First communication device and computer program for first communication device

Abstract

To provide techniques to enable a first communication device to play an appropriate role considering the situation thereof.SOLUTION: A first communication device performs output control processing for outputting output information obtained by using a public key of the first communication device to the outside, and receives an authentication request in which the public key is used from a second communication device that has obtained the public key. If a radio connection is established between the first communication device and a first access point, the first communication device transmits, to the second communication device, a first authentication response including first role information indicating that the first communication device plays a first role. If no radio connection is established between the first communication device and any access point, the first communication device transmits, to the second communication device, a second authentication response including second role information indicating that the first communication device plays a second role different from the first role.SELECTED DRAWING: Figure 7

Description

[Technical field]

[0001] SUMMARY Techniques are disclosed herein for establishing a wireless connection between a first communication device and another device. [Background technology]

[0002] Non-Patent Document 1 describes the DPP (abbreviation of Device Provisioning Protocol), which is a wireless communication method established by the Wi-Fi Alliance. The DPP is a wireless communication method for easily establishing a Wi-Fi connection between a pair of devices. In the DPP method, a first device acting as a Configurator transmits information for establishing a Wi-Fi connection to a second device acting as an Enrollee. Then, a Wi-Fi connection is established between the second device and another device (which may be, for example, the first device or a device different from the first device). [Prior art documents] [Non-patent literature]

[0003] [Non-Patent Document 1] “Device Provisioning Protocol Technical Specification Version 1.1” Wi-Fi Alliance, 2018 Summary of the Invention [Problem to be solved by the invention]

[0004] This specification provides a technique that enables a first communication device to take on an appropriate role in consideration of the situation of the first communication device itself. [Means for solving the problem]

[0005] A first communication device disclosed in this specification includes a wireless interface for performing wireless communication according to the Wi-Fi standard, an output control unit for executing an output control process for outputting to the outside output information according to the Wi-Fi standard, the output information being obtained by using a public key of the first communication device, an authentication request receiving unit for receiving an authentication request using the public key via the wireless interface from a second communication device that has acquired the public key, a first determination unit for determining whether or not a wireless connection has been established between the first communication device and any access point, and a first authentication response transmitting unit for transmitting, to the second communication device via the wireless interface, a first authentication response including first role information indicating that the first communication device plays a first role, when the authentication request is received from the second communication device and it is determined that a wireless connection has been established between the first communication device and a first access point, the first role being a first wireless setting information for the second communication device to establish a first wireless connection with the first access point. a wireless setting transmission unit configured to transmit the first wireless setting information to the second communication device via the wireless interface after the first authentication response is transmitted to the second communication device; and a second authentication response transmission unit configured to transmit a second authentication response to the second communication device via the wireless interface, when the authentication request is received from the second communication device and it is determined that a wireless connection is not established between the first communication device and any access point, the second role being a role of receiving from the second communication device second wireless setting information for the first communication device to establish a second wireless connection with a second access point;and a first establishment unit that establishes the second wireless connection with the second access point.

[0006] According to the above configuration, the first communication device determines whether or not a wireless connection is established between the first communication device and any of the access points. In a situation where a wireless connection is established between the first communication device and the first access point, the first communication device plays a first role, which is a role of transmitting first wireless setting information to the second communication device, and transmits the first wireless setting information to the second communication device. As a result, the first wireless connection can be established between the second communication device and the first access point. In addition, in a situation where a wireless connection is not established between the first communication device and any of the access points, the first communication device plays a second role, which is a role of receiving second wireless setting information from the second communication device, and receives the second wireless setting information from the second communication device. As a result, the second wireless connection can be established between the first communication device and the second access point. Therefore, the first communication device can play an appropriate role in consideration of the situation of the first communication device itself.

[0007] A control method for implementing the first communication device, a computer program, and a computer-readable recording medium storing the computer program are also novel and useful. Also, a communication system including the communication device and another device (e.g., a second communication device, an external device) is also novel and useful. [Brief description of the drawings]

[0008] [Figure 1] 1 shows the configuration of a communication system. [Diagram 2] 1 shows a schematic sequence diagram of a process for establishing a wireless connection between a printer and an access point in accordance with the DPP method. [Diagram 3] A sequence diagram of Bootstrapping process is shown below. [Figure 4] A sequence diagram of authentication process is shown below. [Diagram 5] A sequence diagram of Configuration processing is shown below. [Figure 6] A sequence diagram of the Network Access process is shown below. [Figure 7] 1 shows a flowchart of authentication processing. [Figure 8] 13 shows a sequence diagram of the bootstrap processing and the authentication processing in case A in which a wireless connection is established between the printer and the AP. [Figure 9] The continuation of the sequence diagram in Figure 8 (Configuration processing and Network Access processing) is shown below. [Figure 10] 13 shows a sequence diagram of the bootstrap processing and the authentication processing in case B in which a wireless connection is established between the printer and the AP, and between the terminal device and the AP. [Figure 11] The continuation of the sequence diagram in Figure 10 (Configuration processing and Network Access processing) is shown below. [Figure 12] 13 shows a sequence diagram of the bootstrap processing in case C in which a wireless connection in accordance with the WFD method is established between a printer and an AP. [Figure 13] The sequence diagram (Authentication processing) of FIG. 12 is continued below. [Figure 14] The continuation of the sequence diagram in Figure 13 (Configuration processing) is shown below. [Figure 15] The sequence diagram (Network Access processing) of FIG. 14 is continued. [Figure 16] The following table shows the cases of this embodiment. DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS

[0009] (Example) (Configuration of communication system 2; Figure 1) 1, the communication system 2 includes two access points (hereinafter simply referred to as "AP") 6 and 8, a printer 10, and two terminals 100 and 200. In this embodiment, a user uses, for example, the terminal 100 to establish a wireless connection (hereinafter referred to as "Wi-Fi connection") between the printer 10 and the AP 6 in accordance with the Wi-Fi standard.

[0010] (Configuration of terminal 100) The terminal 100 is a portable terminal device such as a mobile phone (e.g., a smartphone), a PDA, or a tablet PC. In a modified example, the terminal 100 may be a stationary terminal device. The terminal 100 includes a camera 115 and a Wi-Fi interface 116. In the following, the interface is simply referred to as "I / F".

[0011] The camera 115 is a device for photographing an object, and in this embodiment, is used to photograph QR codes (registered trademark) for each of the APs 6 and 8 and the printer 10.

[0012] The Wi-Fi I / F 116 is a wireless interface for performing communication according to the Wi-Fi standard. The Wi-Fi standard is a standard for performing wireless communication according to, for example, the IEEE (The Institute of Electrical and Electronics Engineers, Inc.) 802.11 standard and standards equivalent thereto (for example, 802.11a, 11b, 11g, 11n, etc.). The Wi-Fi I / F 116 supports the DPP (abbreviation of Device Provisioning Protocol) method established by the Wi-Fi Alliance. The DPP method is described in the specification "Device Provisioning Protocol Technical Specification Version 1.1" created by the Wi-Fi Alliance, and is a method for easily establishing a Wi-Fi connection between a pair of devices (for example, the printer 10 and the AP 6) using the terminal 100.

[0013] The Wi-Fi I / F 116 further supports the WFD (short for Wi-Fi Direct (registered trademark)) method established by the Wi-Fi Alliance. The WFD method is described in the specification "Wi-Fi Peer-to-Peer (P2P) Technical Specification Version 1.1" created by the Wi-Fi Alliance. In the WFD, a Group Owner state (hereinafter referred to as "G / O state") and a Client state (hereinafter referred to as "CL state") are defined. In this embodiment, a state different from either the G / O state or the CL state is called a "device state". A device supporting the WFD method can selectively operate in one of the above three states. In the following, a Wi-Fi connection established according to the WFD method may be referred to as a "WFD connection".

[0014] (Configuration of terminal 200) The terminal 200 is also a portable terminal device similar to the terminal 100. In a modified example, the terminal 200 may be a stationary terminal device. The terminal 200 includes a camera 215 and a Wi-Fi I / F 216 similar to the terminal 100.

[0015] (Printer 10 Configuration) The printer 10 is a peripheral device (for example, a peripheral device of the terminals 100 and 200) capable of executing a printing function. The printer 10 includes an operation unit 12, a display unit 14, a Wi-Fi I / F 16, a print execution unit 18, and a control unit 30. Each of the units 12 to 30 is connected to a bus line (reference numerals omitted).

[0016] The operation unit 12 has a plurality of buttons. A user can input various instructions to the printer 10 by operating the operation unit 12. The display unit 14 is a display for displaying various information. The display unit 14 further functions as a so-called touch panel (i.e., an operation unit). The print execution unit 18 has a printing mechanism such as an inkjet type or a laser type.

[0017] The Wi-Fi I / F 16 supports the DPP method and the WFD method. Therefore, the printer 10 can establish a Wi-Fi connection with the AP 6, and can also establish a WFD connection with a terminal (for example, the terminal 100) without going through an AP. In the following, the Wi-Fi connection with the AP 6 may be referred to as an "AP connection."

[0018] Two MAC addresses, "mac_ap" and "mac_wfd", are assigned to the Wi-Fi I / F 16. The MAC address "mac_ap" is the MAC address used for AP connections. The MAC address "mac_wfd" is the MAC address used for WFD connections.

[0019] The control unit 30 includes a CPU 32 and a memory 34. The CPU 32 executes various processes in accordance with a program 40 stored in the memory 34. The memory 34 is configured by a volatile memory, a non-volatile memory, or the like.

[0020] The memory 34 may also store AP information 44 that is utilized in establishing an AP connection.

[0021] (Outline of DPP; Figure 2) Next, an overview of DPP will be described with reference to Fig. 2. The AP 6 also supports the DPP method. In this embodiment, the devices 6, 10, and 100 execute communication according to the DPP method, thereby establishing a DPP connection between the printer 10 and the AP 6. In the following, for ease of understanding, the operations executed by the CPU of each device (e.g., CPU 32) will be described with each device (e.g., printer 10) as the subject, rather than with the CPU as the subject.

