Communication device, control method, and program

Abstract

To provide a communication device that prevents discrepancies in authentication levels between a connection side that does not involve an access point and a connection side that does involve an access point.SOLUTION: The communication device includes control means for executing a predetermined process to prevent at least some communication between the communication device and an information processing device that does not involve an access point on the basis of the fact that an authentication method used for the connection between the communication device and the access point is a predetermined authentication method.SELECTED DRAWING: Figure 14

Description

Technical Field

[0001] The present invention relates to a communication device, a control method, and a program capable of communicating with an external device that requires authentication.

Background Art

[0002] In recent years, in printing devices such as multifunction printers and printers, those equipped with a wireless LAN function have been increasing. Such a printing device can perform wireless LAN communication with an information processing device such as a mobile phone or a personal computer operated by a user, and can print the received print data. Between the printing device and the information processing device, an infrastructure connection (Infra connection) that communicates via a wireless LAN access point or a wireless direct connection (Direct connection) that performs direct wireless LAN communication without passing through a relay device such as an access point is used. connection. Also, depending on the printing device, it is possible to execute the infra connection and the direct connection simultaneously as in Patent Document 1.

[0003] These information processing devices, printing devices, and access points can be interconnected by operating according to the standard specifications of IEEE802.11, and only devices permitted by the authentication process within the wireless connection procedure can be connected.

[0004] Wireless LAN authentication methods include a PSK method using a pre-shared key (Pre Shared Key) and a SAE method using SAE (Simultaneous Authentication of Equals). Furthermore, as an authentication method compatible with both wireless LAN and wired LAN, there is an EAP method for authenticating a communication device connected to a network using an IEEE802.1X / EAP-compatible authentication server.

[0005] In addition to the authentication process during the wireless connection procedure described above, authentication processing is also performed between the information processing device and the printing device during communication after the wireless connection is established. Patent Document 2 describes how performing authentication processing before the printing process ensures that only authorized printing processes are executed, and that it is possible to switch whether or not to perform authentication processing through user settings. In this way, unauthorized printing is prevented not only through authentication processing during the wireless connection but also through application-level authentication processing during the printing process. [Prior art documents] [Patent Documents]

[0006] [Patent Document 1] Japanese Patent Publication No. 2017-87506 [Patent Document 2] Japanese Patent Publication No. 2017-7112 [Overview of the project] [Problems that the invention aims to solve]

[0007] If a communication device can simultaneously perform connections via an access point and connections without an access point, and the connection via the access point operates using an authentication method that requires an authentication server, there is a possibility that a difference in authentication levels may occur between the two connection sides.

[0008] The present invention aims to provide a communication device, control method, and program that prevent discrepancies in authentication levels between a connection side that does not use an access point and a connection side that uses an access point. [Means for solving the problem]

[0009] To solve the above problems, the communication device according to the present invention is a communication device capable of communicating with an information processing device and an access point, and is characterized by having establishment means for establishing a connection between the access point and the communication device, and control means for performing a predetermined process to prevent at least a portion of the communication between the communication device and the information processing device from occurring via the access point, based on the authentication method used for the connection between the communication device and the access point being a predetermined authentication method. [Effects of the Invention]

[0010] According to the present invention, it is possible to prevent differences in authentication levels between a connection that does not go through an access point and a connection that does go through an access point. [Brief explanation of the drawing]

[0011] [Figure 1] This diagram shows the system configuration. [Figure 2] This diagram shows the external configuration of an MFP (Multi-Function Product Processor). [Figure 3] This block shows the configuration of the MFP. [Figure 4] This diagram schematically shows the configuration of the operation display unit of the MFP. [Figure 5] This diagram shows the external configuration of an information processing device. [Figure 6] This is a diagram showing the configuration of an information processing device. [Figure 7] This block diagram shows the configuration of an access point. [Figure 8] This diagram shows the configuration of the authentication server. [Figure 9] This flowchart outlines the process of connecting an MFP (Multi-Function File Provider) to a network composed of access points. [Figure 10] This is a diagram illustrating the network between devices. [Figure 11] This diagram illustrates the screen transitions in the MFP's operation display unit. [Figure 12]This is a diagram for explaining screen transitions in an information processing apparatus. [Figure 13] This is a flowchart showing the process of connecting an MFP to a network composed of access points. [Figure 14] This is a flowchart showing the process when a request to enable the wireless direct mode is received. [Figure 15] This is a flowchart showing the process when a request to enable the wireless infrastructure mode is received. [Figure 16] This is a flowchart showing the process of connecting an MFP to a network composed of access points. [Figure 17] This is a flowchart showing the process when a request to enable the wireless direct mode is received. [Figure 18] This is a flowchart showing the process when a request to enable the wireless infrastructure mode is received. [Figure 19] This is a flowchart showing the process in the MFP. [Figure 20] This is a flowchart showing the process in the MFP. [Figure 21] This is a flowchart showing the process in the MFP. [Embodiments of the Invention]

[0012] Hereinafter, embodiments will be described in detail with reference to the accompanying drawings. Note that the following embodiments do not limit the invention according to the claims. Although a plurality of features are described in the embodiments, not all of these plurality of features are essential for the invention, and the plurality of features may be arbitrarily combined. Further, in the accompanying drawings, the same or similar configurations are given the same reference numerals, and duplicate descriptions are omitted.

[0013] [First Embodiment] Figure 1 shows an example of the system configuration in this embodiment. This communication system 100 is a communication system in which multiple communication devices can communicate wirelessly with each other. As shown in Figure 1, the communication system 100 includes an information processing device 200, an MFP (Multi Function Peripheral) 300, an access point (AP) 400, and an authentication server 500 as communication devices. In the communication system 100, the information processing device 200 and the MFP 300 can perform processing corresponding to printing services using, for example, wireless LAN communication.

[0014] The information processing device 200 is an information processing device that has communication functions such as wireless LAN or wired LAN. Wireless LAN is sometimes referred to as WLAN (Wireless LAN). Examples of information processing devices 200 include smartphones, notebook PCs, tablet devices, and PDAs (Personal Digital Assistants).

[0015] The MFP300 is an example of a printing device with printing capabilities. The MFP300 may also have reading capabilities (scanner), fax capabilities, and telephone capabilities. Furthermore, the MFP300 has communication capabilities that enable wireless communication with the information processing device 200. In this embodiment, the MFP300 is described, but devices of a different form than the MFP300 may be used. For example, a facsimile machine, scanner, projector, mobile terminal, smartphone, notebook PC, tablet terminal, PDA, digital camera, music playback device, television, smart speaker, AR glasses, etc., which have communication capabilities may be used.

[0016] Access point 400 is a communication device that is installed separately (externally) from the information processing device 200 and MFP300 and operates as a base station device for the WLAN. Access point 400 may also be referred to as the external access point 400 or the external wireless base station. Communication devices with WLAN communication capabilities can communicate in WLAN infrastructure mode via access point 400. Wireless infrastructure mode may also be referred to as "wireless infrastructure mode." In other words, wireless infrastructure mode is a mode in which a communication device communicates with the information processing device 200 via the access point 400 to which it is connected. Access point 400 communicates with communication devices that it has authorized to connect to (authenticated) and relays wireless communication between those communication devices and other communication devices. Furthermore, access point 400 is connected to a wired LAN communication network and relays communication between communication devices connected to that network and other communication devices wirelessly connected to access point 400. Furthermore, if the network configured by access point 400 uses an authentication server (i.e., access point 400 supports authentication methods that use an authentication server), it will work in conjunction with the authentication server 500 to authenticate communication devices connected to the network and control access to them. Communication devices connected to the network configured by access point 400 will be restricted from communicating with devices other than the authentication server 500 until they are authenticated. Note that access point 400 may also support authentication methods that do not use an authentication server. Details on authentication methods that use an authentication server and authentication methods that do not use an authentication server will be described later.

[0017] The authentication server 500 is a communication device that is installed separately (externally) from the information processing device 200, MFP 300, and access point 400, and operates as an authentication server that centrally manages authentication information. The authentication server 500 works in cooperation with the access point 400 to authenticate terminals to be authenticated and controls terminal access based on the authentication results. The authentication server 500 is configured to perform authentication processing compliant with, for example, the IEEE 802.1X standard.

[0018] Access point 400 supports authenticators in IEEE 802.1X. Information processing unit 200 and MFP300 support supplicants in IEEE 802.1X. The authentication server is sometimes referred to as the "Radius server."

[0019] Authentication server 500 performs authentication according to the IEEE 802.1X standard, for example, using the EAP-TLS, EAP-TTLS, and PEAP methods. EAP-TLS (EAP-Transport Layer Security) is an authentication method that utilizes the TLS handshake protocol and performs authentication using server certificates and client certificates. EAP-TTLS (EAP-Tunneled TLS) is an authentication method that utilizes the TLS handshake protocol and performs authentication using server certificates, usernames, and passwords. PEAP (Protected EAP) performs authentication using usernames and passwords. The information used for these IEEE 802.1X authentication methods is sometimes collectively referred to as "authentication information."

[0020] The information processing device 200 and the MFP300 can perform wireless communication using their respective WLAN communication functions, either via the external access point 400 in wireless infrastructure mode or via peer-to-peer mode without the external access point 400. The peer-to-peer mode is sometimes referred to as "P2P mode," or as "wireless direct mode" in contrast to wireless infrastructure mode. In other words, P2P mode is a mode for communication devices to communicate directly with the information processing device 200 without going through the access point 400. P2P mode includes Wi-Fi Direct® mode and software access point (soft AP) mode, among others. Wi-Fi Direct® is sometimes referred to as WFD. Therefore, wireless direct mode can also be considered a communication mode compliant with the IEEE 802.11 series.

