First communication device and computer program product for the first communication device

Abstract

The first communication device can perform: output control processing for outputting output information externally, obtaining the output information using the public key of the first communication device; receiving an authentication request from a second communication device that has obtained the public key; upon determining that a wireless connection has been established between the first communication device and the first access point, sending a first authentication response to the second communication device via the wireless interface, the first authentication response including first role information indicating that the first communication device will play a first role, the first role being a role for sending first wireless setting information to the second communication device; and sending the first wireless setting information to the second communication device.

Description

Technical Field

[0001] The disclosure herein discloses a technique for establishing a wireless connection between a first communication device and another device. Background Art

[0002] The Device Configuration Protocol (DPP) scheme is known, which is a wireless communication scheme established by the Wi-Fi Alliance. The DPP scheme is a wireless communication scheme for easily establishing a Wi-Fi (registered trademark, Wi-Fi Alliance) connection between a pair of devices. In the DPP scheme, a first device that plays the role of a configurator sends information for establishing a Wi-Fi connection to a second device that plays the role of a registrant. Then, a Wi-Fi connection is established between the second device and the first device. Summary of the invention

[0003] The disclosure herein provides a technique that enables a first communication device to play an appropriate role based on the status of the first communication device.

[0004] The first communication device disclosed herein may include: a wireless interface, the wireless interface is configured to perform wireless communication in accordance with the Wi-Fi standard; an output control unit, the output control unit is configured to perform output control processing to output output information to the outside, the output information is obtained in accordance with the Wi-Fi standard and using the public key of the first communication device; an authentication request receiving unit, the authentication request receiving unit is configured to receive an authentication request using the public key from a second communication device that has obtained the public key via the wireless interface; a first determination unit, the first determination unit is configured to determine whether a wireless connection has been established between the first communication device and any one of the access points; a first authentication response sending unit, the first authentication response sending unit is configured to send a first authentication response to the second communication device via the wireless interface when it is determined that a wireless connection has been established between the first communication device and the first access point, the first authentication response including first role information indicating that the first communication device will play a first role, the first role being a role of sending first wireless setting information to the second communication device, the first wireless setting information being used to establish a wireless connection between the second communication device and the first access point Establishing a first wireless connection; a wireless setting sending unit, the wireless setting sending unit is configured to send the first wireless setting information to the second communication device via the wireless interface after having sent the first authentication response to the second communication device; a second authentication response sending unit, the second authentication response sending unit is configured to send a second authentication response to the second communication device via the wireless interface when it is determined that the wireless connection has not been established between the first communication device and any access point, the second authentication response includes second role information, the second role information indicates that the first communication device will play a second role, the second role is different from the first role, and is a role for receiving the second wireless setting information from the second communication device, the second wireless setting information is used to establish a second wireless connection between the first communication device and the second access point; a wireless setting receiving unit, the wireless setting receiving unit is configured to receive the second wireless setting information from the second communication device via the wireless interface after having sent the second authentication response to the second communication device; and a first establishing unit, the first establishing unit is configured to establish a second wireless connection with the second access point via the wireless interface using the second wireless setting information.

[0005] In the above technology, the first communication device determines whether a wireless connection is established between the first communication device and any one of the access points. In the case where a wireless connection is established between the first communication device and the first access point, the first communication device plays a first role of sending the first wireless setting information to the second communication device and sends the first wireless setting information to the second communication device. As a result, it is possible to establish a first wireless connection between the second communication device and the first access point. In addition, in the case where a wireless connection is not established between the first communication device and any access point, the first communication device plays a second role of receiving the second wireless setting information from the second communication device, and receives the second wireless setting information from the second communication device. As a result, it is possible to establish a second wireless connection between the first communication device and the second access point. Therefore, it is possible to make the first communication device consider its own situation and play a role suitable for this.

[0006] After having received the authentication request from the second communication device, the first determination unit may determine whether a wireless connection has been established between the first communication device and any one of the access points.

[0007] The first communication device may further include: a second determination unit, the second determination unit being configured to determine, in a case where an authentication request has been received from the second communication device, whether the authentication request includes predetermined information indicating that the second communication device will play the second role, wherein, in a case where it is determined that a wireless connection is established between the first communication device and the first access point and the authentication request includes the predetermined information, the first authentication response sending unit may send a first authentication response including the first role information to the second communication device via the wireless interface, and in a case where it is determined that a wireless connection is established between the first communication device and the first access point and the authentication request does not include the predetermined information, the second authentication response sending unit may send a second authentication response including the second role information to the second communication device via the wireless interface.

[0008] The authentication request may include first usage information related to the use of communication via the access point or second usage information related to the use of communication without intervention of the access point. When the authentication request includes the first usage information, the first determination unit may determine whether a wireless connection has been established between the first communication device and any one of the access points, and the first communication device may further include: a second establishment unit, the second establishment unit is configured to establish a third wireless connection with the second communication device via the wireless interface when the authentication request includes the second usage information, and the third wireless connection is established without intervention of any access point.

[0009] The third wireless connection may be a wireless connection according to a Wi-Fi Direct scheme of the Wi-Fi standard.

[0010] When the first communication device is in a group owner state according to the Wi-Fi Direct scheme, the first communication device may play the first role, and when the first communication device is in a client state according to the Wi-Fi Direct scheme, the first communication device may play the second role.

[0011] The output information may be information of a device configuration protocol scheme in accordance with the Wi-Fi standard.

[0012] In the case where the access point information is already stored in the memory, the first determining unit may determine that a wireless connection has been established between the first communication device and the first access point, and the access point information is related to the first access point with which the wireless connection has been established with the first communication device.

[0013] The access point information may include a signature connector according to a device configuration protocol scheme of the Wi-Fi standard.

[0014] The output information may be a code image obtained by encoding the common key, and the output control process may be a process of causing the display unit to display the output information as the code image.

[0015] The method implemented by the above first communication device, the computer program and the non-transitory computer-readable medium storing the computer program are also novel and useful. A communication system including the above communication device and other devices (eg, second communication device, external device) is also novel and useful. BRIEF DESCRIPTION OF THE DRAWINGS

[0016] Figure 1 shows the configuration of the communication system;

[0017] Figure 2 A schematic sequence diagram showing a process of establishing a wireless connection between a printer and an access point according to the DPP scheme;

[0018] Figure 3 A sequence diagram showing the bootstrapping process;

[0019] Figure 4 A sequence diagram showing the authentication process;

[0020] Figure 5 A sequence diagram showing a configuration process;

[0021] Figure 6 A sequence diagram showing a network access process;

[0022] Figure 7 shows a flow chart of the authentication process;

[0023] Figure 8A sequence diagram showing a bootstrap process and an authentication process in case A, in which a wireless connection is established between a printer and an AP;

[0024] Fig. 9 Shown next Figure 8 Sequence diagram of (configuration processing and network access processing);

[0025] Fig.10 A sequence diagram showing a bootstrap process and an authentication process in case B in which a wireless connection is established between a printer and an AP and between a terminal and another AP;

[0026] Fig.11 Shown next Fig.10 Sequence diagram of (configuration processing and network access processing);

[0027] Fig.12 A sequence diagram showing a bootstrap process in case C, in which a wireless connection according to the WFD scheme is to be established between a printer and a terminal;

[0028] Fig.13 Shown next Fig.12 Sequence diagram (authentication processing);

[0029] Fig.14 Shown next Fig.13 Sequence diagram of (configuration processing);

[0030] Fig.15 Shown next Fig.14 (Network Access Processing); and

[0031] Fig.16 A table summarizing various aspects of the embodiment is shown. DETAILED DESCRIPTION

[0032] (Example)

[0033] (Configuration of communication system 2; Figure 1 )

[0034] like Figure 1 As shown, the communication system 2 includes two access points (hereinafter referred to as "AP") 6, 8, a printer 10, and two terminals 100, 200. In this embodiment, for example, a user uses the terminal 100 to establish a wireless connection (hereinafter referred to as "Wi-Fi connection") between the printer 10 and the AP 6 according to the Wi-Fi standard.

[0035] (Configuration of Terminal 100)

[0036] The terminal 100 is a portable terminal device, such as a cellular phone (such as a smart phone), a PDA, and a tablet PC. In a variation, the terminal 100 may be a desktop terminal device. The terminal 100 includes a camera 115 and a Wi-Fi interface 116. Hereinafter, the interface will be referred to as "I / F".

[0037] The camera 115 is a device configured to capture an image of an object, and in the present embodiment, the camera 115 is used to capture a QR code (registered trademark, DENSO WAVE INCORPORATED) of each of the APs 6 , 8 and the printer 10 .

[0038] The Wi-Fi I / F 116 is a wireless interface for performing communication in accordance with the Wi-Fi standard. The Wi-Fi standard is a standard for performing wireless communication in accordance with the standard 802.11 of the Institute of Electrical and Electronics Engineers (IEEE) and standards conforming thereto (e.g., 802.11a, 11b, 11g, 11n, etc.). The Wi-Fi I / F 116 supports the Device Configuration Protocol (DPP) scheme established by the Wi-Fi Alliance. The DPP scheme is described in the specification "Device Configuration Protocol Technical Specification Version 1.1" created by the Wi-Fi Alliance, and is a scheme for easily establishing a Wi-Fi connection between a pair of devices (e.g., a printer 10 and an AP 6) by using the terminal 100.

[0039] The Wi-Fi I / F 116 also supports the WFD (abbreviation of Wi-Fi Direct (registered trademark, Wi-Fi Alliance)) scheme established by the Wi-Fi Alliance. The WFD scheme is a scheme described in the specification "Wi-Fi Peer-to-Peer (P2P) Technical Specification Version 1.1" created by the Wi-Fi Alliance. In WFD, a group owner state (hereinafter referred to as "G / O state") and a customer state (hereinafter referred to as "CL state") are defined. In addition, in the present embodiment, a state different from both the G / O state and the CL state is referred to as a "device state". Devices that support the WFD scheme are configured to selectively operate in one of the above three states. Hereinafter, a Wi-Fi connection established according to the WFD scheme may be referred to as a "WFD connection".

