Electronic devices, control methods, programs, storage media

Abstract

To provide electronic devices that improve security and usability when obtaining certificate data. [Solution] The electronic device has control means that, when initiating a connection between the electronic device and a first server outside the electronic device, executes a first transmission process that sends information to the first server requesting the start of communication using a predetermined protocol for encrypted communication, and when communication using the predetermined protocol is started between the electronic device and the first server based on the first transmission process, executes a first reception process that receives a second root certificate data from the first server for verifying certificate data from a second server different from the first server, even without any user operation after the execution of the first transmission process.

Description

Technical Field

[0001] The present invention relates to an electronic device, a control method, a program, and a storage medium.

Background Art

[0002] Currently, software called firmware is incorporated in information processing devices such as printers, digital still cameras, and portable music players. Firmware is software incorporated in a device to control the hardware mounted in the device, such as a printer or a digital still camera. For example, the BIOS (Basic Input Output System) of a personal computer is a kind of firmware.

[0003] In addition, firmware can be changed (updated) later for adding functions or fixing defects. For firmware updates, there is a method of distributing a recording medium such as a CD-ROM with the new version of firmware written thereon, reading the firmware from the recording medium, and updating the old version of firmware incorporated in the device. Also, with the spread of networks such as the Internet, services for distributing new versions of firmware via the network have become widespread.

[0004] On the other hand, information processing devices such as printers, digital still cameras, and portable music players themselves have come to have a function of connecting to the Internet. Therefore, in order to ensure the security of the device by supporting encrypted communication such as TLS (Transport Layer Security), it has been required to mount an electronic certificate, which was conventionally for computers, on such information processing devices as well.

[0005] An electronic certificate is used to verify the authenticity of things like electronic signatures, and is generally issued by a trusted third-party certification authority (referred to as a certification authority). By using an issued electronic certificate, it becomes possible to prove, for example, that the server you are trying to access is capable of encrypted communication, or that the provider of a website is a real person.

[0006] Furthermore, digital certificates include what are called root certificates, which are signed and issued by the Certificate Authority (CA) itself to prove their legitimacy. Normally, when performing encrypted communication, web browsers and network controllers already possess root certificates issued by the CA. When communicating with a website (web server), they check whether the server certificate sent from the website (web server) is legitimate. To check the legitimacy of a server certificate, it is first determined whether the server certificate issued by the CA is legitimate. If the server certificate is legitimate, the next step is to check whether the CA itself is trustworthy. In this case, if the user already possesses a root certificate that the CA has digitally signed, the website (web server) can be considered trustworthy.

[0007] Root certificates and server certificates typically have expiration dates. Therefore, technologies exist for renewing these certificates (Patent Document 1). In addition, there are technologies that perform data updates for electronic certificates configured as part of the firmware by executing firmware acquisition and update processes (Patent Document 2). [Prior art documents] [Patent Documents]

[0008] [Patent Document 1] Japanese Patent Publication No. 2006-239930 [Patent Document 2] Japanese Patent Publication No. 2008-129788 [Overview of the project] [Problems that the invention aims to solve]

[0009] In Patent Documents 1 and 2, encrypted communication is not used during the acquisition of root certificates, thus requiring further improvements in data confidentiality and integrity. Furthermore, in Patent Document 2, user operations are required to acquire root certificates, thus requiring further improvements in usability.

[0010] The present invention aims to provide electronic devices, control methods, programs, and storage media that improve security and usability when acquiring certificate data. [Means for solving the problem]

[0011] To solve the above problems, the electronic device according to the present invention is an electronic device that, when a connection is initiated between the electronic device and a first server outside the electronic device, is controlled to execute a first transmission process that sends information to the first server requesting the commencement of communication using a predetermined protocol for encrypted communication; and when communication using the predetermined protocol is initiated between the electronic device and the first server based on the first transmission process, the electronic device is controlled to execute a first reception process that receives a second root certificate data from the first server for verifying certificate data from a second server different from the first server, even without any user operation after the execution of the first transmission process. [Effects of the Invention]

[0012] According to the present invention, security and usability can be improved when acquiring certificate data. [Brief explanation of the drawing]

[0013] [Figure 1] This diagram shows the system configuration. [Figure 2]This is a block diagram showing the configuration of the printer and external server. [Figure 3] This diagram shows the data storage configuration within the printer's memory. [Figure 4] This diagram shows the structure of the firmware update file. [Figure 5] This diagram shows the software configuration of the printer. [Figure 6] This is a sequence diagram illustrating the root certificate renewal process. [Figure 7] This is a diagram showing the communication settings screen. [Figure 8] This is a sequence diagram illustrating the firmware update process. [Figure 9] This is a sequence diagram used to explain the processes performed between devices. [Figure 10] This is a sequence diagram used to explain the processes performed between devices. [Modes for carrying out the invention]

[0014] The embodiments will be described in detail below with reference to the attached drawings. Note that the following embodiments do not limit the invention as defined in the claims. While the embodiments describe multiple features, not all of these features are essential to the invention, and the features may be combined in any way. Furthermore, in the attached drawings, identical or similar configurations are given the same reference numerals, and redundant descriptions are omitted.

[0015] [First Embodiment] Hereinafter, this embodiment will be described by taking a printer as an example of an information processing apparatus. FIG. 1 is a diagram showing an example of the configuration of a printing system including a printer as an information processing apparatus in this embodiment. The printer 101 is connected to a network (not shown) such as a LAN (Local Area Network). And the LAN is connected to the Internet 104 by a router (not shown), and the printer 101 can communicate with a certificate distribution server 102 and a firmware update server 103 as an HTTP (Hyper Text Transfer Protocol) server (Web server) on the Internet. Note that the LAN and the Internet 104 are examples of a network. The network may be a wired network, a wireless network, or a network in which both are mixed. Also, outside the printer 101, servers other than the certificate distribution server 102 and the firmware update server 103 (for example, a content server) may be configured.

[0016] The certificate distribution server 102 is a server for updating the root certificate installed in the printer 101, and the latest root certificate is stored in the certificate distribution server 102. The printer 101 can access the certificate distribution server 102 via the Internet 104 and download the latest root certificate. Note that, for example, when the root certificate becomes invalid, when the expiration date of the root certificate has passed, or when the number of external servers corresponding to the printer 101 increases, the latest root certificate is stored in the certificate distribution server 102. Note that the external server represents a server outside the printer 101, for example, the certificate distribution server 102, and for example, the firmware update server 103.

[0017] The firmware update server 103 is a server for updating the firmware data of the printer 101. In other words, it is a server that serves as a source for the printer 101 to obtain data for updating firmware data. The firmware update server 103 stores a firmware file for updating firmware data, and the firmware file contains new version firmware data. For example, the printer 101 can download firmware data from the firmware update server 103 and update the old version firmware data already installed in the printer 101 to the new version firmware data.

[0018] HTTP communication using a predetermined protocol, such as HTTP, is performed between the certificate distribution server 102 and the printer 101, and between the firmware update server 103 and the printer 101. In this embodiment, in order to implement more secure HTTP communication, TLS (Transport Layer Security) communication is performed. The printer 101 holds a root certificate of a trusted third-party root certification authority to verify the server certificates of the certificate distribution server 102 and the firmware update server 103 respectively. The root certificate is an electronic certificate that the certification authority signs and issues by itself to prove its own legitimacy. The root certificate is used when examining whether the server certificate transmitted from the web server is legitimate. The description of the functions of the certificate distribution server 102 and the firmware update server 103 as HTTP servers respectively is omitted. Hereinafter, data representing the root certificate communicated between devices is called root certificate data, and data representing the server certificate communicated between devices is called server certificate data.