[0021] Figure 2 shows an example of the external configuration of the MFP300. The power button 301 is a hard key that allows the user to turn the power on and off. The operation display unit 302 includes a display and buttons used by the user when operating the MFP300. The operation display unit 302 includes keys such as character input keys, cursor keys, select keys, and cancel keys, as well as LEDs (Light Emitting Diodes) and LCDs (Liquid Crystal Displays). The operation display unit 302 is configured to accept user input when activating individual functions of the MFP300, changing various settings, etc. The operation display unit 302 may also include a touch panel display.

[0022] The paper insertion slot 303 is an insertion slot that can accommodate paper of various sizes. Paper placed in the paper insertion slot 303 is transported to the printing unit one sheet at a time, printed as desired, and then ejected from the paper output slot 304. The document tray 305 is a transparent glass-like tray used when scanning a document. The document cover 306 is a cover that presses the document against the document tray to prevent it from lifting during scanning, and also prevents external light from entering the scanner unit.

[0023] The MFP300 has communication capabilities via WLAN and wired LAN, and includes a wireless communication unit 307 and a wired communication unit 321, which include antennas for wireless communication. Note that the wireless communication unit 307 and the wired communication unit 321 do not necessarily have to be configured to be visible from the outside. The USB communication unit 308 includes a circuit and USB connector for the MFP300 to communicate with an external information processing device 200 or the like via USB connection. The power supply unit 309 connects to an external power supply and supplies power to the MFP300.

[0024] Figure 3 is a block diagram showing an example of the configuration of the MFP300. The MFP300 includes a main board 310 that controls the entire device, a power button 301, an operation display unit 302, a wireless communication unit 307, a wired communication unit 320, a USB communication unit 308, and a power supply unit 309.

[0025] The main board 310 is equipped with a microprocessor-type CPU 311. The CPU 311 controls the MFP 300 according to the control program stored in the ROM-type program memory 313 connected via the internal bus 312 and the contents stored in the RAM-type data memory 314. The operation of the MFP 300 described in this embodiment is realized, for example, by the CPU 311 reading and executing the program stored in the program memory 313. The CPU 311 controls the scan unit 317 to read the document and stores the read data in the image memory 315 in the data memory 314. The CPU 311 controls the print unit 316 to print the image of the read data stored in the image memory 315 in the data memory 314 onto the recording medium. The CPU 311 controls the USB communication unit 308 via the USB communication control unit 320 to perform USB communication with the external information processing device 200 via a USB connection. The CPU 311 controls the operation control unit 319 to receive operation information from the power button 301 and the operation display unit 302. The CPU 311 controls the operation control unit 319 to display, for example, the status of the MFP 300 and the function selection menu on the operation display unit 302. The CPU 311 controls the wireless communication unit 307 and the wired communication unit 320 via the communication control unit 318 according to the operation information received by the operation display unit 302. The CPU 311 also changes the communication method settings and configures network connection settings according to the operation information.

[0026] The wireless communication unit 307 is a unit capable of providing WLAN communication functionality. Specifically, the wireless communication unit 307 converts data into packets according to the WLAN standard and transmits the packets to other communication devices. The wireless communication unit 307 also restores packets from other external communication devices back to their original data and outputs it to the CPU 311. The wireless communication unit 307 is configured to perform data (packet) communication in a WLAN system compliant with, for example, the IEEE 802.11 standard series (IEEE 802.11a / b / g / n / ac / ax, etc.). However, it is not limited to this configuration, and the wireless communication unit 307 may be capable of performing communication in WLAN systems compliant with other standards. In this embodiment, the wireless communication unit 307 is capable of communicating in both the 2.4GHz and 5GHz frequency bands. Furthermore, the wireless communication unit 307 is capable of performing communication in WFD mode, soft AP mode, wireless infrastructure mode, etc. Furthermore, the information processing device 200 and the MFP 300 are capable of wireless communication based on WFD mode, and the wireless communication unit 307 has a soft AP function or a group owner function. In other words, the wireless communication unit 307 can build a communication network in P2P mode and determine the channel to be used for communication in P2P mode.

[0027] The wired communication unit 321 is a unit for performing wired communication. The wired communication unit 321 can perform data (packet) communication in a wired LAN (Ethernet) system compliant with, for example, the IEEE 802.3 series. Furthermore, wired communication using the wired communication unit 321 is possible in wired communication mode. The wired communication unit 321 is connected to the main board 310 via a bus cable or the like.

[0028] Figure 4 is a schematic diagram showing an example of the configuration of the operation display unit 302 of the MFP300. Figure 4(a) shows an example where the operation display unit 302 is configured with a touch panel display 331. Power is turned on to the MFP300 when the user presses the power button 301. When power is turned on to the MFP300, the touch panel display 331 displays the home screen, which is the highest level of the menu that the user can operate. The home screen includes a copy area 335 for receiving instructions to execute copy processing, a scan area 336 for receiving instructions to execute scan processing, and a print area 337 for receiving instructions to execute print processing. The home screen also includes a status display area 332 that shows the settings for connection via wireless infrastructure mode and wireless direct mode of the MFP300, as well as the connection status. The home screen also includes a connection setting mode area 333 that allows the user to start the connection setting mode at any time, and a setting area 334 that allows the user to change various settings.

[0029] Figure 4(b) shows an example of an operation display unit 302 configured with a relatively small LCD display 341 and various hard keys 344-351. The MFP 300 is powered on when the user presses the power button 301. Once powered on, the LCD display 341 displays the home screen, the highest level of the user-operable menu. The user can operate the cursor displayed on the LCD display 341 by pressing the cursor movement buttons 346 and 347. The user presses the OK button 349 to perform an operation, and the back button 348 to return to the previous menu screen. Furthermore, when the user presses the QR button 344, a QR code containing information necessary for direct connection to the MFP 300 is displayed. When the displayed QR code (registered trademark) is read by the information processing device 200, a direct connection is established between the information processing device 200 and the MFP 300, enabling wireless communication between them. Note that the displayed code is not limited to a QR code; any two-dimensional code is acceptable. Additionally, the connection setting mode can be started by pressing the connection setting mode button 345. In connection setting mode, the MFP 300 can be connected to the access point 400 by sending connection information from the information processing device 200 to the MFP 300. If the user presses the stop button 350 while the MFP 300 is performing any of the processes, the processes will be canceled. When the user presses the copy start button 351, the document placed on the document glass 305 is scanned and printing is performed.

[0030] Figure 4(c) shows an example of an operation display unit 302 configured with a relatively small LCD display 361 and various hard keys 363-370. Power is turned on to the MFP 300 when the user presses the power button 301. When power is turned on to the MFP 300, the home screen, which is the highest level of the user-operable menu, is displayed on the LCD display 361. The user can operate the items displayed on the LCD display 361 by pressing the navigation buttons 364 and 365. The user presses the OK button 367 to perform an operation, and the back button 366 to return to the previous menu screen. In addition, the connection setting mode can be started when the user presses the connection setting mode button 363. In connection setting mode, the MFP 300 can be connected to the access point 400 by sending connection information from the information processing device 200 to the MFP 300. If the user presses the stop button 368 while the MFP 300 is executing any process, the process is canceled. When the user presses the copy start button 369, the document placed on the document glass 305 is scanned and printing is performed. When the user presses the settings button 370, the user can change various settings.

[0031] Figure 5 shows an example of the external configuration of the information processing device 200. In this embodiment, the information processing device 200 is described as a typical smartphone (mobile terminal). The information processing device 200 is composed of, for example, a display unit 202, an operation unit 203, and a power key 204. The display unit 202 is a display that includes, for example, an LCD (Liquid Crystal Display) type display mechanism. The display unit 202 may also display information using, for example, an LED (Light Emitting Diode). In addition to or instead of the display unit 202, the information processing device 200 may also have a speaker function that outputs information by sound. The operation unit 203 is composed of hard keys such as keys and buttons, a touch panel, etc., for detecting user operations. In this embodiment, since the information display on the display unit 202 and the reception of user operations by the operation unit 203 are performed using a common touch panel display, the display unit 202 and the operation unit 203 are realized by a single device. In this case, for example, button icons or a software keyboard are displayed using the display function of the display unit 202, and the operation reception function of the operation unit 203 detects when the user touches these areas. The display unit 202 and the operation unit 203 may be separated, with separate hardware for display and hardware for operation reception. The power key 204 is a hard key for receiving user input to turn the power of the information processing device 200 on or off.

[0032] The information processing device 200 has a wireless communication unit 201 that provides WLAN communication functionality, as shown in Figure 6. The wireless communication unit 201 is configured to perform data (packet) communication in a WLAN system compliant with, for example, the IEEE 802.11 standard series (IEEE 802.11a / b / g / n / ac / ax, etc.). However, it is not limited to this, and the wireless communication unit 201 may be able to perform communication in a WLAN system compliant with other standards. In this embodiment, the wireless communication unit 201 is capable of communicating in both the 2.4GHz and 5GHz frequency bands. Furthermore, the wireless communication unit 201 is capable of performing communication in WFD mode, soft AP mode, wireless infrastructure mode, etc.