[0022] At T5, the terminal 100 executes DPP-based Bootstrapping (hereinafter simply referred to as "BS") with the AP 6. The BS is a process in which the AP 6 provides the terminal 100 with information used in Authentication (hereinafter simply referred to as "Auth") at T10, which will be described later, in response to the QR code attached to the AP 6 being photographed by the camera 115 of the terminal 100.

[0023] At T10, the terminal 100 uses the information already acquired at the BS at T5 to execute DPP-based Auth with the AP 6. This Auth is processing by which the terminal 100 and the AP 6 each authenticate the other party of communication.

[0024] At T15, the terminal 100 executes DPP-based Configuration (hereinafter simply referred to as "Config") with the AP 6. The Config is a process of transmitting information to the AP 6 for the AP 6 to establish an AP connection in accordance with the DPP method. Specifically, the terminal 100 generates an AP Configuration Object (hereinafter simply referred to as "CO") and transmits the AP CO to the AP 6. As a result, the AP 6 stores the AP CO.

[0025] Next, in T25, the terminal 100 executes BS of the DPP method with the printer 10. The BS is a process in which the printer 10 provides the terminal 100 with information used in Auth in T30, which will be described later, in response to the QR code displayed on the printer 10 being photographed by the camera 115 of the terminal 100.

[0026] At T30, the terminal 100 uses the information already acquired at the BS at T25 to execute DPP-based Auth with the printer 10. This Auth is a process in which the terminal 100 and the printer 10 each authenticate the other party in communication.

[0027] At T35, the terminal 100 executes a DPP-based Config with the printer 10. This Config is a process for transmitting information for establishing a DPP connection between the printer 10 and the AP 6 to the printer 10. In this Config, the terminal 100 generates a first printer CO for establishing an AP connection in accordance with the DPP method between the printer 10 and the AP 6, and transmits the first printer CO to the printer 10. As a result, the first printer CO is stored in the printer 10.

[0028] In T40, the printer 10 and the AP 6 execute DPP-based Network Access (hereinafter simply referred to as "NA") using the stored AP CO and the first printer CO. NA is a process for sharing a connection key between the printer 10 and the AP 6 for establishing an AP connection according to the DPP method. After that, the printer 10 and the AP 6 execute 4way-handshake communication. In at least a part of the 4way-handshake communication, the printer 10 and the AP 6 communicate encrypted information encrypted by the shared connection key. Then, if the encrypted information is successfully decrypted, an AP connection is established between the printer 10 and the AP 6. This allows the printer 10 to participate as a child station in the wireless network formed by the AP 6. In a modified example, the printer 10 and the AP 6 may execute SAE (short for Simultaneous Authentication of Equals, commonly known as "Dragonfly") communication instead of the 4way-handshake communication.

[0029] In the DPP method, in order to establish an AP connection between the printer 10 and the AP 6, the user does not need to input information (e.g., SSID, password, etc.) of the wireless network in which the AP 6 operates as a master station to the printer 10. Therefore, the user can easily establish an AP connection between the printer 10 and the AP 6.

[0030] (Details of each process: Figures 3 to 6) Next, the details of each process executed in T25 to T40 in Fig. 2 will be described with reference to Fig. 3 to Fig. 6. Note that the processes in T5 to T15 are similar to the processes in T25 to T35 except that AP6 is used instead of printer 10, and therefore detailed description thereof will be omitted.

[0031] (Bootstrapping (BS); Figure 3) First, the BS process executed at T25 in Fig. 2 will be described with reference to Fig. 3. In the initial state in Fig. 3, the memory 34 of the printer 10 prestores the public key PPK1 and private key psk1 of the printer 10. Also, in the initial state in Fig. 3, the memory 34 does not store the AP information 44.

[0032] In T100, the user operates the operation unit 12 to input a predetermined instruction to the printer 10. When the printer 10 accepts the input of the predetermined instruction from the user in T100, the printer 10 displays a selection screen on the display unit 14 in T102. The selection screen is a screen for selecting a communication method. The selection screen includes an "AP communication" button indicating the use of communication via an AP, and a "WFD communication" button indicating the use of communication according to the WFD method not via an AP. Note that the selection screen does not have to be displayed. In this case, for example, when an instruction is accepted from the user on a first screen regarding the use of communication via an AP, a QR code for AP (see T106) may be displayed, and when an instruction is accepted from the user on a second screen different from the first screen and regarding the use of communication according to WFD, a QR code for WFD (see T856 in FIG. 12) may be displayed.

[0033] In T104, the user operates the operation unit 12 to select the "AP communication" button in the selection screen. When the printer 10 accepts the selection of the "AP communication" button from the user in T104, the printer 10 displays an AP QR code on the display unit 14 in T106. The AP QR code is obtained by encoding the public key PPK1 of the printer 10 and the MAC address "mac_ap" used for the AP connection.

[0034] In response to receiving an operation from a user, terminal 100 activates camera 115 of terminal 100, and in T120, uses camera 115 to capture an image of the AP QR code displayed in T100. Then, in T122, terminal 100 decodes the captured AP QR code and acquires public key PPK1 and MAC address "mac_ap." When the process of T122 ends, the process of FIG. 3 ends.

[0035] (Authentication (Auth); Figure 4) Next, the Auth process executed at T30 in Fig. 2 will be described with reference to Fig. 4. All of the following communications executed between the terminal 100 and the printer 10 are executed via the Wi-Fi I / F 116 of the terminal 100 and the Wi-Fi I / F 16 of the printer 10. Therefore, in the following, the phrase "via the Wi-Fi I / F 116 (or 16)" will be omitted.

[0036] In T200, the terminal 100 generates a public key TPK1 and a secret key tsk1 of the terminal 100. Next, in T202, the terminal 100 generates a shared key SK1 according to ECDH (Elliptic curve Diffie-Hellman key exchange) using the generated secret key tsk1 and the public key PPK1 of the printer 10 acquired in T122 of Fig. 3. Then, in T204, the terminal 100 encrypts a random value RV1 using the generated shared key SK1 to generate encrypted data ED1.

[0037] In T210, the terminal 100 sends a DPP Authentication Request (hereinafter simply referred to as "AReq") to the printer 10, with the MAC address "mac_ap" acquired in T122 of Fig. 3 as the destination. AReq is a signal requesting the printer 10 to execute authentication. AReq includes the public key TPK1 of the terminal 100 generated in T200, the encrypted data ED1 generated in T204, the capability of the terminal 100, and the MAC address "mac_ap".

[0038] Capability is information that is specified in advance in a device that supports the DPP method, and includes one of the following values: a value indicating that the device can operate only as a DPP Configurator; a value indicating that the device can operate only as a DPP Enrollee; and a value indicating that the device can operate as both a Configurator and an Enrollee. The Configurator refers to the role of transmitting COs used in the NA (e.g., T40 in FIG. 2) to the Enrollee in the Config (e.g., T35 in FIG. 2). On the other hand, the Enrollee refers to the role of receiving COs used in the NA from the Configurator in the Config. In this case, AReq includes a value indicating that the device can operate as both a Configurator and an Enrollee as the capability of the terminal 100.

[0039] At T210, the printer 10 receives the AReq from the terminal 100. As described above, the AReq is transmitted to the MAC address “mac_ap” of the Wi-Fi I / F 16 of the printer 10 as the transmission destination. Therefore, the printer 10 can appropriately receive the AReq from the terminal 100.

[0040] When the printer 10 receives the AReq from the terminal 100 in T210, the printer 10 executes the process of FIG. 7, which will be described later, in T211 to determine the capability of the printer 10 as Enrollee.

[0041] Next, the printer 10 executes a process for authenticating the sender of the AReq (i.e., the terminal 100). Specifically, in T212, the printer 10 generates a shared key SK1 using the public key TPK1 of the terminal 100 in the AReq and the private key psk1 of the printer 10 according to ECDH. Here, the shared key SK1 generated by the terminal 100 in T202 is the same as the shared key SK1 generated by the printer 10 in T212. Therefore, in T214, the printer 10 can appropriately decrypt the encrypted data ED1 in the AReq using the generated shared key SK1, and as a result, can obtain the random value RV1. If the decryption of the encrypted data ED1 is successful, the printer 10 determines that the sender of the AReq is the device that captured the QR code displayed in T100 of FIG. 3, that is, determines that the authentication has been successful, and executes the process from T216 onward. On the other hand, if the printer 10 is not successful in decrypting the encrypted data ED1, it determines that the sender of AReq is not the device that captured the image of the QR code displayed in T100, i.e., it determines that authentication has failed, and does not execute the processing from T216 onwards.

[0042] In T216, the printer 10 generates a new public key PPK2 and a new private key psk2 of the printer 10. In a modified example, the printer 10 may store the public key PPK2 and the private key psk2 in advance. Next, in T217, the printer 10 generates a shared key SK2 using the public key TPK1 of the terminal 100 in the AReq of T210 and the private key psk2 of the printer 10 that has already been generated, according to ECDH. Then, in T218, the printer 10 encrypts the acquired random value RV1 and the new random value RV2 using the generated shared key SK2 to generate encrypted data ED2.

[0043] In T220, the printer 10 transmits a DPP Authentication Response (hereinafter simply referred to as "ARes") to the terminal 100. The ARes includes the public key PPK2 of the printer 10 generated in T216, the encrypted data ED2 generated in T218, and the capability of the printer 10 determined in T211 (i.e., a value indicating that the printer 10 can operate only as an Enrollee).

[0044] In T220, the terminal 100 receives the ARes from the printer 10. In this case, the terminal 100 executes a process for authenticating the sender of the ARes (i.e., the printer 10). Specifically, in T222, the terminal 100 generates a shared key SK2 according to ECDH using the private key tsk1 of the terminal 100 generated in T200 and the public key PPK2 of the printer 10 in the ARes. Here, the shared key SK2 generated by the printer 10 in T217 is the same as the shared key SK2 generated by the terminal 100 in T222. Therefore, in T224, the terminal 100 can appropriately decrypt the encrypted data ED2 in the ARes using the generated shared key SK2, and as a result, can obtain the random values ​​RV1 and RV2. If the decryption of the encrypted data ED2 is successful, the terminal 100 determines that the sender of the ARes is a device having a photographed QR code, that is, determines that the authentication has been successful, and executes the process from T230 onward. On the other hand, if the terminal 100 is not successful in decrypting the encrypted data ED2, it determines that the sender of the ARes is not a device having a photographed QR code, i.e., it determines that authentication has failed, and does not execute the processing after T230.