[0019] Next, we will explain an example of the configuration of the printer 101 and the external server using Figures 2(a) and 2(b). Figure 2(a) is a block diagram showing an example of the internal configuration of the printer 101, and Figure 2(b) is a block diagram showing an example of the internal configuration of the external server.

[0020] The printer 101 includes a controller 200 that controls network-related functions and an engine controller 210 that controls the printer 101 itself. The controller 200 includes a CPU 201 that controls the controller 200 as a whole. The flash ROM 202 is a computer-readable memory unit that stores firmware data and root certificate data. The RAM 203 is a computer-readable memory unit used as a storage area for various work areas and predetermined management data. For example, the CPU 201 uses the RAM 203 as a work area to realize the operation of the printer 101 based on the firmware data stored in the flash ROM 202 and the management data stored in the RAM 203.

[0021] The network interface 204 is an interface unit for connecting the printer 101 and the LAN. In this embodiment, the printer 101 is assumed to be connected to the LAN via Ethernet® as an example. The network interface 204 may have a configuration that supports wired or wireless networks. In Figure 2(a), the network interface 204 is shown as a single unit, but there may be multiple units. For example, it may be configured as an interface for multiple different communication modes, such as short-range wireless communication. The external interface 205 is, for example, a USB (Universal Serial Bus) device interface. For example, the printer 101 can be connected to a digital still camera (not shown) having a USB host interface via the external interface 205. The internal interface 206 is connected to the engine controller 210, enabling data transmission and reception between the controller 200 and the engine controller 210. Each block within the controller 200 is connected to the system bus 207 of the controller 200 and can communicate with each other.

[0022] The engine controller 210 includes a CPU 211 that controls the entire engine controller 210. The flash ROM 212 is a memory unit that stores firmware data. The RAM 213 is a memory unit used for various work areas. For example, the CPU 211 uses the RAM 213 as a work area to realize the operation of the printer 101 based on the firmware data stored in the flash ROM 212.

[0023] The internal interface 214 is connected to the internal interface 206 of the controller 200, enabling data transmission and reception between the controller 200 and the engine controller 210. The user interface 215 includes input devices such as hardware keys provided on the operation panel (not shown) of the printer 101, and a display device for displaying information. The user interface 215 receives user instructions for the printer 101 and displays the status of the printer 101 and various user interface screens. The user interface 215 may also be configured as a touch panel including software keys. The printing mechanism 216 is a mechanism that forms (prints) an image on a recording medium such as paper, and operates under the control of the CPU 211. Various recording methods, such as inkjet recording and electrophotography, can be used in the printing mechanism 216. Each block within the engine controller 210 is connected to the system bus 217 of the engine controller 210 and can communicate with each other.

[0024] In this embodiment, the operation of the printer 101 may be realized by either the CPU 200 or the CPU 211, or by the coordinated operation of the CPU 200 and the CPU 211. In this embodiment, as an example, the operation of the printer 101 will be described as being realized by the CPU 200 reading a program stored in the flash ROM 202 into the RAM 203 and executing it.

[0025] Figure 2(b) shows an example of the internal configuration of an external server. Here, the external server is, for example, a certificate distribution server 102 and, for example, a firmware update server 103. In this embodiment, the certificate distribution server 102 and the firmware update server 103 are described as having the same configuration as shown in Figure 2(b). However, the configurations of the certificate distribution server 102 and the firmware update server 103 may differ from each other, and each server may have a configuration corresponding to the functions it can perform. In the explanation of Figure 2(b), the certificate distribution server 102 is described as a representative example of the certificate distribution server 102 and the firmware update server 103.

[0026] The certificate distribution server 102 includes a CPU 221 that controls the certificate distribution server 102 as a whole. The flash ROM 222 is a computer-readable storage unit that stores firmware files for updates, which will be described later. The RAM 223 is a computer-readable storage unit used as a storage area for various work areas and predetermined management data. For example, the CPU 221 reads a program stored in the flash ROM 222 into the RAM 223 and executes it, thereby realizing the operation of the certificate distribution server 102 in this embodiment.

[0027] The network interface 224 is an interface unit for connecting the certificate distribution server 102 and the LAN. In this embodiment, the certificate distribution server 102 is assumed to be connected to the LAN via Ethernet® as an example. The network interface 224 may have a configuration that supports wired or wireless networks. In Figure 2(b), the network interface 224 is shown as a single unit, but there may be multiple units. For example, it may be configured as an interface for multiple different communication modes, such as short-range wireless communication. The external interface 225 is, for example, a USB (Universal Serial Bus) device interface. Each of the above blocks is connected to the system bus 226 and can communicate with each other.

[0028] Next, we will explain the data storage configuration (memory configuration) of the flash ROM 202 storage area of ​​the printer 101's controller 200. Here, we will only explain the storage area for the controller firmware data necessary to operate the controller 200, and will omit the explanation of the storage area for the engine controller firmware data necessary to operate the engine controller 210. However, the explanation of the controller firmware data storage area is also applicable to the engine controller firmware data storage area. Hereafter, controller firmware data will simply be referred to as firmware data.

[0029] Figure 3 shows an example of the data storage configuration of the flash ROM 202 of the printer 101. The flash ROM 202 of the controller 200 has two firmware storage areas, firmware storage area 301 and firmware storage area 302, as storage areas for firmware data. When the printer 101 is shipped, the initial version of the firmware data is stored in one of the two storage areas. At that time, no firmware data is stored in the other storage area.

[0030] In response to this, if the printer 101 performs the firmware update process described later and obtains new firmware data, the newly obtained firmware data will be stored in the unused area of ​​the two storage areas mentioned above. Then, if the printer 101 performs the firmware update process again, the new firmware data will be stored (i.e., overwritten) in the area where the firmware data that is not currently being used is stored.

[0031] The individual parameter storage area 303 is an area for storing device information and configuration information specific to the printer 101. Device information includes, for example, the IP address, and configuration information includes, for example, information indicating printing settings such as paper size. The basic parameter storage area 304 is an area for storing information such as firmware data that is started by the boot program. For example, version information of the firmware data stored in firmware storage area 301 and firmware storage area 302 is stored in the basic parameter storage area 304.

[0032] The boot program storage area 305 is an area that stores the boot program for starting the firmware data necessary to operate the controller 200. The boot program stored in the boot program storage area 305 refers to the version information of the firmware data stored in the basic parameter storage area 303 and determines the firmware data to start. For example, firmware data corresponding to a newer version information is determined. The boot program then executes the startup process for the determined firmware data.

[0033] In this embodiment, firmware storage area 301 and firmware storage area 302 each store root certificate data in addition to firmware data. Here, root certificate data refers to, for example, the root certificate data necessary to verify server certificate data and perform secure communication between printer 101 and certificate distribution server 102. It also refers to, for example, the root certificate data necessary to verify server certificate data and perform secure communication between printer 101 and firmware update server 103.