[0033] Figure 6 shows an example of the configuration of the information processing device 200. The information processing device 200 includes a main board 211 that controls the entire device, a wireless communication unit 201 that performs WLAN communication, a display unit 202, an operation unit 203, and a short-range wireless communication unit 205 that performs wireless communication different from that of the wireless communication unit 201. The main board 211 includes, for example, a CPU 212, ROM 213, RAM 214, image memory 215, data conversion unit 216, telephone unit 217, GPS 219, camera unit 221, non-volatile memory 222, data storage unit 223, speaker unit 224, and power supply unit 225. GPS is an abbreviation for Global Positioning System. Each functional unit within the main board 211 is interconnected via a system bus 228. In addition, the main board 211 and the wireless communication unit 201, and the main board 211 and the short-range wireless communication unit 205 are connected, for example, via a dedicated bus. Furthermore, the main board 211 and the display unit 202, and the main board 211 and the operation unit 203 are connected, for example, via a dedicated bus.

[0034] The CPU 212 is the system control unit and controls the entire information processing device 200. The operation of the information processing device 200 described in this embodiment is realized, for example, by the CPU 212 reading and executing a program stored in the ROM 213. Dedicated hardware may be provided for each process. The ROM 213 stores control programs and embedded operating system (OS) programs executed by the CPU 212. Software control such as scheduling and task switching is performed by the CPU 212 executing each control program stored in the ROM 213 under the management of the embedded OS stored in the ROM 213. The RAM 214 is composed of SRAM (Static RAM) or the like. The RAM 214 stores data such as program control variables, user-registered settings, and management data for the information processing device 200. The RAM 214 may also be used as a buffer for various work. The image memory 215 is composed of memory such as DRAM (Dynamic RAM). The image memory 215 temporarily stores image data received via the wireless communication unit 201 and image data read from the data storage unit 223 for processing by the CPU 212. The non-volatile memory 222 is composed of memory such as flash memory and continues to store data even when the power to the information processing device 200 is turned off. Note that the memory configuration of the information processing device 200 is not limited to the above configuration. For example, the image memory 215 and RAM 214 may be shared, or data backup may be performed using the data storage unit 223. In this embodiment, DRAM is given as an example of image memory 215, but other storage media such as hard disks or non-volatile memory may be used.

[0035] The data conversion unit 216 performs data analysis of various data formats and data conversions such as color conversion and image conversion. The telephone unit 217 controls the telephone line and processes voice data input and output via the speaker unit 224, which includes a microphone and speaker, to realize telephone communication. The GPS 219 receives radio waves transmitted from satellites and acquires positional information such as the current latitude and longitude of the information processing device 200. The camera unit 221 has the function of electronically recording and encoding images input through the lens. Image data obtained by imaging by the camera unit 221 is stored in the data storage unit 223. The speaker unit 224 has the function of inputting or outputting voice for telephone functions and controls other functions such as alarm notifications. The power supply unit 225 is, for example, a portable battery and controls the power supply to the device. The power state of the information processing device 200 can be, for example, a battery-dead state where there is no remaining battery power, a power-off state where the power key 204 is not pressed, a power-on state (startup state) where the power key 204 is pressed, or a power-saving state where it is running but power consumption of individual elements is suppressed. The display unit 202 electronically controls the display content and performs control to display various input contents, the operating status of the MFP300, status status, etc. The operation unit 203 receives user operation and performs control such as generating an electrical signal corresponding to that operation and outputting it to the CPU 212.

[0036] The information processing device 200 performs wireless communication using the wireless communication unit 201 and communicates data with other communication devices such as the MFP 300. The wireless communication unit 201 converts data into packets and transmits the packets to other communication devices. The wireless communication unit 201 also restores packets from other external communication devices to their original data and outputs it to the CPU 212. The wireless communication unit 201 is a unit for realizing communication compliant with standards such as WLAN. The short-range wireless communication unit 205 communicates using a different communication method than the wireless communication unit 201, for example, Bluetooth (registered trademark). The configuration of the main board 211 is not limited to the above. For example, the individual functions of the main board 211 realized by the CPU 212 may be realized by processing circuits such as ASICs (Application-Specific Integrated Circuits), and may be realized by either hardware or software.

[0037] Figure 7 is a block diagram showing an example configuration of an access point 400 having wireless LAN access point functionality. The access point 400 includes a main board 410 that controls the access point 400, a wireless communication unit 420, a wired communication unit 421, and operation buttons 422. These are connected to each other via an internal bus 419 so that they can communicate with one another.

[0038] The main board 410 is equipped with a microprocessor-type CPU 411. The CPU 411 operates according to the control program stored in the ROM-type program memory 412, which is connected via the internal bus 418, and the contents stored in the RAM-type data memory 413. In this embodiment, the operation of the access point 400 is realized, for example, by the CPU 411 reading and executing the program stored in the program memory 412. The CPU 411 performs wireless LAN communication with other communication devices by controlling the wireless communication unit 420 via the wireless communication control unit 414. The CPU 411 also performs wired LAN communication with other communication devices by controlling the wired communication unit 421 via the wired communication control unit 415. The CPU 411 accepts user operations via the operation button 422 via the operation control circuit 416.

[0039] The access point 400 includes a terminal access control unit 417. The terminal access control unit 417 protects the network by authenticating communication devices connected to the network. The terminal access control unit 417 authenticates communication devices connected to the network using various methods. These methods include, for example, the PSK method using a pre-shared key, the SAE method using SAE (Simultaneous Authentication of Equals), and the EAP method using an IEEE 802.1X / EAP-compliant authentication server 500. The communication channel authenticated in this way can be changed or switched by the channel change unit 418. In this embodiment, authentication methods that do not use an authentication server are the PSK method and the SAE method, and authentication methods that use an authentication server are the EAP method. Furthermore, authentication methods that do not use an authentication server are also called the personal method, and authentication methods that use an authentication server are also called the enterprise method.

[0040] Figure 8 shows an example of the configuration of the authentication server 500. The authentication server 500 includes a main board 511 that controls the authentication server 500, a communication unit 501 that performs wired LAN communication, etc., a display unit 502, and an operation unit 503. The main board 511 includes a CPU 512, ROM 513, RAM 514, image memory 515, non-volatile memory 516, data storage unit 518, and communication control unit 517. Each functional unit within the main board 511 is interconnected via a system bus 519. Furthermore, the main board 511 and the communication unit 501, the main board 511 and the display unit 502, and the main board 511 and the operation unit 503 are each connected via, for example, a dedicated bus.

[0041] The CPU 512 is the system control unit and controls the entire authentication server 500. In this embodiment, the operation of the authentication server 500 is realized, for example, by the CPU 512 reading and executing a program stored in the ROM 513. Dedicated hardware may be provided for each process. The ROM 513 stores control programs and embedded operating system (OS) programs executed by the CPU 512. By the CPU 512 executing each control program stored in the ROM 513 under the management of the embedded OS stored in the ROM 513, software control such as scheduling and task switching is performed. The RAM 514 is composed of SRAM (Static RAM) or the like. The RAM 514 stores data such as program control variables, user-registered settings, and management data for the authentication server 500. The RAM 514 may also be used as a buffer for various work tasks. The image memory 515 is composed of memory such as DRAM (Dynamic RAM). The image memory 515 temporarily stores image data received via the communication unit 501 and image data read from the data storage unit 518 for processing by the CPU 512. The data storage unit 518 is composed of a storage medium such as an SSD (Solid State Drive) and continues to store data even when the authentication server 500 is powered off. In this embodiment, an SSD is given as an example of the data storage unit 518, but other storage media such as a hard disk or non-volatile memory may be used. The display unit 502 electronically controls the display content and performs control for displaying various input content and status information. The operation unit 503 receives user operations and performs control such as generating electrical signals corresponding to those operations and outputting them to the CPU 512.

[0042] The CPU 512 controls the communication control unit 517 to perform communication using the communication unit 501, and communicates data with other communication devices such as the access point 400. The communication unit 501 converts data into packets and sends the packets to other communication devices. The communication unit 501 also restores packets from other external communication devices back to their original data and outputs it to the CPU 512. The communication unit 501 is capable of data (packet) communication in a wired LAN (Ethernet) system compliant with, for example, the IEEE 802.3 series.

[0043] The following describes the communication modes in which the communication device in the communication system 100 can operate.

[0044] [Wireless Direct Mode] This document describes a communication method using wireless direct mode in WLAN communication, where devices communicate directly wirelessly without going through an external access point. Wireless direct mode communication can be implemented using multiple methods; for example, a communication device can selectively use one of the wireless direct modes described above to perform wireless direct mode communication. Wireless direct mode communication is sometimes referred to as "wireless direct communication" or "P2P communication."

[0045] For example, a communication device capable of performing wireless direct communication is configured to support at least one of two modes: soft AP mode and Wi-Fi Direct (WFD) mode. On the other hand, even a communication device capable of performing wireless direct communication does not have to support all of these modes; it may be configured to support only some of them. In this embodiment, the communication device can also support wireless infrastructure mode in addition to wireless direct mode.

[0046] A communication device (e.g., an information processing device 200) with WFD mode communication capabilities receives user input via its control panel, thereby calling an application to implement its communication function. Based on the user input received through the user interface screen provided by that application, it then performs communication in WFD mode. In P2P mode, the MFP300 acts as the master in connection and communication with other devices. However, this is not the case for WFD mode; the MFP300 may also act as a slave device by performing group owner negotiation.

