WO2018138789A1 - Built-in device and firmware update method - Google Patents

Abstract

A built-in device (1) is provided with: a firmware storage unit (8); a start-up control unit (4) that reads firmware programs (15, 17, or 16, 18) from the firmware storage unit (8) and executes the read firmware programs to start up the built-in device; a device control unit (2) that acquires update firmware programs (20) via a network; a firmware verification unit (6) that verifies the validity of the firmware programs stored in the firmware storage unit (8) and the validity of the update firmware programs (20); a firmware update control unit (5) that writes the update firmware programs (20) to the firmware storage unit (8) if the firmware verification unit (6) determines that the update firmware programs (20) are valid programs. When starting up the built-in device, the start-up control unit (4) reads, as new firmware programs (15, 17, or 16, 18), the update firmware programs (20) that have been written to the firmware storage unit (8), and executes the read update firmware programs (20).

Description

Embedded device and firmware update method

The present invention relates to an embedded device that operates according to firmware and a firmware update method in the embedded device.

In recent years, distribution of copyrighted works such as music contents or video contents by publicly available embedded devices connected to a network such as the Internet (for example, a computer incorporated in a home appliance, machine or facility to realize a specific function), public There are provided services for browsing information held by institutions or companies, and financial services such as online banking or electronic money. In addition, IoT (“Internet of Things”), which is a mechanism for communicating measurement data, sensor data, control data, etc. by connecting to “things” that have communication and control functions through a network, has also become widespread. It's getting on.

However, in an embedded device connected to a network, there is a risk that the firmware is falsified by a malicious third party, and the falsified firmware (unauthorized program) executes an unexpected operation, causing an unexpected situation.

In response to such a problem, Patent Document 1 discloses a secure boot method for safely starting an embedded device by verifying the validity of a part (that is, a partial program) of the OS of the embedded device. is suggesting.

In addition, Patent Document 2 discloses a startup program data, a backup program data, and a non-volatile memory that stores correction data having the same contents as the backup program data. When the system is started with the detected anomaly detection unit and startup program data, bit error detection is performed on the backup program data, and when a bit error is detected, the bit error is corrected with correction data. An apparatus is provided that includes an error correction unit that restarts and a restart unit that restarts the system using backup program data when an abnormality of the startup program data is detected by the abnormality detection unit.

Japanese Patent Laying-Open No. 2015-022521 (for example, summary, FIG. 4) EP-A-2733612 (eg abstract, FIG. 2)

In the secure boot method described in Patent Document 1, the validity of the firmware is verified when the embedded device is activated, and when it is determined that the firmware is an illegal program, the activation of the firmware is stopped and the operation of the embedded device is performed. Stop. However, when the operation of the embedded device is stopped, there is a problem that the service is not provided from the facility in which the embedded device is embedded, and the service cannot be continuously provided. In particular, when a facility equipped with an embedded device is installed in a remote place, it is necessary for an operator to go to the remote place for recovery.

In addition, the apparatus described in Patent Document 2 detects the presence or absence of abnormality in the activation program data in parallel with the activation of the activation program data, and when an abnormality in the activation program data is detected, Since restart is performed, it is possible to ensure continuity of service. However, since the detection of abnormality of the activation program data is performed when the activation program is activated, the system may be restarted at the activation.

The present invention has been made in order to solve the above-described problems, and its purpose is to be able to start up safely with firmware whose validity has been confirmed, and to avoid the suspension of operation due to tampered firmware. It is to provide an embedded device and a firmware update method that can be used.

An embedded device according to one aspect of the present invention is an embedded device connected to a network, and a firmware storage unit that stores firmware, and the firmware is read from the firmware storage unit and executed to activate the embedded device An activation control unit that performs update, a device control unit that acquires firmware for update through the network, and a firmware verification unit that verifies the validity of the firmware stored in the firmware storage unit and the validity of the firmware for update And a firmware update control unit that writes the update firmware that has been determined to be a legitimate program by the firmware verification unit to the firmware storage unit, and the activation control unit includes the update firmware as the firmware. The startup of the embedded device after it has been written in the Muwea storage unit, the firmware for the said written in the firmware storage unit updates read as a new firmware is characterized by executing.

A firmware update method according to another aspect of the present invention is a firmware update method in an embedded device that is connected to a network and is activated by reading and executing firmware stored in a firmware storage unit. An acquisition step of acquiring firmware for verification, a verification step of verifying the validity of the firmware for update, and an update for writing the update firmware determined to be a valid program in the verification step into a firmware storage unit And when the embedded device is started after the update firmware is written in the firmware storage unit, the update firmware written in the firmware storage unit updates the new firmware. Reading the firmware is characterized by having a start executing.