[0040] (Configuration of Terminal 200)

[0041] The terminal 200 is also a portable terminal device similar to the terminal 100. In a variation, the terminal 200 may be a desktop terminal device. Similar to the terminal 100, the terminal 200 includes a camera 215 and a Wi-Fi I / F 216.

[0042] (Configuration of Printer 10)

[0043] The printer 10 is a peripheral device configured to perform a printing function (for example, a peripheral device of the terminal 100, 200). The printer 10 includes an operation unit 12, a display unit 14, a Wi-Fi I / F 16, a print execution unit 18, and a controller 30. The respective units 12 to 30 are connected to a bus (reference numerals omitted).

[0044] The operation unit 12 includes a plurality of buttons. The user can input various instructions to the printer 10 by operating the operation unit 12. The display unit 14 is a display configured to display various types of information. The display unit 14 may also include a touch screen function (i.e., an operation unit). The print execution unit 18 includes a printing mechanism such as an inkjet scheme and a laser scheme.

[0045] The Wi-Fi I / F 16 supports the DPP scheme and the WFD scheme. Therefore, the printer 10 can establish a Wi-Fi connection with the AP 6, and can also establish a WFD connection with a terminal (e.g., the terminal 100) without any intervention of the AP. Hereinafter, the Wi-Fi connection with the AP 6 may be referred to as an "AP connection".

[0046] The Wi-Fi I / F 16 is assigned two MAC addresses “mac_ap” and “mac_wfd.” The MAC address “mac_ap” is a MAC address used in AP connection. The MAC address “mac_wfd” is a MAC address used in WFD connection.

[0047] The controller 30 includes a CPU 32 and a memory 34. The CPU 32 is configured to execute various processes according to a program 40 stored in the memory 34. The memory 34 is constituted by a volatile memory, a nonvolatile memory, or the like.

[0048] In addition, the memory 34 may store AP information 44 for establishing an AP connection.

[0049] (DPP Overview; Figure 2 )

[0050] Next, we will refer to Figure 2 Describes an overview of DPP. The AP 6 also supports the DPP scheme. In the present embodiment, the DPP connection between the printer 10 and the AP 6 is established by each of the devices 6, 10, 100 that perform communication according to the DPP scheme. Hereinafter, for easier understanding, the operations performed by the CPU of each device (e.g., the CPU 32) will be described with its corresponding device (e.g., the printer 10) as the object of the action, rather than describing the operations with its corresponding CPU as the object of the action.

[0051] In T5, the terminal 100 performs a bootstrapping (hereinafter referred to as "BS") of the DPP scheme with the AP 6. The BS is a process of providing information used in authentication (hereinafter referred to as "Auth") in T10 described later from the AP 6 to the terminal 100 in response to the QR code attached to the AP 6 being captured by the camera 115 of the terminal 100.

[0052] In T10, the terminal 100 uses the information obtained in the BS in T5, and performs Auth of the DPP scheme with the AP 6. This Auth is a process in which each of the terminal 100 and the AP 6 authenticates its communication counterpart.

[0053] In T15, the terminal 100 performs configuration (hereinafter referred to as "Config") of the DPP scheme with the AP 6. The Config is a process of sending information for the AP 6 to establish an AP connection according to the DPP scheme to the AP 6. Specifically, the terminal 100 generates a configuration object to be used by the AP (hereinafter, the configuration object is abbreviated as "CO", and the CO to be used by the AP is abbreviated as "AP-CO"), and sends the AP-CO to the AP 6. As a result, the AP-CO is stored in the AP 6.

[0054] Next, the terminal 100 performs BS of the DPP scheme in T25 with the printer 10. The BS is a process of providing information used in Auth in T30 to be described later from the printer 10 to the terminal 100 in response to a QR code displayed on the printer 10 captured by the camera 115 of the terminal 100.

[0055] In T30, the terminal 100 uses the information obtained in the BS of T25 and performs Auth of the DPP scheme with the printer 10. This Auth is a process in which each of the terminal 100 and the printer 10 authenticates its communication counterpart.

[0056] In T35, the terminal 100 performs Config of the DPP scheme with the printer 10. This Config is a process of sending information for establishing a DPP connection between the printer 10 and the AP 6 to the printer 10. In this Config, the terminal 100 generates a first printer-CO for the printer, the first printer-CO being used to establish an AP connection between the printer 10 and the AP 6, and sends the first printer-CO to the printer 10. As a result, the first printer-CO is stored in the printer 10.

[0057] In T40, the printer 10 and the AP 6 use the stored AP-CO and the first printer-CO and perform network access (hereinafter referred to as "NA") of the DPP scheme. NA is a process for sharing a connection key for establishing an AP connection in accordance with the DPP scheme between the printer 10 and the AP 6. Thereafter, the printer 10 and the AP 6 perform a 4-way handshake communication. In at least a part of the process in the 4-way handshake communication, the printer 10 and the AP 6 transmit encrypted information encrypted by the shared connection key. Then, in the event that the decryption of the encrypted information is successful, an AP connection is established between the printer 10 and the AP 6. The printer 10 can thereby participate in the wireless network formed by the AP 6 as a substation. In a variation, the printer 10 and the AP 6 may perform Simultaneous Authentication of Equals (SAE; so-called "dragonfly") communication instead of the 4-way handshake communication.

[0058] In the DPP scheme, in order to establish an AP connection between the printer 10 and the AP 6, the user does not need to input information (such as SSID and password) to the printer 10 on the wireless network where the AP 6 operates as a parent station. Therefore, the user can easily establish an AP connection between the printer 10 and the AP 6.

[0059] (Details of each treatment; Figures 3 to 6 )

[0060] Next, we will refer to Figures 3 to 6 Described in Figure 2 Details of each process performed in T25 to T40.

[0061] (Bootstrapping (BS); Figure 3 )

[0062] First, refer to Figure 3 Described in Figure 2 BS processing is performed in T25 of Figure 3 In the initial state, the memory 34 of the printer 10 pre-stores the public key PPK1 and the private key psk1 of the printer 10. Figure 3 In the initial state, the memory 34 does not store the AP information 44.

[0063] In T100, the user operates the operation unit 12 and inputs a predetermined instruction to the printer 10. When the input of the predetermined instruction is accepted from the user in T100, the printer 10 displays a selection screen on the display unit 14 in T102. The selection screen is a screen for selecting a communication method. The selection screen includes an "AP communication" button indicating that communication via AP will be used and a "WFD communication" button indicating that communication in accordance with the WFD scheme without any AP intervention will be used. Alternatively, the selection screen may not be displayed. In this case, for example, in a case where an instruction is accepted from the user in a first screen related to the use of communication via AP, an AP-QR code of the AP may be displayed (see T106), and in a case where an instruction is accepted from the user in a second screen that is different from the first screen and related to the use of communication in accordance with WFD, a WFD-QR code of the WFD may be displayed (see Fig.12 T856).

[0064] In T104, the user operates the operation unit 12 and selects the "AP communication" button in the selection screen. When the selection of the "AP communication" button is accepted from the user in T104, in T106, the printer 10 displays the AP-QR code on the display unit 14. The AP-QR code is obtained by encoding the public key PPK1 of the printer 10 and the MAC address "mac_ap" used in the AP connection.

[0065] The terminal 100 activates the camera 115 of the terminal 100 in response to receiving the operation from the user, and in T120, the AP-QR code displayed in T100 is captured by using the camera 115. Then, in T122, the terminal 100 decodes the captured AP-QR code and obtains the public key PPK1 and the MAC address "mac_ap". When the processing of T122 is completed, Figure 3 The processing is terminated.

[0066] (Authentication(Auth); Figure 4 )

[0067] Next, we will refer to Figure 4 Described in Figure 2 Auth processing performed in T30 of the terminal 100. All communications performed between the terminal 100 and the printer 10 are performed via the Wi-Fi I / F 116 of the terminal 100 and the Wi-Fi I / F 16 of the printer 10. Thus, hereinafter, the description of "via the Wi-Fi I / F 116 (or 16)" will be omitted.

[0068] In T200, the terminal 100 generates a public key TPK1 and a private key tsk1 of the terminal 100. Then, in T202, the terminal 100 uses the generated private key tsk1 and the Figure 3 The terminal 100 generates a shared key SK1 using the public key PPK1 of the printer 10 obtained in T122 according to the elliptic curve Diffie-Hellman key exchange (ECDH). Then, in T204, the terminal 100 encrypts the random value RV1 using the generated shared key SK1 and generates encrypted data ED1.

[0069] In T210, the terminal 100 uses Figure 3 The MAC address "mac_ap" obtained in T122 of the terminal 100 is used as the recipient to send a DPP authentication request (hereinafter referred to as "AReq") to the printer 10. AReq is a signal requesting the printer 10 to perform authentication. AReq includes the public key TPK1 of the terminal 100 generated in T200, the encrypted data ED1 generated in T204, the capabilities of the terminal 100, and the MAC address "mac_ap".

[0070] Capability is information pre-specified in a device supporting the DPP scheme, and includes one of the following values: a value indicating that the device can only operate as a configurator according to the DPP scheme, a value indicating that the device can only operate as a registrant according to the DPP scheme, and a value indicating that the device can operate as both a configurator and a registrant. A configurator is a device that is configured to operate in a Config (e.g., Figure 2 T35) will be in NA (for example, Figure 2 On the other hand, the registrant refers to a role configured to receive the CO to be used in the NA from the configurator in Config. In this case, AReq contains a value that the device as the capability of the terminal 100 can operate as a configurator and a registrant.

[0071] In T210 , the printer 10 receives the AReq from the terminal 100 . As described above, the AReq is sent with the MAC address “mac_ap” of the Wi-Fi I / F 16 of the printer 10 as the recipient. Therefore, the printer 10 can receive the AReq from the terminal 100 appropriately.

[0072] When receiving AReq from the terminal 100 in T210, the printer 10 executes Figure 7 's processing (described later), and determines the capabilities of the printer 10 as a registrant.