[0047] [Wireless Infrastructure Mode] In contrast to wireless direct mode, wireless infrastructure mode connects communication devices that communicate with each other to an external access point that manages the network, and communication between communication devices takes place via the external access point. Here, "communication between communication devices" refers to, for example, the communication between the information processing device 200 and the MFP300. In other words, communication between communication devices is performed via the network established by the external access point. Furthermore, the MFP300 operating in wireless infrastructure mode acts as a slave device (station) in connection and communication with the access point 400. In wireless infrastructure mode, each communication device searches for an external access point by sending a device discovery request (ProbeRequest). When each communication device receives a device discovery response (ProbeResponse) from the external access point, it displays the SSID included in the ProbeResponse. For example, if the information processing device 200 and the MFP300 each discover access point 400 and send connection requests to this access point 400, communication between these communication devices in wireless infrastructure mode via access point 400 becomes possible. Note that multiple communication devices may connect to separate access points. In this case, data transfer between each access point enables communication between communication devices. The commands and parameters sent and received during communication between communication devices via the access points are those specified in the Wi-Fi standard. In the configuration described above, access point 400 determines the frequency band and frequency channel. Therefore, access point 400 selects which frequency band to use from 5GHz and 2.4GHz, and which frequency channel to use within that frequency band.

[0048] When the information processing device 200 or MFP300 connects to a wireless LAN configured by the access point 400, authentication is performed by the access point 400. The information processing device 200 and MFP300 can connect to the wireless LAN after being authenticated by the authentication method of the wireless LAN configured by the access point 400. Wireless LAN authentication methods include the PSK method using a pre-shared key, the SAE method using SAE, and the EAP method using an IEEE802.1X / EAP compliant authentication server.

[0049] [Wired communication mode] Wired communication mode is a communication mode for communication between communication devices via a wired LAN, etc. When the MFP300 is operating in wired communication mode, it cannot operate in wireless infrastructure mode. In wired communication mode, data (packet) communication is performed over a wired LAN (Ethernet) compliant with, for example, the IEEE 802.3 series. When the MFP300 is operating with IEEE 802.1X / EAP settings enabled, authentication by IEEE 802.1X is performed when connecting to a wired LAN configured by an access point 400.

[0050] [Simultaneous wireless operation] The MFP300 enables simultaneous (parallel) communication in two modes: wireless infrastructure mode and wireless direct mode, when both modes use authentication methods that do not utilize the authentication server 500. In other words, it can maintain the respective connections for each mode of communication simultaneously. Specifically, for example, it enables simultaneous execution of both wireless infrastructure mode and wireless direct mode communication. Therefore, the MFP300 simultaneously maintains both the connection for wireless infrastructure mode communication and the connection for wireless direct mode communication. This operation can also be described as "simultaneous wireless operation." In other words, simultaneous wireless operation means, for example, that the MFP300 simultaneously operates as a client device in Wi-Fi communication using wireless infrastructure mode and as a base station in Wi-Fi communication using P2P mode. On the other hand, when the MFP300 communicates using an authentication method that utilizes the authentication server 500, it does not simultaneously maintain both the infrastructure connection and the P2P connection.

[0051] In wireless direct mode, depending on the settings, connection is possible without authentication. Therefore, if the connection side using wireless infrastructure mode is managed by the authentication server 500, a discrepancy in the authentication level that can access the MFP300 will occur. To prevent such an authentication discrepancy, in this embodiment, when the MFP300 is operating with an authentication method using the authentication server 500 on the connection side using wireless infrastructure mode, connections using wireless direct mode are restricted. This restriction on connections will be described later in Figures 13 to 15.

[0052] Next, we will describe the user interface screens displayed on the operation display unit 302 of the MFP300 and the display unit 202 of the information processing device 200, in order to connect the MFP300 to the network of the access point 400 using an authentication method with an authentication server 500.

[0053] Figure 11 is a diagram illustrating the screen transitions when LAN settings 343 is selected from the settings menu on screen 341 in Figure 4(b) on the operation display unit 302 of the MFP300. Screen 1100 shown in Figure 11(a) is displayed when "LAN settings" 342 is selected on screen 341 in Figure 4(b), and is a screen on which the user can change the LAN settings. Screen 1100 displays, for example, Wireless LAN 1101, Wired LAN 1102, Wireless Direct 1103, and Common Settings 1104.

[0054] The screen 1110 shown in Figure 11(b) is displayed when "Wireless LAN" 1101 is selected in the screen 1100 of Figure 11(a), and allows the user to change the wireless LAN settings. Screen 1110 displays, for example, Wireless LAN Enable / Disable 1111, Wireless LAN Setup 1112, Wireless LAN Settings Display 1113, and Advanced Settings 1114. The Wireless LAN Enable / Disable 1111 is an area for setting whether to enable or disable the state in which the MFP300 can communicate using wireless LAN. When this area is selected, user operation is accepted on the displayed screen, and the state in which the MFP300 can communicate using wireless LAN is set to disabled or enabled. When this state is set to disabled, the MFP300 will not perform wireless LAN communication or connection.

[0055] Screen 1120, shown in Figure 11(c), is displayed when "Advanced Settings" 1114 is selected in screen 1110 of Figure 11(b), and allows the user to change the LAN advanced settings. Screen 1120 displays, for example, TCP / IP settings 1121 and 802.1X / EAP settings 1122. Screen 1130, shown in Figure 11(d), is displayed when "802.1X / EAP Settings" 1122 is selected in screen 1120 of Figure 11(c), and allows the user to change the IEEE802.1X / EAP settings. Screen 1130 displays, for example, enable / disable IEEE802.1X / EAP 1131, search for EAP routers 1132, and check the previous authentication result 1133.

[0056] Screen 1140, shown in Figure 11(e), is displayed when IEEE802.1X / EAP settings are enabled, "Search for EAP routers" 1132 is selected on screen 1130, and a wireless access point search using the authentication server 500 is being performed. Wireless access point search is the process of searching for access points in the vicinity of the MFP300. Screen 1140, shown in Figure 11(e), is also displayed when "Wireless LAN setup" 1112 is selected on screen 1110 in Figure 11(b), and a wireless access point search using an authentication method that does not use the authentication server 500 is being performed.

[0057] The screen 1150 shown in Figure 11(f) displays a list of wireless access point identifiers (SSID: Service Set Identifier) ​​as a result of searching for wireless access points. If "EAP Router Search" 1132 is selected, the screen 1150 shown in Figure 11(f) performs an EAP router search and displays only the SSIDs of wireless access points using the IEEE802.1X / EAP authentication method. In this embodiment, since the access point is, for example, a router, the router search is equivalent to a wireless access point search. If "Wireless LAN Setup" 1112 is performed, only the SSIDs of wireless access points that do not use the IEEE802.1X / EAP authentication method are displayed. The screen 1150 shown in Figure 11(f) displays SSIDs 1151 to 1153, namely SSIDWPA-EAP0001, WPA2-EAP005, and WPA3-EAP003. These correspond to the WPA-EAP, WPA2-EAP, and WPA3-EAP methods, respectively. In addition, other examples of the display may include well-known methods such as WPA-PSK, WPA3-SAE, etc., or the OPEN method may be indicated as an ancillary example.

[0058] The screen 1160 shown in Figure 11(g) is displayed while one of the wireless access point's SSIDs 1151, 1152, or 1153 is selected in the screen 1150 of Figure 11(f) and the connection process with the wireless access point is being performed. The screen 1170 shown in Figure 11(h) is displayed after the screen 1160 of Figure 11(g) is displayed, when the attempt to connect to the access point is completed and the connection is successful or the connection has progressed to a predetermined stage.

[0059] Screen 1180, shown in Figure 11(i), is the screen where "Enable / Disable IEEE802.1X / EAP" 1131 is selected in screen 1130 of Figure 11(d), allowing the user to change the IEEE802.1X / EAP setting between enabled and disabled. Screen 1180 displays both "Enable" 1151 and "Disable" 1152. When the IEEE802.1X / EAP setting is disabled, the MFP300 does not attempt to connect to an access point via IEEE802.1X / EAP. Screen 1190, shown in Figure 11(j), is the screen displayed when "Search for EAP routers" 1132 is selected in screen 1130 of Figure 11(d) when the IEEE802.1X / EAP setting is disabled. In other words, in this embodiment, even if "Search for EAP routers" 1132 is selected when the IEEE802.1X / EAP setting is disabled, the router search is not performed. The screen 1195 shown in Figure 11(k) is displayed when "Wireless Direct" 1103 is selected in the screen 1100 of Figure 11(a) while the IEEE802.1X / EAP setting is enabled. Thus, in this embodiment, when Wireless Direct 1103 is selected while the IEEE802.1X / EAP setting is enabled, a message is displayed indicating that the connection will not be made in Wireless Direct mode.

[0060] The control performed when IEEE802.1X / EAP settings are disabled to prevent connection to access points using IEEE802.1X / EAP authentication is not limited to the control described above. For example, the MFP300 may perform a router search, but may not display access points with IEEE802.1X / EAP authentication enabled in the list of access points found by the router search. Alternatively, access points with IEEE802.1X / EAP authentication enabled may also be displayed in the list, but even if selected by the user, the MFP300 may not perform the connection process with access points with IEEE802.1X / EAP authentication enabled.

[0061] When connecting the MFP300 to a network where IEEE802.1X / EAP authentication is enabled, it is necessary to configure the MFP300 with the authentication information required before performing authentication. The outline of the process for connecting the MFP300 to a network where IEEE802.1X / EAP authentication is enabled, which is configured by the access point 400 in this embodiment, will be explained with reference to Figure 9.

