JP2012089911A - Radio communication device, peripheral apparatus, radio communication connection method, and radio communication connection program - Google Patents

Abstract

PROBLEM TO BE SOLVED: To wirelessly connect a radio communication device to a correspondent device by using an appropriate authentication scheme and encryption scheme.SOLUTION: A security discrimination part 304 performs: discriminating whether an encryption system is "encryption included" or "encryption not included" on the basis of Capability information; discriminating whether an encryption system is "WEP" or "others" on the basis of whether the attribute information transmitted from a correspondent device holds either of RSN information or WPA information; discriminating an authentication method based on AKMSuiteList included in the RSN information and WPA information; discriminating an encryption system based on PairwiseCipherSuiteList included in the RSN information and WPA information; if the discrimination result of either step is "encryption not included" or "WEP", assuming the authentication method to be "Shared authentication" and trying a connection to the correspondent device; and if success in connection, determining the authentication method to be "Shared authentication", or if failure in connection, determining the authentication method to be "Open authentication".

Description

  The present invention relates to security settings for wireless communication in a wireless communication device or a device having a wireless communication function.

  In recent years, not only wired LAN (Local Area Network) connection functions but also wireless LAN connection functions have been installed in network compatible printers (hereinafter referred to as “printers”).

  A general method for connecting a printer to a wireless LAN will be briefly described with reference to an arrangement example of a printer and an AP (Access Point) in the infrastructure network of FIG. In the case of an infrastructure type network, as shown in the figure, one or more APs exist around the printer 100. The AP is a base station for constructing a wireless LAN, and the printer 100 can communicate with the PC 101 or the Internet by wirelessly connecting to any of these APs.

  Here, it is desirable that the wireless transmission path between the printer 100 and the AP encrypts the transmission data so that the transmission data is not intercepted or altered in the middle. In order to perform encryption, it is necessary to set an appropriate authentication method and encryption method in the printer and the AP, respectively. However, as shown in FIG. 10, since there are many combinations of authentication methods and encryption methods, for users who do not have knowledge in the security field, appropriate authentication methods and encryption methods are set for the printer and AP, respectively. It is difficult to do. Therefore, various methods for more easily setting the authentication method and the encryption method have been proposed.

  For example, in the first prior art (Patent Document 1), a character type and the number of characters included in a password input by a user are analyzed, and candidates for an appropriate authentication method and encryption method are displayed. Thereby, the user can select an appropriate authentication method and encryption method from the displayed candidates.

  In the second prior art (Patent Document 2), the combination of the authentication method and the encryption method is changed in order and connection to the AP is attempted brute force. This eliminates the need for the user to set the authentication method and encryption method.

JP 2010-136308 A JP 2010-87909 A

  However, in the first prior art, the authentication method and encryption method to be selected are displayed in technical terms such as “WEP”, “WPA2-PSK”, and “TKIP”. Therefore, there is a problem that it is difficult for a user who does not have security knowledge to know which combination of authentication method and encryption method should be selected.

  Further, in the second conventional technique, a brute force search is performed for a combination of an authentication method and an encryption method that can be connected to an AP. However, since there are many combination patterns, there is a problem that it takes time until the wireless communication apparatus is connected to the AP.

  Therefore, an object of the present invention is to enable a user who does not have knowledge in the security field to connect a wireless communication apparatus to an AP by a combination of an appropriate authentication method and encryption method.

  The wireless communication device of the present invention acquires a piece of attribute information transmitted from one or more counterpart devices that can be a communication partner of wireless communication by controlling the wireless communication unit that processes a wireless communication signal and the wireless communication unit. An attribute information acquisition unit, a storage unit that stores one or more attribute information acquired by the attribute information acquisition unit, and an authentication method and encryption for connecting to the counterpart device with reference to the attribute information stored in the storage unit And a connection control unit for connecting to the counterpart device based on the discrimination of the security discriminator. The attribute information is described in the Beacon frame or the Probe Response frame transmitted from the counterpart device. The security discriminating unit uses the “encryption” encryption method based on the capability information held in the attribute information. Is “no encryption”, and if the attribute information does not hold any RSN (Robust Security Network) information or Vendor Specific information, the encryption method is determined to be “WEP”. The authentication method is determined based on the ASN SuiteList information included in the RSN information or the Vendor Specific information stored in the Vendor Specific information. When the encryption method is determined to be “no encryption” or “WEP” in any of the above determinations in the network, the authentication method is assumed to be “Shared authentication” and the connection with the counterpart device is attempted and the connection is successful. When authentication method And determines that the "Shared Authentication", when the connection failed to determine the authentication method as "Open Authentication".

