JP5127391B2 - Management device for managing radio parameters, control method for management device, and computer program for causing computer to execute the control method - Google Patents

Description

  The present invention relates to a management apparatus that manages wireless parameters, a control method for the management apparatus, and a computer program that causes a computer to execute the control method.

  When communication is performed using an IEEE 802.11 wireless LAN, wireless communication parameters (hereinafter referred to as wireless parameters) such as a communication channel, a network identifier (SSID), an encryption method, an encryption key, an authentication method, and an authentication key must be set in the device. Don't be. Usually, such wireless parameters are set using the user interface of the device. However, this is a troublesome work, and it is not easy to input a character string such as a network identifier and an encryption key in a device other than a personal computer (hereinafter referred to as a PC), such as a digital camera or a printer.

  Therefore, techniques for easily setting wireless parameters for wireless LAN devices have been proposed (Patent Documents 1 and 2).

  In addition, a system has been proposed in which a management device that manages wireless parameters to be provided to a wireless communication device is connected to a base station via a network. (Patent Document 3).

In recent years, public wireless LAN services have been provided. When using a public wireless LAN, it is necessary to perform user authentication when a wireless communication apparatus connects to a network via a base station (AP: Access Point). As a method for user authentication, there is a method using an electronic certificate (hereinafter referred to as a certificate) issued by a certificate authority (CA) (Patent Documents 4 and 5).
JP2004-013718 JP2004-7351 JP 2005-86583 A JP 2004-78426 A JP 2004-128886 A

  In order for the wireless communication device to receive user authentication using a certificate, a certificate issued from a certificate authority must be acquired.

  Here, when temporary access to the network is permitted, such as a one-day limited service in a public wireless LAN, an expiration date is set in the certificate. For example, when the expiration date is set to “one day from the certificate issuance”, when the wireless communication device acquires the certificate after a long time has passed since the certificate was issued, the wireless communication device performs user authentication. The period that you can receive will be shorter than one day.

  An object of the present invention is to solve a problem when a wireless communication apparatus acquires a certificate issued by a certificate authority.

  In order to solve the above-described problem, the present invention provides a management device that provides a wireless parameter to a wireless communication device by a wireless parameter setting method, a storage unit that stores the wireless parameter provided to the wireless communication device, and the wireless Acquiring a certificate from the certificate authority, triggered by a connection unit that connects via a network with a certificate authority that issues a certificate for authenticating the communication device, and a timing related to the setting process by the wireless parameter setting method And a providing means for providing the wireless communication apparatus together with the wireless parameter stored by the storage means and the certificate obtained by the obtaining means by the wireless parameter setting method.

  In addition, the present invention provides a control method for a management apparatus that is connected via a network to a certificate authority that issues a certificate for authenticating a wireless communication apparatus, and that provides wireless parameters to the wireless communication apparatus by a wireless parameter setting method. A storage step of storing wireless parameters to be provided to the wireless communication device in a storage unit, and an acquisition step of acquiring a certificate from the certificate authority using a timing related to setting processing by the wireless parameter setting method as a trigger; A provision step of providing the wireless communication apparatus with the certificate acquired in the acquisition step together with the wireless parameter stored in the storage unit by the storage step by the wireless parameter setting method; .

  According to the present invention, it is possible to acquire a certificate from a certificate authority using a timing related to setting processing by the wireless parameter setting method as a trigger, and transmit the acquired certificate to the wireless communication apparatus together with the wireless parameter.

<Example 1>
FIG. 1 shows a system configuration according to this embodiment.

  A certificate authority (CA) 101 issues an electronic certificate (hereinafter referred to as a certificate). An expiration date can be set for the certificate.

  Reference numeral 102 denotes a wireless parameter management apparatus (hereinafter referred to as a management apparatus) that performs management of wireless parameters in the IEEE 802.11 wireless LAN, provision of wireless parameters to the wireless communication apparatus, and the like. Note that wireless parameters managed by the management apparatus include a communication channel, a network identifier (SSID), an encryption method, an encryption key, an authentication method, an authentication key, and the like. In addition, IEEE 802.11 wireless LAN has standards such as 802.11a, 802.11b, and 802.11g, and information on which standard to use can be managed as a wireless parameter. is there. Here, it is assumed that the management apparatus is used by installing dedicated software or the like on the PC.

  The management apparatus 102 also has a function as a RADIUS (Remote Authentication Dial-In User Service) server. Further, the management apparatus 102 can acquire a client certificate issued by the certificate authority 101 and provide the acquired client certificate to the wireless communication apparatus. The client certificate issued by the certificate authority 101 is a certificate for uniquely identifying the client by the server, and is used for authenticating whether the wireless communication apparatus is a valid terminal.

  Reference numeral 103 denotes a base station (access point, hereinafter referred to as AP), which has an interface function between a wireless network and a wired network, a wireless signal control function, a wireless data encryption function to be transmitted and received, and the like.