[0045] In T230, the terminal 100 sends a Confirm to the printer 10. The Confirm includes information indicating that the terminal 100 operates as a Configurator and the printer 10 operates as an Enrollee. As a result, in T232, the terminal 100 decides to operate as a Configurator, and in T234, the printer 10 decides to operate as an Enrollee. When the process of T234 ends, the process of FIG. 4 ends.

[0046] (Configuration(Config); Figure 5) Next, referring to FIG. 5, the process of Config executed at T35 in FIG. 2 will be described. At T300, the printer 10 transmits a DPP Configuration Request (hereinafter simply referred to as "CReq") to the terminal 100. CReq is a signal requesting transmission of a first printer CO. CReq includes a value "sta" indicating that the printer 10 receives the first printer CO. Furthermore, CReq includes a value "config" requesting operation information for the printer 10 to operate as a Configurator. For example, after the processes of FIG. 3 to FIG. 6 are completed and an AP connection is established between the printer 10 and the AP 6, a case A (FIG. 8, FIG. 9) described later is assumed in which communication according to the DPP method is executed between the printer 10 and the terminal 100. In this case, the printer 10 operates as a Configurator, uses the first printer CO to generate a first terminal CO, and transmits the first terminal CO to the terminal 100. In this case, the printer 10 transmits a CReq including the value "config" to the terminal 100 in advance in T300, prior to the later case A. This enables the printer 10 to operate as a configurator in the later case A and generate a first terminal CO using the first printer CO acquired from the terminal 100.

[0047] When the terminal 100 receives CReq from the printer 10 in T300, the terminal 100 acquires the group ID "Group1", the public key TPK2, and the private key tsk2 from the memory (not shown) of the terminal 100 in T302. As described above, the terminal 100 has already executed the Config in T15 of FIG. 2 with the AP 6, and at this time, the terminal 100 generates the group ID "Group1", the public key TPK2, and the private key tsk2 and stores them in the memory. The group ID "Group1" is information for identifying a wireless network formed by establishing a Wi-Fi connection between the printer 10 and the AP 6. In addition, in a modified example, a character string designated by a user may be used as the group ID. That is, in T302, the terminal 100 acquires each piece of information stored in T15 of FIG. 2. Next, the terminal 100 generates a first printer CO in T304. Specifically, the terminal 100 executes each of the following processes.

[0048] First, the terminal 100 generates a hash value HV1 by hashing the public key TPK2 of the terminal 100. The terminal 100 also generates a specific value by hashing a combination of the hash value HV1, the group ID "Group1", and the public key PPK2 of the printer 10 in the ARes of T220 in FIG. 4. The terminal 100 then generates an electronic signature DSpr1 by encrypting the generated specific value using the private key tsk2 of the terminal 100 according to ECDSA (short for Elliptic Curve Digital Signature Algorithm). As a result, the terminal 100 can generate a first printer Signed-Connector (hereinafter, the Signed-Connector will be simply referred to as "SC") including the hash value HV1, the group ID "Group1", the public key PPK2 of the printer 10, and the electronic signature DSpr1. Then, the terminal 100 generates a CO for the first printer that includes an SC for the first printer and the public key TPK2 of the terminal 100.

[0049] In T310, the terminal 100 sends a DPP Configuration Response (hereinafter simply referred to as "CRes") including a CO for the first printer to the printer 10. Here, the CRes includes operation information as a response to the value "config" in the CReq. The operation information includes information (e.g., the private key tsk2 of the terminal 100) for the printer 10 to operate as a configurator and generate a CO for the first terminal for another terminal (e.g., the terminal 200).

[0050] When the printer 10 receives a CRes from the terminal 100 in T310, the printer 10 stores the first printer CO in the CRes in T312. The first printer CO is information used to establish an AP connection with the AP 6, and can be said to be connection information for establishing an AP connection with the AP 6. The printer 10 stores the first printer CO as the AP information 44. When the process of T312 ends, the process of FIG. 5 ends.

[0051] (Network Access (NA); Figure 6) Next, the process of NA at T40 in FIG. 2 will be described with reference to FIG. 6. As described above, the processes from T5 to T15 have been executed between the terminal 100 and the AP 6, similar to those from T25 to T35 in FIG. 2. The AP 6 stores the public key APK1 and the secret key ask1 of the AP 6 in advance. A QR code obtained by encoding the public key APK1 and the MAC address of the AP 6 is attached to the housing of the AP 6. When the terminal 100 photographs the QR code, each process similar to each process from T200 onward in FIG. 4 is executed between the terminal 100 and the AP 6. As a result, the AP 6 stores the public key APK2 and the secret key ask2 of the AP 6 (see T216 in FIG. 4), and further stores the CO for AP received from the terminal 100 (see T312 in FIG. 5). The CO for AP includes the SC for AP and the public key TPK2 of the terminal 100. The public key TPK2 is the same as the public key TPK2 included in the CO for the first printer. The SC for AP also includes a hash value HV1, a group ID "Group1", a public key APK2 of the AP6, and an electronic signature DSap1. The hash value HV1 and the group ID "Group1" are the same as the hash value HV1 and the group ID "Group1" included in the CO for the first printer, respectively. The electronic signature DSap1 is information obtained by hashing a combination of the hash value HV1, the group ID "Group1", and the public key APK2, and encrypting the specific value with the private key tsk2 of the terminal 100, and is a value different from the electronic signature DSpr1 included in the CO for the first printer.

[0052] In T400, the printer 10 transmits a DPP Peer Discovery Request (hereinafter simply referred to as "DReq") including an SC for the first printer to the AP 6. The DReq is a signal requesting the AP 6 to perform authentication and transmit an SC for the AP.

[0053] When the AP 6 receives the DReq from the printer 10 in T400, the AP 6 executes a process for authenticating the sender of the DReq (i.e., the printer 10) and each piece of information in the DReq (i.e., the hash value HV1, “Group1”, and the public key PPK2). Specifically, in T402, the AP 6 first executes a first AP determination process as to whether the hash value HV1 and the group ID “Group1” in the received SC for the first printer match the hash value HV1 and the group ID “Group1” in the SC for the AP included in the stored CO for the AP, respectively. In the case of FIG. 6, the AP 6 determines that there is a match in the first AP determination process, and therefore determines that the authentication of the sender of the DReq (i.e., the printer 10) has been successful. Note that the match between the hash value HV1 in the received SC for the first printer and the hash value HV1 in the SC for the AP included in the stored CO for the AP means that the SC for the first printer and the SC for the AP were generated by the same device (i.e., the terminal 100). Therefore, the AP 6 also determines that the authentication of the generator of the received first SC for the printer (that is, the terminal 100) has been successful.

[0054] The AP6 further decrypts the electronic signature DSpr1 in the SC for the first printer that has already been received, using the public key TPK2 of the terminal 100 included in the stored CO for the AP. In the case of FIG. 6, the decryption of the electronic signature DSpr1 is successful, so the AP6 executes a second AP determination process to determine whether or not a specific value obtained by decrypting the electronic signature DSpr1 matches a value obtained by hashing each piece of information in the SC for the first printer that has already been received (i.e., the hash value HV1, “Group1”, and the public key PPK2). In the case of FIG. 6, the AP6 determines that there is a match in the second AP determination process, so determines that the authentication of each piece of information in the DReq has been successful, and executes the process from T404 onwards. The determination that there is a match in the second AP determination process means that the information in the SC for the first printer that has already been received (i.e., the hash value HV1, “Group1”, and the public key PPK2) has not been tampered with by a third party after the CO for the first printer is stored in the printer 10. On the other hand, if the first AP determination process determines that there is no match, if decryption of the electronic signature DSpr1 fails, or if the second AP determination process determines that there is no match, AP6 determines that authentication has failed and does not perform processing after T404.

[0055] Next, in T404, the AP6 generates a connection key (ie, a shared key) CK1 using the acquired public key PPK2 of the printer 10 and the stored private key ask2 of the AP6 according to ECDH.

[0056] At T410, the AP 6 sends a DPP Peer Discovery Response (hereinafter simply referred to as “DRes”) including an SC for the AP to the printer 10.

[0057] When the printer 10 receives the DRes from the AP6 in T410, the printer 10 executes a process for authenticating the sender of the DRes (i.e., the AP6) and each piece of information in the DRes (i.e., the hash value HV1, “Group1”, and the public key APK2). Specifically, the printer 10 first executes a first PR determination process in T412 regarding whether the hash value HV1 and the group ID “Group1” in the received SC for the AP match the hash value HV1 and the group ID “Group1” in the SC for the first printer included in the stored CO for the first printer, respectively. In the case of FIG. 6, the printer 10 determines that there is a match in the first PR determination process, and therefore determines that the authentication of the sender of the DRes (i.e., the AP6) has been successful. Incidentally, a match between the hash value HV1 in the received SC for the AP and the hash value HV1 in the SC for the first printer included in the stored CO for the first printer means that the SC for the first printer and the SC for the AP were generated by the same device (i.e., the terminal 100). Therefore, the printer 10 also determines that authentication of the generator of the received SC for the AP (i.e., the terminal 100) has been successful.