According to the present invention, it is possible to safely start the embedded device with the firmware whose validity has been confirmed, and it is possible to prevent the operation from being stopped by the altered firmware, and to continue providing services by the embedded device. Sex can be secured.

1 is a block diagram schematically showing a configuration of an embedded device according to Embodiment 1 of the present invention. FIG. 3 is a diagram illustrating an example of a file configuration of update firmware acquired by the embedded device according to the first embodiment. 6 is a flowchart illustrating an example of an operation at the time of update in which the embedded device according to the first embodiment acquires a file of update firmware and replaces the firmware stored in the firmware storage unit with the update firmware. 6 is a diagram illustrating an example of a startup process of the embedded device according to the first embodiment. FIG. 6 is a flowchart illustrating an example of an activation process of the embedded device according to the first embodiment. 10 is a flowchart illustrating an example of an operation at the time of update in which an embedded device according to Embodiment 2 of the present invention acquires a firmware file for update and replaces firmware stored in a firmware storage unit with firmware for update.

Hereinafter, an embedded device and a firmware update method according to an embodiment of the present invention will be described with reference to the accompanying drawings. In this application, an embedded device (also referred to as “embedded device”) is a computer that is incorporated into household appliances, industrial equipment such as factory equipment, communication equipment, and transportation equipment such as automobiles in order to realize a specific function. is there. The following embodiments are merely examples, and various modifications can be made within the scope of the present invention.

<< 1 >> Embodiment 1
<< 1-1 >> Embedded Device 1
FIG. 1 is a block diagram schematically showing the configuration of the embedded device 1 according to the first embodiment. The embedded device 1 is a device that can perform the firmware update method according to the first embodiment. As shown in FIG. 1, the embedded device 1 includes a device control unit 2 that controls the overall operation of the embedded device 1, and a communication interface unit 3 that is communicably connected to a network by Ethernet (registered trademark) connection or the like. A boot control unit 4 for controlling the operation of the embedded device 1 according to the boot program and firmware, a firmware update control unit 5 for updating firmware, a firmware verification unit 6 for verifying firmware, and firmware verification And a certificate information storage unit 61 for storing certificate information used for verification in the firmware. The embedded device 1 also includes a boot ROM (Read Only Memory) 7 as a storage unit of a boot program 7a, which is a storage device configured by a nonvolatile semiconductor memory, and a memory configured by a semiconductor memory or a hard disk drive. And a firmware storage unit 8 which is a device.

The firmware storage unit 8 includes an OS storage unit 9 for storing an OS (Operating System) and an application storage unit 10 for storing an application program (also referred to as “application”). In the present application, the firmware includes an OS and an application. The OS storage unit 9 and the application storage unit 10 may be provided in different storage devices, but may be different storage areas of the same storage device.

The OS storage unit 9 has an OS storage area (A) 11 and an OS storage area (B) 12 which are duplicated storage areas. An OS (A) 15 is stored in the OS storage area (A) 11. The OS (A) 15 includes OS signature information (A) 15a for proving the legitimacy of the OS (A) 15. An OS (B) 16 is stored in the OS storage area (B) 12. The OS (B) 16 includes OS signature information (B) 16 a for verifying the legitimacy of the OS (B) 16. Note that (A) and (B) are symbols assigned to facilitate the distinction between the OS storage area (A) 11 and the OS storage area (B) 12. For example, when (A) indicates an operating OS storage area or OS currently in operation, (B) is a standby OS storage area or standby firmware that has been operated before. Indicates the OS. In some cases, (A) and (B) are reversed.

The application storage unit 10 has an application storage area (A) 13 and an application storage area (B) 14 which are duplicated storage areas. The application (A) 17 is stored in the application storage area (A) 13. The application (A) 17 includes application signature information (A) 17a for verifying the validity of the application (A) 17. An application (B) 18 is stored in the application storage area (B) 14. The application (B) 18 includes application signature information (B) 18 a for verifying the validity of the application (B) 18. For example, when (A) indicates a currently operating application storage area or application, (B) is a standby application storage area or standby firmware that was previously operated. Indicates an application. In some cases, (A) and (B) are reversed.