[0034] Next, we will explain the structure of the update firmware file, including firmware data, using Figure 4. Figure 4 is a conceptual diagram showing an example of the structure of the update firmware file, including firmware data, stored in binary format in the flash ROM 222 of the firmware update server 103. As mentioned above, the firmware update server 103 stores update firmware files for updating the firmware data of the printer 101's controller 200 and engine controller 210, respectively. Here, we will only explain the update firmware file for updating the firmware data for operating the controller 200. Note that the explanation of the update firmware data for updating the firmware data for operating the controller 200 is also applicable to the update firmware file for updating the firmware data for operating the engine controller 210.

[0035] The update firmware file is a single binary file containing firmware data 401 and 404 for operating the controller 200. The update firmware file also includes root certificate data 402 for secure communication between the printer 101 and the certificate distribution server 102 by verifying the server certificate data. In other words, root certificate data 402 is the root certificate data for verifying the server certificate data from the certificate distribution server 102. Furthermore, the update firmware file includes root certificate data 403 for secure communication between the printer 101 and the firmware update server 103 by verifying the server certificate data. In other words, root certificate data 403 is the root certificate data for verifying the server certificate data from the firmware update server 103.

[0036] Figure 4 shows that the root certificate data includes two types of root certificate data, root certificate data 402 and 403. However, if a server other than the certificate distribution server 102 and the firmware update server 103 is configured as an external server, root certificate data for verifying the server certificate data from that server may also be included. For example, the update firmware file may include root certificate data for verifying the server certificate data from the content server.

[0037] Firmware data 401 contains a pointer to identify the storage location of root certificate data 402 and 403 in the firmware update file. The CPU 221 of the firmware update server 103 can refer to this pointer to determine which part of the firmware update file contains the root certificate data 402 and 403. Root certificate data 402 and 403 contain unique information specific to each root certificate, such as the type of root certificate data, certificate authority information, revision information, and expiration date.

[0038] The firmware storage areas 301 and 302 in Figure 3 each have the same data storage configuration as the firmware update file in Figure 4. In other words, when the printer 101 obtains the firmware update file from the firmware update server 103 and stores it in either the firmware storage area 301 or the firmware storage area 302, the firmware storage area 301 or the firmware storage area 302 will have the same configuration as in Figure 4.

[0039] In Figure 4, the root certificate data 402 and 403 are positioned between firmware data 401 and firmware data 404. However, the configuration is not limited to that shown in Figure 4, as long as the firmware data and root certificate data have an integrated file structure.

[0040] Thus, in this embodiment, the firmware update file has a file structure in which the root certificate data corresponding to the root certificate and the firmware data are integrated. In other words, the root certificate data is configured to be held as part of the firmware update file. Therefore, when the printer 101 downloads the firmware data by obtaining the firmware update file, the root certificate data is obtained together with the firmware data. In other words, in order for the printer 101 to obtain the root certificate data, it is sufficient to execute the firmware update process of the controller 200. On the other hand, in this embodiment, even without performing the firmware update process, the printer 101 can update two types of root certificate data held in the printer 101 by obtaining the root certificate data from the certificate distribution server 102: root certificate data for verifying the server certificate data from the certificate distribution server 102, and root certificate data for verifying the server certificate data from the firmware update server 103. In the following, the root certificate data for verifying the server certificate data from the certificate distribution server 102 may be referred to as the root certificate data corresponding to the certificate distribution server 102. Furthermore, the root certificate data used to verify the server certificate data from the firmware update server 103 is sometimes referred to as the root certificate data corresponding to the firmware update server 103.

[0041] Next, using Figure 5, the software configuration of the controller 200 of the printer 101, specifically the software configuration related to this embodiment, will be explained. Note that the software described below is included in the firmware data.

[0042] Figure 5 shows an example of the software configuration of the controller 200 of the printer 101. The main application 501 is the software used for the primary control of the controller 200. The main application 501 has modules that execute processes requested by the certificate distribution server 102 and the firmware update server 103. However, if the printer 101 can communicate with other external servers, it may have modules that execute processes requested by those servers as appropriate.

[0043] The HTTP client application 502, in cooperation with the main application 501, obtains root certificate data from the certificate distribution server 102 and firmware update files from the firmware update server 103.

[0044] The TLS module 503 is called by the HTTP client application 502 and is used to perform TLS communication between the printer 101 and the certificate distribution server 102, and between the printer 101 and the firmware update server 103. The TLS module 503 uses the root certificate data corresponding to the certificate distribution server 102 stored in the flash ROM 202 to verify the reliability of the server certificate data sent from the certificate distribution server 102 (server certificate data verification). The TLS module 503 also uses the root certificate data corresponding to the firmware update server 103 stored in the flash ROM 202 to verify the reliability of the server certificate data sent from the firmware update server 103.

[0045] The TCP (Transmission Control Protocol) / IP (Internet Protocol) stack 504 controls communication between the HTTP client application 502, the TLS module 503, and the network interface 204. This enables TCP / IP communication between the certificate distribution server 102, the firmware update server 103, and the printer 101. If other external servers not shown in Figure 1 exist, the TCP / IP stack 504 enables TCP / IP communication between those external servers and the printer 101.

[0046] As an example of the processes executed in the above software configuration, we will explain the process when the firmware update server 103 issues a firmware update request in URI (Uniform Resource Identifier) ​​format.

[0047] Let's assume the URI indicating the location of the update firmware file sent from the firmware update server 103 to the printer 101 is "https: / / xxx.yyy.co.jp / index.html". Such a URI is sent, for example, when the firmware update server 103 has prepared the latest firmware data. In the case of this URI, because it is HTTPS, secure HTTP communication is required. The main application 501, knowing that the acquired URI requests HTTP communication, passes the above URI information to the HTTP client application 502.

[0048] The HTTP client application 502, recognizing that the URI indicated by the information it received requests secure HTTP communication, requests processing from the TLS module 503. The TLS module 503, in preparation for secure HTTP communication, initiates communication with the firmware update server 103, specifying the location of the update firmware file indicated by the URI as the communication destination. The actual communication takes place via the TCP / IP stack 504.

[0049] The TLS module 503 obtains server certificate data sent from the firmware update server 103 and uses the root certificate data corresponding to the firmware update server 103 held by the printer 101 to determine whether secure HTTP communication is possible. This determination is included in the verification of the server certificate data. If the determination shows that secure HTTP communication is possible, the HTTP client application 502 executes the communication. If secure HTTP communication is not possible, the HTTP client application 502 decides whether to perform communication in an insecure state or to abort the communication. As will be described later, in this embodiment, there are cases in which verification of the server certificate data is intentionally omitted. In this embodiment, when TLS communication is performed without verifying the server certificate data, it is included in the case where secure HTTP communication is possible.

[0050] Next, we will describe the root certificate update process via communication between the printer 101 and the certificate distribution server 102, and the firmware update process via communication between the printer 101 and the firmware update server 103.

[0051] Figure 6 is a sequence diagram illustrating the root certificate update process performed between the printer 101 and the certificate distribution server 102. The operation of the printer 101 in Figure 6 is achieved, for example, by the CPU 201 reading a program stored in the flash ROM 202 into the RAM 203 and executing it. Similarly, the operation of the certificate distribution server 102 in Figure 6 is achieved, for example, by the CPU 221 of the certificate distribution server 102 reading a program stored in the flash ROM 222 into the RAM 223 and executing it.