[0058] The printer 10 further decrypts the electronic signature DSap1 in the received SC for AP by using the public key TPK2 of the terminal 100 included in the stored first CO for printer. In the case of FIG. 6, the decryption of the electronic signature DSap1 is successful, so the printer 10 executes a second PR determination process to determine whether or not a specific value obtained by decrypting the electronic signature DSap1 matches a value obtained by hashing each piece of information in the received SC for AP (i.e., the hash value HV1, “Group1”, and the public key APK2). In the case of FIG. 6, the printer 10 determines that there is a match in the second PR determination process, so determines that the authentication of each piece of information in the DRes has been successful, and executes the process from T414 onward. The determination that there is a match in the second PR determination process means that the information in the SC for AP (i.e., the hash value HV1, “Group1”, and the public key APK2) has not been tampered with by a third party after the CO for AP is stored in the AP6. On the other hand, if the first PR judgment process determines that there is no match, if decryption of the electronic signature DSap1 fails, or if the second PR judgment process determines that there is no match, the printer 10 determines that authentication has failed and does not execute processing after T414.

[0059] In T414, the printer 10 generates a connection key CK1 according to ECDH using the stored private key psk2 of the printer 10 and the public key APK2 of the AP 6 in the received SC for AP. Here, the connection key CK1 generated by the AP 6 in T404 and the connection key CK1 generated by the printer 10 in T414 are the same. As a result, the connection key CK1 for establishing an AP connection is shared between the printer 10 and the AP 6.

[0060] As described above, after the connection key CK1 is shared between the printer 10 and the AP 6, in T420, the printer 10 and the AP 6 execute 4-way handshake communication using the connection key CK1. As a result, an AP connection is established between the printer 10 and the AP 6. When T420 ends, the process of FIG. 6 ends.

[0061] (Auth processing of printer 10; Figure 7) The Auth process implemented by the CPU 32 of the printer 10 will be described with reference to Fig. 7. Of the Auth processes in Fig. 4, the processes executed by the printer 10 are implemented by the processes in Fig. 7.

[0062] In S2, the CPU 32 monitors whether an AReq is received via the Wi-Fi I / F 16 from the terminal that captured the QR code of the printer 10 in the processing of BS (hereinafter referred to as the "initiator terminal"). When the CPU 32 receives an AReq from the initiator terminal (YES in S2), the process proceeds to S4. The processing of T210 in FIG. 4 is realized by the processing in S2. Note that all communications in the processing of FIG. 7 are executed via the Wi-Fi I / F 16. Therefore, hereinafter, the expression "via the Wi-Fi I / F 16" will be omitted.

[0063] In S4, the CPU 32 determines whether the received AReq includes the MAC address "mac_ap". As shown in T106 of FIG. 3, when the "AP communication" button is selected, an AP QR code in which information including the MAC address "mac_ap" is encoded is displayed. This causes the initiator terminal to photograph the AP QR code, obtain the MAC address "mac_ap", and transmit the AReq including the MAC address "mac_ap" to the printer 10. On the other hand, when the "WFD communication" button in the selection screen is selected, a WFD QR code in which information including the MAC address "mac_wfd" used in the WFD connection is encoded is displayed. This causes the initiator terminal to photograph the WFD QR code, obtain the MAC address "mac_wfd", and transmit the AReq including the MAC address "mac_wfd" to the printer 10. If the CPU 32 determines that the received AReq includes the MAC address "mac_ap" (YES in S4), the process proceeds to S10, and if the CPU 32 determines that the received AReq includes the MAC address "mac_wfd" (NO in S4), the process proceeds to S20. If the printer 10 determines that the AReq includes the MAC address "mac_ap" (YES in S4), the printer 10 establishes an AP connection with any AP, and if the printer 10 determines that the AReq includes the MAC address "mac_wfd", the printer 10 establishes a WFD connection with the Initiator terminal. The process of establishing a WFD connection will be described later with reference to FIGS. 12 to 15. With this configuration, the printer 10 can establish an appropriate Wi-Fi connection according to the MAC address included in the AReq.

[0064] In S10, the CPU 32 determines whether or not the AP information 44 is stored in the memory 34. If the AP information 44 is not stored in the memory 34, this means that an AP connection has not been established between the printer 10 and any AP. If the CPU 32 determines that the AP information 44 is not stored in the memory 34 (NO in S10), the process proceeds to S16.

[0065] In S16, the CPU 32 determines the capability of the printer 10 to be "Enrollee."

[0066] Next, in S40, the CPU 32 executes the same processes as T212 to T218 in FIG. 4 (that is, authentication of the initiator terminal and generation of encrypted data).

[0067] Next, in S42, the CPU 32 transmits an ARes including the capability "Enrollee" to the initiator terminal.

[0068] Next, in S44, the CPU 32 executes a Confirm process similar to T230 and T234 in Fig. 4. That is, the CPU 32 decides to operate as an Enrollee. When the process of S44 ends, the process of Fig. 7 ends.

[0069] Furthermore, the fact that the AP information 44 is stored in the memory 34 means that an AP connection has been established between the printer 10 and any AP (for example, AP 6). When the CPU 32 determines that the AP information 44 is stored in the memory 34 (YES in S10), the CPU 32 proceeds to S12.

[0070] In S12, the CPU 32 determines whether the AReq received in S2 includes a value indicating that the capability of the Initiator terminal is capable of operating only as an Enrollee. Circumstances in which the received AReq includes a value indicating that the terminal is capable of operating only as an Enrollee include, for example, a situation in which a program that prioritizes receiving COs from other devices is installed in the Initiator terminal, or a situation in which a user performs an operation to select receiving COs from other devices in the Initiator terminal. If the CPU 32 determines that the received AReq includes a value indicating that the terminal is capable of operating only as an Enrollee (YES in S12), the process proceeds to S14.

[0071] In S14, the CPU 32 determines the capability of the printer 10 to be "Configurator." The following S30 is similar to S40.

[0072] Next, in S32, the CPU 32 transmits an ARes including the capability "Configurator" to the initiator terminal.

[0073] Next, in S34, the CPU 32 executes a Confirm process. In the Confirm process of S34, the CPU 32 determines to operate as a Configurator, unlike the Confirm process executed in S44. When the process of S34 ends, the process of FIG. 7 ends.

[0074] Furthermore, if the CPU 32 determines that the received AReq includes a value indicating that the printer 10 can operate as both a Configurator and an Enrollee, or that the received AReq includes a value indicating that the printer 10 can operate only as a Configurator (NO in S12), the process proceeds to S16. That is, the CPU 32 determines the capability of the printer 10 to be "Enrollee." Then, the processes of S40 to S44 are executed, and the process of FIG. 7 ends.

[0075] Furthermore, if the CPU 32 determines that the received AReq includes the MAC address "mac_wfd" (NO in S4), it executes the processes of S20 to S26. The printer 10 executes G / O Negotiation, which will be described later, and selects either the G / O state or the CL state. If the result of the G / O negotiation shows that the printer 10 is in the G / O state (YES in S20), the CPU 32 proceeds to S24, and if the result of the G / O negotiation shows that the printer 10 is in the CL state (NO in S20), the CPU 32 proceeds to S26.

[0076] In S24, the CPU 32 determines the capability of the printer 10 to be "Configurator." Then, when S24 ends, the CPU 32 executes the processes of S30 to S34, and ends the process of FIG.

[0077] In S26, the CPU 32 determines the capability of the printer 10 to be "Enrollee." After completing S26, the CPU 32 executes the processes of S40 to S44 and ends the process of FIG.

[0078] For example, a comparative example is assumed in which the judgment of S10 (i.e., judgment as to whether or not AP information 44 is stored) is performed before AReq is received from the initiator terminal. For example, the printer 10 performs the judgment of S10 in the BS processing before the Auth processing. In this comparative example, the printer 10 performs the judgment of S10 unnecessarily even when the Auth processing is not performed due to some reason (e.g. poor communication). In contrast, according to the configuration of this embodiment, the printer 10 performs the judgment of S10 when AReq is received from the initiator terminal (YES in S2). According to the configuration of this embodiment, it is possible to prevent the judgment of S10 from being performed unnecessarily. Note that the configuration of the comparative example may be adopted in the modified example.

[0079] (Specific case A; Figures 8 and 9) 8 and 9, a specific case A realized by the process of FIG. 7 will be described. Case A is a continuation of the process of FIG. 2 (i.e., FIGS. 3 to 6). That is, in the initial state of case A, an AP connection is established between the printer 10 and the AP 6. Therefore, the memory 34 of the printer 10 stores the first printer CO as the AP information 44 (see T312 in FIG. 5). Also, the terminal 200 has not established an AP connection with any AP. In this case, after the AP connection is established between the printer 10 and the AP 6, an AP connection is established between the terminal 200 and the AP 6. By establishing an AP connection between the terminal 200 and the AP 6, the terminal 200 can participate in the wireless network formed by the AP 6 as a slave station and can communicate with the printer 10 via the AP 6.

[0080] (Bootstrapping (BS) and Authentication (Auth) in Case A; Figure 8) The BS process and the Auth process in case A will be described with reference to Fig. 8. T455 is similar to T25 in Fig. 2 (i.e., Fig. 3) except that the terminal 200 photographs the AP QR code of the printer 10.

[0081] In T500, terminal 200 generates public key TPK3 and private key tsk3 of terminal 200. T502 is similar to T202 of Fig. 4 except that T502 generates shared key SK3 using private key tsk3 of terminal 200 and public key PPK1 of printer 10. T504 is similar to T204 of Fig. 4 except that T504 encrypts random value RV2 using shared key SK3 to generate encrypted data ED2.

[0082] In this case, for example, the user performs an operation on the terminal 200 to select receiving a CO from another device. Therefore, in T510, the terminal 200 transmits, to the printer 10, an AReq including a value indicating that the capability of the terminal 200 is that it can operate only as an Enrollee. Furthermore, the AReq includes the public key TPK3 of the terminal 200 generated in T500, the encrypted data ED3 generated in T504, and the MAC address "mac_ap".

[0083] When the printer 10 receives the AReq from the terminal 200 in T510, the printer 10 determines in T511a that the received AReq includes the MAC address "mac_ap" (YES in S4 of FIG. 7). In T511b, the printer 10 determines that the first printer CO is stored in the memory 34 as the AP information 44 (YES in S10). In T511c, the printer 10 determines that the received AReq includes a value indicating that the capability of the terminal 200 is capable of operating only as an Enrollee (YES in S12). Then, in T511d, the printer 10 determines the capability of the printer 10 to be "Configurator" (S14).

