Patent Description:
A typical image forming apparatus is configured to execute various operations, such as image forming on a printing medium, FAX transmission, and transmission of scanned data. Such functions are, in general, realized by firmware installed in a hard disk, an example of a non-volatile storage device, provided in the image forming apparatus. Accordingly, in view of the possibility that the firmware may be manipulated, it is desirable to detect the manipulation of the firmware, for example using a hash value. As specific examples, Patent Literature (PTL) <NUM> and <NUM> propose a technique including saving version information of the firmware installed at the time of shipment of the image forming apparatus in a management server, making an inquiry to the management server at the time of installation of the image forming apparatus, for comparison of the version information by the management server, to thereby detect whether an unintended manipulation has been made during the period between the shipment and the installation of the image forming apparatus.

However, although the manipulation that may be made during the period between the shipment and the installation of the image forming apparatus has been taken into account, an attack from outside after the installation has not been sufficiently discussed.

The present invention has been accomplished in view of the foregoing situation, and provides an image forming system including a plurality of image forming apparatuses connected via a network, in which the security of each of the image forming apparatus can be improved with a simple procedure.

In an aspect, the present invention provides an image forming apparatus connectable to a network. The image forming apparatus includes a non-volatile auxiliary storage device containing firmware that causes the image forming apparatus to operate, a manipulation detection device that analyzes the firmware stored in the auxiliary storage device and accompanied with a digital signature, and decides, using the digital signature, whether the firmware has been manipulated, a firmware restoration device that deletes the firmware decided to have been manipulated, requests another image forming apparatus connected to the network to provide firmware compatible with the deleted firmware, and installs the firmware provided by the other image forming apparatus, a firmware provision device that provides, upon receipt of a request for firmware compatible with the firmware of the other image forming apparatus, the compatible firmware to the other image forming apparatus, and a control device that controls the manipulation detection device, the firmware restoration device, and the firmware provision device. The auxiliary storage device includes a boot block writing in which is restricted, and contains firmware that realizes the manipulation detection device, the firmware restoration device, the firmware provision device, and the control device, in the boot block.

In another aspect, the present invention provides a manipulation prevention method for firmware installed in an image forming apparatus connectable to a network. The method includes a storing process including storing the firmware that enables the image forming apparatus to operate, in a non-volatile auxiliary storage device, a manipulation detection process including analyzing the firmware stored in the auxiliary storage device and accompanied with a digital signature, and deciding, using the digital signature, whether the firmware has been manipulated, a firmware restoration process including deleting the firmware decided to have been manipulated, requesting another image forming apparatus connected to the network to provide firmware compatible with the deleted firmware, and installing the firmware provided by the other image forming apparatus, a firmware provision process including providing, upon receipt of a request for firmware compatible with the firmware of the other image forming apparatus, the compatible firmware to the other image forming apparatus, and a controlling process including controlling the manipulation detection process, the firmware restoration process, and the firmware provision process. The storing process includes storing the firmware that causes the image forming apparatus to execute the manipulation detection process, the firmware restoration process, the firmware provision process, and the controlling process, in a boot block writing in which is restricted, included in the auxiliary storage device.

In still another aspect, the present invention provides a computer-readable non-transitory recording medium containing a manipulation prevention program for preventing manipulation of firmware installed in an image forming apparatus connectable to a network. The recording medium is configured to cause a computer of the image forming apparatus to act, when a processor of the computer of the image forming apparatus executes the manipulation prevention program, as a manipulation detection device that analyzes the firmware that causes the image forming apparatus to operate, stored in a non-volatile auxiliary storage device in the image forming apparatus and accompanied with a digital signature, and decides, using the digital signature, whether the firmware has been manipulated, a firmware restoration device that deletes the firmware decided to have been manipulated, requests another image forming apparatus connected to the network to provide firmware compatible with the deleted firmware and installs the firmware provided by the other image forming apparatus, a firmware provision device that provides, upon receipt of a request for firmware compatible with the firmware of the other image forming apparatus, the compatible firmware to the other image forming apparatus, and a control device that controls the manipulation detection device, the firmware restoration device, and the firmware provision device. The recording medium is further configured to cause the computer to store the firmware that realizes the manipulation detection device, the firmware restoration device, the firmware provision device, and the control device, in a boot block writing in which is restricted, included in the auxiliary storage device.