[0073] Then, the printer 10 performs processing for authenticating the sender of AReq (i.e., the terminal 100). Specifically, the printer 10 uses the public key TPK1 of the terminal 100 in AReq and the private key psk1 of the printer 10 in T212 to generate a shared key SK1. Here, the shared key SK1 generated by the terminal 100 in T202 matches (is the same as) the shared key SK1 generated by the printer 10 in T212. Therefore, in T214, the printer 10 can use the generated shared key SK1 to properly decrypt the encrypted data ED1 in AReq, as a result of which the random value RV1 can be obtained. In the event that such decryption of the encrypted data ED1 is successful, the printer 10 determines that the sender of AReq is someone who has been captured in Figure 3 On the other hand, in the case where decryption of the encrypted data ED1 is unsuccessful, the printer 10 determines that the sender of AReq is not the device that has captured the QR code displayed in T106, that is, determines that the authentication has failed, and does not execute the processing from T216.

[0074] In T216, the printer 10 generates a new public key PPK2 and a new private key psk2 of the printer 10. In a variation, the printer 10 may store the public key PPK2 and the private key psk2 in advance. Then, in T217, the printer 10 uses the public key TPK1 of the terminal 100 in the AReq of T210 and the generated private key psk2 of the printer 10 to generate a shared key SK2 according to ECDH. Then, in T218, the printer 10 encrypts the obtained random value RV1 and the new random value RV2 using the generated shared key SK2, and generates encrypted data ED2.

[0075] In T220, the printer 10 sends a DPP authentication response (hereinafter referred to as "ARes") to the terminal 100. The ARes includes the public key PPK2 of the printer 10 generated in T216, the encrypted data ED2 generated in T218, and the capability of the printer 10 determined in T211 (i.e., a value indicating that it can operate only as a registrant).

[0076] In T220, the terminal 100 receives ARes from the printer 10. In this case, the terminal 100 performs a process for authenticating the sender of ARes (i.e., the printer 10). Specifically, in T222, the terminal 100 generates a shared key SK2 according to ECDH using the private key tsk1 of the terminal 100 generated in T200 and the public key PPK2 of the printer 10 in ARes. Here, the shared key SK2 generated by the printer 10 in T217 matches the shared key SK2 generated by the terminal 100 in T222. Therefore, in T224, the terminal 100 can appropriately decrypt the encrypted data ED2 in ARes using the generated shared key SK2, as a result of which random values ​​RV1 and RV2 can be obtained. In the case where the decryption of the encrypted data ED2 is successful, the terminal 100 determines that the sender of ARes is the device that possesses the captured QR code, that is, determines that the authentication is successful, and performs the process starting from T230. On the other hand, in the case where decryption of the encrypted data ED2 is unsuccessful, the terminal 100 determines that the sender of ARes is not the device storing the captured QR code, that is, determines that the authentication has failed, and does not perform the process from T230.

[0077] In T230, the terminal 100 sends Confirm to the printer 10. Confirm includes information indicating that the terminal 100 will operate as a configurator and the printer 10 will operate as a registrant. As a result, the terminal 100 determines to operate as a configurator in T232, and the printer 10 determines to operate as a registrant in T234. When the processing of T234 is completed, the process is terminated. Figure 4 processing.

[0078] (Config; Figure 5 )

[0079] Next, we will refer to Figure 5 Described in Figure 2 Config processing executed in T35 of . In T300, the printer 10 sends a DPP configuration request (hereinafter referred to as "CReq") to the terminal 100. CReq is a signal requesting to send the first printer-CO. CReq includes a value "sta" indicating that the printer 10 will receive the first printer-CO. In addition, CReq includes a value "config" of operation information requesting the printer 10 to operate as a configurator. For example, it can be assumed that case A ( Figure 8 and 9 ), where Figures 3 to 6After the processing of has been completed and the AP connection has been established between the printer 10 and the AP 6, communication according to the DPP scheme is performed between the printer 10 and the terminal 100. In this case, the printer 10 operates as a configurator, uses the first printer-CO, generates a first terminal-CO for the terminal, and sends the first terminal-CO to the terminal 200. In this case, the printer 10 sends the CReq including the value "config" to the terminal device 100 in advance in T300 before the case A that occurs later. By doing so, the printer 10 can operate as a configurator, use the first printer-CO obtained from the terminal 100, and generate the first terminal-CO in the case A that occurs later.

[0080] When receiving CReq from the printer 10 in T300, the terminal 100 obtains the group ID "Group1", the public key TPK2 and the private key tsk2 from the memory (not shown) of the terminal 100 in T302. As described above, the terminal 100 has performed Figure 2 Config in T15 of the terminal 100, and at this time, the group ID "Group1", the public key TPK2 and the private key tsk2 are generated and stored in the memory. The group ID "Group1" is information for identifying the wireless network formed by the Wi-Fi connection between the printer 10 and the AP 6 being established. In a variation, a letter string specified by the user can be used as the group ID. That is, in T302, the terminal 100 obtains the group ID in Figure 2 Then, in T304, the terminal 100 generates the first printer-CO. Specifically, the terminal 100 performs the following processing.

[0081] The terminal 100 first hashes the public key TPK2 of the terminal 100 to generate a hash value HV1. In addition, the terminal 100 hashes the hash value HV, the group ID "Group1" and Figure 4 The combination of the public key PPK2 of the printer 10 in the ARes in the T220 is hashed to generate a specific value. Then, the terminal 100 generates a digital signature DSpr1 by encrypting the generated specific value using the private key tsk2 of the terminal 100 in accordance with the elliptic curve digital signature algorithm (ECDSA). As a result, the terminal 100 can generate a first printer-signature-connector (hereinafter, the signature-connector will be simply referred to as "SC") for the printer, including the hash value HV1, the group ID "Group1", the public key PPK2 of the printer 10 and the digital signature DSpr1. Then, the terminal 100 generates a first printer-CO including the first printer-SC and the public key TPK2 of the terminal 100.

[0082] In T310, the terminal 100 sends a DPP configuration response (hereinafter referred to as "CRes") including the first printer-CO to the printer 10. Here, CRes contains operation information as a response to the value "config" in CReq. The operation information includes information (e.g., the private key tsk2 of the terminal 100) that the printer 10 operates as a configurator and generates the first terminal-CO for another terminal (e.g., the terminal 200).

[0083] When receiving CRes from the terminal 100 in T310, the printer 10 stores the first printer-CO in CRes in T312. The first printer-CO is information to be used to establish an AP connection with the AP 6, and thus can be said to be connection information for establishing an AP connection with the AP 6. The printer 10 stores the first printer-CO as the AP information 44. When the processing of T312 is completed, Figure 5 The processing is terminated.

[0084] (Network Access (NA); Figure 6 )

[0085] Next, we will refer to Figure 6 describe Figure 2 As described above, Figure 2 Similar to T25 to T35 of FIG. 1 , the processing of T5 to T15 has been performed between the terminal 100 and the AP 6. The AP 6 stores the public key APK1 and the private key ask1 of the AP 6 in advance. In addition, a QR code obtained by encoding the public key APK1 of the AP 6 and the MAC address of the AP 6 is attached to the shell of the AP 6. When the terminal 100 captures the QR code, communication with the AP 6 is performed between the terminal 100 and the AP 6. Figure 4 As a result, AP 6 stores the public key APK2 and the private key ask2 of AP 6 (see Figure 4 T216), and further stores the AP-CO received from the terminal 100 (see Figure 5T312 of the terminal 100). AP-CO includes AP-SC of AP and public key TPK2 of terminal 100. This public key TPK2 matches the public key TPK2 contained in the first printer-CO. In addition, AP-SC includes a hash value HV1, a group ID "Group1", a public key APK2 of AP 6, and a digital signature DSap1. The hash value HV1 and the group ID "Group1" here match the hash value HV1 and the group ID "Group1" contained in the first printer-CO. The digital signature DSap1 is information obtained by encrypting a specific value by the private key tsk2 of the terminal 100 (the specific value is obtained by hashing a combination of the hash value HV1, the group ID "Group1" and the public key APK2), and is a value different from the digital signature DSpr1 included in the first printer-CO.

[0086] In T400, the printer 10 sends a DPP peer discovery request (hereinafter referred to as "DReq") including a first printer-SC to the AP 6. The DReq is a signal requesting the AP 6 to perform authentication and send an AP-SC.

[0087] When receiving DReq from the printer 10 in T400, the AP 6 performs processing for authenticating the sender of DReq (i.e., the printer 10) and the various information in DReq (i.e., the hash value HV1, "Group1", and the public key PPK2). Specifically, in T402, the AP 6 first performs a first AP determination processing related to whether the hash value HV1 and the group ID "Group1" in the received first printer-SC match the hash value HV1 and the group ID "Group1" in the AP-SC included in the stored AP-CO, respectively. Figure 6 In the case shown, since AP 6 determines a match in the first AP determination process, it determines that the authentication of the sender of DReq (i.e., printer 10) is successful. The hash value HV1 in the received first printer-SC and the hash value HV1 in the AP-SC contained in the stored AP-CO match means that the first printer-SC and AP-SC are generated by the same device (i.e., terminal 100). Therefore, AP 6 also determines that the authentication of the generator of the received first printer-SC (i.e., terminal 100) is successful.

[0088] The AP 6 also decrypts the received digital signature DSpr1 in the first printer-SC by using the public key TPK2 of the terminal 100 included in the stored AP-CO. Figure 6In the case shown, the decryption of the digital signature DSpr1 is successful, so the AP 6 performs a second AP determination process regarding whether the specific value obtained by decrypting the digital signature DSpr1 matches the value obtained by hashing the respective information in the received first printer-SC (i.e., hash value HV1, "Group1", and public key PPK2). Figure 6 In the case shown, the AP 6 determines a match in the second AP determination process, and therefore determines that the authentication of the various information in DReq is successful, and executes the process from T404. Determining a match in the second AP determination process means that the various information in the received first printer-SC (i.e., hash value HV1, "Group1", and public key PPK2) has not been tampered with by a third party after the first printer-CO is stored in the printer 10. On the other hand, in each case where a match is not determined in the first AP determination process, the decryption of the digital signature DSpr1 fails, and a match is not determined in the second AP determination process, the AP 6 determines that the authentication fails and does not execute the process from T404.

