Generation device, generation method, generation program, and update system

Abstract

To ensure the authenticity that the firmware to be updated has been correctly tested and provide the test results to the customer.SOLUTION: A generation apparatus according to one embodiment includes: an inspection unit that applies firmware to a device and inspects it by executing inspection software having a private key of an inspection vendor, the inspection unit generating inspection target information indicating firmware as inspection targets and inspection results of firmware inspection, and generating inspection information including an inspection result signature electronically signed with a private key of an inspection vendor for data based on the inspection target information and the inspection result, the inspection target information and the inspection result; and a generation unit that generates report information including inspection information and a report signature electronically signed with a private key of an inspection vendor for providing a device with data based on information on firmware and the inspection information.SELECTED DRAWING: Figure 5

Description

[Technical Field]

[0001] The present invention relates to a generating device, a generating method, a generating program, and an updating system. [Background technology]

[0002] For example, firmware (FW) for embedded devices such as electronic control units (ECUs) that control devices installed in vehicles may be updated. In such cases, the firmware undergoes testing such as operational verification before distribution to ensure that it operates normally when installed on the device being updated.

[0003] In this regard, techniques relating to firmware updates are known (for example, Patent Documents 1 to 4). [Prior art documents] [Patent documents]

[0004] [Patent Document 1] Japanese Patent Publication No. 2020-173832 [Patent Document 2] Japanese Patent Application Laid-Open No. 2017-173893 [Patent Document 3] Japanese Patent Application Publication No. 2015-97022 [Patent Document 4] Patent Publication No. 2021-121963 Summary of the Invention [Problem to be solved by the invention]

[0005] However, when updating firmware, customers who receive the firmware may not know what kind of inspections the equipment vendor that provides the firmware has performed on the firmware used for the update, which can make it difficult for customers to determine whether or not to apply the update.

[0006] The present invention has been made in consideration of the above points, and aims to provide a generation device, generation method, generation program, and update system that make it possible to provide inspection results of firmware used for updates with guaranteed authenticity. [Means for solving the problem]

[0007] A generation device of one embodiment of the present invention includes an inspection unit that applies firmware to an equipment and inspects it by executing inspection software equipped with the inspection vendor's private key, generating inspection target information indicating the firmware to be inspected and inspection results of inspecting the firmware, and generating inspection information including an inspection result signature digitally signed with the inspection vendor's private key on data based on the inspection target information and the inspection results, the inspection target information, and the inspection results; and a generation unit that generates report information including information about the firmware, a report signature digitally signed with the private key of the equipment vendor that provides the equipment on data based on the inspection information, and the inspection information. [Effects of the Invention]

[0008] This makes it possible to provide the inspection results of the firmware used for updating with a guarantee of authenticity. [Brief explanation of the drawings]

[0009] [Figure 1] FIG. 1 illustrates an example update system according to an embodiment. [Figure 2] FIG. 2 is a diagram illustrating a functional block configuration of a generating device according to an embodiment. [Figure 3] FIG. 2 is a diagram illustrating a functional block configuration of a loader according to the embodiment. [Figure 4] FIG. 10 is a diagram illustrating an example of report information according to the embodiment. [Figure 5] FIG. 10 is a diagram illustrating an example of an operational flow of a report information generation process according to the embodiment. [Figure 6] FIG. 10 is a diagram illustrating an example of an operation flow of firmware inspection processing performed by execution of inspection software according to the embodiment. [Figure 7] FIG. 10 is a diagram illustrating an example of an inspection result according to the embodiment. [Figure 8] FIG. 10 is a diagram illustrating an example of an operation flow of firmware update processing according to the embodiment. [Figure 9] FIG. 2 is a diagram illustrating a display screen according to the embodiment. [Figure 10] FIG. 2 is a diagram illustrating an example of a hardware configuration of a computer according to an embodiment. DETAILED DESCRIPTION OF THE INVENTION

[0010] Hereinafter, several embodiments of the present invention will be described in detail with reference to the drawings. Note that the same reference numerals are used to designate corresponding elements in the various drawings.