[0084] Next, the printer 10 executes authentication similar to T212 to T218 in Fig. 4, and the authentication is successful (S30). That is, the printer 10 generates a shared key SK3 using the public key TPK3 of the terminal 200 in the AReq and the private key psk1 of the printer 10 in T512, and decrypts the encrypted data ED3 in the AReq using the shared key SK3 in T514 to obtain a random value RV3. Then, the printer 10 generates a new public key PPK3 and a new private key psk3 of the printer 10 in T516, generates a shared key SK3 using the public key TPK3 of the terminal 200 in the AReq and the private key psk3 of the printer 10 in T517, and encrypts the random value RV3 and the new random value RV4 using the shared key SK3 in T518 to generate encrypted data ED4.

[0085] Next, in T520, the printer 10 transmits an ARes including the public key PPK3 of the printer 10, the encrypted data ED4, and the capability of the printer 10 (i.e., a value indicating that the printer 10 can operate only as a Configurator) to the terminal 200 (S32).

[0086] When the terminal 200 receives the ARes from the printer 10 in T520, it executes authentication similar to T222 and T224 in Fig. 4, and the authentication is successful. That is, in T522, the terminal 200 generates a shared key SK4 using the private key tsk3 of the terminal 200 generated in T500 and the public key PPK3 of the printer 10 in the ARes, and in T524, it decrypts the encrypted data ED4 in the ARes using the shared key SK4 to obtain the random values ​​RV3 and RV4.

[0087] In T530, the terminal 200 sends a Confirm to the printer 10. The Confirm includes information indicating that the terminal 200 operates as an Enrollee and the printer 10 operates as a Configurator. As a result, in T532, the terminal 200 decides to operate as an Enrollee, and in T534, the printer 10 decides to operate as a Configurator.

[0088] (Configuration (Config) and Network Access (NA) in Case A; Figure 9) The Config processing and NA processing in case A will be described with reference to Fig. 9. That is, Fig. 9 is a continuation of Fig. 8. In this case, the terminal 200 is the Enrollee. Therefore, in T600, the terminal 200 transmits CReq to the printer 10. The CReq in this case includes the value "sta" but does not include the value "config".

[0089] When the printer 10 receives the CReq from the terminal 200 in T600, the printer 10 acquires the hash value HV1, the group ID "Group1", and the public key TPK2 from the first printer CO, which is the AP information 44, in T602. Next, the printer 10 generates the first terminal CO in T604. Specifically, the printer 10 executes the following processes.

[0090] The printer 10 generates a specific value by hashing a combination of the hash value HV1, the group ID "Group1", and the public key TPK3 of the terminal 200 in the AReq of T510 in FIG. 8. Then, the printer 10 generates an electronic signature DSta1 by encrypting the generated specific value using the private key tsk2 included in the operation information received from the terminal 100 at T310 in FIG. 5 according to ECDSA. As a result, the printer 10 can generate a first terminal SC including the hash value HV1, the group ID "Group1", the public key TPK3 of the terminal 200, and the electronic signature DSta1. Then, the printer 10 generates a first terminal CO including the first terminal SC and the public key TPK2.

[0091] In T610, the printer 10 transmits a CRes including the first terminal CO to the terminal 200. As a result, the terminal 200 acquires the first terminal CO, and in T612, stores the first terminal CO.

[0092] Next, at T620, the terminal 200 transmits a DReq including the SC for the first terminal to the AP6.

[0093] When the AP6 receives the DReq from the terminal 200 in T620, the AP6 executes authentication of the DReq in T622, similarly to T402 in Fig. 6. In the case of Fig. 9, the hash value HV1 and the group ID "Group1" in the received first terminal SC match the hash value HV1 and the group ID "Group1" in the AP SC included in the stored AP CO, respectively, so the AP6 determines that the authentication is successful in the first AP determination process.

[0094] The AP6 further decrypts the electronic signature DSta1 in the SC for the first terminal that has already been received, using the public key TPK2 included in the stored CO for AP. In the case of Fig. 9, the decryption of the electronic signature DSta1 is successful. In this case, the AP6 determines that the authentication is successful in the second AP determination process, since the specific value obtained by decrypting the electronic signature DSpr1 matches the value obtained by hashing each piece of information (i.e., the hash value HV1, "Group1", and the public key TPK3) in the SC for the first terminal that has already been received.

[0095] Next, in T624, the AP6 generates a connection key CK2 using the acquired public key TPK3 of the terminal 200 and the stored private key ask2 of the AP6 according to ECDH. In T630, the AP6 transmits a DRes including an SC for AP to the terminal 200.

[0096] When terminal 200 receives DRes from AP6 in T630, terminal 200 performs authentication of DRes in T632, similar to T412 in Fig. 6. Terminal 200 first performs a first TA determination process similar to the first PR determination process. In the case of Fig. 9, the hash value HV1 and group ID "Group1" in the received SC for AP match the hash value HV1 and group ID "Group1" in the first terminal SC included in the stored first terminal CO, respectively, so terminal 200 determines that authentication is successful in the first TA determination process.

[0097] Next, the terminal 200 executes a second TA determination process similar to the second PR determination process. Specifically, the terminal 200 decrypts the electronic signature DSap1 in the received SC for AP by using the public key TPK2 included in the stored first CO for terminal. In this case, the specific value obtained by decrypting the electronic signature DSap1 matches the value obtained by hashing each piece of information in the received SC for AP (i.e., the hash value HV1, "Group1", and the public key APK2), so the terminal 200 determines that the authentication is successful in the second TA determination process.

[0098] Next, in T634, the terminal 200 generates a connection key CK2 according to ECDH using the stored private key tsk3 of the terminal 200 and the acquired public key APK2 of the AP 6. As a result, the terminal 200 and the AP 6 establish an AP connection using the connection key CK2 in T640.

[0099] (Specific case B; Figures 10 and 11) 10 and 11, a specific case B realized by the processing in FIG. 7 will be described. Like case A, case B is a continuation of the processing in FIG. 2 (i.e., FIGS. 3 to 6). That is, in the initial state of case A, an AP connection is established between the printer 10 and AP 6. Also, the terminal 200 establishes an AP connection with AP 8. In this case, the devices 8, 10, and 200 execute communication according to the DPP method, thereby newly establishing an AP connection between the printer 10 and AP 8. This allows the printer 10 to be reconnected from the AP 6 to the AP 8.

[0100] (Bootstrapping (BS) and Authentication (Auth) in Case B; Figure 10) The BS process and the Auth process in case B will be described with reference to Fig. 10. T655 is the same as T455 in Fig. 8. T700 to T704 are the same as T500 to T504 in Fig. 8.

[0101] In this case, the user has not performed an operation on the terminal 200 to select receiving COs from other devices. Therefore, in T710, the terminal 200 transmits, to the printer 10, an AReq including a value indicating that the terminal 200 can operate as both a Configurator and an Enrollee as its capability. T710 is similar to T510 in Fig. 8, except that the value of the capability of the terminal 200 is different.

[0102] T711a and T711b are the same as T511a and T511b in Fig. 8. In T511c, the printer 10 determines that the received AReq does not include a value indicating that the capability of the terminal 200 can operate only as an Enrollee (NO in S12). Then, in T711d, the printer 10 determines the capability of the printer 10 to be "Enrollee" (S16).

[0103] T712 to T718 are the same as T512 to T518 in Fig. 8. T720 is the same as T520 in Fig. 8, except that ARes includes a value indicating that the capability of the printer 10 is that it can operate only as an Enrollee.

[0104] T722 and T724 are the same as T522 and T524 in Fig. 8. T730 is the same as T530 in Fig. 8 except that Confirm includes information indicating that the terminal 200 operates as a Configurator and the printer 10 operates as an Enrollee. As a result, in T732, the terminal 200 decides to operate as a Configurator, and in T534, the printer 10 decides to operate as an Enrollee.

[0105] (Configuration (Config) and Network Access (NA) in Case B; Figure 11) The Config processing and NA processing in case B will be described with reference to Fig. 11. That is, Fig. 11 is a continuation of Fig. 10. In this case, the printer 10 is the Enrollee. Therefore, in T800, the printer 10 transmits CReq to the terminal 200. The CReq in this case includes the value "sta" and the value "config".

[0106] When the terminal 200 receives CReq from the printer 10 in T800, the terminal 200 acquires the group ID "Group2", the public key TPK10, and the private key tsk10 from the memory (not shown) of the terminal 200 in T802. In this case, an AP connection is established between the terminal 200 and the AP8. That is, the terminal 200 has executed Config according to the DPP method with the AP8, and at this time, the terminal 200 generates the group ID "Group2", the public key TPK10, and the private key tsk10 and stores them in the memory. That is, in T802, the terminal 200 acquires each piece of information stored in Config. Next, the terminal 200 generates a first printer CO in T804. Specifically, the terminal 200 hashes the public key TPK10 of the terminal 200 to generate a hash value HV2. Furthermore, the terminal 200 generates a specific value by hashing a combination of the hash value HV2, the group ID "Group2", and the public key PPK3 of the printer 10 in the ARes of T720 in FIG. 10. Then, the terminal 100 generates a digital signature DSpr2 by encrypting the generated specific value using the private key tsk10 of the terminal 200. As a result, the terminal 100 generates a first printer SC including the hash value HV2, the group ID "Group2", the public key PPK3 of the printer 10, and the digital signature DSpr2. Then, the terminal 100 generates a first printer CO including the first printer SC and the public key TPK10 of the terminal 200.

[0107] In T810, the terminal 200 transmits a CRes including the first printer CO to the printer 10. As a result, in T812, the printer 10 stores the first printer CO received in T810 as the AP information 44, instead of the first printer CO (i.e., the first printer CO used for AP connection with AP 6) stored as the AP information 44. In other words, the AP information 44 is updated.