  In a preferred embodiment, the security determination unit includes one or more combinations of one or more authentication methods and encryption methods of the counterpart device determined by the security determination unit based on attribute information, and the device corresponds to the combination. One or more matching authentication method / encryption method combinations are extracted from the authentication method / encryption method combination, and the security strength is highest based on a predetermined rule from the extracted authentication method / encryption method combinations. A combination of authentication scheme and encryption scheme may be selected.

  In a preferred embodiment, the security determination unit may determine that the encryption method is “no encryption” when the privacy bit value included in the capability information is 0.

  In a preferred embodiment, when the privacy bit value included in the capability information is 1 and the communication partner information does not hold any of the RSN information and the Vendor Specific information, the security determination unit sets the encryption method to “ It may be determined as “WEP”.

  In a preferred embodiment, the security discriminating unit determines that the authentication method is “WPA”, “WPA-PSK”, “WPA2”, “WPA2-PSK”, and “Unsupported” based on the Suite Type value included in the AKM SuiteList information. May be determined.

  In a preferred embodiment, the security discriminating unit determines whether the encryption method is “WEB-40”, “TKIP”, “AES”, “WEP-104”, or “unsupported” based on the Cipher value included in the PairCipherSuiteList. It may be determined that either of them.

  According to the present invention, even a user who does not have knowledge in the security field can connect a wireless communication apparatus to an AP by a combination of an appropriate authentication method and encryption method.

Example of arrangement of printer and AP in infrastructure type network. 2 is a functional block diagram of the printer 100. FIG. FIG. 2 is a functional block diagram of a wireless communication device 220. Data structure of a Beacon frame or a Probe Response frame. Data structure of capability information 401. Data structure of RSN information 402 and Vendor Specific information 403. The correspondence table of the Sweet Type value in AKM SuiteList 602 and the authentication method. Table of correspondence between Cipher values and encryption methods in Pairwise CipherSuiteList 601. 5 is a flowchart of security determination processing in a security determination unit 304. A table showing the strength of security in a combination of authentication method and encryption method. 10 is a flowchart of processing for selecting an appropriate authentication method and encryption method in the security determination unit. An example of a selection screen of an AP to be connected and a password input screen at the time of AP connection. Other examples of selection screen of AP to be connected.

  Hereinafter, a printing apparatus (printer) as an example of a peripheral device including a wireless communication apparatus according to an embodiment of the present invention will be described with reference to the accompanying drawings. Note that wireless communication according to the present embodiment conforms to the wireless LAN standard (IEEE802.11).

  FIG. 1 shows an arrangement example of printers and APs in an infrastructure type network. Hereinafter, processing when the printer and the AP are wirelessly connected will be briefly described with reference to FIG.

  First, the printer 100 receives a Beacon frame periodically transmitted from the APs 1 to 4 existing inside the range A by passive scanning. A Beacon frame transmitted from the AP 5 existing outside the range A does not reach the printer 100. Therefore, the printer 100 can discover only AP1-4. Then, the user selects an AP to be connected to the printer 100 from the discovered AP1 to AP4. Next, when the security setting is made for the selected AP, the user inputs a password set in advance for the AP. As a result, the printer 100 is connected to the AP wirelessly. Although the above is an embodiment at the time of passive scan, the same implementation is possible at the time of active scan. An example at the time of active scanning will be shown below.

  First, the printer 100 broadcasts a Probe Request frame. Next, each of the APs 1 to 4 that has received the Probe Request frame returns a Probe Response frame to the printer 100. Next, the printer 100 receives the Probe Response frame. The Probe Response frame plays the same role as the Beacon frame.

  FIG. 2 is a functional block diagram of the printer 100. As illustrated in FIG. 1, the printer 100 includes a printing unit 201, a display unit 202, an operation unit 203, and a network unit 204. The network unit 204 includes a print protocol unit 211, a network protocol unit 212, a connection monitoring unit 213, and a wireless communication device 220. Hereinafter, each functional block will be described.