[0011] For example, a device vendor may distribute firmware updates for devices that the vendor provides. In this case, before distributing the firmware updates, the vendor may perform tests such as operational verification on the firmware, and if the tests are successful, provide information indicating that the firmware has been tested along with the firmware. This allows customers, for example, to know that the firmware updates have been tested.

[0012] However, information indicating that firmware has been inspected does not include the inspection results, and therefore the details of the inspections performed on the firmware to be updated cannot be known. Therefore, for example, even if a device vendor conceals the inspection results and provides false inspection information, customers may not notice and may end up updating the firmware. Therefore, there is a need for a technology that allows customers who receive firmware to check what inspections have been performed on the firmware when updating it.

[0013] The embodiment will be described in further detail below.

[0014] Fig. 1 is a diagram illustrating an update system 100 according to an embodiment. In Fig. 1, the update system 100 includes, for example, a generating device 101, a distribution server 102, an inspection target device 103, a loader 104, and an update target device 105. The generating device 101, the distribution server 102, and the loader 104 are, for example, computers such as a server, a personal computer (PC), a mobile PC, or a tablet terminal.

[0015] The generating device 101, the distribution server 102, and the test target device 103 are devices used by, for example, a device vendor that distributes firmware updates. The generating device 101 is communicably connected to the distribution server 102 and the test target device 103, for example, by wire, wirelessly, or via a network.

[0016] The loader 104 and the update target device 105 are, for example, devices used by customers. The loader 104 is, for example, connected to the distribution server 102 and the update target device 105 so as to be able to communicate with each other via a wired or wireless connection or a network.

[0017] The generating device 101 is, for example, a device that executes an inspection of firmware to be updated and generates report information 400 about the inspection. Details of the report information 400 will be described later. The generating device 101 includes, for example, inspection software 110 for inspecting firmware to be updated.

[0018] The inspection software 110 is software provided for firmware inspection by, for example, an inspection vendor that provides a service for inspecting the performance of devices into which firmware is installed. The inspection software 110, for example, has the inspection vendor's private key stored therein. Therefore, after inspecting the firmware, the inspection software 110 can, for example, digitally sign the inspection results with the inspection vendor's private key. Note that the inspection vendor's private key stored in the inspection software 110 may be configured, for example, so that it cannot be extracted by the device vendor. Furthermore, the inspection software 110 may be configured, for example, so that it cannot be modified by the device vendor. By digitally signing the inspection results with the inspection vendor's private key, the inspection software 110 can prove the authenticity of the inspection software 110 having performed the test indicated in the inspection results.

[0019] The generating device 101 also includes, for example, software for generating the report information 400 and a private key of the device vendor.

[0020] For example, when receiving input of firmware for update, the generation device 101 executes the inspection software 110 to inspect the firmware and generates report information 400 including the inspection results. Then, the generation device 101 stores the generated report information 400 in the distribution server 102.

[0021] The distribution server 102 is a computer that can be accessed from an external device such as a customer's loader 104, and is installed in a cloud or the like. The distribution server 102 stores, for example, report information 400 generated by the generation device 101 and firmware for updates, and provides them to the external device that accesses it.

[0022] The test target device 103 is a device that runs firmware to be updated in order to test the firmware to be updated, for example, at a development site of a device vendor, etc. The test target device 103 includes various embedded devices that run firmware, such as electronic control units, inverters, and controllers.

[0023] The loader 104 is, for example, a computer into which the public key of the device vendor, the public key of the inspection vendor, and update software for updating the firmware of the update target device 105 are installed.

[0024] The loader 104, for example, acquires the firmware for update and the report information 400 from the distribution server 102. Then, the loader 104 checks the authenticity of the report information 400. The loader 104 also, for example, displays the check result on the display screen of the display device, executes update software to write the firmware into the update target device 105, and executes the firmware update.