[0108] As described above, in this case, an AP connection is established between the terminal 200 and the AP8. For this reason, the AP8 stores the public key APK10 and the secret key ask10 of the AP8, and further stores the CO for the AP received from the terminal 200. The CO for the AP includes the SC for the AP and the public key TPK10 of the terminal 100. The SC for the AP also includes a hash value HV2, a group ID "Group2", the public key APK10 of the AP8, and an electronic signature DSap2. The electronic signature DSap2 is information obtained by hashing a combination of the hash value HV2, the group ID "Group2", and the public key APK10, and encrypting the specific value with the secret key tsk10 of the terminal 200, and is a value different from the electronic signature DSpr2 included in the CO for the first printer.

[0109] 6, except that communication is executed between the AP8 and the printer 10, and a connection key CK3 is generated using the public key PPK3 and the private key ask10 (or the private key psk3 and the public key APK10). As a result, the printer 10 and the AP8 establish an AP connection using the connection key CK3 in T840.

[0110] (Specific case C; Figures 12 to 15) 12 to 15, a specific case C realized by the processing in FIG. 7 will be described. Like case A, case C is a continuation of the processing in FIG. 2 (i.e., FIGS. 3 to 6). That is, in the initial state of case C, an AP connection is established between the printer 10 and the AP 6. In this case, a WFD connection is established between the printer 10 and the terminal 200 by the user selecting the "WFD communication" button.

[0111] (Bootstrapping (BS) in Case C; Figure 12) The processing of BS in case C will be described with reference to Fig. 12. T850 and T852 are similar to T100 and T102 in Fig. 3. In T854, the user operates the operation unit 12 to select the "WFD communication" button in the selection screen. T856 is similar to T106 in Fig. 3, except that a QR code for WFD is displayed on the display unit 14. The QR code for WFD is obtained by encoding the public key PPK1 of the printer 10 and the MAC address "mac_wfd" used for the WFD connection.

[0112] T870 and T872 are similar to T120 and T122 in FIG. 3, except that a QR code for WFD is photographed by terminal 200 and a MAC address “mac_wfd” is acquired by terminal 200.

[0113] Next, the terminal 200 and the printer 10 execute communication of WFD Discovery according to the WFD method in T880. WFD Discovery is communication for searching for the printer 10.

[0114] Next, in T890, the terminal 200 and the printer 10 execute communication of G / O Negotiation according to the WFD method. G / O Negotiation is communication for determining whether to operate in the G / O state or the CL state. In this case, it is determined that the printer 10 will be in the G / O state and the terminal 200 will be in the CL state. As a result, in T892, the terminal 200 will be in the CL state, and in T894, the printer 10 will be in the G / O state. For example, which of the printer 10 and the terminal 200 will be in the G / O state is determined by various factors such as the specifications of the printer 10 or the terminal 200. In this embodiment, when an AP connection is established between the printer 10 and any AP, the printer 10 will be in the G / O state, and when an AP connection is not established between the printer 10 and any AP, the printer 10 will be in the CL state. In a modified example, it may be determined that the terminal 200 will be in the G / O state and the printer 10 will be in the CL state.

[0115] (Authentication (Auth) in Case C; Figure 13) The Auth process in case C will be described with reference to Fig. 13. That is, Fig. 13 is a continuation of Fig. 12. T900 to T904 are the same as T500 to T504 in Fig. 8. T910 is the same as T510 in Fig. 8, except that AReq includes a value indicating that the terminal 200 can operate as both a Configurator and an Enrollee as its capability, and the MAC address "mac_wfd".

[0116] When the printer 10 receives the AReq from the terminal 200 in T910, the printer 10 determines in T911a that the received AReq includes the MAC address "mac_wfd" (NO in S4 of FIG. 7). In T911c, since the printer 10 is in the G / O state (YES in S20), the printer 10 determines the capability of the printer 10 to be "Configurator" (S24). T912 to T934 are the same as T512 to T534 in FIG. 8.

[0117] (Configuration (Config) in Case C; Figure 14) The processing of Config in case C will be described with reference to Fig. 14. That is, Fig. 14 is a continuation of Fig. 13. T1000 is the same as T600 in Fig. 9.

[0118] In T1002, the printer 10 generates a public key PPK4 and a private key psk4 of the printer 10. Next, in T1004, the printer 10 generates a CO for the second terminal. Specifically, the printer 10 executes the following processes.

[0119] First, the printer 10 generates a hash value HV3 by hashing the public key PPK4 of the printer 10. The printer 10 also generates a specific value by hashing a combination of the hash value HV3, the group ID "Group3", and the public key TPK3 of the terminal 200 in the AReq of T910 in FIG. 13. The printer 10 then generates an electronic signature DSta3 by encrypting the generated specific value using the private key psk4 according to ECDSA. As a result, the printer 10 can generate an SC for the second terminal including the hash value HV3, the group ID "Group3", the public key TPK3 of the terminal 200, and the electronic signature DSta3. The printer 10 then generates a CO for the second terminal including the SC for the second terminal and the public key PPK4.

[0120] In T1010, the printer 10 transmits a CRes including the second terminal CO to the terminal 200. As a result, the terminal 200 acquires the second terminal CO, and in T1012, stores the second terminal CO.

[0121] (Network Access (NA) in Case C; Figure 15) The processing of NA in case C will be described with reference to Fig. 15. That is, Fig. 15 is a continuation of Fig. 14.

[0122] In T1020, the printer 10 generates a public key PPK5 and a private key psk5 of the printer 10. Next, in T1022, the printer 10 generates a second printer CO. Specifically, the printer 10 executes the following processes.

[0123] The printer 10 generates a specific value by hashing a combination of the hash value HV3, the group ID "Group3", and the public key PPK5 generated by the T1020. The printer 10 then generates an electronic signature DSpr3 by encrypting the generated specific value using the private key psk4 according to ECDSA. As a result, the printer 10 can generate an SC for the second printer that includes the hash value HV3, the group ID "Group3", the public key PPK5 of the printer 10, and the electronic signature DSpr3. The printer 10 then generates a CO for the second terminal that includes the SC for the second printer and the public key PPK4.

[0124] At T1030, the printer 10 transmits to the terminal 200 a DReq including the SC for the second printer.

[0125] When the terminal 200 receives the DReq from the printer 10 in T1030, it executes authentication of the DReq in T1032, similar to T402 in FIG. 6. Specifically, the terminal 200 judges that the hash value HV3 and the group ID "Group3" in the received SC for the second printer match the hash value HV3 and the group ID "Group3" in the stored SC for the second terminal, respectively. Then, the terminal 200 decrypts the electronic signature DSpr3 in the received SC for the second printer, using the public key PPK4 in the stored CO for the second terminal. The terminal 200 judges that the specific value obtained by decrypting the electronic signature DSpr3 matches the value obtained by hashing each piece of information in the received SC for the second printer (i.e., the hash value HV3, "Group3", and the public key PPK5). From the above, the terminal 200 judges that the authentication of the DReq is successful.

[0126] Next, in T1034, the terminal 200 generates a connection key CK4 using the stored private key tsk3 of the terminal 200 and the acquired public key PPK5 of the printer 10 according to ECDH. In T1040, the terminal 200 transmits a DRes including the SC for the second terminal to the printer 10.

[0127] When the printer 10 receives the DRes from the terminal 200 in T1040, the printer 10 performs authentication of the DRes in T1042, similar to T412 in FIG. 6. Specifically, the printer 10 determines that the hash value HV3 and the group ID "Group3" in the received SC for the second terminal match the hash value HV3 and the group ID "Group3" in the stored SC for the second printer, respectively. Then, the printer 10 decrypts the electronic signature DSt3 in the received SC for the second terminal, using the public key PPK4 in the stored CO for the second printer. The printer 10 determines that the specific value obtained by decrypting the electronic signature DSt3 matches the value obtained by hashing each piece of information (i.e., the hash value HV3, "Group3", and the public key TPK3) in the received SC for the second terminal. From the above, the printer 10 determines that the authentication of the DRes is successful.

[0128] Next, in T1044, the printer 10 generates a connection key CK4 according to ECDH using the acquired public key TPK3 of the terminal 200 and the stored private key psk5 of the printer 10. As a result, the printer 10 and the terminal 200 establish a WFD connection using the connection key CK4 in T1050.

[0129] (Table summarizing each case in this embodiment; FIG. 16) With reference to Fig. 16, a description will be given of each case realized by the Auth process of the printer 10 in Fig. 7. As shown in each case of lines 1 to 8 in Fig. 16, the capability of the printer 10 is determined.

[0130] The cases of line numbers 1 to 4 indicate cases in which an AP connection is established between the terminal that captured the QR code of the printer 10 in the BS process (that is, the "Initiator terminal") and any AP (for example, AP6).

[0131] The case of line number 1 shows a case where an AP connection is not established between the printer 10 and any AP (for example, AP6) and the "AP communication" button is selected on the selection screen (see T102 in FIG. 3) displayed on the printer 10. This case corresponds to the cases in FIG. 2 to FIG. 6. That is, in a situation where an AP connection is established between the initiator terminal and AP6, the printer 10 establishes an AP connection with the AP6. In this case, the printer 10 determines that the AReq includes the MAC address "mac_ap" (YES in S4 in FIG. 7) and determines that the AP information 44 is not stored in the memory 34 (NO in S10). As a result, the printer 10 determines the capability of the printer 10 to be "Enrollee" (S16). In this case, the printer 10 can receive a CO from the initiator terminal and participate as a slave station in the wireless network in which the initiator terminal is currently participating.

[0132] The case of line number 2 shows a case where an AP connection has not been established between the printer 10 and any AP, and the "WFD communication" button is selected on the selection screen. This case corresponds to a case where a WFD connection is established between the printer 10 and the initiator terminal. In this case, the printer 10 determines that the AReq includes the MAC address "mac_wfd" (NO in S4 of FIG. 7). Since an AP connection has not been established between the printer 10 and any AP, the printer 10 is in the CL state (NO in S20). As a result, the printer 10 determines the capability of the printer 10 to be "Enrollee" (S26). In this case, in response to the selection of the "WFD communication" button, the printer 10 can communicate with the initiator terminal according to the WFD method.