<< 1-2 >> Updating firmware 20
FIG. 2 is a diagram illustrating an example of a file configuration of the update firmware 20 acquired by the embedded device 1 according to the first embodiment. As shown in FIG. 2, the update firmware 20 file acquired from the network through the communication interface unit 3 includes an update OS 21 and an update application 22. The update OS 21 includes OS signature information 21a, and the update application 22 includes application signature information 22a.

<< 1-3 >> Firmware Update FIG. 3 shows that the embedded device 1 according to the first embodiment acquires a file of the firmware 20 for update, and places the firmware stored in the firmware storage unit 8 in the firmware 20 for update. It is a flowchart which shows the operation example at the time of the update to replace.

First, in step S101, the device control unit 2 acquires a file of the firmware 20 for update from the network through the communication interface unit 3, and instructs the firmware update control unit 5 to update the firmware. The update firmware 20 includes an update OS 21 having OS update information 21a and an update application 22 having application signature information 22a.

In the next step S102, the firmware update control unit 5 separates and extracts the update OS 21 and the update application 22 from the file of the update firmware 20.

In the next step S103, the firmware verification unit 6 verifies whether or not the OS signature information 21a of the update OS 21 is valid (ie, confirms the validity). As a verification method, a checksum (or hash value) for the OS object code is obtained, and this is stored in advance in the certificate information storage unit 61 as a valid checksum (or a valid hash value), and the obtained update firmware There is a method in which the checksum (or hash value) obtained for 20 is compared with a stored valid checksum (or valid hash value) and is judged to be valid if they match. In addition, as another verification method, there is a method of inspecting the presence or absence of falsification using the OS signature information 21a and the application signature information 22a. Examples of the algorithm for obtaining the hash value include SHA (Secure Hash Algorithm) -1, SHA-256, SHA-384, SHA-512, SHA-224, Wirlpool, MD5 (Message Digest 5), and SHA-3. The length of the hash value varies depending on the algorithm for obtaining the hash value, and is, for example, 128 bits, 160 bits, 224 bits, 256 bits, 384 bits, 512 bits, 1024 bits, or the like.

In the verification in step S103, when the firmware verification unit 6 determines that the program of the update OS 21 has been tampered (NO in step S103), the process proceeds to step S110, and the firmware update control unit 5 The firmware 20 stops the update process for replacing the firmware in the firmware storage unit 8.

In the verification in step S103, if the firmware verification unit 6 determines that the OS 21 program for update is valid (YES in step S103), the process proceeds to step S104.

In step S104, the firmware update control unit 5 stores (writes) the OS 21 for updating the obtained firmware 20 for update in an OS storage area different from the OS storage area currently in operation. Specifically, when the embedded device 1 is currently operating on the OS (A) 15 stored in the OS storage area (A) 11, the firmware update control unit 5 sets the update OS 21 to the current status. Store in the OS storage area (B) 12 that is not in operation. Conversely, when the embedded device 1 is operating on the OS (B) 16 stored in the OS storage area (B) 12, the firmware update control unit 5 sets the OS 21 for update as an OS that is not currently operated. Store in the storage area (A) 11.

In step S105, the firmware update control unit 5 sets the OS storage area updated this time (for example, the OS storage area (B) 12) as a program to be executed when the next embedded device 1 is started up.

In the next step S106, the firmware verification unit 6 verifies whether or not the application signature information 22a of the update application 22 included in the update OS 20 is valid (that is, confirms the validity). . The verification is executed by the same method as the verification method in step S103.

In the verification in step S106, if the firmware verification unit 6 determines that the program of the update application 22 is valid (YES in step S106), the process proceeds to step S107.

In step S107, the firmware update control unit 5 stores (writes) the acquired update application 22 in an application storage area different from the currently operated application storage area. Specifically, when the embedded device 1 is currently operating with the application (A) 17 stored in the application storage area (A) 13, the firmware update control unit 5 sets the update application 22 as follows: It stores in the application storage area (B) 14 which is not currently operated. Conversely, when the embedded device 1 is operating with the application (B) 18 stored in the application storage area (B) 14, the firmware update control unit 5 does not currently operate the application 22 for update. Store in the application storage area (A) 13.

In step S108, the firmware update control unit 5 uses the application (A) 17 or (B) 18 stored in the application storage unit (A) 13 or (B) 14 of the application storage unit 10 in step S107 at the next startup. Set as the program to be executed.

In the verification in step S106, if the firmware verification unit 6 determines that the program of the update application 22 has been tampered (NO in step S106), the update process skips steps S107 and S108 and updates this time. In order to validate the OS, the process proceeds to step S109. Moreover, after the process of step S108 is performed, a process progresses to step S109.