[0025] The update target device 105 is, for example, a device used by a customer on which firmware runs. The update target device 105 is connected to the loader 104 when updating the firmware. The update target device 105 is, for example, a device on which the same firmware as that of the inspection target device 103 runs, and in one example, is a device of the same type. The update target device 105 includes, for example, various embedded devices on which firmware runs, such as electronic control units, inverters, and controllers.

[0026] FIG. 2 is a diagram illustrating a functional block configuration of a generating device 101 according to an embodiment. The generating device 101 includes, for example, a control unit 201, a storage unit 202, and a communication unit 203. The control unit 201 includes, for example, an inspection unit 211, a generating unit 212, and the like, and may also include other functional units. The inspection unit 211 executes, for example, a program of the inspection software 110 stored in the storage unit 202 to operate the inspection software 110. The storage unit 202 of the generating device 101 stores, for example, the program of the inspection software 110, as well as information such as report information 400 and inspection results 700. The communication unit 203 communicates with other devices, such as the distribution server 102 and the inspection target device 103, in accordance with instructions from the control unit 201. Details of these units and the information stored in the storage unit 202 will be described later.

[0027] 3 is a diagram illustrating an example of a functional block configuration of the loader 104 according to the embodiment. The loader 104 includes, for example, a control unit 301, a storage unit 302, and a communication unit 303. The control unit 301 controls, for example, each unit of the loader 104. The storage unit 302 of the loader 104 stores information such as firmware, report information 400, a test vendor public key, and a device vendor public key. The communication unit 303 communicates with other devices such as the distribution server 102 and the update target device 105 in accordance with instructions from the control unit 301. Details of each of these units and the information stored in the storage unit 302 will be described later.

[0028] Next, an example of report information 400 notified to a customer according to an embodiment will be described. Fig. 4 is a diagram illustrating report information 400 according to an embodiment. The report information 400 includes, for example, firmware information (FW information), inspection information, and a report signature.

[0029] The firmware information, for example, registers information about the firmware to be inspected. In the example of FIG. 4, the firmware information includes the firmware version, a hash value of the firmware, and a file size of the firmware. The hash value of the firmware is, for example, a hash value generated from all of the firmware data. The firmware information is used, for example, to associate and confirm the report information 400 with the firmware to be inspected. The hash value may be generated using, for example, a general hash generation technique. In one example, the control unit 201 generates the hash value by inputting the data into a predetermined hash function.

[0030] The inspection information includes, for example, inspection target information, inspection results, and an inspection result signature. The inspection target information is, for example, information indicating the firmware that was inspected. The inspection target information includes, for example, designation information that designates a portion of the firmware data, and a hash value of the portion of the data designated by the designation information. In the example of FIG. 4, the designation information indicates a hash acquisition range that designates a predetermined area of ​​the firmware data that was inspected. The hash acquisition range is, for example, information such as a start offset and an end offset that indicate the area of ​​the portion from which a hash was acquired.

[0031] The designation information may, for example, designate any area of ​​firmware data. In one example, the area of ​​firmware data designated by the hash designation information is determined randomly. By having the inspection software 110 determine the designation information as needed, it becomes more difficult to falsify the inspection information in the report information 400.

[0032] The inspection result is, for example, information indicating the result of the inspection of firmware executed by the inspection software 110. The inspection result is, for example, embedded as text and HTML (HyperText Markup Language) data or a file. The inspection result signature is, for example, signature data used by an inspection vendor that provides the inspection software 110 to certify that the inspection target information and the inspection result have not been tampered with by the inspection software 110. For example, the inspection result signature is data obtained by signing a hash value of data obtained by combining the inspection target information and the inspection result with the inspection vendor's private key provided inside the inspection software 110.

[0033] The report signature is, for example, signature data used by the device vendor to certify that the firmware information and the inspection information have not been tampered with. The report signature is, for example, data obtained by signing a hash value of data obtained by combining the firmware information and the inspection information with the private key of the device vendor provided in the generation device 101.