  Reference numeral 104 denotes a digital still camera (hereinafter referred to as DSC) having a wireless communication function using an IEEE 802.11 wireless LAN.

  The certificate authority 101, the management apparatus 102, and the AP 103 are connected by a wired LAN. Although not shown here, it is assumed that another device is connected to the wired LAN. In the wired LAN, access management is performed by user authentication using the aforementioned RADIUS server. For the user authentication, a client certificate issued by the certificate authority 101 is used.

The Radius server authenticates whether the wireless communication device is a valid terminal based on the client certificate transmitted from the wireless communication device.
Therefore, in order for the DSC 104 to access the wired LAN via the AP 103, it is necessary to obtain a client certificate issued by the certificate authority 101.

  The management apparatus 102, AP 103, and DSC 104 have a common wireless parameter automatic setting function (hereinafter referred to as wireless parameter setting method). Note that the wireless parameter setting method refers to a method of automatically setting communication parameters by a predetermined procedure and message between connected devices. In many cases, each manufacturer adopts its own method for automatically setting wireless parameters. Therefore, between the devices that do not support the common wireless parameter setting method, the procedure for setting the wireless parameter is different or the decipherable message is different, and the communication parameter cannot be set using the automatic setting method. . On the other hand, between devices that support a common wireless parameter setting method, wireless parameters can be easily set using the automatic setting method.

  By executing the wireless parameter setting method, the wireless parameter managed by the management apparatus 102 can be transferred to the DSC 104 via the AP 103. The management apparatus 102 can also acquire a certificate issued by the certificate authority 101 and transmit a client certificate to the DSC 104 together with wireless parameters. Note that as described above, the client certificate is a certificate indicating that the wireless communication device is a valid terminal, and is not a certificate indicating that the wireless parameter is valid. .

  However, if the management apparatus 102 acquires the certificate from the certificate authority 101 and the management apparatus 102 transmits the wireless parameters to the DSC 104 independently by the wireless parameter setting method, various problems occur. there is a possibility.

  For example, when the management apparatus acquires a certificate in advance regardless of whether wireless parameters are provided, the management apparatus holds the certificate even when the certificate does not need to be transmitted to the DSC 104. Certificates may be stolen.

  Even if it takes a long time for the management apparatus 102 to send the client certificate to the DSC 104 after the certificate authority 101 issues the certificate, the management apparatus 102 holds the client certificate for a long period of time as described above. Therefore, there is a security problem. In addition, when the expiration date is set in the certificate, the period during which the DSC 104 can receive user authentication may be shortened.

  Therefore, in this embodiment, an example of a process for shortening the time from acquisition of a certificate from the certificate authority 101 by the management apparatus 102 to transmission of the certificate to the DSC 104 will be described.

FIG. 2 is a diagram illustrating a block configuration of the management apparatus 102.
Reference numeral 202 denotes a communication unit that performs wireless and wired communication with other devices, and 203 denotes a communication control unit that controls the communication unit. Reference numeral 204 denotes a timer unit for starting the timer and measuring the timer. An interface processing unit 205 performs various interface processes. A display unit 206 performs various displays. A wireless parameter setting control unit 207 performs various types of control related to the wireless parameter setting method. An authentication processing unit 208 performs user authentication with the Radius server. A storage unit 209 stores wireless parameters for wireless communication with the AP 103, a password used for the wireless parameter setting method, a certificate acquired from the certificate authority 101, and the like. A control unit 210 performs operation control of the entire management apparatus 102.

FIG. 5 is a diagram showing a sequence of each device in the present embodiment.
When the wireless parameter setting method of the DSC 104 is activated by a user operation or the like, the DSC 104 transmits a search request for searching for an AP having the wireless parameter setting method (F501). When a search response to the search request is received from the AP 103 (F501), the DSC 104 transmits a connection request to the AP 103 in order to make a temporary connection with the AP 103 (F502). Note that when transmitting the connection request (F502), the SSID included in the search response (F501) from the AP 103 is used. When the DSC 104 receives a connection success response transmitted from the AP 103 (F503), the temporary wireless connection between the AP 103 and the DSC 104 is completed.

  After the temporary wireless connection, even if wireless parameters such as an encryption key are not set in the DSC 104, the DSC 104 communicates with the management apparatus 102 via the AP 103 by using a packet defined by the wireless parameter setting method. It is possible.

  Next, the DSC 104 transmits a request for starting wireless parameter setting processing (hereinafter referred to as wireless parameter setting protocol) by the wireless parameter setting method to the management apparatus 102 via the AP 103 (F504). Upon receiving the wireless parameter setting protocol start request (F504), the management apparatus 102 transmits / receives a message to / from the DSC 104 according to the procedure defined by the wireless parameter setting method (F505). The message transmitted from the DSC 104 includes a password for determining whether or not to provide wireless parameters to the DSC 104. The management apparatus 102 authenticates the DSC 104 by comparing the password stored in the storage unit 210 with the password transmitted from the DSC 104 (F506). Note that the authentication here is authentication for determining whether or not the wireless communication apparatus may provide wireless parameters.