[0052] In S601, the CPU 201 of printer 101 performs a network connection initiation determination. The network connection initiation determination is a determination process to determine whether or not to perform communication between printer 101 and certificate distribution server 102 for the purpose of root certificate update processing. Specifically, for example, if a user turns on printer 101, and the printer 101's communication settings enable wired LAN communication or wireless LAN communication in infrastructure mode (wireless LAN communication via an access point), and printer 101 is assigned an IP address, then it is determined that the above communication between printer 101 and certificate distribution server 102 will take place. Alternatively, if the printer 101 is powered on and network communication is disabled (both wired LAN communication and wireless LAN communication in infrastructure mode are disabled), then a setting change operation is performed to enable network communication (enable at least one of wired LAN communication and wireless LAN communication in infrastructure mode), then it is determined that a network connection will be initiated and communication between printer 101 and certificate distribution server 102 will take place. In other words, the S602 process is performed in response to operations that initiate a network connection, such as turning on the power or enabling network communication. Figure 7 shows an example of a communication settings screen displayed on the operation panel (not shown) of the user interface 215 of the printer 101. The communication settings screen in Figure 7 shows an example where the wired LAN interface has been set to "enabled" by user operation. Note that the settings on the communication settings screen can be changed by user operation, and for example, based on the wired LAN interface being changed from "disabled" to "enabled" by user operation, it is determined that the above communication between the printer 101 and the certificate distribution server 102 will be performed.

[0053] In S602, the CPU 201 of the printer 101 requests a TLS connection from the certificate distribution server 102. In other words, the request for a TLS connection from the certificate distribution server 102 initiates TLS communication between the printer 101 and the certificate distribution server 102. Specifically, for example, the TLS handshake is initiated by the sending process in which a ClientHello message is sent.

[0054] In S603, the CPU 221 of the certificate distribution server 102 sends server certificate data to the printer 101 during the TLS handshake process.

[0055] In S604, when the CPU 201 of the printer 101 receives server certificate data from the certificate distribution server 102, it verifies the received server certificate data using the root certificate data corresponding to the certificate distribution server 102 that the printer 101 holds. Hereafter, the root certificate data that the printer 101 holds at the time it receives server certificate data from the certificate distribution server 102 in S603 will be referred to as the "initial root certificate data".

[0056] For example, server certificate data verification can be performed by determining whether the signature of the server certificate data is a trusted signature using the initial root certificate data. However, verification may be performed by other methods. For example, verification may be performed by comparing the CN (Common Name) of the server certificate data with the domain name to which printer 101 is connected, checking the expiration date of the server certificate data, or checking whether the server certificate data has been revoked. Here, we assume that the verification of the server certificate data in S604 was determined to be successful.

[0057] In S605, the CPU 201 of the printer 101 obtains the latest root certificate data from the certificate distribution server 102 via TLS encrypted communication. Thus, in this embodiment, since the root certificate data is obtained via TLS communication, the security of obtaining the root certificate data can be improved compared to obtaining it in plain text, etc.

[0058] In S606, the CPU 201 of printer 101 updates the initial root certificate data it holds with the latest root certificate data obtained in S605. In S607, the CPU 201 of printer 101 terminates the TLS connection between printer 101 and certificate distribution server 102. The processes in S602 to S606 are performed automatically without any user interaction with printer 101. In other words, after an operation that triggers the network connection is performed, the processes in S602 to S606 are performed automatically without any user interaction.

[0059] In this embodiment, there is root certificate data corresponding to the certificate distribution server 102 and root certificate data corresponding to the firmware update server 103. In S605 of Figure 6, the printer 101 obtains the two root certificate data from the certificate distribution server 102. In other words, in S605 of Figure 6, a receiving process is performed to receive the two root certificate data from the certificate distribution server 102. That is, the printer 101 obtains the root certificate data corresponding to the certificate distribution server 102 and the root certificate data corresponding to the firmware update server 103 from the certificate distribution server 102. Then, in S606, the printer 101 updates the initial root certificate data corresponding to the certificate distribution server 102 using the root certificate data corresponding to the certificate distribution server 102 obtained in S605. Also in S606, the printer 101 updates the initial root certificate data corresponding to the firmware update server 103 using the root certificate data corresponding to the firmware update server 103 obtained in S605. In other words, in this embodiment, if the verification of the server certificate data in S604 is determined to be successful, the printer 101 updates all the initial root certificate data it holds at that time. Therefore, if there is an external server not shown in Figure 1, root certificate data other than the two root certificate data mentioned above may be updated. For example, in S605, the printer 101 may obtain root certificate data from the certificate distribution server 102 to verify server certificate data from another content server (not shown), and in S606, update the initial root certificate data corresponding to the content server using the obtained root certificate data.

[0060] Figure 8 is a sequence diagram illustrating the firmware update process performed between the printer 101 and the firmware update server 103. The operation of the printer 101 in Figure 8 is achieved, for example, by the CPU 201 reading a program stored in the flash ROM 202 into the RAM 203 and executing it. Similarly, the operation of the firmware update server 103 in Figure 8 is achieved, for example, by the CPU 221 of the firmware update server 103 reading a program stored in the flash ROM 222 into the RAM 223 and executing it.

[0061] In S801, the CPU 201 of the printer 101 starts the firmware update process. In this embodiment, the firmware update process is assumed to start without user operation. Specifically, for example, the firmware update process is started when the printer 101 determines that a predetermined time has arrived based on time information held in the non-volatile area, or when it is initiated based on instructions from an external server. However, the firmware update process may also be started by user operation. Specifically, for example, the firmware update process may be started based on user operation on the operation panel (not shown) of the user interface 215 of the printer 101.

[0062] In S802, the CPU 201 of the printer 101 requests a TLS connection to the firmware update server 103. In other words, the request for a TLS connection to the firmware update server 103 initiates TLS communication between the printer 101 and the firmware update server 103. Specifically, for example, the TLS handshake is initiated by the sending process in which a ClientHello message is sent.

[0063] In S803, the CPU 221 of the firmware update server 103 sends server certificate data to the printer 101 during the TLS handshake process.

[0064] In S804, when the CPU 201 of the printer 101 receives server certificate data from the firmware update server 103, it verifies the server certificate data using the root certificate data corresponding to the firmware update server 103 that the printer 101 holds. Here, the root certificate data corresponding to the firmware update server 103 that the printer 101 holds may be the initial root certificate data corresponding to the firmware update server 103. Alternatively, the root certificate data held by the printer 101 may be the latest root certificate data corresponding to the firmware update server 103, which was updated in S606 in Figure 6. For verification, for example, similar to S604, it is determined using the root certificate data whether the signature of the server certificate data is a trusted signature. Here, let's assume that the verification of the server certificate data in S804 was determined to be successful.

[0065] In S805, the CPU 201 of the printer 101 obtains an update firmware file containing the latest firmware data from the firmware update server 103 via TLS encrypted communication. As mentioned above, the update firmware file includes root certificate data 402 and root certificate data 403 in addition to the firmware data. Thus, in this embodiment, since the update firmware file is obtained via TLS communication, the security related to the acquisition of root certificate data can be improved. Furthermore, the update firmware file itself may be encrypted. This would further improve the security related to the acquisition of root certificate data.

[0066] In S806, the CPU 201 of printer 101 updates the firmware data using the firmware data contained in the update firmware file. In S807, the CPU 201 of printer 101 terminates the TLS connection between printer 101 and firmware update server 103.