[0034] Next, generation of report information 400 according to the embodiment will be described. Fig. 5 is a diagram illustrating an example of an operational flow of a process for generating report information 400 according to the embodiment. For example, when a firmware inspection instruction is input, the control unit 201 of the generation device 101 starts the operational flow of Fig. 5. In one example, the operational flow of Fig. 5 is executed when firmware to be updated is stored in the distribution server 102 for distribution.

[0035] In step 501 (hereinafter, step will be abbreviated as "S", for example, S501), the control unit 201 inputs the firmware designated as the target for inspection into the inspection software 110 and instructs the inspection software 110 to perform inspection processing on the firmware to be inspected.

[0036] In S502, the control unit 201 executes the inspection software 110 to inspect the firmware.

[0037] 6 is a diagram illustrating an example of an operational flow of firmware inspection processing performed by the control unit 201 through execution of the inspection software 110. The inspection software 110 executed by the control unit 201 starts the operational flow of FIG. 6 when, for example, an instruction to execute inspection processing of the firmware to be inspected is input. Note that the operations executed by the inspection software 110 in the operational flow of FIG. 6 below are performed by the control unit 201 executing the inspection software 110.

[0038] In S601, the inspection software 110 generates inspection target information for the report information 400. For example, the inspection software 110 acquires a hash value of an arbitrary portion of the firmware to be inspected. Then, the inspection software 110 generates, as the inspection target information, information that pairs the hash value with designation information (e.g., start offset and end offset) that indicates the area of ​​the portion from which the hash was acquired.

[0039] In S602, the inspection software 110 transmits the firmware to be inspected to the inspection target device 103, inspects the inspection target device 103, and outputs the inspection results. Note that the inspection can be performed in the same manner as when it is performed by, for example, existing inspection software for firmware. For example, the inspection software 110 transmits a communication message that causes an abnormality to the inspection target device 103 on which the inspection target firmware is running, and performs the inspection by checking a response from the inspection target device 103.

[0040] In S603, the inspection software 110 generates the results of the inspection performed as inspection results in a file format such as text or HTML, for example.

[0041] In S604, the inspection software 110 generates and outputs inspection information including, for example, inspection target information, inspection results, and an inspection result signature, and then this operation flow ends and the flow proceeds to S503. Note that the inspection software 110 obtains the inspection result signature by, for example, digitally signing the inspection result or a hash value of the inspection result using the inspection vendor's private key. The inspection result signature is, for example, information that proves that the inspection result is certainly the output of the inspection software 110, and is data obtained by signing the inspection target information and the inspection result using the inspection vendor's private key.

[0042] In S503, the control unit 201 generates firmware information for the report information 400. The firmware information includes, for example, version information stored in the firmware to be inspected, the file size of the firmware, and a hash value of the firmware. The hash value of the firmware is, for example, a hash value generated from the entire firmware.

[0043] In S504, the control unit 201 generates a report signature. For example, the control unit 201 signs the hash value of the data obtained by combining the inspection information received from the inspection software 110 and the firmware information acquired in S504 with the private key of the device vendor, thereby generating the report signature.

[0044] In S505, the control unit 201 generates the report information 400 including the inspection information, firmware information, and a report signature.

[0045] In S506, the control unit 201 stores the firmware to be updated and the report information 400 generated for the firmware in the distribution server 102, and this operation flow ends. For example, the control unit 201 transmits the firmware to be updated and the report information 400 generated for the firmware to the distribution server 102, and stores them in a storage device of the distribution server 102.

[0046] When the distribution server 102 receives the update firmware and the report information 400, it stores the update firmware and the report information 400 in an externally accessible storage area of ​​the storage device. For example, the distribution server 102 combines firmware information similar to the firmware information stored in the report information 400 with the firmware and information indicating the storage location of the report information 400 and stores the combined firmware information as a firmware package. The control unit 201 then stores the firmware package in an externally accessible storage area, for example. In another embodiment, the control unit 201 stores the update firmware and the report information 400 as a package in an externally accessible storage area, for example.