[0089] Next, in T404 , the AP 6 generates a connection key (ie, a shared key) CK1 according to ECDH using the obtained public key PPK2 of the printer 10 and the stored private key Ask2 of the AP 6 .

[0090] In T410 , the AP 6 sends a DPP peer discovery response (hereinafter referred to as “DRes”) including the AP-SC to the printer 10 .

[0091] When DRes is received from AP 6 in T410, the printer 10 performs processing for authenticating the sender of DRes (i.e., AP6) and the various information in DRes (i.e., hash value HV1, "Group1", and public key APK2). Specifically, in T412, the printer 10 first performs a first PR determination process related to whether the hash value HV1 and group ID "Group1" in the received AP-SC respectively match the hash value HV1 and group ID "Group1" in the first printer-SC included in the stored first printer-CO. Figure 6 In the illustrated case, since the printer 10 determines a match in the first PR determination process, it determines that the authentication of the sender of DRes (i.e., AP 6) is successful. The hash value HV1 in the received AP-SC matches the hash value HV1 in the first printer-SC included in the stored first printer-CO, which means that the first printer-SC and the AP-SC are generated by the same device (i.e., terminal 100). Therefore, the printer 10 also determines that the authentication of the generator of the received AP-SC (i.e., terminal 100) is successful.

[0092] In addition, the printer 10 decrypts the received digital signature DSap1 in the AP-SC by using the stored public key TPK2 of the terminal 100 included in the first printer-CO. Figure 6 In the case shown, the decryption of the digital signature DSap1 is successful, so the printer 10 performs a second PR determination process related to whether a specific value obtained by decrypting the digital signature DSap1 matches a value obtained by hashing the respective information in the received AP-SC (i.e., hash value HV1, "Group1", and public key APK2). Figure 6 In the case shown, the printer 10 determines a match in the second PR determination process, thereby determining that the authentication of the various information in DRes is successful, and executes the process from T414. Determining a match in the second PR determination process means that the various information in AP-SC (i.e., hash value HV1, "Group1", and public key APK2) has not been tampered with by a third party after AP-CO is stored in AP 6. On the other hand, in each case where a match is not determined in the first PR determination process, decryption of the digital signature DSap1 fails, and a match is not determined in the second PR determination process, the printer 10 determines that the authentication has failed and does not execute the process from T414.

[0093] In T414, the printer 10 generates a connection key CK1 according to ECDH using the stored private key psk2 of the printer 10 and the public key APK2 of the AP 6 in the received AP-SC. Here, the connection key CK1 generated by the AP 6 in T404 matches the connection key CK1 generated by the printer 10 in T414. Therefore, the connection key CK1 for establishing the AP connection is shared between the printer 10 and the AP 6.

[0094] As described above, after the connection key CK1 has been shared between the printer 10 and the AP 6, the printer 10 and the AP 6 perform 4-way handshake communication in T420 using the connection key CK1. As a result, an AP connection is established between the printer 10 and the AP 6. When T420 is completed, Figure 6 The processing is terminated.

[0095] (Auth processing of the printer 10; Figure 7 )

[0096] Will refer to Figure 7 The Auth process implemented by the CPU 32 of the printer 10 is described. Figure 4 The process executed by the printer 10 is performed within the Auth process of Figure 7 Processing implementation.

[0097] In S2, the CPU 32 monitors reception of AReq from a terminal (hereinafter referred to as "initiator terminal") that has captured the QR code of the printer 10 in BS processing via the Wi-Fi I / F 16. In the case of receiving AReq from the initiator terminal (S2 YES), the CPU 32 proceeds to S4. Figure 4 The processing of T210 is implemented by the processing of S2. Executed via Wi-Fi I / F 16 Figure 7 Therefore, hereinafter, the description of “via Wi-Fi I / F 16” will be omitted.

[0098] In S4, the CPU 32 determines whether the received AReq includes the MAC address "mac_ap". Figure 3 As shown in T106 of , in the case where the "AP communication" button is selected, an AP-QR code in which information including the MAC address "mac_ap" is encoded is displayed. Therefore, the initiator terminal captures the AP-QR code, obtains the MAC address "mac_ap", and sends the AReq including the MAC address "mac_ap" to the printer 10. On the other hand, in the case where the "WFD communication" button in the selection screen is selected, a WFD-QR code in which information including the MAC address "mac_wfd" to be used in the WFD connection is encoded is displayed. Therefore, the initiator terminal captures the WFD-QR code, obtains the MAC address "mac_wfd", and sends the AReq including the MAC address "mac_wfd" to the printer 10. In the case of determining that the received AReq includes the MAC address "mac_ap" (S4 Yes), the CPU 32 proceeds to S10, and in the case of determining that the received AReq includes the MAC address "mac_wfd" (S4 No), the CPU 32 proceeds to S20. Then, in the case where it is determined that AReq includes the MAC address "mac_ap" (S4 Yes), the printer 10 establishes an AP connection with an AP, and in the case where it is determined that AReq includes the MAC address "mac_wfd", the printer 10 establishes a WFD connection with the initiator terminal. Figures 12 to 15 The process for establishing a WFD connection is described in . According to this configuration, the printer 10 can establish an appropriate Wi-Fi connection according to the MAC address included in the AReq.

[0099] In S10, the CPU 32 determines whether the AP information 44 is stored in the memory 34. The fact that the AP information 44 is not stored in the memory 34 means that an AP connection has not been established between the printer 10 and any AP. In the case where it is determined that no AP information 44 is stored in the memory 34 (S10: No), the CPU 32 proceeds to S16.

[0100] In S16, the CPU 32 determines the capability of the printer 10 as "registrant".

[0101] Then, in S40, the CPU 32 executes a process similar to Figure 4 The processing of T212 to T218 (ie, authentication of the initiator terminal and generation of encryption data) is performed.

[0102] Then, in S42, the CPU 32 sends an ARes including the capability "registrant" to the initiator terminal.

[0103] Then, in S44, the CPU 32 executes a process similar to Figure 4 That is, the CPU 32 determines to operate as a registrant. When the processing of S44 is completed, Figure 7 The processing is terminated.

[0104] The storage of the AP information 44 in the memory 34 means that an AP connection has been established between the printer 10 and an AP (eg, AP 6). In the case where it is determined that the AP information 44 is stored in the memory 34 (S10: Yes), the CPU 32 proceeds to S12.

[0105] In S12, the CPU 32 determines whether the AReq received in S2 includes a value indicating that the capability of the originator terminal is capable of operating only as a registrant. For example, the case where the received AReq includes a value indicating that it is capable of operating only as a registrant may be a case where a program that preferentially executes receiving CO from other devices is installed in the originator terminal, or the user has performed an operation of selecting receiving CO from other devices on the originator terminal. In the case of determining that the received AReq includes a value indicating that it is capable of operating only as a registrant (S12 Yes), the CPU 32 proceeds to S14.

[0106] In S14, the CPU 32 determines the capability of the printer 10 as "configurator." The process after S30 is similar to that of S40.

[0107] Next, in S32, the CPU 32 sends an ARes including the capability "Configurator" to the initiator terminal.

[0108] Then, in S34, the CPU 32 performs a Confirm process. Unlike the Confirm process performed in S44, the CPU 32 determines to operate as a configurator in the Confirm process of S34. When the process of S34 is completed, Figure 7 The processing is terminated.

[0109] In the case where the received AReq includes a value indicating that it can operate as a configurator or a registrant, or in the case where the received AReq includes a value indicating that it can operate only as a configurator (S12: No), the CPU 32 proceeds to S16. That is, the CPU 32 determines the capability of the printer 10 as "registrant". Then, the processing of S40 to S44 is executed, and the process is terminated. Figure 7 processing.

[0110] In the case where it is determined that the received AReq includes the MAC address "MAC_wfd" (S4 No), the CPU 32 performs the processing of S20 to S26. The printer 10 performs the G / O negotiation described later, and selects one of the G / O state and the CL state. In the case where the printer 10 selects the G / O state as a result of the G / O negotiation (S20 Yes), the CPU 32 proceeds to S24, and in the case where the printer 10 selects the CL state as a result of the G / O negotiation (S20 No), the CPU 32 proceeds to S26.

[0111] In S24, the CPU 32 determines the capability of the printer 10 as "configurator". Then, when S24 is completed, the CPU 32 executes the processing of S30 to S34 and terminates. Figure 7 processing.

[0112] In S26, the CPU 32 determines the capability of the printer 10 as "registrant". Then, when S26 is completed, the CPU 32 executes the processing of S40 to S44 and terminates. Figure 7 processing.

[0113] For example, a comparative example can be assumed in which the determination of S10 (i.e., the determination as to whether the AP information 44 is stored) is performed before AReq is received from the initiator terminal. For example, the printer 10 performs the determination of S10 in the BS process before the Auth process. In this comparative example, the printer 10 performs the determination of S10 when it is not necessary, even in a case where the Auth process is not performed for some reason (e.g., communication interruption). In contrast, according to the configuration of the present embodiment, in a case where AReq is received from the initiator terminal (S2 is), the printer 10 performs the determination of S10. According to the configuration of the present embodiment, the determination of S10 can be suppressed from being performed when it is not necessary. In a variation, the configuration of the comparative example can be adopted.

[0114] (Specific situation A; Figure 8 and Fig. 9 )

[0115] Will refer to Figure 8 and Fig. 9 Description by Figure 7 A specific case A is implemented by processing. Case A is Figure 2 (Right now, Figures 3 to 6 ) is a continuation of the processing of . That is, in the initial state of case A, an AP connection is established between the printer 10 and the AP 6. Therefore, the first printer-CO is stored as AP information 44 in the memory 34 of the printer 10 (see Figure 5 T312 of FIG. 14 ). In addition, the terminal 200 does not establish any AP connection with any AP. In this case, after the AP connection between the printer 10 and the AP 6 has been established, the AP connection between the terminal 200 and the AP 6 is established. In the case where the AP connection is established between the terminal 200 and the AP 6, the terminal 200 can participate in the wireless network formed by the AP 6 as a slave station, thereby communicating with the printer 10 via the AP 6.

