the file providing server2cthat can communicate with the printing apparatus10. The printing apparatus10includes the printing apparatus storage unit21that stores firmware to which a public key is added, the public key being information related to a public key encryption method. The printing apparatus10includes the printing apparatus network-communication unit23(printing apparatus communication unit) that receives the signature information J26obtained by encrypting the hash value of the file data of the new firmware with the private key corresponding to the public key, from the management server2b, and that receives the file data from the file providing server2c. The printing apparatus10includes the printing apparatus control unit20which determines the validity of the file data by comparing the hash value generated by decrypting the signature information J26, which is received from the management server2bby the printing apparatus network-communication unit23, with the public key stored in the printing apparatus storage unit21, and the hash value of the file data of the new firmware that is received from the file providing server2cby the printing apparatus network-communication unit23.

With this configuration, an apparatus as a transmission source of the file data of the new firmware (file providing server2c) is different from an apparatus as a transmission source of the signature information J26which is used for determining the validity of the file data (management server2b). Accordingly, a possibility that a third party acquires both of the file data and the signature information J26, can be effectively reduced. Thus, it is possible to effectively reduce a possibility that a third party decrypts the private key by using both of the file data and the signature information J26. Therefore, the printing apparatus10can accurately determine the validity of the file data. That is, with this configuration, in the network system1including the printing apparatus10which executes overwriting of the firmware with the file data of the new firmware that is received from the server, the printing apparatus10can accurately determine the validity of the file data of the new firmware by using characteristics of the configuration of the server which communicates with the printing apparatus10.

In addition, in this embodiment, in a case where it is determined that the file data of the new firmware has validity, the printing apparatus control unit20executes overwriting of the firmware with the file data, and in a case where it is determined that the file data of the new firmware does not have validity, the printing apparatus control unit20does not execute overwriting of the firmware with the file data.

With this configuration, it is possible to prevent the firmware stored in the printing apparatus10from being overwritten with firmware which may be tampered with.

In addition, in this embodiment, the printing apparatus control unit20determines that the file data has validity, in a case where the hash value generated by decrypting the signature information J26, which is received from the management server2bby the printing apparatus network-communication unit23, with the public key stored in the printing apparatus storage unit21, and the hash value of the file data of the new firmware that is received from the file providing server2cby the printing apparatus network-communication unit23, are the same.

With this configuration, the printing apparatus10can accurately determine the validity of the file data of the new firmware.

In addition, in this embodiment, in a case where it is determined that the file data of the new firmware does not have validity, the printing apparatus control unit20prints information indicating that the file data may be tampered with, on the roll paper (printing medium), by controlling the printing unit22.

With this configuration, by visually confirming the information printed on the roll paper, a user can accurately recognize that the file data of the new firmware may be tampered with.

In addition, in this embodiment, for the public key stored in the printing apparatus storage unit21, the printing apparatus control unit20permits modification of the public key by overwriting of the firmware, and on the other hand, prohibits modification of the public key by another method.

With this configuration, it is possible to prevent the public key from being illegally modified.

The above-described embodiment has been presented by way of example of the aspect of the invention, and can be arbitrarily modified and applied within the scope of the invention.

For example, in the above-described embodiment, although a case where the printing apparatus10is applied to a store is described as an example, a facility to which the store system3is applied is not limited to a store.

In addition, each functional block described with reference to the drawings can be arbitrarily realized by hardware and software, and does not suggest a specific hardware configuration.

The entire disclosure of Japanese Patent Application No. 2016-191723, filed Sep. 29, 2016 is expressly incorporated by reference herein.