[0047] As described above, according to the embodiment, the report information 400 including the test results that cannot be tampered with by the device vendor can be generated using the test vendor's private key provided in the test software 110, and can be distributed from the distribution server 102. Therefore, by referring to the report information 400, the customer can know what kind of tests have been performed on the firmware obtained from the distribution server 102.

[0048] FIG. 7 is a diagram illustrating an example of a test result 700 according to an embodiment. The test result 700 includes, for example, the results of each test performed during the test. For example, assume that the test software 110 performed a test to determine whether a communication message exceeded its specified length. The test result 700 includes information indicating that the test results were satisfactory, indicating that no problems were found. In the example of FIG. 7, information indicating that no problems were found is also registered for abnormal communication message formatting, communication sequence interruptions, and communication timeouts. Therefore, by referencing the test results in the report information 400, customers can confirm that no abnormalities have occurred in the firmware to be used for updating. Furthermore, because customers can refer to test results guaranteed by the test vendor that performed the test, they can perform processes such as firmware updates with peace of mind.

[0049] Next, an example of firmware update processing executed by the loader 104 owned by a customer will be described. Fig. 8 is a diagram illustrating an operation flow of firmware update processing according to an embodiment. For example, when an instruction to update firmware for the update target device 105 is input, the control unit 301 of the loader 104 starts the operation flow of Fig. 8.

[0050] In step S801, the control unit 301 of the loader 104 acquires firmware to be used for updating. For example, the control unit 301 acquires firmware for updating the update target device 105 from the distribution server 102.

[0051] In S802, the control unit 301 of the loader 104 acquires the report information 400 corresponding to the firmware to be updated from the storage location. For example, the control unit 301 of the loader 104 acquires the report information 400 corresponding to the firmware to be updated from the storage area of ​​the storage device of the distribution server 102. Note that the storage location of the report information 400 is described in, for example, the firmware. In another embodiment, the report information 400 and the firmware are acquired as a package from the distribution server 102.

[0052] In S803, the control unit 301 checks the report signature of the report information 400. For example, the control unit 301 verifies the report signature of the report information 400 with the device vendor's public key to confirm that the report information 400 has not been tampered with. For example, the control unit 301 acquires a hash value of the firmware information and inspection information data of the report information 400 and checks whether it matches the value obtained by decrypting the report signature with the device vendor's public key. In this way, the control unit 301 confirms, for example, that the report information 400 has not been tampered with. If the report information 400 has been tampered with, the control unit 301 determines, for example, NO in S803, and in this case, this operation flow ends. On the other hand, if the report information 400 has not been tampered with, the control unit 301 determines, for example, YES in S803, and in this case, the flow proceeds to S804.

[0053] In S804, the control unit 301 checks whether the information on the firmware to be updated is correct. For example, the control unit 301 checks whether the file size and hash value of the firmware included in the firmware information in the report information 400 match the file size and hash value of the firmware to be updated. If the information does not match, the control unit 301 determines, for example, NO in S804, and in this case, this operation flow ends. On the other hand, if the information matches, the control unit 301 determines, for example, YES in S804, and in this case, the flow proceeds to S805.

[0054] In S805, the control unit 301 confirms whether the inspection result has been generated by the authentic inspection software 110. For example, the control unit 301 verifies the inspection result signature of the report information 400 with the inspection vendor's public key to confirm the authenticity of the inspection result, that is, that the inspection result has been generated by the authentic inspection software 110. For example, the control unit 301 determines that the inspection result has been generated by the authentic inspection software 110 when the hash value of the data based on the inspection target information and inspection result included in the report information 400 matches the hash value obtained by decrypting the inspection result signature with the inspection vendor's public key. If the inspection result has not been generated by the authentic inspection software 110 (NO in S805), this operation flow ends. On the other hand, if the inspection result has been generated by the authentic inspection software 110 (YES in S805), the flow proceeds to S806.