  If the authentication is successful, the management apparatus 102 transmits a certificate acquisition request to the certificate authority 101 (F507). Upon receiving the certificate acquisition request (F507), the certificate authority 101 creates a certificate (F508) and transmits the certificate to the management apparatus 102 as a certificate acquisition response (F509).

  The management apparatus 102 extracts the client certificate from the received certificate acquisition response (F509) and stores it in the storage unit 210. Then, the management apparatus 102 starts a timer for certificate deletion processing (F510), and transmits the wireless parameters and client certificate stored in the storage unit 210 to the DSC 104 (F511).

  Upon receiving the wireless parameters and client certificate transmitted from the management apparatus 102, the DSC 104 transmits a reception completion message to the management apparatus 102 (F512). Upon receiving the reception completion message, the management apparatus 102 deletes the client certificate from the storage unit 210 (F513).

  With the above processing, the DSC 104 can perform normal data communication with the AP 103 by setting the wireless parameter transmitted from the management apparatus 102. Further, the DSC 104 can receive authentication by the Radius server on the management apparatus 102 by using the client certificate transmitted from the management apparatus 102, and can access the wired LAN via the AP 103. .

  FIG. 3 is a diagram illustrating an operation flow of the management apparatus 102.

  The management apparatus 102 waits for reception of a wireless parameter setting protocol start request transmitted from the wireless communication apparatus (DSC 104 in the present embodiment) (S301). When the management apparatus 102 receives the wireless parameter setting protocol start request (Yes in S301), the management apparatus 102 transmits / receives a message to / from the wireless communication apparatus that is the transmission source of the request according to the procedure specified in the wireless parameter setting method ( Protocol processing) is performed (S302).

  The management apparatus 102 authenticates the wireless communication apparatus by comparing the password stored in the storage unit 210 with the password acquired in the course of the protocol processing (S303). Note that the authentication here is authentication for determining whether or not the wireless communication apparatus may provide wireless parameters.

  If the authentication is successful (Yes in S304), the management apparatus 102 performs certificate acquisition processing (S305). Specifically, the management apparatus 102 requests the certificate authority 101 to obtain a certificate, and receives the certificate issued by the certificate authority 101. The management apparatus 102 stores the received client certificate in the storage unit 210.

  When the certificate acquisition process is completed, the management apparatus 102 transmits the wireless parameters and client certificate stored in the storage unit 210 to the wireless communication apparatus (S306).

  When the authentication fails (No in S304), the management apparatus 102 ends the process.

  FIG. 4 is a diagram showing an operation flow when the management apparatus 102 deletes the client certificate.

  In the certificate acquisition process (S305) of FIG. 3, the management apparatus 102 transmits a certificate acquisition request to the certificate authority 101, and then waits for reception of a certificate acquisition response transmitted from the certificate authority 101 (S401). .

  When a certificate acquisition response is received (Yes in S401), a timer for measuring the time until the client certificate is deleted is started (S402). Thereafter, when a reception completion message is received from the wireless communication device (Yes in S403) or when the timer times out (Yes in S404), the management device 102 deletes the client certificate from the storage unit 210 (S405).

  In the present embodiment, the management apparatus performs certificate acquisition processing when password authentication is successful in the wireless parameter setting method as a timing related to wireless parameter setting processing in the wireless parameter setting method. Then, the acquired client certificate is transmitted to the wireless communication apparatus together with the wireless parameter. In other words, since the management apparatus acquires a certificate when it is determined that the wireless parameter may be provided to the wireless communication apparatus, the certificate is acquired from the certificate acquisition as compared with the case of acquiring the certificate in advance. The time until transmission of can be shortened. Therefore, when an expiration date is set for the certificate, the time lag from the certificate issuance by the certificate authority to the certificate acquisition by the wireless communication apparatus can be reduced.

  In addition, since the certificate is not acquired when it is not necessary to provide the client certificate to the wireless communication device, the amount of useless communication is reduced and the load on the certificate authority and the management device is reduced. be able to.

  In addition, since the management apparatus does not hold the certificate when it is not necessary to provide the certificate, the possibility of the certificate being stolen by unauthorized access can be reduced. In addition, compared to the case where the management apparatus acquires the certificate in advance, the period during which the management apparatus holds the certificate can be shortened, so that the possibility of the certificate being stolen by unauthorized access can be further reduced. it can.

  In addition, when the reception completion message from the wireless communication apparatus is received, the management apparatus deletes the stored client certificate, so that security can be further enhanced. In addition, since the client certificate is deleted when the certificate deletion timer times out, even if the reception completion message cannot be received, the client certificate is not retained for a certain period of time, further enhancing security. be able to.