[0062] First, in S901, a connection is established between the information processing device 200 and the MFP300 using a connection method that does not employ IEEE802.1X / EAP authentication. In S901, the information processing device 200 and the MFP300 are connected to a network that does not employ IEEE802.1X / EAP authentication, which is configured by an access point 400 as shown in Figure 10(b), enabling communication between the communication devices via the access point 400. A network that does not employ IEEE802.1X / EAP authentication is, for example, a network with an authentication method that does not employ an authentication server 500. Alternatively, the connection between the information processing device 200 and the MFP300 may be realized by connecting the information processing device 200 to a network configured by the MFP300 as a master station in wireless direct mode, as shown in Figure 10(c). Specifically, in S901, for example, the MFP300 receives a connection request from the information processing device 200 and establishes a connection between the MFP300, which operates in P2P mode, and the information processing device 200.

[0063] Next, in S902, as explained in Figure 12, the information processing device 200 transmits IEEE802.1X / EAP authentication information to the MFP300. The MFP300 then uses this information to perform the IEEE802.1X / EAP authentication settings. Then, in S903, as explained in Figure 13, the MFP300 connects to the IEEE802.1X / EAP authentication enabled network configured by the access point 400. In other words, the MFP300 establishes a connection with an access point that enables IEEE802.1X / EAP authentication. In S903, the MFP300 is connected to the IEEE802.1X / EAP authentication enabled network (for example, using an authentication server 500) configured by the access point 400 as shown in Figure 10(a), and communication devices can communicate with each other via the access point 400.

[0064] Figure 12 is a diagram illustrating the screen transitions in the information processing device 200. Figure 12(a) shows an example of the settings screen for the MFP300 displayed on the information processing device 200. Screen 1200 in Figure 12(a) is displayed when a web browser or application program (hereinafter referred to as "application") running on the information processing device 200 communicates with an HTTP server running on the MFP300. Screen 1200 displays, for example, the printer status 1201, main unit settings 1202, LAN settings 1203, and security settings 1204. Note that screen 1200 shown in Figure 12(a) may also be displayed by the USB communication control unit 320 of the MFP300 waiting for and responding to HTTP requests via USB communication.

[0065] If "Security Settings" 1204 is selected on screen 1200 in Figure 12(a), screen 1210 shown in Figure 12(b) will be displayed. Screen 1210 will display, for example, SSL / TLS settings 1211 and IEEE802.1X / EAP settings 1212. If "IEEE802.1X / EAP settings" 1212 is selected on screen 1210 in Figure 12(b), screen 1220 shown in Figure 12(c) will be displayed.

[0066] If "Authentication Method" 1221 is selected on screen 1220 in Figure 12(c), screen 1230 shown in Figure 12(d) will be displayed. On screen 1230 in Figure 12(d), selecting either "EAP-TLS" 1231, "EAP-TTLS" 1232, or "PEAP" 1233 will set the authentication method to be used for IEEE802.1X / EAP authentication on the MFP300. Also, if a login name is entered in "Username" 1234 and a password in "Password" 1235 on screen 1230 in Figure 12(d), the login name and password to be used for IEEE802.1X / EAP authentication will be set on the MFP300.

[0067] On screen 1220 in Figure 12(c), the user selects "Key and Certificate Settings" 1222, and on screen 1240 in Figure 12(e), the user selects "Upload Key and Certificate" 1241, which displays screen 1250 in Figure 12(f). On screen 1250, the user can register the certificate to be used for IEEE802.1X / EAP authentication to the MFP300. On screen 1250 in Figure 12(f), the user selects a file using "Select File" 1251, thereby selecting the certificate to be used for IEEE802.1X / EAP authentication. Then, on screen 1250, the user enters a password in "Password" 1252 and selects "Upload" 1253, setting the certificate and password to be used for IEEE802.1X / EAP authentication to the MFP300.

[0068] On screen 1240 in Figure 12(e), the user can delete the certificate stored on the MFP300 by selecting "Delete keys and certificates" 1242. Additionally, on screen 1240 in Figure 12(e), the user can view a list of certificates stored on the MFP300 by selecting "View keys and certificates" 1243.

[0069] When the user selects "Enable / Disable IEEE802.1X / EAP" 1223 on screen 1220 in Figure 12(c), screen 1260 shown in Figure 12(g) is displayed. On screen 1260 in Figure 12(g), the user can enable or disable IEEE802.1X / EAP on the MFP300 using Enable 1261 or Disable 1262.

[0070] Through the user operations described above, the user can configure authentication information used for IEEE 802.1X / EAP authentication for the MFP300. The MFP300 can connect to the network using the authentication server 500, which is configured with access points 400, by being authenticated by the authentication server 500 using the configured authentication information. In this embodiment, the connection in each mode is managed as enabled (ON state) / disabled (OFF state). For example, in the MFP300, the switching of enabled connections and control of communications can be performed by controlling the wireless communication unit 307 and the wired communication unit 321.

[0071] Figure 13 is a flowchart illustrating the setup process for connecting the MFP300 to a network using an authentication server 500 configured with access points 400. Before performing the setup process shown in Figure 13, it is necessary to configure the MFP300 with authentication information used for IEEE 802.1X / EAP authentication using S902 in Figure 9. If authentication information is not configured in the MFP300, EAP authentication will fail. The process shown in Figure 13 is achieved, for example, by the CPU 311 reading and executing a program stored in program memory 313.

[0072] In S1301, the CPU 311 of the MFP300 receives an access point search request. For example, when the user selects "Search for EAP router" 1132 on screen 1130 in Figure 11(d), the CPU 311 receives an access point search request.

[0073] In S1302, the CPU 311 determines whether the type of access point search request is "EAP". In other words, S1302 determines whether the access point search is for an access point using an authentication method that utilizes the authentication server 500. For example, if the user selects "Search for EAP router" 1132 on screen 1130 in Figure 11(d), the CPU 311 determines that the type of access point search request is "EAP". Alternatively, the determination in S1302 may be made based on whether the search request received by the MFP 300 via the communication path includes an instruction to search for an access point using an authentication method that utilizes the authentication server 500. On the other hand, if the user selects "Wireless LAN setup" 1112 on screen 1110 in Figure 11(b), the CPU 311 determines that the type of access point search request is not "EAP". If the CPU 311 determines in S1302 that the type of access point search request is "EAP", the process proceeds to S1303. On the other hand, if the type of access point search request is determined to be not "EAP", the process proceeds to S1307.

[0074] In S1303, the CPU 311 determines whether the IEEE802.1X / EAP setting is enabled or disabled. The determination in S1303 is made, for example, based on the setting of "Enable / Disable IEEE802.1X / EAP" 1131 on screen 1130 in Figure 11(d). If S1303 determines that the IEEE802.1X / EAP setting is enabled, the process proceeds to S1305. If S1303 determines that the IEEE802.1X / EAP setting is disabled, the process proceeds to S1304.

[0075] In S1304, the CPU 311 responds that it is not possible to search for an access point using the authentication method with the authentication server 500, and then terminates the process shown in Figure 13. For example, if the IEEE802.1X / EAP setting is disabled and "Search for EAP routers" 1132 is selected on screen 1130 in Figure 11(d), then in S1304, a screen like the one shown on screen 1190 in Figure 11(j) will be displayed.

[0076] In S1305, the CPU 311 searches for access points using the authentication method with the authentication server 500, and in S1306, it stores that it has searched for access points using the authentication method with the authentication server 500. Note that S1305 and S1306 may be performed in the reverse order.

[0077] If in S1302 it is determined that the type of access point search request is not "EAP", then in S1307 the CPU 311 searches for access points using authentication methods other than the authentication method using the authentication server 500. Then, in S1308 the CPU 311 stores that it has performed a search for access points using authentication methods other than the authentication method using the authentication server 500. Note that S1307 and S1308 may be performed in the reverse order. After S1306 and S1308, proceed to S1309.

[0078] In S1309, the CPU 311 displays a list of wireless access point SSIDs as a result of the access point search, as shown in screen 1150 of Figure 11(f). In S1310, the CPU 311 accepts the user's selection of the SSID of the access point to connect to.

[0079] In S1311, the CPU 311 determines whether the wireless direct mode is enabled or disabled. In this embodiment, the enabled (ON) / disabled (OFF) state of each communication mode is stored as setting information in the MFP 300, so the determination in S1311 is made, for example, based on the stored information for each communication mode. If it is determined that the wireless direct mode is enabled, the process proceeds to S1312; if it is determined that the wireless direct mode is disabled, the process proceeds to S1316.

[0080] In S1312, the CPU 311 determines whether the IEEE802.1X / EAP setting is enabled or disabled. The determination in S1312 is made, for example, based on the setting of "Enable / Disable IEEE802.1X / EAP" 1131 on screen 1130 in Figure 11(d). If it is determined that the IEEE802.1X / EAP setting is enabled, the process proceeds to S1313; if it is determined that the IEEE802.1X / EAP setting is disabled, the process proceeds to S1316.

[0081] In S1313, the CPU 311 determines whether the access point to be connected to is an access point that uses an authentication method with an authentication server 500. If it is determined that it is an access point that uses an authentication method with an authentication server 500, the process proceeds to S1314; if it is determined that it is not an access point that uses an authentication method with an authentication server 500, the process proceeds to S1316. The determination in S1313 is made, for example, based on the contents stored in S1306 and S1308.