  The printing unit 201 performs printing based on an input operation from the operation unit 203 and print data acquired via the network unit 204. The printing unit 201 includes a print head, a paper feed mechanism, and the like, and performs printing on a print medium such as paper.

  The display unit 202 includes a display device such as a liquid crystal panel, for example, and displays various information of the printer on the screen. In the display unit 202, for example, in addition to information related to printing such as the printing status, the reception status of print data, and the remaining amount of ink, as will be described later, a selection screen of APs to be connection destinations of printers, printers and APs Is displayed, such as an authentication method and encryption method that are compatible with the password, and a password input screen for connecting to the AP.

  The operation unit 203 is an input device such as a push button, for example, and accepts an input operation from a user. The operation unit 203 accepts selection of an AP to which a printer is to be connected and input of a password for connecting to the AP, as will be described later, in addition to those related to printing such as printing start / stop.

  The network unit 204 is an interface for communicating with the outside, and includes a print protocol unit 211, a network protocol unit 212, a connection monitoring unit 213, and a wireless communication device 220. The network unit 204 performs processing related to wireless data transmission / reception. For example, the network unit 204 receives print data from the PC via wireless communication, or transmits data related to the print status or printer status to the PC.

  The print protocol unit 211 processes a communication protocol for a network compatible printer. For example, the print protocol unit 211 processes information such as print status, print data, and ink remaining amount that is transmitted and received via the LAN.

  The network protocol unit 212 processes a data communication protocol transmitted / received on the LAN. For example, the network protocol unit 212 processes a TCP / IP protocol.

  The connection monitoring unit 213 monitors the connection state between the printer and the AP, and performs reconnection processing when disconnected.

  The wireless communication device 220 is a device that controls wireless communication signals when the printer is connected to the LAN wirelessly.

  FIG. 3 is a functional block diagram of the wireless communication device 220. As shown in the figure, the wireless communication device 220 includes a wireless communication control unit 301, an attribute information acquisition unit 302, a storage unit 303, a security determination unit 304, a connection control unit 305, a security method storage unit 306, and a device specification storage unit. 307. Hereinafter, each functional block will be described.

  The wireless communication unit 301 processes a wireless communication signal. Specifically, signal processing corresponding to IEEE 802.11a / b / g / n, communication data processing, communication data encryption processing and decryption processing, communication speed control processing, and the like are performed. Note that the wireless communication unit 301 may be realized by, for example, hardware such as a transmission / reception antenna for a wireless communication signal and a predetermined processor for controlling the hardware. The following control units, storage units, and the like can be realized by executing a predetermined computer program using a processor and a memory.

  The attribute information acquisition unit 302 controls the wireless communication unit 301 to acquire attribute information transmitted from one or more counterpart devices (for example, APs) that can be a communication partner of wireless communication. Here, the attribute information is Beacon frame information periodically transmitted from the counterpart device. Next, the attribute information acquisition unit 302 stores all of the acquired one or more attribute information in the storage unit 303. Note that the attribute information may be information of a probe response frame. Note that the data structures of the Beacon frame and the Probe Response frame will be described later with reference to FIG.

  The storage unit 303 stores one or more pieces of attribute information acquired from each counterpart device by the attribute information acquisition unit 302. In addition, the storage unit 303 returns corresponding attribute information in response to a request from another functional block.

  First, the security determination unit 304 acquires attribute information of a counterpart device to be a communication partner from one or more attribute information stored in the storage unit 303. Hereinafter, the acquired attribute information is referred to as counterparty attribute information. Next, the security determination unit 304 extracts, from the counterparty attribute information, a combination of one or a plurality of authentication schemes and encryption schemes supported by the counterparty apparatus that transmitted the information. Hereinafter, the combination of the extracted authentication method and encryption method is used as counterparty security correspondence information. Next, the security determination unit 304 acquires, from the device specification storage unit 307, a combination of one or more authentication methods and encryption methods supported by its own device. Hereinafter, the acquired combination of the authentication method and the encryption method is set as self-device security correspondence information. It is assumed that the own device security correspondence information is set in advance. Next, the security determination unit 304 extracts a combination of one or a plurality of matching authentication methods and encryption methods in the counterparty security support information and the local device security support information. Next, the security determination unit 304 determines one combination having the highest security strength from the extracted combination of one or more authentication methods and encryption methods. Hereinafter, one combination having the highest security strength is referred to as a security discrimination result. It should be noted that the other party security information extraction method will be described later with reference to FIG. The security strength comparison method will be described later with reference to FIG.