[0116] (Bootstrapping (BS) and authentication (Auth) in case A; Figure 8 )

[0117] Will refer to Figure 8 Describe the BS processing and Auth processing in case A. T455 and Figure 2 (Right now, Figure 3 ) is similar to T25, except that the terminal 200 captures the AP-QR code of the printer 10.

[0118] In T500, the terminal 200 generates a public key TPK3 and a private key tsk3 of the terminal 200. Figure 4 T202 is similar to that of T504, except that the shared key SK3 is generated using the private key tsk3 of the terminal 200 and the public key PPK1 of the printer 10. Figure 4 T204, except that the encrypted data ED3 is generated by encrypting the random value RV3 using the shared key SK3.

[0119] In this case, for example, the user has performed an operation of selecting to receive CO from other devices on the terminal 200. Therefore, in T510, the terminal 200 transmits an AReq including a value indicating that it is capable of operating only as a registrant as a capability of the terminal 200 to the printer 10. In addition, this AReq includes the public key TPK3 of the terminal 200 generated in T500, the encrypted data ED3 generated in T504, and the MAC address "mac_ap".

[0120] When receiving the AReq from the terminal 200 in T510, the printer 10 determines in T511a that the received AReq includes the MAC address "mac_ap" ( Figure 7In T511b, the printer 10 determines that the first printer-CO is stored in the memory 34 as the AP information 44 (S10 Yes). In T511c, the printer 10 determines that the received AReq includes a value indicating that the terminal 200 can only operate as a registrant as a capability (S12 Yes). Then, in T511d, the printer 10 determines the capability of the printer 10 as "configurator" (S14).

[0121] The printer 10 then executes a process similar to Figure 4 The authentication from T212 to T218 is successfully completed (S30). That is, the printer 10 generates a shared key SK3 using the public key TPK3 of the terminal 200 in AReq and the private key psk1 of the printer 10 in T512, and decrypts the encrypted data ED3 in AReq using the shared key SK3 in T514 to obtain the random value RV3. Then, the printer 10 generates a new public key PPK3 and a new private key psk3 of the printer 10 in T516, generates a shared key SK4 using the public key TPK3 of the terminal 200 in AReq and the private key psk3 of the printer 10 in T517, and encrypts the random value RV3 and the new random value RV4 using the shared key SK4 in T518 to generate the encrypted data ED4.

[0122] Then, in T520 , the printer 10 transmits ARes including the public key PPK3 of the printer 10 , the encrypted data ED4 , and the capability of the printer 10 (ie, a value indicating that it can operate only as a configurator) to the terminal 200 ( S32 ).

[0123] When receiving ARes from the printer 10 in T520, the terminal 200 executes a similar Figure 4 The authentication of T222 and T224 is successfully completed. That is, in T522, the terminal 200 uses the private key tsk3 of the terminal 200 generated in T500 and the public key PPK3 of the printer 10 in ARes to generate the shared key SK4, and in T524, the shared key SK4 is used to decrypt the encrypted data ED4 in ARes and obtain the random values ​​RV3 and RV4.

[0124] In T530, the terminal 200 sends Confirm to the printer 10. Confirm includes information indicating that the terminal 200 will operate as a registrant and the printer 10 will operate as a configurator. As a result, the terminal 200 determines to operate as a registrant in T532, and the printer 10 determines to operate as a configurator in T534.

[0125] (Configuration (Config) and Network Access (NA) in Case A; Fig. 9 )

[0126] Will refer to Fig. 9 Describe the Confi treatment and NA treatment in case A. That is, Fig. 9 yes Figure 8 In this case, the terminal 200 is the registrant. Therefore, in T600, the terminal 200 sends CReq to the printer 10. The CReq in this case includes the value "sta" but does not include the value "config".

[0127] When receiving CReq from the terminal 200 in T600, the printer 10 obtains in T602 a hash value HV1, a group ID "Group1", and a public key TPK2 from the first printer-CO which is the AP information 44. Then, in T604, the printer 10 generates a first terminal-CO. Specifically, the printer 10 performs the following processing.

[0128] The printer 10 performs a query on the hash value HV1, the group ID "Group1" and Figure 8 The combination of the public key TPK3 of the terminal 200 in the AReq in the T510 is hashed to generate a specific value. Then, the printer 10 uses the Figure 5 The specific value generated by encrypting the private key tsk2 included in the operation information received from the terminal device 100 in T310 is used to generate a digital signature DSta1 according to ECDSA. As a result, the printer 10 can generate a first terminal-SC for the terminal, including the hash value HV1, the group ID "Group1", the public key TPK3 of the terminal 200, and the digital signature DSta1. Then, the printer 10 generates a first terminal-CO including the first terminal-SC and the public key TPK2.

[0129] In T610, the printer 10 transmits the CRes including the first terminal-CO to the terminal 200. Therefore, the terminal 200 obtains the first terminal-CO and stores the first terminal-CO in T612.

[0130] Then, at T620 , the terminal 200 sends the DReq including the first terminal-SC to the AP 6 .

[0131] When receiving DReq from the terminal 200 at T620, the AP 6 performs the same operation as in T622. Figure 6 The T402 is similar to the DReq certification. Fig. 9In the illustrated case, the received hash value HV1 and group ID "Group1" in the first Terminal-SC respectively match the hash value HV1 and group ID "Group1" in the AP-SC included in the stored AP-CO, so AP 6 determines that the authentication is successful in the first AP determination process.

[0132] AP 6 also decrypts the received digital signature DSta1 in the first terminal-SC using the public key TPK2 included in the stored AP-CO. Fig. 9 In the case shown, the decryption of the digital signature DSta1 is successfully completed. In this case, the specific value obtained by decrypting the digital signature DSta1 matches the value obtained by hashing the respective information received in the first terminal-SC (i.e., the hash value HV1, "Group1" and the public key TPK3), so AP 6 determines that the authentication is successful in the second AP determination process.

[0133] Next, at T624, AP 6 generates a connection key CK2 according to ECDH using the obtained public key TPK3 of terminal 200 and the stored private key ask2 of AP 6. At T630, AP 6 sends DRes including AP-SC to terminal 200.

[0134] When DRes is received from AP 6 in T630, similar to Figure 6 At T412, the terminal 200 performs authentication of the DRes at T632. The terminal 200 first performs a first TA determination process similar to the first PR determination process. Fig. 9 In the case shown, since the received hash value HV1 and group ID "Group1" in the AP-SC respectively match the hash value HV1 and group ID "Group1" in the first terminal-SC included in the stored first terminal-CO, the terminal 200 determines that the authentication is successful in the first TA determination process.

[0135] Then, the terminal 200 performs a second TA determination process similar to the second PR determination process. Specifically, the terminal 200 uses the public key TPK2 included in the stored first terminal-CO to decrypt the digital signature DSap1 in the received AP-SC. In the present case, the terminal 200 determines that the specific value obtained by decrypting the digital signature DSap1 and the value obtained by hashing the various information in the received AP-SC (i.e., the hash value HV1, "Group1" and the public key APK2) match, so the terminal 200 determines that the authentication is successful in the second TA determination process.

[0136] Then, in T634, the terminal 200 generates a connection key CK2 according to ECDH using the stored private key tsk3 of the terminal 200 and the obtained public key APK2 of the AP 6. In doing so, in T640, the terminal 200 and the AP 6 establish an AP connection using the connection key CK2.

[0137] (Specific case B; Fig.10 and 11 )

[0138] Will refer to Fig.10 and 11 Description by Figure 7 of the processing implementation of a specific case B. Similar to case A, case B is Figure 2 (Right now, Figures 3 to 6 ) is a continuation of the processing of the situation B. That is, in the initial state of the situation B, an AP connection is established between the printer 10 and the AP 6. In addition, the terminal 200 has an AP connection established with the AP 8. In the current situation, a new AP connection will be established between the printer 10 and the AP 8 through the respective devices 8, 10, 200 that perform communication according to the DPP scheme. By doing so, the printer 10 can be changed from a state connected to the AP 6 to a state connected to the AP 8.

[0139] (Bootstrapping (BS) and authentication (Auth) in case B; Fig.10 )

[0140] Will refer to Fig.10 Describe the BS processing and Auth processing in case B. T655 is similar to Figure 8 T455. T700 to T704 are similar to Figure 8 T500 to T504.

[0141] In the present case, the user has not yet performed an operation for selecting to receive CO from other devices on the terminal 200. Therefore, in T710, the terminal 200 transmits to the printer 10 an AReq including a value indicating that it is capable of operating as a configurator or a registrant as a capability of the terminal 200. T710 is similar to Figure 8 T510.

[0142] T711a and T711b are similar to Figure 8 In T711c, the printer 10 determines that the received AReq does not include a value indicating that the terminal 200 can operate only as a registrant as a capability (S12: No). Then, in T711d, the printer 10 determines the capability of the printer 10 as "registrant" (S16).

[0143] T712 to T718 are similar to Figure 8 T512 to T518. T720 and Figure 8 The T520 is similar, except that the ARes includes a value as an indication of the ability of the printer 10 to operate only as a registrant.

[0144] T722 and T724 are similar to Figure 8 T522 and T524. T730 and Figure 8 The terminal 200 is similar to T530 except that Confirm includes information indicating that the terminal 200 will operate as a configurator and the printer 10 will operate as a registrant. As a result, the terminal 200 determines to operate as a configurator in T732, and the printer 10 determines to operate as a registrant in T734.