[0082] In S1314, the CPU 311 disables the wireless direct mode. Then, in S1315, the CPU 311 enables the wireless infrastructure mode and connects to a network using an authentication method that utilizes an authentication server 500 configured by the access point 400, using the authentication information set in S902. Specifically, disabling the wireless direct mode means that, for example, the MFP 300 stops operating as an access point or as a Wi-Fi Direct group owner, and does not establish direct Wi-Fi connections with other devices.

[0083] From S1311 onwards, if wireless direct mode is enabled, IEEE802.1 / EAP settings are enabled, and the access point to be connected uses an authentication method that utilizes the authentication server 500, wireless direct mode is disabled and wireless infrastructure mode is enabled. When wireless infrastructure mode is enabled, the MFP300 connects to the access point 400 using the authentication information set by the information processing device 200. Note that enabling wireless infrastructure mode means starting operation in wireless infrastructure mode.

[0084] On the other hand, if it is determined that any of the conditions in S1311, S1312, or S1313 are not met, in S1316, the CPU 311 enables wireless infrastructure mode and connects the MFP 300 to the access point 400. However, in this case, the connection using wireless infrastructure mode will be established without using the IEEE802.1X / EAP authentication method. Also, if it is determined that the conditions are not met in S1312 or in S1313, both wireless infrastructure mode without IEEE802.1X / EAP authentication and wireless direct mode will be enabled. Note that if the access point's SSID is selected in S1310 and the process proceeds to S1315, screen 1160 in Figure 11(g) will be displayed until the access point connection attempt starts in S1315. Furthermore, if the process proceeds to S1316, screen 1160 in Figure 11(g) will be displayed until success or failure to access the access point is determined in S1316.

[0085] As described above, the MFP300 can be connected to a network using an authentication method that utilizes an authentication server 500 configured with access points 400. In this case, if wireless direct mode is enabled, the wireless direct mode should be disabled before connecting the MFP300 to the network using the authentication method that utilizes the authentication server 500.

[0086] In addition, in S1302, the type of access point 400 search request does not need to be specified. For example, access point search requests using the authentication method with authentication server 500 may be given priority, or access point connections may be attempted without distinction of type.

[0087] Figure 13 illustrates that when a connection to an access point using an authentication method with authentication server 500 is requested, if wireless direct mode is enabled, it is disabled before enabling wireless infrastructure mode.

[0088] One example of a case in which the wireless direct mode is enabled is when "Wireless Direct" 1103 is selected on screen 1100 in Figure 11(a). Another example is when an instruction to enable the wireless direct mode is received during communication with an information processing device 200 connected in wireless infrastructure mode. In this embodiment, if a request to enable the wireless direct mode is received as in the above case, and the MFP 300 is operating in wireless infrastructure mode using an authentication method with an authentication server 500, the request to enable the wireless direct mode will be rejected. The following describes such operation with reference to Figure 14.

[0089] Figure 14 is a flowchart showing the operation of the MFP300 when it receives a request to enable wireless direct mode. The process in Figure 14 is achieved, for example, by the CPU311 reading and executing a program stored in the program memory313.

[0090] In S1401, the CPU 311 receives a request to enable wireless direct mode. This request is an instruction to start operation in wireless direct mode. This instruction is issued, for example, by the user selecting "Wireless Direct" 1103 on screen 1100 in Figure 11(a). The instruction is also transmitted to the MFP 300 during communication with the information processing device 200. Selecting "Wireless Direct" 1103 is the operation to enable wireless direct mode. The MFP 300 may also receive the instruction from the information processing device 200 via an access point to which it is connected in wireless infrastructure mode. Furthermore, the MFP 300 may also receive the instruction via communication using a communication standard other than the IEEE 802.11 series with the information processing device 200. Examples of communication standards other than the IEEE 802.11 series include Bluetooth Classic, Bluetooth Low Energy (BLE), and Near Field Communication (NFC).

[0091] In S1402, the CPU 311 determines whether the wireless infrastructure mode is enabled or disabled. In this embodiment, the enabled (ON) / disabled (OFF) state of each communication mode is stored as setting information in the MFP 300, so the determination in S1402 is made, for example, based on the stored information for each communication mode. If it is determined that the wireless infrastructure mode is enabled, the process proceeds to S1403; if it is determined that the wireless infrastructure mode is disabled, the process proceeds to S1406.

[0092] In S1403, the CPU 311 determines whether the IEEE802.1X / EAP setting is enabled or disabled. The determination in S1403 is made, for example, based on the setting of "Enable / Disable IEEE802.1X / EAP" 1131 on screen 1130 in Figure 11(d). If it is determined that the IEEE802.1X / EAP setting is enabled, the process proceeds to S1404; if it is determined that the IEEE802.1X / EAP setting is disabled, the process proceeds to S1406.

[0093] In S1404, the CPU 311 determines whether the authentication method used by the access point to which the MFP 300 is connected is an authentication method using the authentication server 500. In other words, the CPU 311 determines whether the MFP 300 is connected to an access point that uses an authentication method with the authentication server 500. The determination in S1404 is made, for example, based on the contents stored in S1306 and S1308 in Figure 13. If it is determined that the authentication method uses the authentication server 500, the process proceeds to S1405; if it is determined that the authentication method does not use the authentication server 500, the process proceeds to S1406.

[0094] Proceeding to S1405 means that the MFP300 is operating with an authentication method using the authentication server 500 on the wireless infrastructure mode connection side, and a request to enable wireless direct mode has been received. In this embodiment, in this case, the CPU311 rejects the request to enable wireless direct mode (i.e., controls it not to operate in wireless direct mode). This prevents the connection via wireless direct mode and the connection via wireless infrastructure mode with IEEE802.1X / EAP settings from being established simultaneously. At that time, the screen 1195 shown in Figure 11(k) is displayed on the operation display unit 302.

[0095] On the other hand, in S1406, the CPU 311 enables wireless direct mode. If the process is determined to be inactive in wireless infrastructure mode in S1402 and proceeds to S1406, only wireless direct mode is enabled. If the process proceeds to S1406 in either S1403 or S1404, both wireless infrastructure mode (but not the authentication method using the authentication server 500) and wireless direct mode are enabled. If the process proceeds to S1402, S1403, S1404, or S1405, only wireless infrastructure mode (the authentication method using the authentication server 500) is enabled.

[0096] Figure 15 is a flowchart showing the operation of the MFP300 when it receives a request to enable wireless infrastructure mode. The process in Figure 15 is achieved, for example, by the CPU311 reading and executing a program stored in the program memory313.

[0097] In S1501, the CPU 311 receives a request to enable the wireless infrastructure mode. For example, if the "Enable / Disable IEEE802.1X / EAP" setting 1131 on screen 1130 in Figure 11(d) is set to "Enable", then a request to enable the wireless infrastructure mode is received, and the process proceeds to S1502. From S1502 to S1507 onward, the same processing as in S1311 to S1316 in Figure 13 is performed. In other words, when a request to enable the wireless infrastructure mode is made, if the wireless direct mode is enabled, the wireless direct mode is disabled before the wireless infrastructure mode is enabled.

[0098] As described above, according to this embodiment, when the MFP300 is operating in wireless infrastructure mode using an authentication method employing the authentication server 500, it is not simultaneously operated in wireless direct mode. This configuration prevents a discrepancy in authentication levels between the two modes, which would occur if a connection were made in wireless direct mode without authentication while the MFP300 was operating in wireless infrastructure mode using an authentication method employing the authentication server 500.

[0099] In the above description, we explained a configuration in which S1403 and S1404 are performed to control the system so that a connection via wireless direct mode and a connection via wireless infrastructure mode using IEEE802.1X / EAP settings are not established simultaneously. However, the system is not limited to this configuration, and it may be configured so that only one of the S1403 or S1404 checks is performed. Furthermore, it may be configured so that if either check is determined to be NO, the system proceeds to S1406, and if it is determined to be YES, the system proceeds to S1405.

[0100] Furthermore, as described above, a process was implemented to prevent simultaneous establishment of a connection via wireless direct mode and a connection via wireless infrastructure mode using IEEE802.1X / EAP settings, which involved not activating wireless direct mode even when a start command was received. However, the process is not limited to this. For example, when a connection via wireless infrastructure mode using IEEE802.1X / EAP settings is established, the button for initiating the start command for wireless direct mode (specifically, for example, "Wireless Direct" 1103) may be grayed out or not displayed. This prevents the operation to initiate wireless direct mode from being accepted, thus preventing the establishment of a connection via wireless direct mode.

[0101] [Second Embodiment] The second embodiment will now be described in terms of its differences from the first embodiment. In the first embodiment, a configuration was described to prevent connections in wireless direct mode while the MFP300 was operating in wireless infrastructure mode using an authentication method with an authentication server 500. In this embodiment, connections in wireless direct mode are limited to communication with the authenticated information processing device 200. Hereinafter, a connection state in wireless direct mode limited to communication that performs such authentication will be referred to as the "authentication-limited state," and a connection state in wireless direct mode without such limitations will be referred to as the "normal state."

[0102] As explained in the first embodiment, the MFP300 is capable of "simultaneous wireless operation". Connection in wireless direct mode can be performed without authentication depending on the authentication settings, but if access is managed by the authentication server 500 in wireless infrastructure mode, a discrepancy may occur in the authentication level that can access the MFP300. In this embodiment, when the MFP300 is operating in wireless infrastructure mode with an authentication method using the authentication server 500, connections via wireless direct mode are set to an authentication-restricted state, limiting communication to authenticated information processing devices 200. As a result, it is possible to prevent a discrepancy in the authentication level that can access the MFP300.