[0055] In S806, the control unit 301 checks whether the firmware targeted by the inspection results in the report information 400 matches the firmware to be updated. For example, the control unit 301 generates a hash value from data in a partial area of ​​the firmware to be updated, which is specified by the designation information of the inspection target information in the report information 400. If the hash value obtained from the data in the partial area of ​​the firmware to be updated matches the hash value of the inspection target information, the control unit 301 determines that the firmware targeted by the inspection results matches the firmware to be updated. If the firmware targeted by the inspection results does not match the firmware to be updated (NO in S806), this operation flow ends. On the other hand, if the firmware targeted by the inspection results matches the firmware to be updated (YES in S806), the flow proceeds to S807.

[0056] In S807, the control unit 301 displays the test result display screen 900 based on the report information 400.

[0057] FIG. 9 is a diagram illustrating a display screen 900 according to an embodiment. In the example of FIG. 9, the display screen 900 includes a confirmation result and an inspection result. The confirmation result includes, for example, a confirmation result of whether the report information has been tampered with, a confirmation result of whether the inspected FW matches the updated FW, and a confirmation result of the authenticity of the inspection result. For example, the confirmation result of whether the report information has been tampered with registers the confirmation result of whether the report information 400 has been tampered with, which is executed in the process of S803. Furthermore, for example, the confirmation result of whether the inspected FW matches the updated FW registers the confirmation result of whether the inspected FW matches the updated FW, which is executed in the process of S806. For example, the confirmation result of the authenticity of the inspection result registers the confirmation result of the authenticity of the inspection result registers the confirmation result of the authenticity of the inspection result registers the confirmation result of the authenticity of the inspection result of S805.

[0058] Furthermore, the test results included in the report information 400 are registered as the test results on the display screen 900. In the example of Fig. 9, the test results 700 in Fig. 7 are displayed on the display screen 900 as the test results.

[0059] In S808, the control unit 301 writes the update firmware to the update target device 105, updates the firmware of the update target device 105 with the update firmware, and this operation flow ends.

[0060] As described above, according to the embodiment, it is possible to provide the customer with the inspection results, with the authenticity of the firmware to be updated having been inspected by the inspection software 110 guaranteed. This allows the customer to determine the appropriateness of the firmware update. For example, by checking the inspection result display screen 900, the customer can confirm that the performance of the device after the firmware update satisfies the specified numerical values. This allows the customer to determine, for example, whether or not to apply the update.

[0061] For example, even if a device vendor distributes firmware that does not meet the specifications established in the test, the test results are provided to the customer. Therefore, the customer can determine that the firmware update is inappropriate by looking at the test results. Furthermore, since the test results are provided to the customer, device vendors are also deterred from distributing unauthorized firmware. For example, suppose that after a firmware update, the test results show that the device does not meet the specified performance conditions. In this case, it is possible to prevent falsification of the test results, such as distributing firmware that has been tampered with to make the device meet the specified performance conditions.

[0062] In addition, in the embodiment, the report information 400 includes a hash value of a portion of the firmware that was inspected and designation information that designates that portion. This allows the customer to confirm that the inspection results are inspection details for the firmware to be updated. This prevents, for example, inspection results obtained for other firmware from being falsely represented as inspection results for the firmware to be updated.

[0063] 6 in the above embodiment, the control unit 201 operates as, for example, the inspection unit 211. In the process of S505, the control unit 201 operates as, for example, the generation unit 212.

[0064] 10 is a diagram illustrating an example of the hardware configuration of a computer 1000 for realizing devices such as a generating device 101, a distribution server 102, and a loader 104 according to an embodiment. The hardware configuration of the computer in FIG. 10 includes, for example, a processor 1001, a memory 1002, a storage device 1003, a reading device 1004, a communication interface 1006, and an input / output interface 1007. The processor 1001, the memory 1002, the storage device 1003, the reading device 1004, the communication interface 1006, and the input / output interface 1007 are connected to one another via, for example, a bus 1008.

[0065] The processor 1001 may be, for example, a single processor, or a multi-processor or multi-core processor. The processor 1001 provides some or all of the functions of the above-mentioned units by using the memory 1002 to execute a program that describes, for example, the procedures of the above-mentioned operation flow. For example, the processor 1001 of the generation device 101 operates as the control unit 201, the inspection unit 211, and the generation unit 212 by reading and executing a program stored in the storage device 1003. Also, for example, the processor 1001 of the loader 104 operates as the control unit 301 by reading and executing a program stored in the storage device 1003.