With the foregoing arrangement according to the present invention, the security of each of the plurality of image forming apparatus, connected via the network and included in the image forming system, can be improved with a simple procedure.

Hereafter, some forms to carry out the present invention (hereinafter, "embodiment") will be described, with reference to the drawings.

<FIG> is a schematic diagram showing a general configuration of an image forming system, including an image forming apparatus according to the embodiment of the present invention. The image forming system <NUM> includes, in this embodiment, a plurality (e.g., three) of image forming apparatuses <NUM>, <NUM>, and <NUM> connected to one another via a local area network (hereinafter, LAN) <NUM>. As shown in <FIG>, in the image forming system <NUM> the plurality of image forming apparatuses <NUM>, <NUM>, and <NUM> are connected (connectable) to one another via the LAN <NUM>, and a support server <NUM> and a personal computer (not shown) are connectable to the system.

In this embodiment, the three image forming apparatuses <NUM>, <NUM>, and <NUM> are different in configuration from each other, though they may have the same configuration. To be more detailed, a firmware group 142F, a firmware group 242F, and a firmware group 342F are respectively installed in the three image forming apparatuses <NUM>, <NUM>, and <NUM>. As shown in <FIG> to be subsequently referred to, the firmware group 142F and the firmware group 242F include a PDL analysis program, a color conversion program, a half tone program, an image reading program, a binarization program, a PDF conversion program, a compression/decompression program, and a management program. In contrast, although the firmware group 342F includes the PDL analysis program, the color conversion program, the half tone program, the image reading program, and the management program, the firmware group 342F is without the binarization program, the PDF conversion program, and the compression/decompression program. The firmware group 142F, the firmware group 242F, and the firmware group 342F are different in composition from one another. Accordingly, the image forming apparatuses <NUM>, <NUM>, and <NUM> have different functions from one another such that, for example, one apparatus has a transmission function, while another apparatus is without the transmission function. The details of each program will be subsequently described. In the present description, the firmware and the program are used as synonyms.

The support server <NUM> is connected to the LAN <NUM>, via the internet <NUM>. The support server <NUM> is provided by the manufacturer of the three image forming apparatuses <NUM>, <NUM>, and <NUM>. The support server <NUM> also acts as a public key certificate authority (CA), and is authorized to issue a public key certificate to the user. The public key certificate serves to associate the public key and the identification information of the owner of the certificate (i.e., image forming apparatus).

<FIG> is a schematic block diagram showing a configuration of the image forming apparatus <NUM> according to the embodiment of the present invention. The image forming apparatus <NUM> includes a control device <NUM>, an image reading device <NUM>, a storage device <NUM>, a communication interface (I/F) <NUM>, an image forming device <NUM>, and a FAX communication device <NUM>. The image reading device <NUM> reads the image of a source document, and generates image data ID which is digital data. The image forming device <NUM> forms the image on a printing medium (not shown), according to the image data ID or a printing job received from a personal computer <NUM>, and delivers the printing medium. The printing medium is also called an image forming medium. The FAX communication device <NUM> transmits and receives a facsimile. To transmit the facsimile, a binarization process is executed.

The control device <NUM> includes a central processing unit (CPU), a random-access memory (RAM) constituting a main memory <NUM>, a read-only memory (ROM), and an exclusive hardware circuit. The control device <NUM> also has a function to control interfaces, such as various types of I/O, a universal serial bus (USB), a bus, and other hardware. The control device <NUM> controls the overall operation of the image forming apparatus <NUM>. In this embodiment, it will be assumed that the control device <NUM> employs Linux (registered trademark) kernel as the operating system.