In step S109, the embedded device 1 is restarted, and the update process is terminated. The restart is executed by the update firmware stored in the firmware storage unit 8 this time.

<< 1-4 >> Startup of Embedded Device 1 Next, startup processing of the embedded device 1 will be described with reference to the drawings. FIG. 4 is a diagram illustrating an example of a startup process of the embedded device 1 according to the first embodiment. Generally, in the embedded device 1, as shown in FIG. 4, the boot program 31 read from the boot ROM 7 is started first, and the boot program 31 is sequentially started from the OS 32 read from the firmware storage unit 8. Then, the OS 32 activates the application 33.

FIG. 5 is a flowchart showing an example of the startup process of the embedded device 1 according to the first embodiment. FIG. 5 shows a case where the OS 21 for update and the application 22 for update are respectively written in the OS storage area (B) 12 and the application storage area (B) 14 in the last firmware update.

In step S201, the activation control unit 4 reads the boot program 31 for activating the embedded device 1 from the boot ROM 7 which is a non-rewritable storage area when the embedded device 1 is activated, and executes the read boot program. .

In the next step S202, the firmware verification unit 6 determines the OS signature information (B) 16a of the OS (B) 16 stored in the OS storage area (B) 12 that is currently being executed (that is, by the previous firmware update). The written OS signature information 21a) of the update OS 21 is verified.

As a result of verifying the OS in step S202, if it is determined that the OS (B) 16 has not been tampered with (YES in step S202), in step S203, the activation control unit 4 determines that the OS (OS) in the OS storage area (B) 12 B) 16 is read and executed, and then the process proceeds to step S207.

If it is determined that the OS (B) 16 has been falsified as a result of the verification of the OS (B) 16 in step S202 (NO in step S202), the process proceeds to step S204.

In step S204, the OS storage area to be used is switched to the OS storage area (A) 11 different from the currently operating OS storage area (B) 12.

In the next step S205, it is verified whether or not the stored OS signature information (A) 15 is valid.

As a result of the verification in step S205, if it is determined that the OS signature information (A) 15 is valid (has not been tampered with) (YES in step S205), in step S206, the activation control unit 4 displays the OS storage area (A ) 11 OS (A) 15 is read and executed, and then the process proceeds to step S207.

As a result of the verification in step S205, when it is determined that the OS storage area (A) 11 is not valid (tampered) (NO in step S205), the stored OS storage area (B) 12 and the OS storage area (A) It is determined that none of the OSs of 11 can be trusted, and the startup operation is terminated as a startup failure.

In step S207, the firmware verification unit 6 writes the application signature information (B) 18a of the application (B) 18 stored in the application storage area (B) 14 that is currently being executed (that is, written by the previous firmware update). The application signature information 22a) of the application 22 is verified.

As a result of the verification of the application in step S207, when it is determined that the application (B) 18 has not been tampered with (YES in step S207), in step S208, the activation control unit 4 determines that the application (B) 14 application ( B) 18 is read and executed, the verified OS and application are successfully started, and the start process is terminated.

If it is determined that the application (B) 18 has been tampered with as a result of the application verification in step S207 (NO in step S207), the process proceeds to step S209.

In step S209, the activation control unit 4 switches the application storage area to be used to an application storage area (A) 13 different from the application storage area (B) 14 currently used.

In the next step S210, the firmware verification unit 6 verifies the application signature information (A) 17a stored in the application storage area (A) 13.

As a result of the verification of the application in step S210, when it is determined that the application (A) 17 has not been tampered with (YES in step S210), in step S211, the activation control unit 4 determines that the application (A) 13 A) 17 is read and executed.

As a result of the application verification in step S210, when it is determined that the application (A) 17 has been tampered with (NO in step S210), the application (A) 17 stored in the application storage area (A) 13 and the application storage are stored. It is determined that none of the applications (B) 18 stored in the area (B) 14 can be trusted, the reading and execution of the applications are skipped, and the activation process is terminated with only the OS activated. In this case, the service provided by the OS can be provided as the embedded device 1, but the service provided by the application cannot be provided. However, it is more secure because the operation of applications that cannot be trusted is suppressed.