  The connection control unit 305 performs connection start processing with the counterpart device based on the security determination result determined by the security determination unit 304. Specifically, the connection start process is a process for transmitting / receiving an authentication frame and an association frame to / from the counterpart device. In addition, the connection control unit 305 also performs connection termination processing with the counterpart device. Specifically, the connection termination process is a process of transmitting / receiving a deauthentication frame and a dissociation frame to / from a counterpart device.

  The security method storage unit 306 stores own device security correspondence information in advance. As described above, the self-device security support information is information on a combination of one or more authentication methods and encryption methods supported by the self-device.

  The security method storage unit 306 stores data indicating the correspondence relationship between the Suite Type value and the authentication method as shown in FIG. In addition, data indicating the correspondence between Cipher values and encryption methods as shown in FIG. 8 is also stored. Further, as shown in FIG. 10, data relating to the strength of security by the combination of the authentication method and the encryption method is also stored. It is assumed that these data are stored in advance in the security method storage unit 306. Details of FIGS. 7, 8, and 10 will be described later.

  FIG. 4 shows the data structure of the Beacon frame and the Probe Response frame. As shown in the figure, in the Beacon frame and the Probe Response frame, various information related to the AP that transmitted the frame is described. Note that the Beacon frame and the Probe Response frame have the same data structure. Therefore, in the following description, a portion described as a Beacon frame may be read as a Probe Response frame. The Beacon frame holds Capability information 401 in which the presence / absence of security settings is described, RSN (Robust Security Network) information 402 in which information related to security is described, Vender Specific information 403, and the like. The Beacon frame does not necessarily hold all the various types of information shown in the figure. For example, the Beacon frame may not hold the RSN information 402. The Vendor Specific information 403 is a generic name for information used uniquely by each Vendor, and here is WPA (Wi-Fi Protected Access) (registered trademark) information. Therefore, hereinafter, the Vendor Specific information 403 is referred to as WPA information 403.

  FIG. 5 shows the data structure of the capability information 401. As shown in the figure, the capability information 401 holds a privacy bit 501 for determining whether or not there is a security setting. Here, when the bit value of the privacy bit 501 is “0”, it can be determined as “no encryption”, and when the bit value is “1”, it can be determined as “encrypted”.

  FIG. 6 shows the data structure of RSN information 402 and WPA information 403. The RSN information 402 and the WPA information 403 have the same data structure. However, the data content described may be different. RSN information and WPA information hold AKM SuiteList 602 and Pairwise CipherList 601 as shown in the figure. Here, the authentication method is determined by the value of AKM SuiteList 602. Also, the encryption method is determined by the value of PairCipherList 601. Note that there may be a plurality of AKM SuiteLists 602 and PairCipherLists 601, respectively.

  FIG. 7 is a correspondence table between a Suite Type value and an authentication method in AKM SuiteList 602. As shown in the figure, when the Suite Type value is “00-50-F2-01”, the authentication method can be determined as “WPA”. When the Suite Type value is “00-50-F2-02”, the authentication method can be determined as “WPA-PSK”. In addition, when the Suite Type value is “00-0F-AC-01”, the authentication method can be determined as “WPA2”. Further, when the Suite Type value is “00-0F-AC-02”, the authentication method can be determined as “WPA2-PSK”.

  FIG. 8 is a correspondence table between Cipher values and encryption methods in PairCipherSuiteList 601. As shown in the figure, when the Cipher value of PairCipherSuiteList 601 is “00-50-F2-01”, the encryption method can be determined as “WEP40”. When the Cipher value is “00-50-F2-02”, the encryption method can be determined as “TKIP”. When the Cipher value is “00-50-F2-04”, the encryption method can be determined as “AES”. When the Cipher value is “00-50-F2-05”, the encryption method can be determined as “WEP-104”. When the Cipher value is “00-0F-AC-01”, the encryption method can be determined as “WEP-40”. When the Cipher value is “00-0F-AC-02”, the encryption method can be determined as “TKIP”. When the Cipher value is “00-0F-AC-04”, the encryption method can be determined as “AES”. When the Cipher value is “00-0F-AC-05”, the encryption method can be determined as “WEP-104”.