<Example 2>
In the above-described wireless parameter setting method, when a timeout time is set in advance, the wireless parameter setting process ends even if the wireless parameter setting is not completed when the timeout occurs. Therefore, when acquiring a certificate when password authentication is successful in the wireless parameter setting method as in the first embodiment, if it takes a long time to acquire the certificate, the wireless parameter setting is performed before the certificate is acquired. Processing may time out.

  In the second embodiment, another method related to the timing at which the management apparatus performs certificate acquisition processing will be described. Since the system configuration and the block configuration of the management apparatus 102 are the same as those in the first embodiment (FIGS. 1 and 2), description thereof is omitted.

  FIG. 7 is a diagram showing a sequence of each device in the present embodiment.

  When the wireless parameter setting method of the DSC 104 is activated by a user operation or the like, the DSC 104 transmits a search request for searching for an AP having the wireless parameter setting method (F701). When a search response to the search request is received from the AP 103 (F701), the DSC 104 transmits a connection request to the AP 103 in order to make a temporary connection with the AP 103 (F702). When transmitting the connection request (F702), the SSID included in the search response (F701) from the AP 103 is used. When the DSC 104 receives a connection success response transmitted from the AP 103 (F703), the temporary wireless connection between the AP 103 and the DSC 104 is completed.

  After the temporary wireless connection, even if wireless parameters such as an encryption key are not set in the DSC 104, the DSC 104 communicates with the management apparatus 102 via the AP 103 by using a packet defined by the wireless parameter setting method. It is possible.

  Next, the DSC 104 transmits a wireless parameter setting protocol start request to the management apparatus 102 via the AP 103 (F704). When the wireless parameter setting protocol start request (F704) is received, the management apparatus 102 transmits a certificate acquisition request to the certificate authority 101 (F705). Upon receiving the certificate acquisition request (F705), the certificate authority 101 creates a certificate (F706) and transmits the certificate to the management apparatus 102 as a certificate acquisition response (F707).

  The management apparatus 102 extracts the client certificate from the received certificate acquisition response (F707) and stores it in the storage unit 210. Then, the management apparatus 102 starts a timer for certificate deletion processing (F708).

  In parallel with the certificate acquisition process, the management apparatus 102 transmits / receives a message to / from the DSC 104 according to a procedure defined by the wireless parameter setting method (F709). The message transmitted from the DSC 104 includes a password for determining whether or not to provide wireless parameters to the DSC 104. The management apparatus 102 authenticates the DSC 104 by comparing the password stored in the storage unit 210 with the password transmitted from the DSC 104 (F710). Note that the authentication here is authentication for determining whether or not the wireless communication apparatus may provide wireless parameters.

  If the authentication is successful, the management apparatus 102 transmits the wireless parameters and client certificate stored in the storage unit 210 to the DSC 104 (F711). If acquisition of a certificate is not completed when authentication is successful, the management apparatus 102 waits for transmission until the certificate is acquired.

  When the wireless parameter and the client certificate transmitted from the management apparatus 102 are received, the DSC 104 transmits a reception completion message to the management apparatus 102 (F712). Upon receiving the reception completion message, the management apparatus 102 deletes the client certificate from the storage unit 210 (F713).

  FIG. 6 is a diagram illustrating an operation flow of the management apparatus 102 in the present embodiment.

  The management apparatus 102 waits for reception of a wireless parameter setting protocol start request transmitted from the wireless communication apparatus (DSC 104 in the present embodiment) (S601). Upon receiving the wireless parameter setting protocol start request (Yes in S601), the management apparatus 102 performs certificate acquisition processing (S602). Specifically, the management apparatus 102 requests the certificate authority 101 to obtain a certificate, and receives the certificate issued by the certificate authority 101. The management apparatus 102 stores the received client certificate in the storage unit 210.

  In addition, the management apparatus 102 performs message transmission / reception (protocol processing) with the wireless communication apparatus that is the transmission source of the wireless parameter setting protocol start request according to the procedure defined in the wireless parameter setting method (S603). Note that the processing of S602 and S603 can be performed in parallel.

  The management apparatus 102 authenticates the wireless communication apparatus by comparing the password stored in the storage unit 210 with the password acquired in the course of the protocol processing (S604). Note that the authentication here is authentication for determining whether or not the wireless communication apparatus may provide wireless parameters.

  When the authentication is successful (Yes in S605), the management apparatus 102 transmits the wireless parameters and client certificate stored in the storage unit 210 to the wireless communication apparatus (S606). If acquisition of a certificate is not completed when authentication is successful, the management apparatus 102 waits for transmission until the certificate is acquired. If the wireless parameter setting method times out without completing the certificate acquisition, the management apparatus 102 stops the processing. When the authentication fails (No in S605), the management apparatus 102 ends the process.

  Since the operation flow when the management apparatus 102 deletes the client certificate is the same as that in the first embodiment (FIG. 4), description thereof is omitted here.