The control device <NUM> acts as a manipulation detection device <NUM>, a firmware restoration device <NUM>, and a firmware provision device <NUM>, when the CPU executes a control program stored in the storage device <NUM> (including a manipulation detection program, a firmware restoration program, and a firmware provision program to be subsequently described). The CPU executes the processings, using predetermined storage regions in the main memory <NUM>.

The storage device <NUM> is a memory unit such as a hard disk drive, for storing the firmware that causes the image forming apparatus <NUM> to operate. For example, the storage device <NUM> may be a hard disk drive which is a non-transitory and non-volatile recording medium, having a hard disk encryption function. The storage device <NUM> includes a boot program storage region <NUM>, a firmware storage region <NUM>, a public key storage region <NUM>, a secret key storage region <NUM>, and a firmware management information storage region <NUM>. The firmware storage region <NUM>, the public key storage region <NUM>, the secret key storage region <NUM>, and the firmware management information storage region <NUM> are rewritable. In contrast, the boot program storage region <NUM> is not rewritable, in other words, writing in the boot program storage region <NUM> is restricted.

The boot program storage region <NUM> is a boot block storing a boot program, the manipulation detection program, the firmware restoration program, and the firmware provision program. The manipulation detection device <NUM>, the firmware restoration device <NUM>, and the firmware provision device <NUM> are realized, when the CPU executes the manipulation detection program, the firmware restoration program, and the firmware provision program, respectively. The firmware storage region <NUM> contains the firmware group 142F.

The public key storage region <NUM> is for storing public keys. The public keys include a public key for manipulation detection PKf of the firmware supplier, and a public key for external communication PKc used by the image forming apparatus <NUM> when making communication with outside. The public key for manipulation detection PKf is used by the manipulation detection device <NUM> to detect manipulation. The public key for external communication PKc is registered in advance in the support server <NUM> and other image forming apparatuses <NUM> and <NUM> in the network (from the viewpoint of image forming apparatus <NUM>). The secret key storage region <NUM> is for storing secret keys. The secret keys include a secret key for communication SKc used by the image forming apparatus <NUM> when making communication with outside.

The manipulation detection device <NUM> is stored in the storage device <NUM>, and serves to analyze the firmware accompanied with a digital signature, to thereby decide whether the firmware has been manipulated, using the digital signature.

The firmware restoration device <NUM> deletes the firmware decided to have been manipulated, and requests another image forming apparatus connected to the LAN <NUM> (network) (e.g., image forming apparatus <NUM>) to provide firmware compatible with the deleted one. Then the firmware restoration device <NUM> installs the firmware provided by the other image forming apparatus (e.g., image forming apparatus <NUM>).

The firmware provision device <NUM> provides, upon receipt of a request to provide firmware compatible with the firmware of the other image forming apparatus (e.g., image forming apparatus <NUM>) the compatible firmware to the other image forming apparatus (e.g., image forming apparatus <NUM>).

<FIG> is a firmware management table for showing details of the firmware of the three image forming apparatuses <NUM>, <NUM>, and <NUM> according to the embodiment. The firmware management information storage region <NUM> of each of the three image forming apparatuses <NUM>, <NUM>, and <NUM> contains the firmware management table T shown in <FIG>. The firmware management table T indicates whether the firmware is installed, and compatibility with other firmware. Circular symbols indicate that the program is compatible. Triangular symbols indicate that the program is incompatible. Cross marks indicate that the program is not installed.

To be more detailed, the PDL analysis program is installed in all of the three image forming apparatuses <NUM>, <NUM>, and <NUM>, and is compatible with one another. The half tone program is installed in all of the three image forming apparatuses <NUM>, <NUM>, and <NUM>, but incompatible with one another. The image reading program is installed in all of the three image forming apparatuses <NUM>, <NUM>, and <NUM>, but compatible only between two image forming apparatuses <NUM> and <NUM>. The PDF conversion program is installed only in two image forming apparatuses <NUM> and <NUM>, and compatible with each other.