[0145] (Configuration (Config) and Network Access (NA) in Case B; Fig.11 )

[0146] Will refer to Fig.11 Describe the Config processing and NA processing in case B. That is, Fig.11 yes Fig.10 In the current case, the printer 10 is the registrant. Therefore, in T800, the printer 10 sends CReq to the terminal 200. In the current case, CReq includes a value "sta" and a value "config".

[0147] When CReq is received from the printer 10 in T800, the terminal 200 obtains the group ID "Group2", the public key TPK10 and the private key tsk10 from the memory (not shown) of the terminal 200 in T802. In the current case, an AP connection is established between the terminal 200 and AP8. That is, the terminal 200 has performed Config in accordance with the DPP scheme with the AP 8, and once this is done, the group ID "Group2", the public key TPK10 and the private key tsk10 are generated and stored in the memory. That is, in T802, the terminal 200 obtains the various information stored in Config. Then, in T804, the terminal 200 generates the first printer-CO. Specifically, the terminal 200 generates a hash value HV2 by hashing the public key TPK10 of the terminal 200. In addition, the terminal 200 generates a hash value HV2 by hashing the hash value HV2, the group ID "Group2" and Fig.10The combination of the public key PPK3 of the printer 10 in the ARes in the T720 is hashed to generate a specific value. Then, the terminal 200 encrypts the generated specific value using the private key tsk10 of the terminal 200 and generates a digital signature DSpr2. As a result, the terminal 200 generates a first printer-SC including the hash value HV2, the group ID "Group2", the public key PPK3 of the printer 10 and the digital signature DSpr2. Then, the terminal 200 generates a first printer-CO including the first printer-SC and the public key TPK10 of the terminal 200.

[0148] In T810, the terminal 200 sends the CRes including the first printer-CO to the printer 10. Therefore, in T812, the printer 10 stores the first printer-CO received in T810 as the AP information 44 by replacing the first printer-CO (i.e., the first printer-CO used in the AP connection with the AP) already stored as the AP information 44. That is, it updates the AP information 44.

[0149] As described above, in the present case, an AP connection has been established between the terminal 200 and the AP 8. Therefore, the AP 8 stores the public key APK10 and the private key ask10 of the AP 8, and further stores the AP-CO received from the terminal 200. The AP-CO includes the AP-SC and the public key TPK10 of the terminal 200. In addition, the AP-SC includes the hash value HV2, the group ID "Group2", the public key APK10 of the AP 8, and the digital signature DSap2. The digital signature DSap2 is information in which a specific value obtained by hashing a combination of the hash value HV2, the group ID "Group2", and the public key APK10 is encrypted using the private key tsk10 of the terminal 200, and is a value different from the digital signature DSpr2 included in the first printer-CO.

[0150] T820 to T834 are mainly similar to Figure 6 In addition to performing communication between the AP 8 and the printer 10 and generating the connection key CK3 using the public key PPK3 and the private key ask10 (and the private key psk3 and the public key APK10), in T400 to T414, the printer 10 and the AP 8 establish an AP connection using the connection key CK3.

[0151] (Specific case C; Figures 12 to 15 )

[0152] Will refer to Figures 12 to 15 Description by Figure 7 A specific case C of the processing implementation. Similar to case A, case C is Figure 2 (Right now, Figures 3 to 6 That is, in the initial state of case C, an AP connection is established between the printer 10 and the AP 6. In the current case, a WFD connection will be established between the printer 10 and the terminal 200 by the user selecting the “WFD communication” button.

[0153] (Bootstrapping (BS) in case C); Fig.12 )

[0154] Will refer to Fig.12 Describe BS processing in case C. T850 and T852 are Figure 3 T854 is similar to T100 and T102. In T854, the user operates the operation unit 12 and selects the "WFD communication" button in the selection screen. T856 is similar to Figure 3 The WFD-QR code is obtained by encoding the public key PPK1 of the printer 10 and the MAC address “mac_wfd” used in the WFD connection.

[0155] T870 and T872 are similar to Figure 3 T120 and T122, except that the WFD-QR code is captured by the terminal 200 and the MAC address “mac_wfd” is obtained by the terminal 200.

[0156] Next, at T880 , the terminal 200 and the printer 10 perform WFD discovery communication in accordance with the WFD scheme. The WFD discovery is communication for searching for the printer 10 .

[0157] Next, in T890, the terminal 200 and the printer 10 perform G / O negotiation communication in accordance with the WFD scheme. G / O negotiation is a communication for determining a device to be operated in the G / O state or the CL state. In the current case, it is determined that the printer 10 will be in the G / O state and the terminal 200 will be in the CL state. As a result, the terminal 200 enters the CL state in T892, and the printer 10 enters the G / O state in T894. For example, it is determined which of the printer 10 and the terminal 200 will be in the G / O state according to various factors such as the specifications of the printer 10 or the terminal 200. In the present embodiment, when an AP connection is established between the printer 10 and one of the APs, the printer 10 enters the G / O state, and when no AP connection is established between the printer 10 and any AP, the printer 10 enters the CL state. In a variant, it may be determined that the terminal 200 will be in the G / O state and the printer 10 will be in the CL state.

[0158] (Authentication (Auth) in case C; Fig.13 )

[0159] Will refer to Fig.13 Describe the Auth process in case C. That is, Fig.13 yes Fig.12 The continuation of T900 to T904 is similar to Figure 8 T500 to T504. T910 is similar to Figure 8 T510, in addition to AReq, includes a value and a MAC address "mac_wfd" as an indication of the capability of the terminal 200 to be able to operate as a configurator or a registrant.

[0160] When receiving the AReq from the terminal 200 in T910, the printer 10 determines in T911a that the received AReq includes the MAC address "mac_wfd" ( Figure 7 In T911c, the printer 10 determines the capability of the printer 10 as "configurator" (S24) because the printer 10 is in the G / O state (S20 Yes). T912 to T934 are similar to Figure 8 T512 to T534.

[0161] (Config in case C); Fig.14 )

[0162] Will refer to Fig.14 Describe the Config processing in case C. That is, Fig.14 yes Fig.13 The T1000 is similar to Fig. 9 T600.

[0163] In T1002, the printer 10 generates a public key PPK4 and a private key psk4 of the printer 10. Then, in T1004, the printer 10 generates a second terminal-CO of the terminal. Specifically, the printer 10 performs the following processing.

[0164] First, the printer 10 generates a hash value HV3 by hashing the public key PPK4 of the printer 10. Furthermore, the printer 10 generates a hash value HV3 by hashing the hash value HV3, the group ID "Group3" and Fig.13 The combination of the public key TPK3 of the terminal 200 in the AReq of T910 is hashed to generate a specific value. Then, the printer 10 generates a digital signature DSta3 by encrypting the generated specific value using the private key psk4 in accordance with ECDSA. As a result, the printer 10 can generate a second terminal-SC for the terminal, including the hash value HV3, the group ID "Group3", the public key TPK3 of the terminal 200, and the digital signature DSta3. Then, the printer 10 generates a second terminal-CO including the second terminal-SC and the public key PPK4.

[0165] In T1010, the printer 10 transmits the CRes including the second terminal-CO to the terminal 200. Therefore, the terminal 200 obtains the second terminal-CO and stores the second terminal-CO in T1012.

[0166] (Network Access (NA) in Case C; Fig.15 )

[0167] Will refer to Fig.15 Describe the NA handling in case C. That is, Fig.15 yes Fig.14 The continuation of.

[0168] In T1020, the printer 10 generates a public key PPK5 and a private key psk5 of the printer 10. Then, in T1022, the printer 10 generates a second printer-CO. Specifically, the printer 10 performs the following processing.

[0169] The printer 10 generates a specific value by hashing a combination of the hash value HV3, the group ID "Group3", and the public key PPK5 generated in T1020. Then, the printer 10 generates a digital signature DSpr3 by encrypting the generated specific value using the private key psk4 in accordance with ECDSA. As a result, the printer 10 can generate a second printer-SC for the printer, including the hash value HV3, the group ID "Group3", the public key PPK5 of the printer 10, and the digital signature DSpr3. Then, the printer 10 generates a second terminal-CO including the second printer-SC and the public key PPK4.

[0170] At T1030 , the printer 10 transmits DReq including the second printer-SC to the terminal 200 .

[0171] When DReq is received from the printer 10 at T1030, similar to Figure 6 In T402, the terminal 200 performs authentication of DReq in T1032. Specifically, the terminal 200 determines that the hash value HV3 and the group ID "Group3" in the received second printer-SC match the hash value HV3 and the group ID "Group3" in the stored second terminal-SC, respectively. Then, the terminal 200 decrypts the digital signature DSpr3 in the received second printer-SC using the public key PPK4 stored in the second terminal-CO. The terminal 200 determines that the specific value obtained by decrypting the digital signature DSpr3 and the value obtained by hashing the various information in the received second printer-SC (i.e., the hash value HV3, "Group3" and the public key PPK5) match. Due to the above reasons, the terminal 200 determines that the authentication of DReq is successful.

[0172] Next, at T1034 , the terminal 200 generates a connection key CK4 according to ECDH using the stored private key tsk3 of the terminal 200 and the obtained public key PPK5 of the printer 10 . At T1040 , the terminal 200 sends DRes including the second terminal-SC to the printer 10 .

[0173] When DRes is received from the terminal 200 in T1040, similar to Figure 6 In T412, the printer 10 performs authentication of DRes in T1042. Specifically, the printer 10 determines that the hash value HV3 and the group ID "Group3" received in the second terminal-SC match the hash value HV3 and the group ID "Group3" stored in the second printer-SC. Then, the printer 10 decrypts the digital signature DSta3 received in the second terminal-SC using the public key PPK4 stored in the second printer-CO. The printer 10 determines that the specific value obtained by decrypting the digital signature DSta3 and the value obtained by hashing the various information in the received second terminal-SC (i.e., the hash value HV3, "Group3" and the public key TPK3) match. Due to the above reasons, the printer 10 determines that the authentication of DRes is successful.

[0174] Next, at T1044, the printer 10 generates a connection key CK4 according to ECDH using the obtained public key TPK3 of the terminal 200 and the stored private key psk5 of the printer 10. Therefore, the printer 10 and the terminal 200 establish a WFD connection using the connection key CK4 at T1050.