<< 1-5 >> Effect As described above, according to the embedded device 1 and the firmware update method according to the first embodiment, after the firmware 20 for update is acquired and stored in the firmware storage unit 8, The firmware verification unit 6 verifies the validity of the update firmware 20 (steps S103 and S106 in FIG. 3). For this reason, if the updating firmware 20 is not a valid program, the firmware 20 is not stored in the firmware storage unit 8 (step S110 in FIG. 3), and it is illegal to consider the continuity of the service. Control without operating the firmware program becomes possible.

In addition, according to the embedded device 1 and the firmware update method according to the first embodiment, the OS (B) 16 and the application (B) 18 read from the firmware storage unit 8 when the embedded device 1 is activated by the activation control unit 4. The validity of (or OS (A) 15 and application (A) 17) is verified (steps S202 and S207 in FIG. 5). For this reason, when the OS or application to be executed is not a valid program, the OS used before being stored in another OS storage area and used before being stored in another application storage area are used. The loaded application is read and executed (steps S204, S206, S209, and S211 in FIG. 5). For this reason, it is possible to ensure the continuity of the service provided by the embedded device 1 without stopping the operation of the embedded device 1.

Furthermore, verifying the validity before reading and executing the previously used OS stored in another OS storage area and the previously used application stored in another application storage area. (Steps S205 and S210 in FIG. 5), a more secure program execution environment can be provided.

<< 2 >> Embodiment 2
In the embedded device 1 and the firmware update method according to the first embodiment, as shown in FIG. 3, the validity of the OS signature information 21a is verified in the validity confirmation process performed when the file of the firmware 20 for update is acquired. Both confirmation of the authenticity (step S103) and validity of the application signature information 22a (step S106) are performed. However, in general, the file size of the application is larger than the file size of the OS, the amount of calculation required for the process of confirming the validity of the application is relatively large, and the processing time is relatively long.

Therefore, in the embedded device and the firmware update method according to the second embodiment of the present invention, the validity of the OS signature information 21a is confirmed in the validity confirmation process performed when the update firmware 20 file is acquired. However, the validity of the application authentication information 22a is not confirmed. Except for this point, the second embodiment is almost the same as the first embodiment. Therefore, in the description of the second embodiment, reference is also made to FIG. 1 showing the configuration of the embedded device, FIG. 2 showing the file of the firmware 20 for update, and FIG. 5 showing the operation at startup.

FIG. 6 shows an operation example at the time of update in which the embedded device according to the second embodiment acquires the file of the firmware 20 for update and replaces the firmware stored in the firmware storage unit 8 with the firmware 20 for update. It is a flowchart.

First, in step S301, the apparatus control unit 2 acquires a firmware 20 file for update from the network through the communication interface unit 3, and instructs the firmware update control unit 5 to update the firmware. The firmware 20 includes an update OS 21 having OS signature information 21a and an update application 22 having application signature information 22a.

In the next step S302, the firmware update control unit 5 separates and extracts the update OS 21 and the update application 22 from the file of the update firmware 20.

In the next step S303, the firmware verification unit 6 verifies whether or not the OS signature information 21a of the update OS 21 is valid (that is, confirms the validity).

In the verification in step S303, if the firmware verification unit 6 determines that the program of the update OS 21 has been falsified (NO in step S303), the process proceeds to step S307, and the firmware update control unit 5 The update process for rewriting the firmware in the firmware storage unit 8 is stopped by the firmware.

In the verification in step S303, if the firmware verification unit 6 determines that the OS 21 program for update is valid (YES in step S303), the process proceeds to step S304.

In step S304, the firmware update control unit 5 stores (writes) the OS 21 for update of the obtained update firmware 20 in an OS storage area different from the OS storage area currently in operation, and performs the current operation. The update application 22 of the acquired update firmware 20 is stored (written) in a different application storage area from the application storage area being used. Specifically, when the embedded device is currently operating on the OS (A) 15 stored in the OS storage area (A) 11, the firmware update control unit 5 operates the OS 21 for update at present. If the embedded device is operating in the application (A) 17 stored in the unstored OS storage area (B) 12 and currently stored in the application storage area (A) 13, the firmware update control unit 5 The update application 22 is stored in the application storage area (B) 14 that is not currently operated. When the embedded device 1 is currently operating on the OS (B) 16 stored in the OS storage area (B) 12, the firmware update control unit 5 does not currently operate the OS 21 for update. When the embedded device 1 is operating in the application (B) 18 stored in the OS storage area (A) 11 and currently stored in the application storage area (B) 14, the firmware update control unit 5 Are stored in the application storage area (A) 13 which is not currently operated.