  In the present embodiment, as timing related to wireless parameter setting processing by the wireless parameter setting method, when the management apparatus receives a wireless parameter setting protocol start request from the wireless communication apparatus, certificate acquisition processing is performed. Then, the acquired client certificate is transmitted to the wireless communication apparatus together with the wireless parameter. Therefore, it is possible to reduce the possibility that the setting process by the wireless parameter setting method will time out before acquiring the certificate.

  Also, the time from certificate acquisition to certificate transmission can be shortened compared to the case where the management apparatus acquires the certificate in advance. Therefore, when an expiration date is set for the certificate, the time lag from the certificate issuance by the certificate authority to the certificate acquisition by the wireless communication apparatus can be reduced.

  Also, compared to the case where the management device acquires the certificate in advance, the period during which the management device holds the client certificate can be shortened, thus reducing the possibility of the client certificate being stolen by unauthorized access. can do.

  In addition, when the reception completion message from the wireless communication apparatus is received, the management apparatus deletes the stored client certificate, so that security can be further enhanced. In addition, since the client certificate is deleted when the certificate deletion timer times out, even if the reception completion message cannot be received, the client certificate is not retained for a certain period of time, further enhancing security. be able to.

<Example 3>
Next, a third embodiment will be described. Since the system configuration and the block configuration of the management apparatus 102 are the same as those in the first embodiment (FIGS. 1 and 2), description thereof is omitted.

  FIG. 9 is a diagram showing a sequence of each device in the present embodiment.

  The management apparatus 102 transmits a search request for searching for an AP that has activated the wireless parameter setting method on the wired LAN (F901). The management apparatus 102 periodically transmits a search request until receiving a search response from the AP. The search request may be transmitted by any method of broadcast, multicast, and unicast. Here, broadcasting means sending a message to an unspecified number of other parties. Multicast means that the same message is transmitted by designating a plurality of partners. Unicast refers to sending a message by designating a single partner.

  If the wireless parameter setting method is being activated when the AP 103 receives the search request, the AP 103 transmits a search response to the management apparatus 102 (F902). Here, the AP that is activating the wireless parameter setting method does not simply indicate an AP having the wireless parameter setting method, but in a state in which setting processing by the wireless parameter setting method can be executed by a user operation or the like. It refers to a certain AP. Therefore, even if the AP has a wireless parameter setting method, if the wireless parameter setting method is set to the start-off state, other processing is being performed and the AP is busy, etc. , Do not send a search response.

  Upon receiving the search response (F902), the management apparatus 102 transmits a certificate acquisition request to the certificate authority 101 (F903). Upon receiving the certificate acquisition request (F903), the certificate authority 101 creates a certificate (F904) and transmits the certificate as a certificate acquisition response to the management apparatus 102 (F905).

  The management apparatus 102 extracts the client certificate from the received certificate acquisition response (F905) and stores it in the storage unit 210. Then, the management apparatus 102 starts a timer for certificate deletion processing (F906).

  When the wireless parameter setting method of the DSC 104 is activated by a user operation or the like, the DSC 104 transmits a search request for searching for an AP having the wireless parameter setting method (F907). When a search response to the search request is received from the AP 103 (F907), the DSC 104 transmits a connection request to the AP 103 in order to make a temporary connection with the AP 103 (F908). When transmitting the connection request (F908), the SSID included in the search response (F907) from the AP 103 is used. When the DSC 104 receives a connection success response transmitted from the AP 103 (F909), the temporary wireless connection between the AP 103 and the DSC 104 is completed.

  After the temporary wireless connection, even if wireless parameters such as an encryption key are not set in the DSC 104, the DSC 104 communicates with the management apparatus 102 via the AP 103 by using a packet defined by the wireless parameter setting method. It is possible.

  Next, the DSC 104 transmits a request for starting a wireless parameter setting protocol to the management apparatus 102 via the AP 103 (F910). Upon receiving the wireless parameter setting protocol start request (F910), the management apparatus 102 transmits / receives a message to / from the DSC 104 according to the procedure defined by the wireless parameter setting method (F911). The message transmitted from the DSC 104 includes a password for determining whether or not to provide wireless parameters to the DSC 104. The management apparatus 102 authenticates the DSC 104 by comparing the password stored in the storage unit 210 with the password transmitted from the DSC 104 (F912). Note that the authentication here is authentication for determining whether or not the wireless communication apparatus may provide wireless parameters.

  If the authentication is successful, the management apparatus 102 transmits the wireless parameters and client certificate stored in the storage unit 210 to the DSC 104 (F913). When the wireless parameter and the client certificate transmitted from the management apparatus 102 are received, the DSC 104 transmits a reception completion message to the management apparatus 102 (F914). Upon receiving the reception completion message, the management apparatus 102 deletes the client certificate from the storage unit 210 (F915).

  FIG. 8 is a diagram illustrating an operation flow of the management apparatus 102 in the present embodiment.