  FIG. 9 is a flowchart of the security determination process in the security determination unit 304.

  First, the security determination unit 304 acquires one piece of attribute information of the AP to which the printer is to be connected, from one or more pieces of attribute information stored in the storage unit 303. This is communication partner attribute information. Here, a method for selecting an AP to which a printer is to be connected will be described later with reference to FIG.

  Next, the security determination unit 304 refers to the communication partner attribute information and checks the value of the privacy bit 501 included in the capability information 401 (S901).

  If the value of the privacy bit 501 is “0” in the check in step S901, it is determined that the encryption method is “no encryption”, and the process proceeds to step S908. On the other hand, if the value of the privacy bit 501 is “1”, the encryption method is determined to be “encrypted”, and the process proceeds to step S902.

  First, the processing from step S902 will be described first. The security determination unit 304 determines whether the communication partner attribute information includes the RSN information 402 or the WPA information 403 (S902).

  If the determination result in step S902 is “no RSN information” and “no WPA information”, the process proceeds to step S909. On the other hand, if the determination result in step S902 is other than that, the process proceeds to step S903.

  Next, the process from step S903 will be described first. The security determination unit 304 checks the Suite Type value included in the AKM SuiteList 602 from the RSN information 402 or the WPA information 403 included in the communication partner attribute information (S903).

  Here, when the Suite Type value checked in step S903 does not correspond to any of “WPA”, “WPA-PSK”, “WPA2”, and “WPA2-PSK” in the table 700 of FIG. And the encryption method is determined as “unsupported” (S907), and the process ends. On the other hand, otherwise, the process proceeds to step S904.

  Next, processing from step S904 will be described. The security determination unit 304 refers to the table 700 of FIG. 7 and determines whether the Suite Type value corresponds to “WPA”, “WPA-PSK”, “WPA2”, or “WPA2-PSK” of the authentication method. A determination is made (S904).

  Next, the security determination unit 304 checks the Cipher value included in the PairCipherSuiteList 601 from the RSN information 402 or the WPA information 403 included in the communication partner attribute information (S905).

  Here, if the Cipher value checked in step S905 does not correspond to any of “WEP-40”, “WEP-104”, “TKIP”, and “AES” in the table 800 of FIG. Each of the encryption methods is determined as “unsupported” (S907), and the process is terminated. On the other hand, in other cases, the process proceeds to step S906.

  Next, processing from step S906 will be described. The security discriminating unit 304 refers to the table 800 in FIG. 8 and determines whether the Cipher value corresponds to “WEP-40”, “WEP-104”, “TKIP”, or “AES” of the encryption method. A determination is made (S906). Then, the process ends.

  Here, returning to step S901, the case where the value of the privacy bit 501 is “0”, that is, “no encryption” will be described below.

  First, the security determination unit 304 determines that the encryption method is “no encryption” (S908). Next, the security determination unit 304 instructs the connection control unit 305 to attempt to connect to the AP assuming that the authentication method is “Shared authentication” (S910). Here, the connection control unit 305 causes the display unit 202 to display a password input screen for connecting to the AP, and tries to connect to the AP with the password input by the user. Next, the security determination unit 304 checks whether or not the connection in step S910 is successful (S911).

  Here, when the connection is successful, the authentication method is determined as “Shared authentication” (S915), and the process ends. On the other hand, if the connection fails, the process proceeds to step S912.

  Next, processing from step S912 will be described. The security determination unit 304 instructs the connection control unit 305 to attempt to connect to the AP assuming that the authentication method is “Open authentication” (S912). Next, the connection control unit 305 attempts to connect to the AP using the password input in step S910. Next, it is checked whether or not the connection in step S912 is successful (S913).

  If the connection is successful, the authentication method is determined to be “Open authentication” (S914), and the process ends. On the other hand, if the connection fails, the authentication method and the encryption method are each determined to be “unsupported” (S907), and the process ends.

  Here, returning to step S902, the case where the communication partner attribute information is “no RSN information” and “no WPA information”, that is, when neither the RSN information 402 nor the WPA information 403 exists in the communication partner attribute information, Explained.