[0067] In S805 of Figure 8, the printer 101 obtains root certificate data corresponding to the certificate distribution server 102 and root certificate data corresponding to the firmware update server 103 from the firmware update server 103. Then, in S806, the printer 101 updates the root certificate data corresponding to the certificate distribution server 102 held by the printer 101 using the root certificate data corresponding to the certificate distribution server 102 obtained in S805. Also in S806, the printer 101 updates the root certificate data corresponding to the firmware update server 103 held by the printer 101 using the root certificate data corresponding to the firmware update server 103 obtained in S805. In other words, in this embodiment, if the verification of the server certificate data in S804 is determined to be successful, the printer 101 updates all root certificate data held at that time. Therefore, if an external server not shown in Figure 1 exists, root certificate data other than the two root certificate data mentioned above may also be updated. For example, in S805, the printer 101 obtains root certificate data from the firmware update server 103, along with the firmware update file, to verify server certificate data from other content servers (not shown). Then, in S806, the printer 101 may update the root certificate data corresponding to the content servers it holds using the obtained root certificate data. In this way, in this embodiment, all root certificate data held by the printer 101 can be updated by performing a firmware update.

[0068] The above describes the process when the server certificate data verification is successful. Below, we will describe the process when the server certificate data verification fails.

[0069] Figure 9 is a sequence diagram illustrating the processes performed between the printer 101 and the certificate distribution server 102, and between the printer 101 and the firmware update server 103. The operation of the printer 101 in Figure 9 is achieved, for example, by the CPU 201 reading a program stored in the flash ROM 202 into the RAM 203 and executing it. The operation of the certificate distribution server 102 in Figure 9 is achieved, for example, by the CPU 221 of the certificate distribution server 102 reading a program stored in the flash ROM 222 into the RAM 223 and executing it. The operation of the firmware update server 103 in Figure 9 is achieved, for example, by the CPU 221 of the firmware update server 103 reading a program stored in the flash ROM 222 into the RAM 223 and executing it.

[0070] The processing in S901 to S904 is the same as the explanation in S601 to S604, so the explanation will be omitted. Also, at least the processing in S902 to S914 in Figure 9 is performed even without user operation after an operation that causes the network connection to start has been performed. However, in Figure 9, it is assumed that in S904, the CPU 201 of printer 101 receives server certificate data from certificate distribution server 102 and verifies the server certificate data using the initial root certificate data, and the result is determined to be a failure (verification error). Specifically, for example, if the initial root certificate data corresponding to certificate distribution server 102 held by printer 101 has expired, the result of the verification of the server certificate data from certificate distribution server 102 will be determined to be a failure.

[0071] In S905, the CPU 201 of the printer 101 determines whether or not to reacquire the root certificate data. Specifically, for example, if the expiration date of the initial root certificate data held by the printer 101 has expired, it is determined to reacquire the root certificate data. As a method for checking the expiration date, for example, the expiration date of the initial root certificate data is compared with time information held in a non-volatile area different from the area where the initial root certificate data is stored. In this case, for example, the printer 101 may be configured to update the time information held in the non-volatile area using the RTC (Real Time Clock) built into the printer 101. Alternatively, for example, the printer 101 may be configured to update the time information in its non-volatile area when time information is obtained from an external device.

[0072] For example, if the initial root certificate data held by printer 101 has expired, it will be determined that the root certificate data needs to be reacquired. As a way to check for revocation, for example, the CPU 201 of printer 101 can access the certificate authority's server (not shown) using OCSP (Online Certificate Status Protocol) to check. Alternatively, for example, the CPU 201 of printer 101 may download the CRL (Certificate Revocation Lists) and verify the serial number of the certificate registered in the CRL by comparing it with the server certificate data or initial root certificate data.

[0073] If S905 determines that the root certificate needs to be reacquired, in S906, the CPU 201 of the printer 101 requests a TLS connection to the certificate distribution server 102 again. In other words, the request for a TLS connection to the certificate distribution server 102 restarts TLS communication between the printer 101 and the certificate distribution server 102. Specifically, for example, the TLS handshake is initiated by the sending process in which a ClientHello message is sent.

[0074] In S907, the certificate distribution server 102 sends server certificate data to the printer 101 during the TLS handshake process. The printer 101's CPU 201 receives the server certificate data from the certificate distribution server 102, but deliberately does not verify the server certificate data. This is because if the server certificate data were verified, the verification result would be determined to be a failure, and as a result, the subsequent TLS communication to obtain the root certificate data would also fail.

[0075] In S908, the CPU 201 of the printer 101 obtains root certificate data corresponding to the firmware update server 103 from the certificate distribution server 102. Thus, in this embodiment, the CPU 201 of the printer 101 obtains the latest root certificate data corresponding to the firmware update server 103 from the certificate distribution server 102 using TLS encrypted communication. This improves the security of obtaining root certificate data compared to obtaining it in plain text.

[0076] In Figure 6, step S605 explains that root certificate data corresponding to the certificate distribution server 102 and root certificate data corresponding to the firmware update server 103 are obtained. On the other hand, in step S908, only root certificate data corresponding to the firmware update server 103 is obtained, and root certificate data corresponding to the certificate distribution server 102 is not obtained. Note that the target of root certificate data acquisition can be changed, for example, by changing the URI to which the printer 101 connects.

[0077] As will be described later, the CPU 201 of the printer 101 verifies the server certificate data sent from the firmware update server 103 using the root certificate data obtained by S908. In other words, the firmware update server 103 has a low risk of impersonation. Therefore, in this embodiment, it is possible to update the root certificate data corresponding to a server other than the firmware update server 103, such as the certificate distribution server 102, through TLS communication with the firmware update server 103, which has a low risk of impersonation.

[0078] In S909, the CPU 201 of the printer 101 updates the root certificate data corresponding to the firmware update server 103, which is held in the printer 101, using the root certificate data corresponding to the firmware update server 103 that was received from the certificate distribution server 102 in S908. The root certificate data here may be the initial root certificate data.

[0079] In S910, the CPU 201 of printer 101 terminates the TLS connection between printer 101 and certificate distribution server 102.

[0080] In S911, the CPU 201 of the printer 101 starts the firmware update process. In this embodiment, the firmware update process is started automatically without user intervention.

[0081] In S908, it was explained that only the root certificate data corresponding to the firmware update server 103 is acquired. In other words, root certificate data corresponding to the certificate distribution server 102 or other external servers (not shown) different from the firmware update server 103 is not acquired. Therefore, the root certificate data held in the printer 101 that corresponds to the certificate distribution server 102 or other external servers (not shown) is not updated. Consequently, if the subsequent firmware update process is not executed, TLS communication between the printer 101 and the certificate distribution server 102 or other external servers will fail. Therefore, in this embodiment, the firmware update process is started automatically at the timing of S911 without user operation. As a result, when the user intends to communicate with an external server thereafter, TLS communication between the printer 101 and the external server can be successfully established.

[0082] Figure 9 illustrates the process of starting the firmware update at the timing of S911. However, the firmware update process may be configured to start at a different time. Generally, firmware updates take longer to process than root certificate data updates. Therefore, in addition to the process shown in Figure 9, the firmware update process may be automatically started, for example, during the nighttime. User configuration operations for this purpose may be accepted on the operation panel (not shown) of the user interface 215 of the printer 101. Alternatively, a message screen indicating that a connection to an external server (not shown) cannot be established may be displayed on the operation panel of the user interface 215 of the printer 101 at S910, and the user may be allowed to set the time information for when the firmware update process can be started.