[0103] Figure 16 is a flowchart illustrating the setup process for connecting the MFP300 to a network using an authentication server 500 configured with access points 400. Before performing the setup process shown in Figure 16, it is necessary to configure the MFP300 with authentication information used for IEEE 802.1X / EAP authentication using S902 in Figure 9. If authentication information is not configured in the MFP300, EAP authentication will fail. The process in Figure 16 is achieved, for example, by the CPU 311 reading and executing a program stored in program memory 313.

[0104] Since steps S1601 to S1613 in Figure 16 are the same as those explained in steps S1301 to S1313 in Figure 13, their explanations will be omitted.

[0105] If S1613 determines that the access point to be connected to is an access point that uses an authentication method with an authentication server 500, the process proceeds to S1614. In S1614, the CPU 311 sets the wireless direct mode connection to an authentication-only state and proceeds to S1615. The operation of setting the connection to an authentication-only state will be described later in Figures 19 to 21.

[0106] In S1615, the CPU 311 enables wireless infrastructure mode and connects the MFP 300 to a network using an authentication method that utilizes an authentication server 500 configured by the access point 400, using the authentication information set in S902. As a result, when the MFP 300 connects to a network where IEEE802.1X / EAP authentication is enabled, even if the MFP 300 is simultaneously operating in wireless direct mode, the connection in wireless direct mode is limited to communication with the authenticated information processing device 200. After S1615, the process shown in Figure 16 is terminated.

[0107] On the other hand, if the process proceeds from S1611, S1612, or S1613 to S1616, the CPU 311 returns the wireless direct mode connection to the normal state and proceeds to S1617. In S1617, the CPU 311 enables wireless infrastructure mode and connects the MFP 300 to the network configured by the access point 400. Here, since the wireless direct mode connection is in the normal state, communication without authentication is also possible.

[0108] In this way, the MFP300 can be connected to a wireless infrastructure network that uses an authentication method with an authentication server 500 configured by the access point 400. If wireless direct mode is enabled, the wireless direct mode is set to an authentication-only state before connecting the MFP300 to the network using the authentication method with the authentication server 500.

[0109] Figure 16 illustrates that when a connection to an access point using an authentication method with authentication server 500 is requested, if wireless direct mode is enabled, the wireless direct mode is set to an authentication-only state and wireless infrastructure mode is enabled.

[0110] One example of a case in which the wireless direct mode is enabled is when wireless direct 1103 is selected on screen 1100 in Figure 11(a). Another example is when an instruction to enable wireless direct mode is received during communication with an information processing device 200 connected via wireless infrastructure mode. In this embodiment, when a request to enable wireless direct mode is received as in the above case, and the MFP 300 is operating in wireless infrastructure mode with an authentication method using the authentication server 500, wireless direct mode is enabled as an authentication-only state. The following describes such processing with reference to Figure 17.

[0111] Figure 17 is a flowchart showing the operation of the MFP300 when it receives a request to enable wireless direct mode. The process shown in Figure 17 is achieved, for example, by the CPU311 reading and executing a program stored in the program memory313.

[0112] Since steps S1701 to S1704 in Figure 17 are the same as those explained in steps S1401 to S1404 in Figure 14, their explanations will be omitted.

[0113] If it is determined that the authentication method of the access point to be connected to is an authentication method using the authentication server 500, in S1705, the CPU 311 sets the wireless direct mode connection to an authentication-only state. Then, in S1706, the CPU 311 enables wireless direct mode. On the other hand, if it is determined to be No in any of S1702 to S1704, in S1707, the CPU 311 sets the wireless direct mode connection to a normal state. Then, in S1706, the CPU 311 enables wireless direct mode.

[0114] Thus, in this embodiment, when a request to enable wireless direct mode is received, if the MFP300 is operating in wireless infrastructure mode with an authentication method using the authentication server 500, wireless direct mode is enabled as an authentication-only state.

[0115] Figure 18 is a flowchart showing the operation of the MFP300 when it receives a request to enable wireless infrastructure mode. The process in Figure 18 is achieved, for example, by the CPU311 reading and executing a program stored in the program memory313.

[0116] One example of a case where the wireless infrastructure mode is enabled is when the "Enable / Disable IEEE802.1X / EAP" setting 1131 on screen 1130 in Figure 11(d) is enabled.

[0117] In S1801, the CPU 311 receives a request to enable the wireless infrastructure mode. For example, if "Enable / Disable IEEE802.1X / EAP" 1131 is set on screen 1130 in Figure 11(d) and enabled 1151 is set on screen 1180, then a request to enable the wireless infrastructure mode is received, and the process proceeds to S1802. From S1802 to S1808, the same processing as in S1611 to S1617 in Figure 16 is performed. In other words, if the activation of the wireless infrastructure mode is requested, and the wireless direct mode is enabled, the wireless direct mode is set to an authentication-only state before the wireless infrastructure mode is enabled.

[0118] The following describes the operation of setting the system to an authentication-only state. When the MFP300 is connected in wireless infrastructure mode to a network where IEEE802.1X / EAP authentication is enabled, in order to match the authentication level, the system controls the connection to be operated in wireless direct mode simultaneously to be limited to communications that involve authentication. In this embodiment, this state in which communications are limited to those that involve authentication is called the authentication-only state. The method for achieving this authentication-only state will be explained with reference to Figures 19 to 21. In this embodiment, the process for achieving the authentication-only state is explained by three flowcharts, but the flowcharts in Figures 19 to 21 are not the only ones that achieve the same effect as each process. Note that the processes in Figures 19 to 21 are executed when the communication procedure for the wireless direct mode connection between the information processing device 200 and the MFP300 is initiated. The communication procedure between the information processing device 200 and the MFP300 includes, for example, application-level communication procedures that use the functions of the MFP300.

[0119] Figure 19 is a flowchart showing the processing performed by the MFP300 when initiating a communication procedure via wireless direct mode connection. In the processing shown in Figure 19, when the communication procedure between the MFP300 and the information processing device 200 is initiated, the MFP300 performs a process to authenticate the information processing device 200. The processing shown in Figure 19 is achieved, for example, by the CPU311 reading and executing a program stored in the program memory 313.

[0120] In S1901, the CPU 311 initiates a communication procedure with the information processing device 200 via a wireless direct mode connection. The communication procedure here is the one described above. In S1902, the CPU 311 performs authentication of the information processing device 200, as the wireless direct mode connection is in an authentication-only state. This authentication may be performed by the information processing device 200 sending the ID and password assigned to the information processing device 200 to the MFP 300, which the MFP 300 then verifies. Alternatively, authentication may be performed using a challenge-and-response method, client certificates, tokens, etc., instead of an ID and password. In S1903, the CPU 311 determines whether the authentication was successful. If it is determined to be successful, the process proceeds to S1904; if it is determined to be unsuccessful, the process proceeds to S1905. In S1903, for example, if the authentication information (ID and password, etc.) of the information processing device 200, which is permitted to access the MFP 300 via IEEE802.1X / EAP authentication, is confirmed, the authentication is determined to be successful.

[0121] If authentication is successful, in S1904, the CPU 311 continues to execute the communication procedure with the information processing device 200. For example, based on the information received from the information processing device 200 via this communication procedure, the CPU 311 can perform actions such as printing image data, scanning images, or changing settings. On the other hand, if authentication fails, in S1905, the CPU 311 interrupts the communication procedure with the information processing device 200.

[0122] Thus, when a connection via wireless direct mode is in an authentication-only state, a decision is made on whether or not to continue the communication procedure with the information processing device 200 based on authentication information uniquely assigned to the information processing device 200. As a result, the communication procedure is limited to that with the information processing device 200 that has successfully authenticated, and communication other than that procedure is restricted, thus preventing communication via wireless direct mode from continuing without authentication.

[0123] Figure 20 is a flowchart showing the processing performed by the MFP300 when initiating a communication procedure via wireless direct mode connection. In the processing shown in Figure 20, the information processing device 200 is authenticated based on whether or not authentication is performed in the communication procedure and whether or not the wireless direct mode connection is in an authentication-only state. The processing shown in Figure 20 is achieved, for example, by the CPU 311 reading and executing a program stored in the program memory 313.

[0124] In S1911, the CPU 311 initiates a communication procedure with the information processing device 200 via a wireless direct mode connection. The communication procedure here is the one described above. In S1912, the CPU 311 determines whether the communication procedure between the MFP 300 and the information processing device 200 is a communication procedure in which authentication processing is performed. The determination in S1912 is made based, for example, on the settings of the application in the information processing device 200 that controls communication with the MFP 300, such as whether or not it performs authentication with the MFP 300, or on negotiations with the information processing device 200. If it is determined that the communication procedure is one in which authentication processing is performed, the process proceeds to S1913; if it is determined that the communication procedure is not one in which authentication processing is performed, the process proceeds to S1916. Note that if the wireless direct mode connection is in an authentication-only state, the authentication of the information processing device 200 in S1913 may be performed regardless of the setting of whether or not the application performs authentication.