[0175] (Table summarizing various situations in this embodiment; Fig.16 )

[0176] Will refer to Fig.16 Description by Figure 7 The Auth processing of the printer 10 in the example is implemented. Fig.16 The capabilities of the printer 10 are determined as shown in the corresponding cases of lines 1 to 8.

[0177] The cases of row numbers 1 to 4 indicate the cases in which an AP connection is established between one terminal (ie, “originator terminal”) that has captured the QR code of the printer 10 in the BS process and one AP (eg, AP 6 ).

[0178] The case of row number 1 indicates that an AP connection is not established between the printer 10 and any AP (for example, AP 6) and the selection screen 10 (see FIG. 1 ) is displayed in the printer 10. Figure 3 In T102 of FIG. 103 , the "AP communication" button is selected. This situation corresponds to Figures 2 to 6 That is, the printer 10 establishes an AP connection with the AP 6 when the AP connection is established between the initiator terminal and the AP 6. In this case, the printer 10 determines that the AReq includes the MAC address "mac_ap" ( Figure 7 The printer 10 determines the capability of the printer 10 as "registrant" (S16). In the present case, the printer 10 can receive the CO from the initiator terminal and participate as a slave station in the wireless network in which the initiator terminal is currently participating.

[0179] The case of row number 2 indicates a case where an AP connection is not established between the printer 10 and any AP and the "WFD communication" button is selected in the selection screen. This case corresponds to a case where a WFD connection is established between the printer 10 and the initiator terminal. In this case, the printer 10 determines that AReq includes the MAC address "mac_wfd" ( Figure 7 Since the AP connection is not established between the printer 10 and any AP, the printer 10 enters the CL state (S20 No). As a result, the printer 10 determines the capability of the printer 10 as "registrant" (S26). In the present case, in response to selecting the "WFD communication" button, the printer 10 can perform communication with the initiator terminal according to the WFD scheme.

[0180] The case of row number 3 represents a case in which an AP connection is established between the printer 10 and the AP 6 and the "AP communication" button is selected in the selection screen. This case corresponds to Fig.10 and 11 That is, it corresponds to the case B in which the printer 10 changes from the state of being connected to the AP 6 to the state of being connected to the AP 8 in the case where the AP connection is established between the initiator terminal and the AP 8. In this case, the printer 10 determines the capability of the printer 10 as "registrant" ( Fig.10 T711a to T711d and Figure 7 S16).

[0181] The case of row number 4 indicates a case where an AP connection is established between the printer 10 and one AP and the "WFD communication" button is selected in the selection screen. This case corresponds to a case where a WFD connection is established between the printer 10 and the initiator terminal although an AP connection is established between the initiator terminal and one of the APs. In this case, the printer 10 determines that AReq includes the MAC address "mac_wfd" ( Figure 7Since the AP connection is established between the printer 10 and one of the APs, the printer 10 enters the G / O state (S20 Yes). As a result, the printer 10 determines the capability of the printer 10 as "configurator" (S24). In the present case, the printer 10 can perform communication via the AP, but from a security point of view, it can perform communication with the initiator terminal according to the WFD scheme.

[0182] Furthermore, the cases of row numbers 5 to 8 represent the cases in which no AP connection is established between the initiator terminal and any AP (eg, AP 6).

[0183] The case of line number 5 is similar to the case of line number 1, except that an AP connection is not established between the initiator terminal and any AP. In this case, the printer 10 establishes an AP connection with the AP 6 in a situation where an AP connection is not established between the initiator terminal and the AP 6. For example, after the AP connection has been established between the printer 10 and the AP 6, by the initiator terminal capturing a QR code attached to the AP 6, an AP connection is also established between the initiator terminal and the AP 6. In this case, the printer 10 determines the capability of the printer 10 as "registrant" ( Figure 7 In the current situation, both the printer 10 and the initiator terminal can participate in the wireless network formed by the AP.

[0184] The case of line number 6 is similar to the case of line number 2, except that no AP connection is established between the initiator terminal and any AP. In this case, the printer 10 determines the capability of the printer 10 as "registrant" ( Figure 7 In the present case, in the case where neither the printer 10 nor the initiator terminal establishes a Wi-Fi connection with any AP, the printer 10 may perform communication with the initiator terminal according to the WFD scheme.

[0185] The case of line number 7 is similar to the case of line number 3, except that no AP connection is established between the initiator terminal and any AP. This case corresponds to Figure 8 and 9 That is, in the case where the AP connection is not established between the initiator terminal and any AP but the AP connection is established between the printer 10 and the AP 6, the initiator terminal establishes the AP connection with the AP 6. In this case, the printer 10 determines the capability of the printer 10 as "configurator" ( Figure 8 T511a to T511d and Figure 7 In the current case, the printer 10 may send the CO to the initiator terminal and cause the initiator terminal to participate as a slave station in the wireless network in which the printer 10 is currently participating.

[0186] The case of line number 8 is similar to the case of line number 4, except that no AP connection is established between the initiator terminal and any AP. This case corresponds to Figures 12 to 15 That is, although an AP connection is established between the printer 10 and one of the APs, the printer 10 establishes a WFD connection with the initiator terminal. In this case, the printer 10 determines the capability of the printer 10 as "configurator" ( Fig.13 The T911a and T911c and Figure 7 In the present case, the printer 10 may perform communication via the AP, however, from the viewpoint of security, it may perform communication with the initiator terminal in accordance with the WFD scheme.

[0187] (Effects of this embodiment)

[0188] According to the configuration of the present embodiment, the printer 10 determines whether the AP information 44 is stored in the memory 34, that is, whether an AP connection has been established between the printer 10 and any access point ( Figure 7 In the case where the AP connection has been established between the printer 10 and the AP 6 (S10 is), the printer 10 plays the role of the configurator (S14) and sends the first terminal-CO to the terminal 200 ( Fig. 9 T610 and Fig.16 As a result, an AP connection can be established between the terminal 200 and the AP 6 (T640). In addition, in the case where an AP connection has not been established between the printer 10 and any access point (S10 No), the printer 10 plays the role of a registrant (S16) and receives the first printer-CO ( Figure 5 T310 and Fig.16 As a result, an AP connection can be established between the printer 10 and the AP 6. Therefore, the printer 10 can play an appropriate role by determining the status of the printer 10 itself.

[0189] Furthermore, in the case where an AP connection has been established between the printer 10 and any access point, the printer 10 determines whether AReq includes an indication of the capability to be an initiator terminal and can only operate as a registrant ( Figure 7 In the case where it is determined that AReq includes such a value ( Figure 7 S12 is), the printer 10 plays the role of the configurator (S14 and Fig.16 On the other hand, in the case where it is determined that AReq does not include the value ( Figure 7 S12 No), the printer 10 plays the role of the registrant (S16 and Fig.16According to this configuration, the printer 10 can play an appropriate role by determining both the status of the printer 10 itself and the status of the initiator terminal.

[0190] (Corresponding relationship)

[0191] The printer 10, the display unit 14, and the Wi-Fi I / F 16 are examples of a “first communication device,” a “display unit,” and a “wireless interface,” respectively. The AP-QR code and the WFD-QR code are examples of “output information.” An initiator terminal (such as the terminal 100) is an example of a “second communication device.” AReq (i.e., a DPP authentication request) is an example of an “authentication request.” ARes (i.e., a DPP authentication response) is an example of a “first authentication response (and a second authentication response).” The capability “configurator” and the capability “registrant” are examples of “first role information” and “second role information,” respectively. Fig. 9 The first terminal-CO in T610 is an example of “first wireless setting information”. Figure 5 The first printer-CO in T310 is an example of the "second wireless setting information". AP 6 is an example of the "first access point". Fig.16 In the case where the row number is 1, AP 6 is an example of a "second access point". Fig.16 In the case of row number 3 in FIG. 8 , AP 8 is an example of a “second access point”. Figure 8 In AReq in T510 of FIG. 4 , the value that is an indication of the capability of the terminal 200 that can be operated only as a registrant is an example of “predetermined information”. The MAC address “mac_ap” and the MAC address “mac_wfd” are examples of “first use information” and “second use information”, respectively. The AP information 44 is an example of “access point information”.

[0192] Figure 3 The T106 is an example of an "output control unit". Figure 7 S2, S10, S32, and S42 are examples of an “authentication request receiving unit,” a “first determination unit,” a “first authentication response sending unit,” and a “second authentication response sending unit,” respectively. Figure 5 T310 and Figure 6 The T420 are examples of a “wireless setting receiving unit” and a “first establishing unit”, respectively. Fig. 9 The T610 is an example of a "wireless settings sending unit".

[0193] (Variant 1) The printer 10 may cause the print execution unit 18 to print a QR code instead of Figure 3 The QR code is displayed in T106 of . In this modification, the process of causing the print execution unit 18 to print the QR code is an example of the “output control process”.

[0194] (Variant 2) Each of the printer 10 and the terminal 100 may further include a wireless interface (e.g., BT (abbreviation of Bluetooth (registered trademark, Bluetooth SIG, Inc)) I / F or NFC (abbreviation of Near Field Communication) I / F) conforming to a wireless scheme different from the Wi-Fi scheme (e.g., BT scheme or NFC scheme). In this case, for example, Figure 3 In T106 of the embodiment, the printer 10 may instruct the BT I / F of the printer 10 to send DPP information including the public key PPK1 and the MAC address "mac_ap". In this case, the terminal 100 may receive the DPP information via the BT I / F of the terminal 100. In this variation, instructing the BT I / F to send the DPP information is an example of "output control processing". In addition, in another variation, Figure 3 In T106 of the printer 10, the printer 10 may cause the NFC I / F of the printer 10 to store the DPP information. In this case, the terminal 100 may receive the DPP information via the NFC I / F of the terminal 100. In this modification, causing the NFC I / F to store the DPP information is an example of the "output control process".