[0083] When the firmware update process begins, in S912, the CPU 201 of the printer 101 requests a TLS connection to the firmware update server 103. In other words, the request for a TLS connection to the firmware update server 103 initiates TLS communication between the printer 101 and the firmware update server 103. Specifically, for example, the TLS handshake is initiated by the sending process in which a ClientHello message is sent.

[0084] In S913, the CPU 221 of the firmware update server 103 sends server certificate data to the printer 101 during the TLS handshake process.

[0085] In S914, when the CPU 201 of the printer 101 receives server certificate data from the firmware update server 103, it verifies the server certificate data using the root certificate data corresponding to the firmware update server 103 that the printer 101 holds. Here, the root certificate data corresponding to the firmware update server 103 that the printer 101 holds is the latest root certificate data updated in S909. For verification, for example, similar to S604, it is determined whether the signature of the server certificate data is a trusted signature using the initial root certificate. Since the verification is performed using the root certificate data corresponding to the firmware update server 103 obtained in S908, the result of the verification of the server certificate data in S914 is determined to be successful.

[0086] In S915, the CPU 201 of the printer 101 obtains an update firmware file containing the latest firmware data from the firmware update server 103 via TLS encrypted communication. As mentioned above, the update firmware file includes root certificate data 402 and root certificate data 403 in addition to the firmware data. Thus, in this embodiment, since the update firmware file is obtained via TLS communication, the security of obtaining the root certificate data can be improved. Furthermore, the update firmware file itself may be encrypted. This would further improve the security of obtaining the root certificate data.

[0087] In S916, the CPU 201 of the printer 101 updates the firmware using the firmware data contained in the update firmware file. In S917, the CPU 201 of the printer 101 terminates the TLS connection between the printer 101 and the firmware update server 103.

[0088] In step S915 of Figure 9, the printer 101 obtains root certificate data corresponding to the certificate distribution server 102 and root certificate data corresponding to the firmware update server 103 from the firmware update server 103. Then, in step S916, the printer 101 updates the root certificate data corresponding to the certificate distribution server 102 that it holds using the root certificate data corresponding to the certificate distribution server 102 obtained in step S915. Also in step S916, the printer 101 updates the root certificate data corresponding to the firmware update server 103 that it holds using the root certificate data corresponding to the firmware update server 103 obtained in step S915. In other words, in this embodiment, if the verification of the server certificate data in step S914 is determined to be successful, the printer 101 updates all root certificate data it holds at that time. Therefore, if an external server not shown in Figure 1 exists, root certificate data other than the root certificate data corresponding to the certificate distribution server 102 and the root certificate data corresponding to the firmware update server 103 may be updated. For example, in S915, the printer 101 may obtain root certificate data from the firmware update server 103 to verify server certificate data from other content servers (not shown), and in S916, update the initial root certificate data corresponding to the content servers held by the printer 101 using the obtained root certificate data. In this embodiment, when the firmware is updated, all root certificate data held by the printer 101 is updated. As a result, failure of TLS communication between the printer 101 and external servers, including the certificate distribution server 102, after the firmware update process is executed can be prevented.

[0089] Next, we will explain the process that differs from Figure 9 when the server certificate data verification fails.

[0090] Figure 10 is a sequence diagram illustrating the processes performed between the printer 101 and the certificate distribution server 102, and between the printer 101 and the firmware update server 103. The operation of the printer 101 in Figure 10 is achieved, for example, by the CPU 201 reading a program stored in the flash ROM 202 into the RAM 203 and executing it. The operation of the certificate distribution server 102 in Figure 10 is achieved, for example, by the CPU 221 of the certificate distribution server 102 reading a program stored in the flash ROM 222 into the RAM 223 and executing it. The operation of the firmware update server 103 in Figure 10 is achieved, for example, by the CPU 221 of the firmware update server 103 reading a program stored in the flash ROM 222 into the RAM 223 and executing it.

[0091] The processes in S1001 to S1005 are the same as those in S901 to S905, so their explanations will be omitted. Also, at least the processes in S1002 to S1012 in Figure 10 are processes that are performed even without user input after an operation that causes the network connection to start has been performed. In Figure 10, we assume the case in the process of determining whether or not to reacquire the root certificate data in S1005, where it is determined that the root certificate data should not be reacquired. Specifically, for example, if the initial root certificate data held by printer 101 should be updated for reasons such as expiration, but the server certificate data from certificate distribution server 102 has also expired, it is determined that the root certificate data should not be reacquired.

[0092] In S1006, the CPU 201 of printer 101 terminates the TLS connection between printer 101 and certificate distribution server 102.

[0093] In S1007, the CPU 201 of the printer 101 starts the firmware update process. In this embodiment, the firmware update process is started automatically without user intervention. However, it may also be started by user intervention instead of automatically.

[0094] When the firmware update process begins, in S1008, the CPU 201 of the printer 101 requests a TLS connection from the firmware update server 103. In other words, the request for a TLS connection from the firmware update server 103 initiates TLS communication between the printer 101 and the firmware update server 103. Specifically, for example, the TLS handshake is initiated by the sending process in which a ClientHello message is sent.

[0095] In S1009, the CPU 221 of the firmware update server 103 sends server certificate data to the printer 101 during the TLS handshake process.

[0096] In S1010, when the CPU 201 of printer 101 receives server certificate data from firmware update server 103, it uses the root certificate data held by printer 101 to verify the server certificate data received from firmware update server 103. For example, the verification involves determining whether the signature of the server certificate data is a trusted signature, using the root certificate data held by printer 101.

[0097] If the verification of the server certificate data is successful, the CPU 201 of the printer 101 obtains an update firmware file containing the latest firmware data from the firmware update server 103 via TLS encrypted communication, as in Figure 9. Then, as in Figure 9, the CPU 201 of the printer 101 updates the firmware using the firmware data contained in the update firmware file and terminates the TLS connection between the printer 101 and the firmware update server 103. Although these processes are not shown in Figure 10, the same processes as in steps S915 to S917 in Figure 9 are performed.

[0098] Here, we assume that the verification of the server certificate data from the firmware update server 103 has failed. Specifically, for example, if the initial root certificate corresponding to the firmware update server 103 held by the printer 101 has expired, the verification of the server certificate data will be determined to have failed.

[0099] In S1011, the CPU 201 of the printer 101 requests a TLS connection to the firmware update server 103 again. In other words, the request for a TLS connection to the firmware update server 103 restarts TLS communication between the printer 101 and the firmware update server 103. Specifically, for example, the TLS handshake is initiated by the sending process in which a ClientHello message is sent.

[0100] In S1012, the CPU 221 of the firmware update server 103 sends server certificate data to the printer 101 during the TLS handshake process. The CPU 201 of the printer 101 receives the server certificate data from the firmware update server 103, but deliberately does not verify the server certificate data. This is because if the server certificate data were verified, the verification result would be determined to be a failure, and as a result, even the subsequent TLS communication to obtain the firmware update file would fail.

[0101] In S1013, the CPU 201 of the printer 101 obtains an update firmware file containing the latest firmware data from the firmware update server 103 via TLS encrypted communication. As mentioned above, the update firmware file includes root certificate data 402 and root certificate data 403 in addition to the firmware data. Thus, in this embodiment, since the update firmware file is obtained via TLS communication, the security related to the acquisition of root certificate data can be improved. Furthermore, the update firmware file itself may be encrypted. This would further improve the security related to the acquisition of root certificate data.