[0125] In S1913, similar to S1902, the CPU 311 performs authentication of the information processing device 200. Authentication here may be performed by the information processing device 200 sending the ID and password assigned to the information processing device 200 to the MFP 300, which the MFP 300 then verifies. Alternatively, the information processing device 200 may send the administrator password and administrator ID set on the MFP 300 to the MFP 300, which the MFP 300 then verifies. Authentication may also be performed using a challenge-and-response method, client certificates, tokens, etc., instead of an ID and password. In S1914, the CPU 311 determines whether the authentication was successful or not. If it is determined that the authentication was successful, the process proceeds to S1915; if it is determined that the authentication failed, the process proceeds to S1917.

[0126] If authentication is determined to be successful, in S1915, the CPU 311 continues to execute the communication procedure with the information processing device 200. For example, based on the information received from the information processing device 200 via this communication procedure, the CPU 311 can perform actions such as printing image data, scanning images, and changing settings. It can also perform actions such as changing the IEEE802.1X / EAP settings of the MFP 300. On the other hand, if authentication is determined to have failed, in S1917, the CPU 311 interrupts the communication procedure with the information processing device 200.

[0127] If it is determined in S1912 that the communication procedure does not involve authentication, then in S1916, the CPU 311 determines whether the connection via wireless direct mode is in an authentication-only state. If it is determined to be in an authentication-only state, in S1917, the CPU 311 interrupts the communication procedure with the information processing device 200. On the other hand, if it is determined not to be in an authentication-only state, in S1915, the CPU 311 continues to execute the communication procedure with the information processing device 200.

[0128] Thus, in a wireless direct mode connection between the MFP300 and the information processing device 200, the communication procedure can be limited to communication with the information processing device 200 that has the same access level as the MFP300 access level via IEEE802.1X / EAP authentication, and where authentication is performed at the application level or similar. Furthermore, there is no need to change the application-level authentication settings in response to IEEE802.1X / EAP authentication.

[0129] Figure 21 is a flowchart showing the processing performed by the MFP300 when initiating a communication procedure via wireless direct mode connection. In the processing shown in Figure 21, the destination information of communications from the information processing device 200 to the MFP300 is limited to communications that meet certain conditions. The processing shown in Figure 21 is achieved, for example, by the CPU 311 reading and executing a program stored in the program memory 313.

[0130] In S1921, the CPU 311 initiates a communication procedure with the information processing device 200 via a wireless direct mode connection. The communication procedure here is the one described above. In S1922, the CPU 311 obtains communication destination information from the information processing device 200. Here, destination information refers to information indicating the destination on the MFP 300 side, such as an IP address, port number, URL, or query.

[0131] In S1923, the CPU 311 determines whether the acquired destination information satisfies predetermined conditions. In S1923, the CPU 311 determines that the predetermined conditions are met if the communication corresponding to the destination information includes authentication processing. This may be determined, for example, by whether or not application-level authentication is performed. If it is determined that the predetermined conditions are met, the process proceeds to S1924; if it is determined that the predetermined conditions are not met, the process proceeds to S1925.

[0132] If it is determined that the predetermined conditions are met, in S1924, the CPU 311 continues to execute the communication procedure with the information processing device 200. In this communication procedure, authentication of the information processing device 200 is performed, similar to S1902 and S1913. That is, authentication may be performed using an ID and password, a challenge-and-response method, a client certificate, a token, etc. If the authentication fails, the communication procedure with the information processing device 200 is interrupted. On the other hand, if it is determined in S1923 that the predetermined conditions are not met, the authentication process will not be performed even if the communication procedure is continued, so in S1925, the CPU 311 interrupts the communication procedure with the information processing device 200.

[0133] Thus, in a wireless direct mode connection between the MFP300 and the information processing device 200, communication can be limited to, for example, a communication procedure in which application-level authentication is performed and which has the same access level as the MFP300 access level under IEEE802.1X / EAP authentication.

[0134] As described above, according to each embodiment, even if the MFP300 is connected to a network where IEEE802.1X / EAP authentication is enabled and simultaneously operates in wireless direct mode, communication with the information processing device 200 is restricted on the wireless direct mode connection side. This prevents a discrepancy in authentication levels, where a connection in wireless direct mode would be made without authentication, even if the MFP300 is connected to a network where IEEE802.1X / EAP authentication is enabled in wireless infrastructure mode.

[0135] The present invention can also be realized by supplying a program that implements one or more of the functions of the above-described embodiments to a system or device via a network or storage medium, and by having one or more processors in the computer of that system or device read and execute the program. It can also be realized by a circuit (e.g., an ASIC) that implements one or more functions.

[0136] The invention is not limited to the embodiments described above, and various modifications and variations are possible without departing from the spirit and scope of the invention. Accordingly, claims are attached to disclose the scope of the invention. [Explanation of Symbols]

[0137] 100 Communication Systems: 200 Information Processing Devices: 300 MFPs: 400 Access Points: 500 Authentication Servers

Claims

1. A communication device capable of communicating with an information processing device and an access point, an establishing means for establishing a connection between said access point and said communication device; a first receiving means for receiving a predetermined request for enabling a predetermined mode in the communication device for directly communicating between the communication device and the information processing device without going through the access point; a first enabling means for enabling the predetermined mode in the communication device based on the acceptance of the predetermined request, when a connection between the communication device and the access point is established and an authentication method used for the connection between the communication device and the access point is not a predetermined authentication method; a control means for executing a predetermined control so as not to enable the predetermined mode in the communication device when a connection between the communication device and the access point is established and an authentication method used for the connection between the communication device and the access point is the predetermined authentication method; A communication device comprising:

2. A communication device as described in claim 1, characterized in that when a connection between the communication device and the access point is not established, the specified mode is enabled in the communication device based on the specified request being accepted.

3. A communication device as described in claim 1 or 2, characterized in that the specified request is a request issued by a specified user operation on a user interface screen of the communication device.

4. The communication device described in Claim 3, characterized in that the specified control is a process of graying out a button for accepting the specified operation, or a process of not displaying a button for accepting the specified operation.

5. A communication device as described in any one of claims 1 to 4, characterized in that the specified request is a request transmitted from the information processing device to the communication device.

6. A communication device as described in any one of claims 1 to 5, characterized in that the specified control is control for preventing the specified request from being accepted.

7. A communication device as described in any one of claims 1 to 5, characterized in that the specified control is control for preventing the specified mode from being enabled in the communication device even if the specified request is accepted.

8. A second receiving means for receiving a specific request for enabling a specific mode in the communication device for communicating between the communication device and the information processing device via the access point; a second enabling means for enabling the specific mode in the communication device based on the specific request; a disabling means for disabling the predetermined mode when an authentication method used for a connection between the communication device and the access point established based on the specific request is the predetermined authentication method and the communication device is in the predetermined mode when the specific request is accepted; 8. The communication device according to claim 1, further comprising:

9. The communication device described in Claim 8, characterized in that if the authentication method used for the connection between the communication device and the access point established based on the specific request is the predetermined authentication method, and if the communication device is in the predetermined mode when the specific request is accepted, the predetermined mode is disabled and then the specific mode is enabled.

10. A communication device as described in claim 8 or 9, characterized in that if the authentication method used for the connection between the communication device and the access point established based on the specific request is not the specified authentication method, and if the communication device is in the specified mode when the specific request is accepted, the specific mode is enabled while the specified mode remains enabled.

11. A communication device as described in any one of claims 8 to 10, characterized in that the specific request is a request issued by a specific user operation on a user interface screen of the communication device.

12. A communication device described in any one of claims 1 to 11, characterized in that the specified authentication method is an authentication method defined in IEEE802.1X / EAP.

13. A communication device as described in any one of claims 1 to 12, characterized in that the authentication method other than the specified authentication method is a personal method.

14. The communication device according to claim 1, wherein the authentication method that is not the specified authentication method is a PreShared Key (PSK) method or a Simultaneous Authentication of Equals (SAE) method.

15. A communication device as described in any one of claims 1 to 14, characterized in that the specified mode is a mode in which the communication device operates as an access point.

16. The communication device according to claim 1, wherein the predetermined mode is a mode for communicating via Wi-Fi Direct (registered trademark).

17. The communication device according to claim 1, wherein the communication device is a printer.

18. A computer of a communication device capable of communicating with an information processing device and an access point, an establishing means for establishing a connection between said access point and said communication device; a first receiving means for receiving a predetermined request for enabling a predetermined mode in the communication device for directly communicating between the communication device and the information processing device without going through the access point; a first enabling means for enabling the predetermined mode in the communication device based on the acceptance of the predetermined request, when a connection between the communication device and the access point has been established and an authentication method used for the connection between the communication device and the access point is not a predetermined authentication method; a control means for executing a predetermined control so as not to enable the predetermined mode in the communication device when a connection between the communication device and the access point is established and an authentication method used for the connection between the communication device and the access point is the predetermined authentication method; A program to function as a

19. A method for controlling an information processing device and a communication device capable of communicating with an access point, comprising: establishing a connection between the access point and the communication device; a first receiving step of receiving a predetermined request for enabling a predetermined mode in the communication device for directly communicating between the communication device and the information processing device without going through the access point; a first enabling step of enabling the predetermined mode in the communication device based on the acceptance of the predetermined request, when a connection between the communication device and the access point is established and an authentication method used for the connection between the communication device and the access point is not a predetermined authentication method; a control step of executing a predetermined control so as not to enable the predetermined mode in the communication device when a connection between the communication device and the access point is established and an authentication method used for the connection between the communication device and the access point is the predetermined authentication method; A control method comprising the steps of:

Images