[0066] The memory 1002 is, for example, a semiconductor memory, and includes a RAM area and a ROM area. The storage device 1003 is, for example, a semiconductor memory such as a hard disk or flash memory, or an external storage device. RAM is an abbreviation for Random Access Memory, and ROM is an abbreviation for Read Only Memory.

[0067] The reading device 1004 accesses the removable storage medium 1005 in accordance with instructions from the processor 1001. The removable storage medium 1005 is realized by, for example, a semiconductor device, a medium that inputs and outputs information by magnetic action, or a medium that inputs and outputs information by optical action. An example of a semiconductor device is a USB (Universal Serial Bus) memory. An example of a medium that inputs and outputs information by magnetic action is a magnetic disk. An example of a medium that inputs and outputs information by optical action is a CD-ROM, DVD, Blu-ray Disc, etc. (Blu-ray is a registered trademark). CD is an abbreviation for Compact Disc. DVD is an abbreviation for Digital Versatile Disk.

[0068] The storage unit 202 of the generating device 101 includes, for example, a memory 1002, a storage device 1003, a removable storage medium 1005, etc. For example, the storage device 1003 of the generating device 101 stores firmware, report information 400, test software 110 that includes a test vendor's private key therein, the test vendor's public key, and the device vendor's private key and public key.

[0069] The storage device of the distribution server 102 stores, for example, firmware and report information 400 corresponding to the firmware.

[0070] The storage unit 302 of the loader 104 includes, for example, a memory 1002, a storage device 1003, a removable storage medium 1005, etc. For example, the storage device 1003 of the loader 104 stores firmware, report information 400, a test vendor public key, and a device vendor public key.

[0071] The communication interface 1006 communicates with other devices, for example, according to instructions from the processor 1001. In one example, the communication interface 1006 transmits and receives data to and from other devices using, for example, wired communication, wireless communication, and communication via a network.

[0072] The communication interface 1006 is, for example, an example of the communication unit 203 of the generation device 101. The communication interface 1006 of the generation device 101 communicates with the distribution server 102 and the test target device 103 in accordance with instructions from the processor 1001, for example.

[0073] The communication interface 1006 of the distribution server communicates with the generator 101 and the loader 104, for example, according to instructions from the processor 1001.

[0074] The communication interface 1006 is, for example, an example of the communication unit 303 of the loader 104. The communication interface 1006 of the loader 104 communicates with the distribution server 102 and the update target device 105 in accordance with instructions from the processor 1001, for example.

[0075] The input / output interface 1007 is, for example, an interface between an input device and an output device. The input device is, for example, a device such as a keyboard, mouse, or touch panel that accepts instructions from a user. The output device is, for example, a display device such as a display, and an audio device such as a speaker.

[0076] For example, the input / output interface 1007 of the generation device 101 includes an interface for connecting to the inspection target device 103. Furthermore, the input / output interface 1007 of the loader 104 includes an interface for connecting to the update target device 105, for example. Furthermore, the input / output interface 1007 of the loader 104 may be connected to a display device, and the processor 1001 of the loader 104 causes the display device connected via the input / output interface 1007 to display the display screen 900, for example.

[0077] Each program according to the embodiment is provided to the generating device 101, the distribution server 102, and the loader 104 in the following form, for example. (1) It is pre-installed in the storage device 1003. (2) Provided by removable storage medium 1005. (3) Provided from a server such as a program server.

[0078] The hardware configuration of the computer 1000 described with reference to FIG. 10 is an example, and the embodiment is not limited thereto. For example, part of the above-described configuration may be deleted, or new configuration may be added. In another embodiment, for example, part or all of the above-described functions may be implemented as hardware using an FPGA, SoC, ASIC, PLD, or the like. Note that FPGA is an abbreviation for Field Programmable Gate Array. SoC is an abbreviation for System-on-a-chip. ASIC is an abbreviation for Application Specific Integrated Circuit. PLD is an abbreviation for Programmable Logic Device.