[0102] In S1014, the CPU 201 of printer 101 updates the firmware using the firmware data contained in the update firmware file. In S1015, the CPU 201 of printer 101 terminates the TLS connection between printer 101 and firmware update server 103.

[0103] As described above, this embodiment improves confidentiality and integrity by using TLS communication when the printer 101 acquires root certificate data. At the same time, since the root certificate data is acquired without user intervention, convenience can be improved.

[0104] Furthermore, the various controls described above, which are assumed to be performed by the CPU, may be performed by a single piece of hardware, or multiple pieces of hardware (for example, multiple processors or circuits) may share the processing to control the entire device.

[0105] Furthermore, although the present invention has been described in detail based on its preferred embodiments, the present invention is not limited to these specific embodiments, and various forms that do not depart from the spirit of the invention are also included in the present invention. Moreover, each of the embodiments described above is merely one embodiment of the present invention, and it is possible to combine each embodiment as appropriate.

[0106] Furthermore, although the above-described embodiments used the application of the present invention to a printer as an example, the invention is not limited to this example and can be applied to any device capable of communicating with the certificate distribution server 102 and the firmware update server 103. In other words, the present invention can be applied to personal computers, PDAs, mobile phone terminals, portable image viewers, printer devices equipped with displays, digital photo frames, music players, game consoles, e-book readers, and the like.

[0107] The present invention can also be realized by supplying a program that implements one or more of the functions of the above-described embodiments to a system or device via a network or storage medium, and by having one or more processors in the computer of that system or device read and execute the program. It can also be realized by a circuit (e.g., an ASIC) that implements one or more functions.

[0108] The disclosure of this embodiment includes electronic equipment, control methods, programs, and storage media. (Item 1) It is an electronic device, When initiating a connection between the electronic device and a first server outside the electronic device, the system controls the execution of a first transmission process that sends information to the first server requesting the initiation of communication using a predetermined protocol for encrypted communication. When communication using the predetermined protocol is initiated between the electronic device and the first server based on the first transmission process, control means control the execution of a first reception process to receive a second root certificate data from the first server for verifying certificate data from a second server different from the first server, even without user operation after the execution of the first transmission process. An electronic device characterized by having the following features. (Item 2) The system further includes a means for receiving specific operations that trigger the initiation of a network connection, The electronic device according to item 1, characterized in that the control means controls the first transmission process to be performed in response to the reception of the specific operation. (Item 3) The electronic device according to item 2, characterized in that the specific operation is at least one of the operation of turning on the power of the electronic device while the network connection is enabled, and the operation of changing the setting of the electronic device from a state in which the network connection is disabled to a state in which it is enabled. (Item 4) The system further includes a storage means that stores first root certificate data for verifying certificate data from the first server, When communication between the electronic device and the first server according to the predetermined protocol is initiated based on the first transmission process, the control means verifies the certificate data from the first server using the first root certificate data stored in the storage means. The electronic device described in item 1, characterized by the features described herein. (Item 5) If the verification of the certificate data from the first server is successful, in the first receiving process, the first root certificate data for verifying the certificate data from the first server is received from the first server. The control means controls the updating of the first root certificate data stored in the storage means with the first root certificate data received from the first server. The electronic device described in item 4, characterized by the features described herein. (Item 6) The electronic device according to item 5, characterized in that the second root certificate data is received from the first server in the first receiving process. (Item 7) The storage means stores second root certificate data for verifying certificate data from the second server. The electronic device according to item 6, characterized in that the control means controls the second root certificate data stored in the storage means to update with the second root certificate data received from the first server. (Item 8) The storage means stores third root certificate data for verifying certificate data from a third server that is different from the first server and different from the second server. In the first receiving process, a third root certificate data is received for verifying the certificate data from the third server. The electronic device according to item 6 or 7, characterized in that the control means controls the updating of the third root certificate data stored in the storage means with the third root certificate data received from the first server. (Item 9) The control means controls the execution of the first transmission process again if the verification of the certificate data from the first server fails, and does not perform verification of the certificate data from the first server if communication using the predetermined protocol is restarted between the electronic device and the first server based on the first transmission process. An electronic device as described in any one of items 5 to 8, characterized by the features described herein. (Item 10) The electronic device according to item 9, characterized in that, in the first reception process when communication according to the predetermined protocol is restarted, the first root certificate data for verifying the certificate data from the first server is not received from the first server. (Item 11) The electronic device according to item 10, characterized in that, in the first reception process when communication according to the predetermined protocol is restarted, the second root certificate data is received from the first server. (Item 12) The storage means stores the second root certificate data, The electronic device according to item 11, characterized in that the control means controls the second root certificate data stored in the storage means to be updated with the second root certificate data received from the first server. (Item 13) The electronic device according to any one of items 9 to 12, characterized in that the control means controls the first transmission process to be executed again if the verification result of the certificate data from the first server is a failure and the conditions are met. (Item 14) The electronic device according to item 13, characterized in that the condition includes the expiration date of the first root certificate data stored in the storage means. (Item 15) The electronic device according to any one of items 9 to 12, characterized in that the control means controls the device to terminate the connection between the electronic device and the first server without performing the first transmission process again if the verification of the certificate data from the first server is unsuccessful and the conditions are met. (Item 16) The electronic device according to item 15, characterized in that the aforementioned condition includes the expiration of the certificate data from the first server. (Item 17) The electronic device according to any one of items 2 to 16, characterized in that the control means controls the electronic device to execute a second transmission process that sends information to the second server requesting the commencement of communication according to the predetermined protocol in order to initiate a connection between the electronic device and the second server. (Item 18) The electronic device according to item 17, characterized in that the control means controls the electronic device to execute a second receiving process to receive data from the second server for updating the software stored in the electronic device when communication according to the predetermined protocol is initiated between the electronic device and the second server based on the second transmission process. (Item 19) The storage means stores the second root certificate data, The electronic device according to item 18, characterized in that when communication according to the predetermined protocol is initiated between the electronic device and the second server based on the second transmission process, the control means verifies the certificate data from the second server using the second root certificate data stored in the storage means. (Item 20) If the verification of the certificate data from the second server is successful, the reception of the data in the second reception process results in the reception of the first root certificate data from the second server for verifying the certificate data from the first server. The control means controls the updating of the first root certificate data stored in the storage means with the first root certificate data received from the second server. The electronic device described in item 19, characterized by the features described herein. (Item 21) Upon receiving the data in the second reception process, the second root certificate data is received from the second server. The control means controls the second root certificate data stored in the storage means to be updated with the second root certificate data received from the second server. The electronic device described in item 20, characterized by the features described herein. (Item 22) The storage means stores third root certificate data for verifying certificate data from a third server that is different from the first server and different from the second server. Upon receiving the data in the second reception process, the third root certificate data is received. The control means controls the updating of the third root certificate data stored in the storage means with the third root certificate data received from the second server. The electronic device according to item 20 or 21, characterized by the features described herein. (Item 23) The control means controls the execution of the second transmission process again if the verification of the certificate data from the second server fails. If communication using the predetermined protocol is restarted between the electronic device and the second server based on the second transmission process, the system is controlled to execute the second reception process without verifying the certificate data from the second server. An electronic device as described in any one of items 20 to 22, characterized by the features described herein. (Item 24) The electronic device described in any one of items 1 to 23 is characterized in that the electronic device is a printer. (Item 25) The electronic device described in any one of items 1 to 24, characterized in that the communication using the predetermined protocol is communication using TLS (Transport Layer Security). (Item 26) A control method performed in an electronic device, When initiating a connection between the electronic device and a first server outside the electronic device, the system controls the execution of a first transmission process that sends information to the first server requesting the initiation of communication using a predetermined protocol for encrypted communication. A control step that controls the execution of a first receiving process to receive a second root certificate data from the first server for verifying certificate data from a second server different from the first server, even if there is no user operation after the execution of the first transmitting process, when communication using the predetermined protocol is initiated between the electronic device and the first server based on the first transmission process. A control method characterized by having the following features. (Item 27) A program for causing a computer to function as one of the electronic devices described in any one of items 1 through 25. (Item 28) A computer-readable storage medium for storing programs that cause a computer to function as one of the electronic devices described in any one of items 1 through 25.