<FIG> is a schematic diagram for explaining the firmware to be used for the functions of the three image forming apparatuses according to the embodiment. <FIG> indicates the firmware used for each of the functions of the three image forming apparatuses <NUM>, <NUM>, and <NUM>. For example, the printing function utilizes the PDL analysis program, the color conversion program, and the half tone program. The transmission function utilizes the image reading program and the PDF conversion program. Such information is stored in the firmware management information storage region <NUM>.

The firmware is accompanied with the digital signature. The digital signature is generated by encrypting the hash value of the firmware translated into a machine language, with the secret key. From the digital signature, the has value can be acquired by decrypting with the public key (also called public key for manipulation detection) constituting a pair with the secret key. The manipulation detection device <NUM> again calculates the hash value of the firmware translated into the machine language, to thereby decide whether the firmware translated into the machine language has been manipulated, or confirm that the firmware has not been manipulated, through comparison between the calculated hash value and the hash value acquired by the decryption.

In this embodiment, the firmware supplier can generate the digital signature using the supplier's own secret key, and generate the firmware accompanied with the digital signature, by adding the digital signature to the firmware. In principle, the firmware supplier supplies the firmware accompanied with the digital signature to the user of the image forming apparatuses <NUM>, <NUM>, and <NUM>, with the public key for manipulation detection, constituting a pair with the secret key used for the encryption of the digital signature.

Here, in the case where the firmware supplier provides the firmware without the digital signature, instead of the firmware accompanied with the digital signature, the image forming apparatuses <NUM>, <NUM>, and <NUM> can each generate the secret key (or use the originally owned secret key) to generate the digital signature, with the manipulation detection device (e.g., manipulation detection device <NUM> in the case of image forming apparatus <NUM>), thereby obtaining the firmware accompanied with the digital signature.

The firmware management information storage region <NUM> contains information for identifying the public key for manipulation detection constituting a pair with the secret key used to generate the digital signature for the firmware, in association with the corresponding firmware. The firmware management information storage region <NUM> also contains ID information for identifying each of the image forming apparatuses <NUM>, <NUM>, and <NUM>.

The mentioned configuration of the image forming apparatus <NUM> is based on <FIG>. The image forming apparatuses <NUM> and <NUM> each include at least the elements corresponding to the control device <NUM>, the image reading device <NUM>, the storage device <NUM>, the image forming apparatus <NUM>, and the communication interface <NUM> of the image forming apparatus <NUM>. Therefore, detailed description on the configuration of the image forming apparatuses <NUM> and <NUM> will be skipped.

<FIG> is a flowchart showing details of a system startup process (step S100) according to the embodiment. At step S110, the user turns on the power to the image forming apparatus <NUM>. The power may be automatically turned on by a timer, at a predetermined time.

At step S120, the image forming apparatus <NUM> starts up the boot program. In the boot program startup process, the CPU (not shown) of the image forming apparatus <NUM> retrieves the boot program from the boot block on the hard disk of the storage device <NUM>, and starts up the image forming apparatus <NUM>. In this embodiment, the boot program includes, in addition to a startup program and setting information, programs for realizing the manipulation detection device <NUM>, the firmware restoration device <NUM>, and the firmware provision device <NUM> of the control device <NUM>. The storage device <NUM> is also called as auxiliary storage device.

At step S130, the manipulation detection device <NUM> acquires the public key for manipulation detection. More specifically, the manipulation detection device <NUM> attempts to acquire the public key for manipulation detection PKf for the corresponding firmware, from the public key storage region <NUM> in the storage device <NUM>. Upon completing the acquisition of the public key for manipulation detection PKf for the corresponding firmware, the manipulation detection device <NUM> proceeds to step S140.