  First, the security determination unit 304 determines that the encryption method is “WEP”, and proceeds to step S910. Since the processing after step S910 is the same as described above, the description thereof is omitted.

  Through the above processing, it is possible to extract a combination of one or a plurality of authentication methods and encryption methods supported by the AP to which the printer is to be connected. This extracted combination is used as counterparty security correspondence information as described above.

  When the AP supports a plurality of authentication schemes and encryption schemes, a combination of a plurality of authentication schemes and encryption schemes is described in the counterparty security support information. In addition, the device itself may support a plurality of authentication methods and encryption methods. At this time, the own device needs to select an appropriate authentication method and encryption method when connecting to the AP. Therefore, a method for selecting an appropriate authentication method and encryption method will be described below.

  FIG. 10 is a table showing the strength of security in the combination of the authentication method and the encryption method. In the table 1000 of the figure, the upper combination has higher security strength. Also, the strength of security strength in the combination of authentication method and encryption method changes the order of security strength from the viewpoint of eavesdropping or network intrusion, but this figure shows the strength of security strength from the viewpoint of eavesdropping. It is.

  FIG. 11 is a flowchart of processing for selecting an appropriate authentication method and encryption method in the security determination unit 304. Hereinafter, the flowchart shown in FIG. 11 will be described with reference to FIG.

  First, the security discriminating unit 304 compares the counterparty security correspondence information with the own device security correspondence information stored in the device specification storage unit 307, and compares one or more authentication methods and encryption methods described in both. A combination is extracted (S1101). Next, in step S1101, it is checked whether at least one or more can be extracted (S1102). Here, if it can be extracted (YES), the process proceeds to step S1103. On the other hand, if it cannot be extracted (NO), the security determination unit 304 determines that connection to the selected AP is impossible (S1104), and ends the process.

  Next, processing from step 1103 will be described. The security determination unit 304 compares the combination of one or more authentication methods and encryption methods extracted in step S1101 based on the table 1000 in FIG. 10, and selects the combination with the highest security strength. Then, the selected combination is passed to the connection control unit 305 as a security discrimination result (S1104).

  That is, when there are a plurality of combinations of authentication methods and encryption methods that can be connected to the AP, the security determination unit 304 selects the combination with the highest security strength.

  Next, an example when the user connects the printer to the AP using the method for automatically discriminating between the authentication method and the encryption method described above will be described.

  FIG. 12 shows an example of an AP selection screen to be connected and a password input screen at the time of AP connection.

  First, an SSID (Service Set Identifier) list screen 1210 is displayed on the display unit 202. Here, the SSID is character string data that can uniquely identify an AP, and is preset in each AP. As shown on the screen 1210, a “strength” column may be provided, and the radio wave intensity of each AP may be displayed with a radio wave mark or the like. The radio wave intensity can be calculated with reference to an RSSI (Received Signal Strength Indicator) value of the Beacon frame or the Probe Response frame.

  Next, the user selects an AP to which the printer is to be connected from the SSID list via the operation unit 203. Here, it is assumed that an AP with “SSID: BBBB” is selected.

  Next, the connection control unit 305 causes the display unit 202 to display a password input screen 1220 necessary for connecting to the previously selected AP. Note that the connection control unit 305 may provide a “security” field as shown on the screen 1220 and display the security discrimination result (for example, “WPA2-PSK (AES)”) received from the security discrimination unit 304. In addition, the connection control unit 305, based on the security determination result received from the security determination unit 304, can input character types (for example, “half-width alphanumeric characters + symbols”) and the maximum number of characters that can be input (for example, “maximum 63 characters”). May be displayed. Furthermore, other characters or more may not be input based on the character type that can be input and the maximum number of characters that can be input.

  Next, the user inputs a password via the operation unit 203 and presses an “OK” button. Note that the connection control unit 305 determines whether the input password does not satisfy the predetermined requirement based on the security determination result received from the security determination unit 304, or the input password does not satisfy the predetermined security strength. The user may be requested to re-enter the password.