  The management apparatus 102 searches for an AP that has activated the wireless parameter setting method (S801). The search can be realized by using the Discovery function of UPnP (Universal Plug and Play), but the search method is not limited to this.

  When an AP that has activated the wireless parameter setting method is found (Yes in S802), the management apparatus 102 performs certificate acquisition processing (S803). Specifically, the management apparatus 102 requests the certificate authority 101 to obtain a certificate, and receives the certificate issued by the certificate authority 101. The management apparatus 102 stores the received client certificate in the storage unit 210.

  Next, the management apparatus 102 waits for reception of a wireless parameter setting protocol start request transmitted from the wireless communication apparatus (DSC 104 in the present embodiment) (S804). When the management apparatus 102 receives the wireless parameter setting protocol start request (Yes in S804), the management apparatus 102 transmits / receives a message to / from the wireless communication apparatus that is the transmission source of the request (protocol) (protocol). Process) (S805).

  The management apparatus 102 authenticates the wireless communication apparatus by comparing the password stored in the storage unit 210 with the password acquired in the course of the protocol processing (S806). Note that the authentication here is authentication for determining whether or not the wireless communication apparatus may provide wireless parameters.

  If the authentication is successful (Yes in S807), the management apparatus 102 transmits the wireless parameters and client certificate stored in the storage unit 210 to the wireless communication apparatus (S808). If the authentication fails (No in S807), the management apparatus 102 ends the process.

  Since the operation flow when the management apparatus 102 deletes the client certificate is the same as that in the first embodiment (FIG. 4), description thereof is omitted here.

  In the present embodiment, as a timing related to the setting process by the wireless parameter setting method, a certificate acquisition process is performed when the management apparatus finds an AP that can execute the setting process by the wireless parameter setting method. Then, the acquired client certificate is transmitted to the wireless communication apparatus together with the wireless parameter. Therefore, as compared with the first and second embodiments, it is possible to reduce the possibility that the setting process by the wireless parameter setting method times out before obtaining the certificate.

  Also, the time from certificate acquisition to certificate transmission can be shortened compared to the case where the management apparatus acquires the certificate in advance. Therefore, when an expiration date is set for the certificate, the time lag from the certificate issuance by the certificate authority to the certificate acquisition by the wireless communication apparatus can be reduced.

  Also, compared to the case where the management device acquires the certificate in advance, the period during which the management device holds the client certificate can be shortened, thus reducing the possibility of the client certificate being stolen by unauthorized access. can do.

  In addition, when the reception completion message from the wireless communication apparatus is received, the management apparatus deletes the stored client certificate, so that security can be further enhanced. In addition, since the client certificate is deleted when the certificate deletion timer times out, even if the reception completion message cannot be received, the client certificate is not retained for a certain period of time, further enhancing security. be able to.

<Example 4>
In the first to third embodiments, the timing at which the management apparatus requests the certificate authority to obtain a certificate is different. As described above, when it takes a lot of time to acquire a certificate, it is conceivable that the setting process by the wireless parameter setting method times out in the middle.

  In the present embodiment, an example will be described in which the timing for transmitting a certificate acquisition request is switched according to the time required for the certificate acquisition processing by the management apparatus. Since the system configuration and the block configuration of the management apparatus 102 are the same as those in the first embodiment (FIGS. 1 and 2), description thereof is omitted.

  The management apparatus 102 in the present embodiment can switch and execute the methods (hereinafter, acquisition methods 1 to 3) shown in the above-described embodiments 1 to 3. Further, the management apparatus 102 can acquire a certificate from the certificate authority 101 in advance regardless of the timing related to the setting process by the wireless parameter setting method (hereinafter, acquisition method 4).

  The time required for the management apparatus 102 to acquire the certificate and transmit the acquired client certificate to the wireless communication apparatus has a relationship such as acquisition method 1 <acquisition method 2 <acquisition method 3 <acquisition method 4 It becomes. In the acquisition methods 1 to 3, threshold values T (T1 to T3) are set. For example, when the time required for certificate acquisition by the management apparatus exceeds T1, the use of the acquisition method 1 increases the probability of occurrence of a setting process time-out by the wireless parameter setting method.

  FIG. 10 is a diagram illustrating an operation flow when the management apparatus 102 selects which income method to use from among the acquisition methods 1 to 4.

  First, the management apparatus 102 measures the time (certificate acquisition time) t from when a certificate acquisition request is transmitted to the certificate authority 101 until the certificate issued by the certificate authority 101 is received (certificate acquisition time) t. S1001). Here, the management apparatus 102 may perform the certificate acquisition process a plurality of times and set the average value as t. Note that the certificate obtained for measuring the certificate acquisition time t is not used for the authentication process of the wireless communication apparatus. For example, after the measurement of the certificate acquisition time t is completed, the earned certificate may be deleted.