[0079] Several embodiments have been described above. However, the embodiments are not limited to the above embodiments and should be understood to include various modifications and alternative forms of the above embodiments. For example, it will be understood that the various embodiments can be realized by modifying the components without departing from the spirit and scope of the embodiments. It will also be understood that various embodiments can be implemented by appropriately combining multiple components disclosed in the above-described embodiments. Furthermore, it will be understood by those skilled in the art that various embodiments can be implemented by deleting some components from all the components shown in the embodiments or by adding some components to the components shown in the embodiments. [Explanation of symbols]

[0080] 100: Update System 101:Generation device 102: Distribution Server 103: Equipment to be inspected 104: Loader 105: Devices to be updated 110: Inspection software 201: Control unit 202: Storage section 203: Communications Department 211: Inspection Department 212 :Generation part 301: Control section 302: Storage section 303: Communications Department 400 : Report Information 700: Test results 900:Display screen 1000: Computer 1001: Processor 1002: Memory 1003 :Storage device 1004: Reading device 1005: Removable storage media 1006: Communication interface 1007: Input / output interface 1008: Bus

Claims

1. an inspection unit that applies firmware to a device and inspects it by executing inspection software having a private key of an inspection vendor, generating inspection target information indicating the firmware that was inspected and inspection results of inspecting the firmware, and generating inspection information including an inspection result signature digitally signed with the private key of the inspection vendor on data based on the inspection target information and the inspection results; a generation unit that generates report information including information about the firmware, a report signature digitally signed with a private key of a device vendor that provides the device on data based on the inspection information, and the inspection information; A generating device comprising:

2. The generating device according to claim 1 , wherein the inspection target information includes designation information that designates a portion of data in the firmware, and a hash value of the portion of data designated by the designation information.

3. The generating device according to claim 1 or 2, wherein the information about the firmware includes a hash value of the entire data of the firmware.

4. The generating device according to claim 1 , wherein the inspection result includes information indicating whether the device to which the firmware is applied satisfies predetermined performance conditions.

5. A generation method executed by a generation device, comprising: a step in which the generation device applies firmware to a device by executing inspection software having a private key of an inspection vendor to inspect the firmware, generating inspection target information indicating the firmware to be inspected and inspection results of inspecting the firmware, and generating inspection information including an inspection result signature digitally signed with the private key of the inspection vendor on data based on the inspection target information and the inspection results; generating, by the generating device, report information including information about the firmware, a report signature digitally signed with a private key of a device vendor that provides the device on data based on the inspection information, and the inspection information; A method of generating the same.

6. Applying firmware to a device and testing it by executing testing software equipped with a testing vendor's private key, generating test target information indicating the firmware to be tested and test results of testing the firmware, and generating test information including a test result signature digitally signed with the testing vendor's private key to data based on the test target information and the test results, the test target information, and the test results; generating report information including information about the firmware, a report signature digitally signed with a private key of a device vendor that provides the device on data based on the inspection information, and the inspection information; A generation program that causes a generation device to execute a process including the steps of:

7. A generating device; Loader and An update system comprising: The generating device comprises: an inspection unit that applies firmware to a device and inspects it by executing inspection software having a private key of an inspection vendor, generating inspection target information indicating the firmware that was inspected and inspection results of inspecting the firmware, and generating inspection information including an inspection result signature digitally signed with the private key of the inspection vendor on data based on the inspection target information and the inspection results; a generation unit that generates report information including information about the firmware, a report signature digitally signed with a private key of a device vendor that provides the device on data based on the inspection information, and the inspection information; Including, The loader verifying that the test results included in the test information of the report information were generated by the test software using the test result signature included in the test information of the report information and the test vendor's public key; displaying the test results on a display device if the test results are generated by the test software; Update the target device with the firmware; An update system comprising:

Images