  Next, the connection control unit 305 causes the display unit 202 to display a screen 1230 indicating that connection start processing is being performed. Then, the connection control unit 305 performs an authentication and association connection start process for the AP with the SSID selected earlier, using the security determination result and the password. Next, when the connection control unit 305 is successfully connected to the AP, the connection control unit 305 causes the display unit 202 to display a screen 1240 indicating that the connection is successful. On the other hand, when the connection control unit 305 fails to connect to the AP, the connection control unit 305 causes the display unit 202 to display a screen (not shown) indicating that the connection has failed. At this time, the cause of the failure may be displayed together on the screen.

  FIG. 13 is another example of an AP selection screen to be connected. In the description so far, after the user selects an AP to be connected, the authentication method and encryption method of the selected AP are determined. However, the authentication method and the encryption method may be determined in advance for all the attribute information acquired by the attribute information acquisition unit. As a result, as shown in the SSID selection screen 1310 in the figure, the security strength of the authentication method and encryption method supported by each AP is displayed as “strong”, “medium”, and “weak” in the “security” column. can do. Here, the security strength is determined based on the table 1000 of FIG. 10 as described above.

  Note that the SSID selection screen 1310 may be rearranged according to the security strength, or an SSID with a security strength lower than a predetermined level may be hidden. Also, SSIDs whose security strength is lower than a predetermined value and whose radio field strength is weaker than a predetermined value may be hidden. Moreover, you may make it rearrange according to security intensity | strength.

  According to the present embodiment, the user can wirelessly connect the printer to the AP with a combination of the authentication method and the encryption method with the highest security strength by simply inputting the password without selecting the authentication method and the encryption method by itself. can do.

  In the above-described embodiment of the present invention, a printer provided with a wireless communication device is described as an example. However, the present invention can be applied to any electronic device provided with a wireless communication device or a wireless communication function. For example, the present invention can be applied to computer peripheral devices such as computers, projectors, scanners, and digital cameras, manufacturing devices, and electrical appliances. That is, the above-described embodiments of the present invention are exemplifications for explaining the present invention, and are not intended to limit the scope of the present invention only to those embodiments. Those skilled in the art can implement the present invention in various other modes without departing from the gist of the present invention.

100 Printer 101 PC
DESCRIPTION OF SYMBOLS 201 Printing part 202 Display part 203 Operation part 204 Network part 220 Wireless communication apparatus 301 Wireless communication part 302 Attribute information acquisition part 303 Storage part 304 Security discrimination part 305 Connection control part 306 Security method storage part 307 Device specification storage part

Claims (9)