[0109] The invention is not limited to the embodiments described above, and various modifications and variations are possible without departing from the spirit and scope of the invention. Accordingly, claims are attached to disclose the scope of the invention. [Explanation of Symbols]

[0110] 101 Printer: 102 Certificate Distribution Server: 103 Firmware Update Server 103: 311 CPU

Claims

1. It is an electronic device, When a connection is initiated between the electronic device and a first server outside the electronic device, the system controls the execution of a first transmission process that sends information to the first server requesting the commencement of communication using a predetermined protocol for encrypted communication. When communication using the predetermined protocol is initiated between the electronic device and the first server based on the first transmission process, control means control the execution of a first reception process to receive a second root certificate data from the first server for verifying certificate data from a second server different from the first server, even without user operation after the execution of the first transmission process. An electronic device characterized by having the following features.

2. The system further includes a means for receiving specific operations that trigger the initiation of a network connection, The electronic device according to claim 1, characterized in that the control means controls the first transmission process to be performed in response to the reception of the specific operation.

3. The electronic device according to claim 2, characterized in that the specific operation is at least one of the operation of turning on the power of the electronic device while the network connection is enabled, and the operation of changing the setting of the electronic device from a state in which the network connection is disabled to a state in which it is enabled.

4. The system further includes a storage means that stores first root certificate data for verifying certificate data from the first server, When communication between the electronic device and the first server according to the predetermined protocol is initiated based on the first transmission process, the control means verifies the certificate data from the first server using the first root certificate data stored in the storage means. The electronic device according to feature 1.

5. If the verification of the certificate data from the first server is successful, in the first receiving process, the first root certificate data for verifying the certificate data from the first server is received from the first server. The control means controls the first root certificate data stored in the storage means to be updated with the first root certificate data received from the first server. The electronic device according to feature 4.

6. The electronic device according to claim 5, characterized in that the second root certificate data is received from the first server in the first receiving process.

7. The storage means stores second root certificate data for verifying certificate data from the second server. The electronic device according to claim 6, characterized in that the control means controls the second root certificate data stored in the storage means to be updated with the second root certificate data received from the first server.

8. The storage means stores third root certificate data for verifying certificate data from a third server that is different from the first server and different from the second server. In the first receiving process, a third root certificate data is received for verifying the certificate data from the third server. The electronic device according to claim 6, characterized in that the control means controls the updating of the third root certificate data stored in the storage means with the third root certificate data received from the first server.

9. The control means controls the execution of the first transmission process again if the verification of the certificate data from the first server fails, and does not perform verification of the certificate data from the first server if communication using the predetermined protocol is restarted between the electronic device and the first server based on the first transmission process. The electronic device according to feature 5.

10. The electronic device according to claim 9, characterized in that, in the first reception process when communication according to the predetermined protocol is restarted, the first root certificate data for verifying the certificate data from the first server is not received from the first server.

11. The electronic device according to claim 10, characterized in that, in the first reception process when communication according to the predetermined protocol is restarted, the second root certificate data is received from the first server.

12. The storage means stores the second root certificate data, The electronic device according to claim 11, characterized in that the control means controls the second root certificate data stored in the storage means to be updated with the second root certificate data received from the first server.

13. The electronic device according to claim 9, characterized in that the control means controls the first transmission process to be executed again if the verification result of the certificate data from the first server is a failure and the conditions are met.

14. The electronic device according to claim 13, characterized in that the condition includes the expiration date of the first root certificate data stored in the storage means.

15. The electronic device according to claim 9, characterized in that the control means controls the device to terminate the connection between the electronic device and the first server if the verification of the certificate data from the first server fails and the conditions are met, without performing the first transmission process again.

16. The electronic device according to claim 15, characterized in that the aforementioned condition includes the expiration of the certificate data from the first server.

17. The electronic device according to claim 4, characterized in that the control means controls the electronic device to execute a second transmission process that sends information to the second server requesting the commencement of communication according to the predetermined protocol in order to initiate a connection between the electronic device and the second server.

18. The electronic device according to claim 17, characterized in that the control means controls the electronic device to execute a second receiving process to receive data from the second server for updating the software stored in the electronic device when communication according to the predetermined protocol is initiated between the electronic device and the second server based on the second transmission process.

19. The storage means stores the second root certificate data, The electronic device according to claim 18, wherein the control means verifies certificate data from the second server using the second root certificate data stored in the storage means when communication according to the predetermined protocol is initiated between the electronic device and the second server based on the second transmission process.

20. If the verification of the certificate data from the second server is successful, the reception of the data in the second reception process results in the reception of the first root certificate data from the second server for verifying the certificate data from the first server. The control means controls the first root certificate data stored in the storage means to be updated with the first root certificate data received from the second server. The electronic device according to feature 19.

21. Upon receiving the data in the second reception process, the second root certificate data is received from the second server. The control means controls the second root certificate data stored in the storage means to be updated with the second root certificate data received from the second server. The electronic device according to claim 20.

22. The storage means stores third root certificate data for verifying certificate data from a third server that is different from the first server and different from the second server. Upon receiving the data in the second reception process, the third root certificate data is received. The control means controls the updating of the third root certificate data stored in the storage means with the third root certificate data received from the second server. The electronic device according to claim 20.

23. The control means controls the execution of the second transmission process again if the verification of the certificate data from the second server fails. If communication between the electronic device and the second server using the predetermined protocol is restarted based on the second transmission process, the system is controlled to execute the second reception process without verifying the certificate data from the second server. The electronic device according to claim 20.

24. The electronic device according to claim 1, characterized in that the electronic device is a printer.

25. The electronic device according to claim 1, characterized in that the communication using the predetermined protocol is communication using TLS (Transport Layer Security).

26. A control method performed in an electronic device, When a connection is initiated between the electronic device and a first server outside the electronic device, the system controls the execution of a first transmission process that sends information to the first server requesting the commencement of communication using a predetermined protocol for encrypted communication. A control step that controls the execution of a first receiving process to receive a second root certificate data from the first server for verifying certificate data from a second server different from the first server, even if there is no user operation after the execution of the first transmitting process, when communication using the predetermined protocol is initiated between the electronic device and the first server based on the first transmission process. A control method characterized by having the following features.

27. A program for causing a computer to function as one of the electronic devices described in any one of claims 1 to 25.

28. A computer-readable storage medium for storing a program for causing a computer to function as one of the electronic devices described in any one of claims 1 to 25.

Images