Upon deciding that there is firmware without the public key for manipulation detection PKf, the manipulation detection device <NUM> generates the pair of the secret key and the public key, for such firmware. The manipulation detection device <NUM> generates the digital signature using the secret key, and stores the information for identifying the public key for manipulation detection constituting the pair with the secret key used to generate the digital signature, in the firmware management information storage region <NUM> in association with the firmware. The mentioned operation is performed after the firmware without the digital signature is installed, in other words at the time of first startup after the installation.

At step S140, the manipulation detection device <NUM> executes a manipulation detection at startup process. In the manipulation detection at startup according to this embodiment, the manipulation detection device <NUM> utilizes the digital signatures stored in the hard disk of the storage device <NUM> in association with the corresponding firmware, to confirm that the firmware has not been manipulated.

At step S150, the manipulation detection device <NUM> proceeds to step S160 in the case where the manipulation has not been detected, or proceeds to step S170 when the manipulation has been detected in at least one of the firmware. A normal operation mode is continued until the power to the image forming apparatus <NUM> is turned off (step S195).

In the case where no manipulation has been detected, the manipulation detection device <NUM> erases (deletes) the secret key generated in the image forming apparatus <NUM> and constituting the pair with the public key for manipulation detection. Therefore, the image forming apparatus <NUM> can prevent malicious use of the secret key generated therein, thereby improving the security level.

<FIG> is a schematic diagram for explaining the status of the regions in the main memory <NUM>, after the startup of the image forming apparatus according to the embodiment. The main memory <NUM> is composed of a text region 114T, a static region <NUM>, a heap region <NUM>, a vacant region 114F, and a stack region 114V. The main memory <NUM> is also called as main storage device.

The text region 114T, also called as program region, is a region of a fixed size in which programs translated into a machine language are stored. The image forming apparatus <NUM> retrieves, at the time of startup, the program translated into the machine language from the boot program storage region <NUM>, and stores that program in the text region 114T. The processings are performed when the commands in the machine language are executed by the CPU.

The static region <NUM> is a region of a fixed size, in which static variables such as a global variable is stored. The static variable refers to a variable that does not change during the execution of the processings. The stack region 114V is a region of a fixed size, in which automatic variables (local variables) and temporary variables such as an argument and return value of a function are stored. In the stack region 114V, the register of the CPU can be temporarily saved.

The heap region <NUM> is a dynamic region where, in the case of the C programming language for example, the process can secure physical memory with a malloc function, and free the physical memory with a free function. In each process, a storage region required for the process is secured as a physical memory with the malloc function, and the physical memory is freed after the completion of the process. The vacant region 114F refers to a region other than the region secured in the heap region <NUM>. Therefore, the heap region <NUM> and the vacant region 114F vary depending on the operation performed in each process.

<FIG> is a flowchart showing details of the normal operation mode (step S160) performed by the image forming apparatus according to the embodiment. In the normal operation mode, the manipulation is detected on the background of the operation of the image forming apparatus, such as printing and copying.

At step S161, the manipulation detection device <NUM> executes a trigger detection process. In the trigger detection process, the manipulation detection device <NUM> detects such events as receipt of a printing job, movement of the document table cover, and lapse of a predetermined time set by a timer, as the trigger.

At step S162, the manipulation detection device <NUM> executes a related program identification process. In the related program identification process, the manipulation detection device <NUM> predicts the function to be used, according to the type of the trigger, and identifies the firmware from which manipulation is to be detected. For example, when the trigger is the receipt of the printing job, the manipulation detection device <NUM> identifies the PDL analysis program, the color conversion program, and the half tone program, which are used for the printing job, as the object of the manipulation detection.

Therefore, the manipulation detection device <NUM> can decide, before (immediately before) the execution of the firmware, whether the firmware to be executed to realize the predicted function has been manipulated, thus completing the manipulation detection. Here, when the trigger is the lapse of the time set by the timer, the manipulation detection device <NUM> identifies all of the firmware as the object of the manipulation detection.

At step S163, the manipulation detection device <NUM> executes the manipulation detection during the operation. To detect the manipulation during the operation, the manipulation detection device <NUM> utilizes the digital signature accompanying the firmware stored in the text region 114T of the main memory <NUM>, to check whether the firmware in the main memory <NUM> has been manipulated.