A wireless communication unit for processing wireless communication signals;
An attribute information acquisition unit that controls the wireless communication unit to acquire attribute information transmitted from one or more counterpart devices that can be a communication partner of wireless communication;
A storage unit for storing one or more of the attribute information acquired by the attribute information acquisition unit;
Referring to the attribute information stored in the storage unit, a security determination unit for determining an authentication method and an encryption method for connecting to the counterpart device;
A connection control unit for connecting to the counterpart device based on the determination result of the security determination unit;
The attribute information is information described in a Beacon frame or a Probe Response frame transmitted from the counterpart device,
The security determining unit determines whether the encryption method is “with encryption” or “without encryption” based on the capability information held in the attribute information, and the attribute information is RSN (Robust Security Network) information and If none of the Vendor Specific information is held, the encryption method is determined as “WEP”, the authentication method is determined based on the RSN information held in the attribute information or the AKM SuiteList information included in the Vendor Specific information, and the attribute The encryption scheme is determined based on the PairCipherSuiteList information included in the RSN information or Vendor Specific information held by the information, and the encryption scheme is “no encryption” or “ If it is determined that the authentication method is “Shared authentication”, the connection is attempted with the counterpart device. When the connection is successful, the authentication method is determined as “Shared authentication”. A wireless communication apparatus, wherein the authentication method is determined as “Open authentication”.   The security determination unit includes a combination of one or more authentication methods and encryption methods of the counterpart device determined by the security determination unit based on the attribute information, and one or more authentication methods and ciphers corresponding to the device. One or a plurality of matching authentication methods and encryption methods are extracted from the combination of methods, and the authentication method having the highest security strength based on a predetermined rule from the extracted combinations of authentication methods and encryption methods, and The wireless communication apparatus according to claim 1, wherein a combination of encryption methods is used as a determination result.   The wireless communication apparatus according to claim 1, wherein the security determination unit determines that the encryption method is “no encryption” when a privacy bit value included in the capability information is zero.   The security discrimination unit sets the encryption method to “WEP” when the privacy bit value included in the capability information is 1 and the communication partner information does not hold any of the RSN information and the vendor specific information. The wireless communication apparatus according to claim 1, wherein:   The security determination unit determines whether the authentication method is “WPA”, “WPA-PSK”, “WPA2”, “WPA2-PSK”, or “unsupported” based on the Suite Type value included in the AKM SuiteList information. The wireless communication apparatus according to claim 1, wherein it is determined that   Based on the Cipher value included in the PairCipherSuiteList, the security discriminating unit determines whether the encryption method is “WEP-40”, “TKIP”, “AES”, “WEP-104”, or “not supported”. The wireless communication device according to claim 1, wherein the wireless communication device is determined to be present. A peripheral device comprising a wireless communication device,
The wireless communication device
A wireless communication unit for processing wireless communication signals;
An attribute information acquisition unit that controls the wireless communication unit to acquire attribute information transmitted from one or more counterpart devices that can be a communication partner of wireless communication;
A storage unit for storing one or more of the attribute information acquired by the attribute information acquisition unit;
Referring to the attribute information stored in the storage unit, a security determination unit for determining an authentication method and an encryption method for connecting to the counterpart device;
A connection control unit for connecting to the counterpart device based on the determination result of the security determination unit;
The attribute information is information described in a Beacon frame or a Probe Response frame transmitted from the counterpart device,
The security determining unit determines whether the encryption method is “with encryption” or “without encryption” based on the capability information held in the attribute information, and the attribute information is RSN (Robust Security Network) information and If none of the Vendor Specific information is held, the encryption method is determined as “WEP”, the authentication method is determined based on the RSN information held in the attribute information or the AKM SuiteList information included in the Vendor Specific information, and the attribute The encryption scheme is determined based on the PairCipherSuiteList information included in the RSN information or Vendor Specific information held by the information, and the encryption scheme is “no encryption” or “ If it is determined that the authentication method is “Shared authentication”, the connection is attempted with the counterpart device. When the connection is successful, the authentication method is determined as “Shared authentication”. A peripheral device, wherein the authentication method is determined as “Open authentication”. The information described in the Beacon frame or Probe Response frame transmitted from the counterpart device is received as attribute information,
Based on the capability information held in the attribute information, it is determined whether the encryption method is “with encryption” or “without encryption”, and the attribute information is either RSN (Robust Security Network) information or Vendor Specific information. If not, the encryption method is determined to be “WEP”, the authentication method is determined based on the RSN information held in the attribute information or the AKM SuiteList information included in the Vendor Specific information, and the RSN information held in the attribute information Alternatively, when the encryption method is determined based on the PairCipherSuiteList information included in the Vendor Specific information, and the encryption method is determined to be “no encryption” or “WEP” in any of the determinations in the security determination unit, Assuming that the method is “Shared authentication”, a connection is attempted with the counterpart device. When the connection is successful, the authentication method is determined as “Shared authentication”, and when the connection fails, the authentication method is determined as “Open authentication”. And
A wireless communication connection method comprising performing wireless communication connection with the counterpart device based on the determined authentication method and encryption method. When executed on a wireless communication device,
The information described in the Beacon frame or Probe Response frame transmitted from the counterpart device is received as attribute information,
Based on the capability information held in the attribute information, it is determined whether the encryption method is “with encryption” or “without encryption”, and the attribute information is either RSN (Robust Security Network) information or Vendor Specific information. If not, the encryption method is determined to be “WEP”, the authentication method is determined based on the RSN information held in the attribute information or the AKM SuiteList information included in the Vendor Specific information, and the RSN information held in the attribute information Alternatively, when the encryption method is determined based on the PairCipherSuiteList information included in the Vendor Specific information, and the encryption method is determined to be “no encryption” or “WEP” in any of the determinations in the security determination unit, Assuming that the method is “Shared authentication”, a connection is attempted with the counterpart device. When the connection is successful, the authentication method is determined as “Shared authentication”, and when the connection fails, the authentication method is determined as “Open authentication”. And
A wireless communication connection program for performing wireless communication connection with the counterpart device based on the determined authentication method and encryption method.

Images