If the certificate acquisition time t is 0 <t <= T1 (Yes in S1002), the management apparatus 102 selects the acquisition method 1 (S1003).
If T1 <t <= T2 (Yes in S1004), the management apparatus 102 selects acquisition method 2 (S1005).
If T2 <t <= T3 (Yes in S1006), the management apparatus 102 selects acquisition method 3 (S1007).
If T3 <t (No in S1006), the management apparatus 102 selects acquisition method 4 (S1008).

  According to the present embodiment, the management apparatus switches and executes a plurality of acquisition methods according to the time required for certificate acquisition, so the time required for certificate acquisition changes due to changes in the communication environment and device performance. However, it can respond adaptively. Accordingly, it is possible to reduce the probability that the setting process timeout by the wireless parameter setting method occurs while shortening the period in which the management apparatus holds the certificate.

  As described above, according to each of the above embodiments, the management apparatus acquires a certificate from the certificate authority using the timing related to the setting process by the wireless parameter setting method as a trigger. Then, the acquired client certificate is transmitted to the wireless communication apparatus together with the wireless parameter. Therefore, it is possible to prevent the management apparatus from acquiring a certificate when it is not necessary to provide a certificate to the wireless communication apparatus, thereby reducing unnecessary communication volume and reducing the load on the certificate authority and the management apparatus. be able to.

  Note that the timing related to the setting process by the wireless parameter setting method includes password authentication in the wireless parameter setting method, reception of a wireless parameter setting protocol start request from the wireless communication apparatus, and an AP in a state where the setting process by the wireless parameter setting method can be executed Each example of discovery was explained. However, the timing related to the setting process by the wireless parameter setting method is not limited to these.

  In each of the above embodiments, the case where the DSC is used as the wireless communication device has been described. However, any device such as a printer, a personal computer, or a portable music player may be used.

  In each of the above embodiments, the case where the IEEE 802.11 wireless LAN is used has been described. However, the present invention can also be applied to other wireless communication systems such as UWB and WiMax. Further, the present invention can be applied even when parameters for wired communication as well as wireless communication are set.

  An object of the present invention is to supply a recording medium that records a program code of software that implements the functions of the above-described embodiments to various devices constituting the system, and a computer (or CPU or MPU that controls the system or device). Needless to say, this can also be achieved by reading and executing the program code stored in the recording medium. In this case, the program code itself read from the storage medium realizes the functions of the above-described embodiment, and the storage medium storing the program code constitutes the present invention.

  As a storage medium for supplying the program code, for example, a flexible disk, a hard disk, an optical disk, a magneto-optical disk, a CD-ROM, a CD-R, a magnetic tape, a nonvolatile memory card, a ROM, a DVD, or the like is used. it can.

  Further, by executing the program code read by the computer, not only the functions of the above-described embodiments are realized, but also an operating system (OS) running on the computer based on an instruction of the program code. However, it is needless to say that a case where the function of the above-described embodiment is realized by performing part or all of the actual processing and the processing is included.

  Further, after the program code read from the storage medium is written in a memory provided in a function expansion board inserted into the computer or a function expansion unit connected to the computer, based on the instruction of the program code, It goes without saying that the CPU of the function expansion board or function expansion unit performs part or all of the actual processing and the functions of the above-described embodiments are realized by the processing.

System configuration diagram according to first to fourth embodiments Block diagram of management apparatus 102 according to first to fourth embodiments Operation Flow of Management Device 102 in Embodiment 1 Operation flow when the management apparatus 102 deletes a certificate Sequence diagram in the first embodiment Operation Flow of Management Device 102 in Embodiment 2 Sequence diagram in the second embodiment Operation Flow of Management Device 102 in Embodiment 3 Sequence diagram in embodiment 3 Operation Flow for Acquisition Method Selection Processing in Embodiment 4

Explanation of symbols

101 Certificate Authority (CA)
102 management apparatus 103 base station (AP)
104 Digital still camera (DSC)
DESCRIPTION OF SYMBOLS 201 Management apparatus 202 Communication part 203 Communication control part 204 Time measuring part 205 Interface process part 206 Display part 207 Wireless parameter setting management part 208 Authentication process part 209 Judgment part 210 Storage part 211 Device control part

Claims (29)

