Dynamic Key-Pair Authentication for Secure DPP Communication Setup

Resolve Bottlenecks,
Find Innovative Solutions
Generate Solutions

Solution Overview

Problem

Existing wireless communication setups using QR codes for DPP are vulnerable to unauthorized access due to the use of pre-shared public keys, allowing third parties to perform unintended setups, and users can mistakenly repeat previous setups.

Innovation Solution

A system for generating a new pair of public and secret keys in communication apparatuses, where a trusted platform module (TPM) manages key generation and authentication, ensuring secure communication parameters are shared only with authorized devices.

Engineering Contradictions & Design Principles

VSEngineering Contradiction Analysis

1Ease of operation

If a pre-shared public key is used for DPP authentication, then setup convenience is improved, but security is worsened due to unauthorized access risks

Engineering Contradiction:
Improvesetup convenienceVSAvoidsecurity
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

The system generates a new key pair specifically for DPP authentication at the time of setup, rather than using a pre-shared key. This preliminary generation of authentication credentials ensures that each setup operation uses a unique, secure key pair that hasn't been exposed to potential attackers.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

The authentication mechanism changes from using a static pre-shared public key to using a dynamically generated public key specific to each DPP setup operation. This parameter change in the authentication credentials fundamentally improves security while maintaining operational convenience.

Inventive Principle:
Principle #35Parameter changes

2Device complexity

If a pre-shared public key is used for multiple purposes, then device complexity is reduced, but security is worsened due to key exposure risks

Engineering Contradiction:
Improvekey management complexityVSAvoidsecurity
Core Design Contradiction:
Device complexityVSReliability

Solution Approach 1:

The system segments the key usage by creating separate key pairs for different purposes: one key pair for DPP authentication and another for general device authentication. This segmentation prevents compromise of one key from affecting other security functions.

Inventive Principle:
Principle #1Segmentation

Solution Approach 2:

The system applies different security qualities to different keys: the DPP-specific key pair is generated with high security requirements and used only for DPP authentication, while other keys serve different purposes. This localized security approach optimizes both security and complexity management.

Inventive Principle:
Principle #3Local quality

3Ease of operation

If DPP setup is performed multiple times with the same public key, then ease of operation is improved, but reliability is worsened due to unintended repeated setups

Engineering Contradiction:
Improvesetup easeVSAvoidsetup accuracy
Core Design Contradiction:
Ease of operationVSReliability

Solution Approach 1:

The system generates a new key pair at the beginning of each DPP setup operation and uses this newly generated public key for authentication. This preliminary generation ensures that each setup operation is distinct and cannot be inadvertently repeated, as the authentication key changes with each setup.

Inventive Principle:
Principle #10Preliminary action

Solution Approach 2:

Instead of reusing the same public key across multiple setups, the system creates a copy of the key generation process for each setup operation. This results in a unique key pair for each setup, preventing unintended repetition while maintaining operational simplicity.

Inventive Principle:
Principle #26Copying

Data Source

PatentUS20250286721A1Communication apparatus, method for controlling communication apparatus, and storage medium
Publication Date: 2025.09.11 CANON KK
  • US20250286721A1 patent drawing
  • US20250286721A1 patent drawing
  • US20250286721A1 patent drawing

AI summary

A communication apparatus includes a generation unit configured to generate a new pair of a public key and a secret key paired with the public key in a case where a predetermined condition is satisfied, a provision unit configured to externally provide information including at least the public key generated by the generation unit, a first reception unit configured to receive, from an external apparatus after the information is provided by the provision unit, an authentication request including information generated using at least the public key, a transmission unit configured to transmit, to the external apparatus, an authentication response as a response to the authentication request in a case where the authentication request is received, and a second reception unit configured to receive, from the external apparatus after the authentication response is transmitted to the external apparatus, configuration information including a communication parameter.