In step S305, the firmware update control unit 5 sets the OS storage area updated this time (for example, the OS storage area (B) 12) as a program to be executed when the next embedded device is started up.

In step S109, the embedded device is restarted, and the update process ends. The restart is executed by the update firmware stored in the firmware storage unit 8 this time.

Since the application is generally large in size, if the processing capability of the embedded device is small, there is a possibility that it takes time to obtain the checksum or hash value from the application itself. On the other hand, at this stage, the first purpose is to quickly detect the presence or absence of tampering. Therefore, the verification of the update firmware 20 is performed only for the verification of the update OS 21, and the verification of the application is performed when the embedded device is started.

As described above, in the embedded device and the firmware update method according to the second embodiment, in addition to the effects described in the first embodiment, only the update OS 21 is verified, and the verification of the update application 22 is skipped. Thus, the processing time can be shortened.

1 embedded device, 2 device control unit, 3 communication interface unit, 4 startup control unit, 5 firmware update control unit, 6 firmware verification unit, 6a certificate information storage unit, 7 boot ROM, 8 firmware storage unit, 9 OS storage unit , 10 Application storage section, 11 OS storage area (A), 12 OS storage area (B), 13 Application storage area (A), 14 Application storage area (B), 15 OS (A), 15a OS signature information (A ), 16 OS (B), 16a OS signature information (B), 17 application (A), 17a application signature information (A), 18 application (B), 18a application signature information (B), 20 for update Firmware, OS for 21 updating, 21a OS signature information, application for 22 updating, 22a application signature information, 31 boot program, 32 OS, 33 applications, 61 certificate information storage section.

Claims (9)

An embedded device connected to a network,
A firmware storage unit for storing firmware;
An activation control unit that activates the embedded device by reading and executing the firmware from the firmware storage unit;
An apparatus control unit for obtaining firmware for update through the network;
A firmware verification unit that verifies the validity of the firmware stored in the firmware storage unit and the validity of the firmware for update;
A firmware update control unit that writes the firmware for update determined to be a legitimate program by the firmware verification unit to the firmware storage unit, and
The activation control unit reads and executes the update firmware written in the firmware storage unit as new firmware when the embedded device is activated after the update firmware is written in the firmware storage unit. An embedded device characterized by The firmware verification unit verifies the validity of the firmware read from the firmware storage unit when the embedded device is activated by the activation control unit,
The embedded device according to claim 1, wherein when the firmware verification unit determines that the program is a valid program, the activation control unit executes the firmware that is determined to be a valid program. . The firmware includes an OS and an application,
The firmware verification unit verifies the legitimacy of the OS read from the firmware storage unit at the time of startup of the embedded device by the startup control unit,
The boot control unit executes the OS that is determined to be a valid program when the firmware verification unit determines that the OS is a valid program. Embedded device. The firmware verification unit validates the application read from the firmware storage unit when the firmware verification unit determines that the OS is a valid program at the time of activation of the embedded device by the activation control unit. Verify the sex,
4. The activation control unit executes the application determined to be a valid program when the firmware verification unit determines that the application is a valid program. Embedded device. The firmware includes operational firmware being executed by the activation control unit, and standby firmware,
5. The firmware update control unit replaces the waiting firmware with the update firmware that is determined to be a valid program by the firmware verification unit. 6. The embedded device described in 1. The update firmware includes an update OS and an update application,
The firmware verification unit performs verification of the validity of the OS for update and verification of the validity of the application for update when verifying the validity of the firmware for update. The embedded device according to any one of 1 to 5. The update firmware includes an update OS and an update application,
The firmware verification unit verifies the validity of the OS for update and does not verify the validity of the application for update when verifying the validity of the firmware for update. Item 6. The embedded device according to any one of Items 1 to 5. A firmware update method for an embedded device that is connected to a network and starts by reading and executing firmware stored in a firmware storage unit,
An acquisition step of acquiring firmware for update through the network;
A verification step of verifying the validity of the firmware for update;
An update step of writing the update firmware, which is determined to be a valid program in the verification step, into a firmware storage unit;
When the embedded device is started after the update firmware is written in the firmware storage unit, the update firmware written in the firmware storage unit reads and executes new firmware as new firmware A firmware update method comprising the steps of: In the activation step, the validity of the firmware read from the firmware storage unit is verified, and when it is determined that the firmware is a valid program, the activation control unit determines that the firmware is a valid program. The firmware update method according to claim 8, wherein the firmware is executed.

Images