[0133] The case of line number 3 shows a case where an AP connection has been established between the printer 10 and AP 6, and the "AP communication" button has been selected on the selection screen. This case corresponds to case B in Figs. 10 and 11. That is, it corresponds to a case where the printer 10 is reconnected from AP 6 to AP 8 in a situation where an AP connection has been established between the initiator terminal and AP 8. In this case, the printer 10 determines its capability to be "Enrollee" (T711a to T711d in Fig. 10, S16 in Fig. 7).

[0134] The case of line number 4 shows a case where an AP connection is established between the printer 10 and any AP, and the "WFD communication" button is selected on the selection screen. This case corresponds to a case where an AP connection is established between the initiator terminal and any AP, but a WFD connection is established between the printer 10 and the initiator terminal. In this case, the printer 10 determines that the AReq includes the MAC address "mac_wfd" (NO in S4 of FIG. 7). Since an AP connection is established between the printer 10 and any AP, the printer 10 is in a G / O state (YES in S20). As a result, the printer 10 determines the capability of the printer 10 to be "Configurator" (S24). In this case, the printer 10 can communicate via an AP, but can also communicate with the initiator terminal according to the WFD method in consideration of security.

[0135] Moreover, the cases of line numbers 5 to 8 indicate cases in which an AP connection is not established between the initiator terminal and any AP (for example, AP6).

[0136] The case of line number 5 is similar to the case of line number 1, except that no AP connection is established between the initiator terminal and any AP. In this case, the printer 10 establishes an AP connection with the AP 6 in a situation where no AP connection is established between the initiator terminal and the AP 6. For example, after an AP connection is established between the printer 10 and the AP 6, the initiator terminal photographs a QR code attached to the AP 6, and an AP connection is also established between the initiator terminal and the AP 6. In this case, the printer 10 determines the capability of the printer 10 to be "Enrollee" (S16 in FIG. 7). In this case, both the printer 10 and the initiator terminal can participate in a wireless network formed by the APs.

[0137] The case of line number 6 is similar to the case of line number 2, except that no AP connection has been established between the initiator terminal and any AP. In this case, the printer 10 determines the capability of the printer 10 to be "Enrollee" (S26 in FIG. 7). In this case, in a situation where neither the printer 10 nor the initiator terminal has established a Wi-Fi connection with an AP, the printer 10 can communicate with the initiator terminal according to the WFD method.

[0138] The case of line number 7 is similar to the case of line number 3, except that an AP connection is not established between the initiator terminal and any AP. This case corresponds to case A in FIG. 8 and FIG. 9. That is, in a situation where an AP connection is not established between the initiator terminal and any AP, and an AP connection is established between the printer 10 and AP6, the initiator terminal establishes an AP connection with AP6. In this case, the printer 10 determines the capability of the printer 10 to be "Configurator" (T511a to T511d in FIG. 8, S14 in FIG. 7). In this case, the printer 10 transmits a CO to the initiator terminal, and can cause the initiator terminal to participate as a slave station in the wireless network in which the printer 10 is currently participating.

[0139] The case of line number 8 is similar to the case of line number 4, except that no AP connection is established between the initiator terminal and any AP. This case corresponds to case C in Figs. 12 to 15. That is, although an AP connection is established between the printer 10 and any AP, the printer 10 establishes a WFD connection with the initiator terminal. In this case, the printer 10 determines the capability of the printer 10 to be "Configurator" (T911a, T911c in Fig. 13, S24 in Fig. 7). In this case, the printer 10 can execute communication via an AP, but can also execute communication with the initiator terminal according to the WFD method, taking security into consideration.

[0140] (Effects of this embodiment) According to the configuration of this embodiment, the printer 10 judges whether the AP information 44 is stored in the memory 34, that is, whether an AP connection is established between the printer 10 and any access point (S10 in FIG. 7). In a situation where an AP connection is established between the printer 10 and the AP6 (YES in S10), the printer 10 plays the role of a Configurator (S14) and transmits a first CO for the terminal to the terminal 200 (T610 in FIG. 9, the case of line number 7 in FIG. 16). As a result, an AP connection can be established between the terminal 200 and the AP6 (T640). In addition, in a situation where an AP connection is not established between the printer 10 and any access point (NO in S10), the printer 10 plays the role of an Enrollee (S16) and receives a first CO for the printer from the terminal 100 (T310 in FIG. 5, the case of line number 1 in FIG. 16). As a result, an AP connection can be established between the printer 10 and the AP6. Therefore, the printer 10 can take on an appropriate role taking into account the situation of the printer 10 itself.

[0141] Furthermore, in a situation where an AP connection is established between the printer 10 and any access point, the printer 10 judges whether or not AReq contains a value indicating that the printer 10 can operate only as an Enrollee, as a capability of the Initiator terminal (S12 in FIG. 7). If the printer 10 judges that AReq contains the value (YES in S12 in FIG. 7), it assumes the role of Configurator (S14, the case of line number 7 in FIG. 16). On the other hand, if the printer 10 judges that AReq does not contain the value (NO in S12 in FIG. 7), it assumes the role of Enrollee (S16, the case of line number 3 in FIG. 16). With this configuration, the printer 10 can assume an appropriate role by considering both the status of the printer 10 itself and the status of the Initiator terminal.

[0142] (Correspondence) The printer 10, the display unit 14, and the Wi-Fi I / F 16 are examples of a "first communication device," a "display unit," and a "wireless interface," respectively. The QR code for AP and the QR code for WFD are examples of "output information." The initiator terminal (e.g., the terminal 100) is an example of a "second communication device." AReq (i.e., DPP Authentication Request) is an example of an "authentication request." ARes (i.e., DPP Authentication Response) is an example of a "first authentication response (and second authentication response)." The capability "Configurator" and the capability "Enrollee" are examples of "first role information" and "second role information," respectively. The first terminal CO of T610 in FIG. 9 is an example of "first wireless setting information." The first printer CO of T310 in FIG. 5 is an example of "second wireless setting information." AP6 is an example of a "first access point." In the case of row number 1 in FIG. 16, AP6 is an example of a "second access point." In the case of line number 3 in Fig. 16, AP8 is an example of a "second access point". In the AReq of T510 in Fig. 8, a value indicating that terminal 200 can operate only as an Enrollee as its capability is an example of "predetermined information". The MAC address "mac_ap" and the MAC address "mac_wfd" are examples of "first usage information" and "second usage information", respectively. AP information 44 is an example of "access point information".

[0143] T106 in Fig. 3 is an example of a process realized by the "output control unit". S2, S10, S32, and S42 in Fig. 7 are examples of a process realized by the "authentication request receiving unit", "first determination unit", "first authentication response transmitting unit", and "second authentication response transmitting unit", respectively. T310 in Fig. 5 and T420 in Fig. 6 are examples of a process realized by the "first wireless setting receiving unit" and "first establishment unit", respectively. T610 in Fig. 9 is an example of a process realized by the "wireless setting transmitting unit".

[0144] Although specific examples of the technology disclosed in this specification have been described in detail above, these are merely examples and do not limit the scope of the claims. The technology described in the claims includes various modifications and variations of the specific examples exemplified above. Modifications are listed below.

[0145] (Variation 1) In place of displaying the QR code at T106 in Fig. 3, the printer 10 may cause the print execution unit 18 to print the QR code. In this variation, the process of causing the print execution unit 18 to print the QR code is an example of an "output control process."

[0146] (Modification 2) Each of the printer 10 and the terminal 100 may further include a wireless interface (e.g., BTI / F, NFC / F, etc.) conforming to a wireless method other than the Wi-Fi method (e.g., BT (abbreviation of Blue Tooth (registered trademark)) method, NFC (abbreviation of Near Field Communication) method, etc.). In this case, in T106 of FIG. 3, the printer 10 may instruct the BTI / F of the printer 10 to transmit DPP information including the public key PPK1 and the MAC address "mac_ap". In this case, the terminal 100 can receive the DPP information via the BTI / F of the terminal 100. In this modification, instructing the BTI / F to transmit the DPP information is an example of "output control processing". In addition, in another modification, in T106 of FIG. 3, the printer 10 may store the DPP information in the NFC / F of the printer 10. In this case, the terminal 100 can receive the DPP information via the NFC / F of the terminal 100. In this modified example, storing the DPP information in the NFC I / F is an example of an "output control process."

[0147] (Modification 3) In the above case A, the printer 10 executes the process of FIG. 2 according to the DPP method to establish an AP connection with the AP 6. Then, in T610 of FIG. 9, the printer 10 generates a first terminal SC using the first printer CO stored in the process of FIG. 2, and transmits the first terminal CO to the terminal 200. Alternatively, the printer 10 may execute communication using a wireless profile (i.e., SSID (abbreviation of Service Set Identifier) ​​and password) according to another method (e.g., WPS (abbreviation of Wi-Fi Protected Setup) method) different from the DPP method among Wi-Fi methods to establish an AP connection with the AP 6. In this case, the printer 10 may transmit the first terminal CO including the wireless profile stored in the printer 10 in the other method to the terminal 200 in place of the first terminal SC in the Config process. This allows the terminal 200 to establish an AP connection with the AP 6 using the received wireless profile. In this modification, the wireless profile is an example of the "first wireless setting information". 7, the printer 10 may determine whether or not a wireless profile is stored as the AP information 44. In this modification, the wireless profile is an example of "access point information."

[0148] (Modification 4) In the above case B, the terminal 200 executes communication according to the DPP method to establish an AP connection with the AP 8. Then, the terminal 200 generates a first printer SC using each piece of information stored in the communication according to the DPP method in T810 of FIG. 11, and transmits the first printer CO to the printer 10. Alternatively, the terminal 200 may execute communication according to another method (for example, WPS (abbreviation of Wi-Fi Protected Setup) method) different from the DPP method among the Wi-Fi methods to establish an AP connection with the AP 8. In this case, the printer 10 may receive from the terminal 200 a first printer CO including a wireless profile stored in the terminal 200 in the other method, instead of the first printer SC. In this modification, the wireless profile is an example of the "second wireless setting information".