At step S164, the manipulation detection device <NUM> finishes the operation in the case where the manipulation has not been detected, but proceeds to a restorative operation mode (step S170), when the manipulation has been detected at least in one of the firmware. The operation to be performed in the restorative operation mode (step S170) is the same as that in the restorative operation mode (step S170) in the system startup process (step S100). In this example, it will be assumed that the manipulation has been detected in the PDL analysis program.

<FIG> is a flowchart showing details of a restorative operation mode performed by the image forming apparatus according to the embodiment. In the restorative operation mode, the firmware restoration device <NUM> deletes the firmware in which the manipulation detection device <NUM> has detected the manipulation, and replaces the firmware compatible with the deleted firmware, provided from another image forming apparatus <NUM> or <NUM> in the network.

At step S171, the firmware restoration device <NUM> of the image forming apparatus <NUM> searches the two image forming apparatuses <NUM> and <NUM> which are capable of providing the compatible PDL analysis program, by looking up the firmware management table T, and selects one of these image forming apparatuses. For example, the firmware restoration device <NUM> selects, out of the two image forming apparatuses <NUM> and <NUM>, the one having a larger number of compatible programs according to <FIG> (the image forming apparatus <NUM> contains a larger number of compatible programs than the image forming apparatus <NUM>), as the image forming apparatus to which the request for the firmware is to be made. Thus, the firmware restoration device <NUM> selects the image forming apparatus <NUM> as the provider of the firmware. Here, the firmware restoration device <NUM> may select the image forming apparatus <NUM> according to a predetermined selection priority (e.g., image forming apparatus <NUM> is at the first place in selection priority, and image forming apparatus <NUM> is at the second place). Alternatively, the firmware restoration device <NUM> may select the image forming apparatus <NUM>, according to the selection instruction from a manager operating the image forming apparatus <NUM>.

The firmware restoration device <NUM> of the image forming apparatus <NUM> can acquire the ID information for identifying the image forming apparatus <NUM> from the firmware management information storage region <NUM>, and generate a firmware request ticket accompanied with the digital signature, using the ID information and firmware identification information for identifying the PDL analysis program. The firmware request ticket accompanied with the digital signature may be generated, for example, as a simple object access protocol (SOAP) message. The SOAP message representing the firmware request ticket accompanied with the digital signature is a data file having a SOAP envelope containing the SOAP main body.

The SOAP main body contains the data including the ID information for identifying the image forming apparatus <NUM>, which is the sender of the SOAP message, and the firmware identification information, and the digital signature generated by encrypting the hash value of that data with the secret key for communication SKc. Thus, the firmware restoration device <NUM> of the image forming apparatus <NUM> can transmit the firmware request ticket accompanied with the digital signature, to the image forming apparatus <NUM> via the LAN <NUM>.

At step S172, the firmware provision device of the image forming apparatus <NUM> receives the SOAP message. The firmware provision device confirms that the SOAP message has not been manipulated, using the digital signature in the SOAP message, and analyzes the content of the SOAP message.

The firmware provision device of the image forming apparatus <NUM> confirms that the image forming apparatus <NUM>, the sender of the SOAP message, is registered in advance in the firmware management table T in the image forming apparatus <NUM>. Upon confirming that the image forming apparatus <NUM> is registered, the firmware provision device identifies that the image forming apparatus <NUM> is requesting to provide the PDL analysis program, and verifies that the PDL analysis program in the image forming apparatus <NUM> has not been manipulated (firmware verification).

At step S173, the firmware provision device of the image forming apparatus <NUM> encrypts the verified PDL analysis program, using the public key for external communication PKc acquired in advance from the image forming apparatus <NUM>, thereby generating the SOAP message accompanied with the digital signature. The firmware provision device of the image forming apparatus <NUM> then transmits the SOAP message containing the PDL analysis program, to the image forming apparatus <NUM>. The SOAP based on the XML format does not depend on a protocol, and therefore the PDL analysis program can be transmitted and received, using the HTTPS protocol.