[0195] (Variant 3) The printer 10 may perform wireless communication in accordance with a scheme included in the Wi-Fi scheme (eg, Wi-Fi Protected Setup (WPS) scheme) instead of the DPP scheme using a wireless profile (ie, a service set identifier (SSID) and a password). Figure 2 In this case, in the Config process, the printer 10 may send the first terminal-CO including the wireless profile stored in the printer 10 to the terminal 200 instead of the first terminal-SC according to another scheme. Therefore, the terminal 200 may establish the AP connection with the AP 6 using the received wireless profile. In this variation, the wireless profile is an example of the “first wireless setting information”. In addition, in the variation, Figure 7 In S4, the printer 10 may determine whether a wireless profile is stored as the AP information 44. In this variation, the wireless profile is an example of "access point information".

[0196] (Variant 4) The terminal 200 may perform the process in case B according to a scheme included in the Wi-Fi scheme (e.g., Wi-Fi Protected Setup (WPS) scheme) instead of the DPP scheme to establish an AP connection with the AP 8. In this case, the printer 10 may receive the first terminal-CO including the wireless profile stored in the terminal 200 from the terminal 200 according to another scheme instead of the first terminal-SC. In this variation, the wireless profile is an example of the “second wireless setting information”.

[0197] (Variant 5) The Wi-Fi I / F 116 may support the SoftAP scheme established by the Wi-Fi Alliance instead of the WFD scheme. In this case, Figure 3 The selection screen in T102 of may include a “SoftAP communication” button instead of the “WFD communication” button. Here, the AP-QR code displayed when the “AP communication” button in the selection screen is selected is obtained by encoding the public key PPK1 and the first information indicating the use of communication via the AP. On the other hand, the SoftAP-QR code for SoftAP communication displayed when the “SoftAP communication” button in the selection screen is selected is obtained by encoding the public key PPK1 and the second information indicating the use of communication according to the SoftAP scheme without the intervention of the AP. Furthermore, in this variation, the printer 10 may determine whether AReq includes the first information in the Auth process instead of Figure 7 In the case where it is determined that AReq includes the first information, the printer 10 may proceed to S10 and establish an AP connection with an AP (such as AP 6). In addition, in the case where it is determined that AReq includes the second information, the printer 10 may determine the capability of the printer 10 as one of the “configurator” and the “registrant” and establish a Wi-Fi connection with the initiator terminal according to the SoftAP scheme. In this variation, the first information and the second information are examples of “first usage information” and “second usage information”, respectively.

[0198] (Variant 6) can be skipped Figure 7 That is, the program 40 may not include instructions corresponding to the processing of S12. In this variation, Fig.16 In the case where the row number in the table of is 3, the printer 10 may determine the capability of the printer 10 as "configurator". Then, in the case where the AP connection is established between the initiator terminal and the AP 8, the printer 10 may generate a first terminal-CO related to the AP 6 and send the first terminal-CO to the initiator terminal. Then, the initiator terminal may transition from a state of being connected to the AP 8 to a state of being connected to the AP 6. In this variation, the "second determination unit" and the "predetermined information" may be omitted.

[0199] (Variant 7) Figure 7 In the case where the printer determines that yes in S2, the printer 10 proceeds to S10 without performing the processing of S4. That is, a WFD connection may not be established between the printer 10 and the initiator terminal. In this variation, the processing load on the printer 10 may be reduced. In this variation, the "second establishment unit", "first use information", "second use information" and "third wireless connection" may be omitted.

[0200] (Variant 8) For example, in a case where it is uncertain whether the AP information 44 is stored in the memory 34 ( Figure 7 In S10 of FIG. 1 , the printer 10 may attempt to send a confirmation signal to the AP and determine whether a response signal to the confirmation signal is received. In the case where it is determined that a response signal is received, the printer 10 may proceed to S12, and in the case where it is determined that a response signal is not received, the printer 10 may proceed to S16. In this variation, the “access point information” may be omitted.

[0201] (Variant 9) The "first communication device" may not be the printer 10, but may be replaced by another device such as a scanner, a multifunction device, a portable terminal, a PC, and a server. In addition, the "second communication device" may not be the terminal 100 or 200, but may be another device such as a printer, a scanner, a multifunction device, and a camera.

[0202] (Variant 10) It can be realized by hardware such as a logic circuit Figures 2 to 15 One or more processes are implemented by software instead of as described in the above embodiments.

Claims

1. A first communication device, characterized in that: include: a wireless interface configured to perform wireless communications in accordance with the Wi-Fi standard; an output control unit configured to perform an output control process of outputting output information to the outside, the output information being obtained in accordance with the Wi-Fi standard and using a public key of the first communication device; an authentication request receiving unit configured to receive, via the wireless interface, an authentication request using the public key from a second communication device that has obtained the public key; a first determining unit, the first determining unit being configured to determine whether a wireless connection has been established between the first communication device and any one of the access points; a first authentication response sending unit, configured to send a first authentication response to the second communication device via the wireless interface when it is determined that a wireless connection has been established between the first communication device and the first access point, the first authentication response including first role information indicating that the first communication device will play a first role, the first role being a role for sending first wireless setting information to the second communication device, the first wireless setting information being used to establish a first wireless connection between the second communication device and the first access point; a wireless setting sending unit configured to send the first wireless setting information to the second communication device via the wireless interface after the first authentication response has been sent to the second communication device; a second authentication response sending unit, the second authentication response sending unit being configured to send a second authentication response to the second communication device via the wireless interface when it is determined that a wireless connection has not been established between the first communication device and any of the access points, the second authentication response comprising second role information indicating that the first communication device will play a second role, the second role being different from the first role and being a role for receiving second wireless setting information from the second communication device, the second wireless setting information being used for establishing a second wireless connection between the first communication device and a second access point; a wireless setting receiving unit configured to receive the second wireless setting information from the second communication device via the wireless interface after the second authentication response has been sent to the second communication device; and A first establishing unit is configured to establish the second wireless connection with the second access point via the wireless interface using the second wireless setting information.

2. The first communication device according to claim 1, characterized in that in, After having received the authentication request from the second communication device, the first determination unit determines whether a wireless connection has been established between the first communication device and any one of the access points.

3. The first communication device according to claim 1, characterized in that Also includes: a second determining unit configured to, in a case where the authentication request has been received from the second communication device, determine whether the authentication request includes predetermined information indicating that the second communication device will play the second role, Wherein, when it is determined that the wireless connection is established between the first communication device and the first access point and the authentication request includes the predetermined information, the first authentication response sending unit sends the first authentication response including the first role information to the second communication device via the wireless interface, and When it is determined that the wireless connection is established between the first communication device and the first access point and the authentication request does not include the predetermined information, the second authentication response sending unit sends the second authentication response including the second role information to the second communication device via the wireless interface.

4. The first communication device according to claim 1, characterized in that: in The authentication request includes first usage information related to usage of communications via the access point or second usage information related to usage of communications without intervention of the access point, In a case where the authentication request includes the first usage information, the first determination unit determines whether a wireless connection has been established between the first communication device and any one of the access points, and The first communication device further includes: A second establishing unit is configured to establish a third wireless connection with the second communication device via the wireless interface when the authentication request includes the second usage information, wherein the third wireless connection is established without any intervention of an access point.

5. The first communication device according to claim 4, characterized in that: in, The third wireless connection is a wireless connection according to the Wi-Fi Direct scheme of the Wi-Fi standard.

6. The first communication device according to claim 5, characterized in that in In a case where the first communication device is in a group owner state according to the Wi-Fi Direct scheme, the first communication device plays the first role, and In a case where the first communication device is in a client state according to the Wi-Fi Direct scheme, the first communication device plays the second role.

7. The first communication device according to claim 1, characterized in that: in, The output information is information of a device configuration protocol scheme according to the Wi-Fi standard.

8. The first communication device according to claim 1, characterized in that: in, The first determining unit determines that the wireless connection has been established between the first communication device and the first access point when access point information has been stored in a memory, the access point information being related to the first access point with which the wireless connection has been established.

9. The first communication device according to claim 8, characterized in that: in, The access point information includes a signature connector according to a device configuration protocol scheme of the Wi-Fi standard.

10. The first communication device according to claim 1, characterized in that: in The output information is a code image obtained by encoding the public key, and The output control process is a process of causing a display unit to display the output information as the code image.

11. A computer program product for a first communication device, comprising a computer program, characterized in that: in The first communication device comprises Processor; and a wireless interface configured to perform wireless communications in accordance with the Wi-Fi standard, wherein the computer program causes the processor to: an output control unit configured to perform an output control process of outputting output information to the outside, the output information being obtained in accordance with the Wi-Fi standard and using a public key of the first communication device; an authentication request receiving unit configured to receive, via the wireless interface, an authentication request using the public key from a second communication device that has obtained the public key; a first determining unit, the first determining unit being configured to determine whether a wireless connection has been established between the first communication device and any one of the access points; a first authentication response sending unit, the first authentication response sending unit being configured to send a first authentication response to the second communication device via the wireless interface when it is determined that a wireless connection has been established between the first communication device and the first access point, the first authentication response comprising first role information, the first role information indicating that the first communication device will play a first role, the first role being a role for sending first wireless setting information to the second communication device, the first wireless setting information being used to establish a first wireless connection between the second communication device and the first access point; a wireless setting sending unit configured to send the first wireless setting information to the second communication device via the wireless interface after the first authentication response has been sent to the second communication device; a second authentication response sending unit, the second authentication response sending unit being configured to send a second authentication response to the second communication device via the wireless interface when it is determined that a wireless connection has not been established between the first communication device and any of the access points, the second authentication response comprising second role information indicating that the first communication device will play a second role, the second role being different from the first role and being a role for receiving second wireless setting information from the second communication device, the second wireless setting information being used for establishing a second wireless connection between the first communication device and a second access point; a wireless setting receiving unit configured to receive the second wireless setting information from the second communication device via the wireless interface after the second authentication response has been sent to the second communication device; and A first establishing unit is configured to establish the second wireless connection with the second access point via the wireless interface using the second wireless setting information.

Images