[0149] (Modification 5) The Wi-Fi I / F 116 may support the SoftAP method established by the Wi-Fi Alliance instead of the WFD method. In this case, the selection screen of T102 in FIG. 3 may include a "SoftAP communication" button instead of the "WFD communication" button. Here, the QR code for AP displayed when the "AP communication" button in the selection screen is selected is obtained by encoding the public key PPK1 and the first information indicating that communication via an AP is used. On the other hand, the QR code for SoftAP displayed when the "SoftAP communication" button in the selection screen is selected is obtained by encoding the public key PPK1 and the second information indicating that communication according to the SoftAP method not via an AP is used. Furthermore, in this modification, the printer 10 may determine whether or not the AReq includes the first information in the Auth process, instead of the determination in S4 in FIG. 7. When the printer 10 determines that the AReq includes the first information, the printer 10 may proceed to S10 and establish an AP connection with the AP (e.g., AP6). Furthermore, when the printer 10 determines that the AReq includes the second information, the printer 10 may determine the capability of the printer 10 to be either "Configurator" or "Enrollee" and establish a Wi-Fi connection with the Initiator terminal according to the SoftAP method. In this modification, the first information and the second information are examples of "first usage information" and "second usage information", respectively.

[0150] (Variation 6) The process of S12 in FIG. 7 does not need to be executed. In this variation, in the case of row number 3 in the table in FIG. 16, the printer 10 may determine the capability of the printer 10 to be "Configurator". Then, in a situation where an AP connection is established between the initiator terminal and AP8, the printer 10 may generate a first terminal CO for AP6 and transmit the first terminal CO to the initiator terminal. Then, the initiator terminal may reconnect from AP8 to AP6. In this variation, the "second determination unit" and the "predetermined information" can be omitted.

[0151] (Variation 7) The processes of S4, and S20 to S26 in Fig. 7 do not have to be executed. In other words, a WFD connection does not have to be established between the printer 10 and the initiator terminal. In this variation, the "second establishment unit", "first usage information", "second usage information", and "third wireless connection" can be omitted.

[0152] (Variation 8) In the above embodiment, the printer 10 determines whether or not the AP information 44 is stored in the memory 34 (S10 in FIG. 7). Alternatively, the printer 10 may, for example, attempt to send a confirmation signal to the AP and determine whether or not a response signal to the confirmation signal is received. If it is determined that the response signal is received, the printer 10 may proceed to S12, and if it is determined that the response signal is not received, the printer 10 may proceed to S16. In this variation, the "access point information" can be omitted.

[0153] (Variation 9) The "first communication device" does not have to be the printer 10, but may be other devices such as a scanner, a multi-function device, a mobile terminal, a PC, a server, etc. Also, the "second communication device" does not have to be the terminal 100, but may be other devices such as a printer, a scanner, a multi-function device, a camera, etc.

[0154] (Modification 10) In the above embodiment, each process in FIGS. 2 to 15 is realized by software (for example, program 40), but at least one of these processes may be realized by hardware such as a logic circuit.

[0155] The technical elements described in this specification or drawings have technical utility either alone or in various combinations, and are not limited to the combinations described in the claims at the time of filing. In addition, the technologies illustrated in this specification or drawings can achieve multiple objectives simultaneously, and achieving one of these objectives is itself technically useful. [Explanation of symbols]

[0156] 2: communication system, 6, 8: AP, 10: printer, 12: operation unit, 14: display unit, 16: Wi-Fi I / F, 18: print execution unit, 30: control unit, 32: CPU, 34: memory, 40: program, 44: AP information, 100: terminal, 115: camera, 116: Wi-Fi I / F, 200: terminal, 215: camera, 216: Wi-Fi I / F, PPK1, PPK2, PPK3, PPK4, PPK5: public key (printer), TPK1, TPK2, TPK3, TPK10: public key (terminal), APK1, APK2, APK10: public key (AP), psk1, psk2, psk3, psk4, psk5: Private key (printer), tsk1, tsk2, tsk3, tsk10: Private key (terminal), ask1, ask2, ask10: Private key (AP), RV1, RV2, RV3, RV4: Random value, ED1, ED2, ED3, ED4: Encrypted data, SK1, SK2, SK3, SK4: Shared key, HV1, HV2, HV3: Hash value, DSpr1, DSpr2, DSpr3: Electronic signature (printer), DSta1, DSta3: Electronic signature (terminal), DSap1, DSap2: Electronic signature (AP), CK1, CK2, CK3, CK4: Connection key

Claims

1. A first communication device, a wireless interface for performing wireless communication according to the Wi-Fi standard; an output control unit that executes an output control process for outputting to an outside the output information, the output information being in accordance with the Wi-Fi standard and obtained by using a public key of the first communication device; an authentication request receiving unit that receives an authentication request using the public key from a second communication device that has acquired the public key via the wireless interface; a first determination unit that determines whether a wireless connection is established between the first communication device and any access point; a first authentication response transmission unit that transmits, when the authentication request is received from the second communication device and it is determined that a wireless connection is established between the first communication device and a first access point, a first authentication response including first role information indicating that the first communication device plays a first role to the second communication device via the wireless interface, the first role being a role of transmitting, to the second communication device, first wireless setting information for the second communication device to establish a first wireless connection with the first access point; a wireless setting transmission unit configured to transmit the first wireless setting information to the second communication device via the wireless interface after the first authentication response is transmitted to the second communication device; a second authentication response transmission unit that transmits, when the authentication request is received from the second communication device and it is determined that a wireless connection is not established between the first communication device and any access point, a second authentication response including second role information indicating that the first communication device has a second role different from the first role to the second communication device via the wireless interface, the second role being a role of receiving, from the second communication device, second wireless setting information for the first communication device to establish a second wireless connection with a second access point; a first wireless setting receiver that receives the second wireless setting information from the second communication device via the wireless interface after the second authentication response is transmitted to the second communication device; a first establishment unit that establishes the second wireless connection with the second access point via the wireless interface by using the second wireless setting information; A first communication device comprising:

2. 2. The first communication device according to claim 1, wherein the first determination unit determines whether a wireless connection has been established between the first communication device and any access point when the authentication request is received from the second communication device.

3. The first communication device further comprises: a second determination unit that determines whether the authentication request includes predetermined information when the authentication request is received from the second communication device, the predetermined information being information indicating that the second communication device will take on the second role; the first authentication response transmission unit transmits the first authentication response, including the first role information, to the second communication device via the wireless interface when it is determined that a wireless connection is established between the first communication device and the first access point and when it is determined that the authentication request includes the predetermined information; The first communication device according to claim 1 or 2, wherein the second authentication response sending unit further sends the second authentication response including the second role information to the second communication device via the wireless interface when it is determined that a wireless connection has been established between the first communication device and the first access point and when it is determined that the authentication request does not include the specified information.

4. the authentication request includes either first usage information related to the use of communication via an access point or second usage information related to the use of communication not via an access point; the first determination unit, when the authentication request includes the first usage information, determines whether or not a wireless connection is established between the first communication device and any access point; The first communication device further comprises: The first communication device according to any one of claims 1 to 3, further comprising a second establishment unit that establishes a third wireless connection with the second communication device via the wireless interface without going through an access point when the authentication request includes the second usage information.

5. The first communication device according to claim 4 , wherein the third wireless connection is a wireless connection conforming to a Wi-Fi Direct method of the Wi-Fi standard.

6. the first communication device assumes the first role when the first communication device is in a Group Owner state in the Wi-Fi Direct system; The first communication device according to claim 5 , wherein the first communication device assumes the second role when the first communication device is in a client state in the Wi-Fi Direct system.

7. The first communication device according to claim 1 , wherein the output information is information conforming to a Device Provisioning Protocol method of the Wi-Fi standard.

8. The first communication device according to any one of claims 1 to 7, wherein the first determination unit determines that a wireless connection has been established between the first communication device and any of the access points when access point information regarding an access point to which a wireless connection with the first communication device has been established is stored in a memory.

9. The first communication device according to claim 8 , wherein the access point information includes a Signed Connector conforming to a Device Provisioning Protocol method of the Wi-Fi standard.

10. the output information is a code image obtained by encoding the public key, The first communication device according to claim 1 , wherein the output control process is a process for displaying the output information, which is the code image, on a display unit.

11. A computer program for a first communication device, comprising: The first communication device is A wireless interface is provided for performing wireless communication in accordance with the Wi-Fi standard; The computer of the first communication device is composed of the following parts: an output control unit that executes an output control process for outputting to an outside the output information, the output information being in accordance with the Wi-Fi standard and obtained by using a public key of the first communication device; an authentication request receiving unit that receives an authentication request using the public key from a second communication device that has acquired the public key via the wireless interface; a first determination unit that determines whether a wireless connection is established between the first communication device and any access point; a first authentication response transmission unit that transmits, when the authentication request is received from the second communication device and it is determined that a wireless connection is established between the first communication device and a first access point, a first authentication response including first role information indicating that the first communication device plays a first role to the second communication device via the wireless interface, the first role being a role of transmitting, to the second communication device, first wireless setting information for the second communication device to establish a first wireless connection with the first access point; a wireless setting transmission unit configured to transmit the first wireless setting information to the second communication device via the wireless interface after the first authentication response is transmitted to the second communication device; a second authentication response transmission unit that transmits, when the authentication request is received from the second communication device and it is determined that a wireless connection is not established between the first communication device and any access point, a second authentication response including second role information indicating that the first communication device has a second role different from the first role to the second communication device via the wireless interface, the second role being a role of receiving, from the second communication device, second wireless setting information for the first communication device to establish a second wireless connection with a second access point; a first wireless setting receiver that receives the second wireless setting information from the second communication device via the wireless interface after the second authentication response is transmitted to the second communication device; a first establishment unit that establishes the second wireless connection with the second access point via the wireless interface by using the second wireless setting information; A computer program that functions as a

Images