In this embodiment, it suffices that the legitimacy of the image forming apparatus <NUM> and the image forming apparatus <NUM> can be confirmed, for example by using the digital signature, for the communication therebetween, without limitation to the use of the SOAP message. Further, the transmission method of the firmware is not limited to the use of the HTTPS protocol. For example, a Diffie-Hellman key sharing algorithm may be employed, to transmit the firmware on the basis of a shared key system.

At step S174, the manipulation detection device <NUM> of the image forming apparatus <NUM> confirms that the received PDL analysis program has not been manipulated, using the digital signature. At step S175, the firmware restoration device <NUM> installs the received PDL analysis program in the hard disk of the storage device <NUM>. At step S176, the firmware restoration device <NUM> reboots the image forming apparatus <NUM>, when the installation of the PDL analysis program in the hard disk of the storage device <NUM> has been completed.

At step S181 (see <FIG>), the control device <NUM> continues with the normal operation mode when the restoration is successfully completed, but suspends the operation of the image forming apparatus <NUM>, when the restoration has failed (step S191). Here, when the restorative operation mode (step S170) in the system startup process (step S100) is completed also, the control device <NUM> proceeds to the boot program startup process (step S120) when the restoration is successful, but suspends the operation of the image forming apparatus <NUM> when the restoration has failed (step S190), and finishes the operation (step S180).

In the image forming system <NUM> according to the embodiment, as described above, the three image forming apparatuses <NUM>, <NUM>, and <NUM> can each continuously detect the manipulation of the firmware, during the period from the startup to the finish of the operation. Therefore, the image forming system <NUM> can fortify the capacity to resist against an attack to an in-house network including the image forming apparatuses. Further, the three image forming apparatuses <NUM>, <NUM>, and <NUM> can mutually provide the firmware for automatic restoration, in the image forming system <NUM>. As result, the downtime of the three image forming apparatuses <NUM>, <NUM>, and <NUM> can be shortened, and the burden on the maintenance staff can be alleviated.

The present invention is not limited to the foregoing embodiment, but may be implemented according to the following variations.

Although each of the three image forming apparatuses <NUM>, <NUM>, and <NUM> includes the firmware management information storage region in the foregoing embodiment, it is not mandatory that the image forming apparatus is configured to store the firmware management information. A server connected to the network (e.g., support server <NUM>) may manage the firmware management information.

Although the support server <NUM> acts as the public key certificate authority in the embodiment, for example the support server <NUM> may provide the firmware to the image forming system <NUM>, when the firmware is unavailable in the image forming system <NUM>.

Although the boot program storage region <NUM> is provided on the hard disk in the embodiment, the boot program storage region <NUM> may be provided in a ROM, such as a masked ROM or a PROM. In this case, the auxiliary storage device includes the hard disk and the ROM.

Claim 1:
An image forming apparatus connectable to a network, the image forming apparatus comprising:
r a non-volatile auxiliary storage device containing firmware that causes the image forming apparatus to operate;
a manipulation detection device that analyzes the firmware stored in the auxiliary storage device and accompanied with a digital signature, and decides, using the digital signature, whether the firmware has been manipulated;
a firmware restoration device that deletes the firmware decided to have been manipulated, requests another image forming apparatus connected to the network to provide firmware compatible with the deleted firmware, and installs the firmware provided by the other image forming apparatus;
a firmware provision device that provides, upon receipt of a request for firmware compatible with the firmware of the other image forming apparatus, the compatible firmware to the other image forming apparatus; and
a control device that controls the manipulation detection device, the firmware restoration device, and the firmware provision device,
wherein the auxiliary storage device includes a boot block writing in which is restricted, and contains firmware that realizes the manipulation detection device, the firmware restoration device, the firmware provision device, and the control device, in the boot block.