A management device that provides wireless parameters to a wireless communication device by a wireless parameter setting method,
Storage means for storing wireless parameters to be provided to the wireless communication device;
Connection means for connecting via a network with a certificate authority that issues a certificate for authenticating the wireless communication device;
An acquisition means for acquiring a certificate from the certificate authority, triggered by a timing related to setting processing by the wireless parameter setting method,
Providing means for providing the wireless communication apparatus together with the wireless parameter stored by the storage means together with the certificate acquired by the acquiring means by the wireless parameter setting method,
A management apparatus comprising:   The management apparatus according to claim 1, wherein the timing is a timing at which provision of wireless parameters to the wireless communication apparatus is permitted.   The management apparatus according to claim 1, wherein the timing is a timing at which a request to start setting processing by the wireless parameter setting method is received.   The management apparatus according to claim 1, wherein the timing is a timing at which a base station in a state where the setting process by the wireless parameter setting method can be executed is found. A timer for measuring the time until the certificate acquired by the acquisition unit is deleted;
5. The management apparatus according to claim 1, wherein the certificate acquired by the acquisition unit is deleted based on the time measured by the timer. 6. Receiving means for receiving a certificate reception completion message from the wireless communication device;
6. The management apparatus according to claim 1, wherein the certificate acquired by the acquisition unit is deleted in response to reception by the reception unit. Measuring means for measuring the time required to obtain the certificate;
A selection unit that selects a timing that triggers certificate acquisition by the acquisition unit from among a plurality of timings related to the setting process by the wireless parameter setting method according to the time measured by the measurement unit;
The management apparatus according to claim 1, further comprising: Regardless of the timing related to the setting process by the wireless parameter setting method, second acquisition means for acquiring a certificate from the certificate authority,
Selecting means for selecting whether to obtain a certificate from the certificate authority by the obtaining means or to obtain a certificate from the certificate authority by the second obtaining means;
The management apparatus according to claim 1, further comprising: It further has a measuring means for measuring the time required for obtaining the certificate,
The selection unit selects to acquire a certificate by the acquisition unit when the time measured by the measurement unit is shorter than a predetermined time, and when the time measured by the measurement unit is longer than the predetermined time. The management apparatus according to claim 8, wherein the second acquisition unit selects to acquire a certificate.   The said provision means transmits the message containing the radio | wireless parameter memorize | stored by the said memory | storage means and the certificate acquired by the said acquisition means to the said radio | wireless communication apparatus, The any one of Claim 1 to 9 characterized by the above-mentioned. The management device according to item.   The management apparatus according to any one of claims 1 to 10, wherein the radio parameter is a radio parameter in radio communication between the radio communication apparatus and a base station.   The management apparatus according to claim 1, wherein the wireless parameter includes at least one of a communication channel, a network identifier, an encryption method, an encryption key, an authentication method, and an authentication key.   Until the wireless communication apparatus receives the wireless parameter and the certificate provided by the providing unit, the wireless communication apparatus wirelessly uses a specific packet defined by the wireless parameter setting method. 13. The wireless communication is performed by setting the wireless parameter after performing communication and receiving the wireless parameter and the certificate provided by the providing unit. The management device described. An information processing device that provides wireless parameters to a wireless communication device by a wireless parameter setting method,
Storage means for storing wireless parameters to be provided to the wireless communication device;
Connection means for connecting via a network with an external device that issues authentication information for authenticating the wireless communication device;
An acquisition means for acquiring authentication information from the external device using a timing related to the setting process by the wireless parameter setting method as a trigger,
Providing means for providing the wireless communication device together with the wireless parameter stored by the storage means together with the authentication information acquired by the acquiring means by the wireless parameter setting method,
An information processing apparatus comprising:   The information processing apparatus according to claim 14, wherein the timing is a timing at which provision of wireless parameters to the wireless communication apparatus is permitted.   The information processing apparatus according to claim 14, wherein the timing is a timing at which a start request for setting processing by the wireless parameter setting method is received.   The information processing apparatus according to claim 14, wherein the timing is a timing at which a base station in a state where the setting process by the wireless parameter setting method can be executed is found. A timer for measuring the time until the authentication information acquired by the acquisition unit is deleted;
18. The information processing apparatus according to claim 14, wherein the authentication information acquired by the acquisition unit is deleted based on a time measured by the timer. Receiving means for receiving an authentication information reception completion message from the wireless communication device;
The information processing apparatus according to claim 1, wherein the authentication information acquired by the acquisition unit is deleted in response to reception by the reception unit. Measuring means for measuring the time required to acquire the authentication information;
A selection unit that selects a timing that triggers acquisition of authentication information by the acquisition unit from a plurality of timings related to the setting process by the wireless parameter setting method according to the time measured by the measurement unit;
The information processing apparatus according to claim 14, further comprising: Regardless of the timing related to the setting process by the wireless parameter setting method, second acquisition means for acquiring authentication information from the external device;
Selection means for selecting whether to acquire authentication information from the external device by the acquisition means or to acquire authentication information from the external device by the second acquisition means;
15. The information processing apparatus according to claim 14, further comprising: It further has a measuring means for measuring the time required for obtaining the authentication information,
When the time measured by the measuring unit is shorter than a predetermined time, the selecting unit selects to acquire the authentication information by the acquiring unit, and when the time measured by the measuring unit is longer than the predetermined time. The information processing apparatus according to claim 21, wherein acquisition of authentication information is selected by the second acquisition unit.   The said providing means transmits the message containing the radio | wireless parameter memorize | stored by the said memory | storage means and the authentication information acquired by the said acquisition means to the said radio | wireless communication apparatus, The any one of Claim 14 to 22 characterized by the above-mentioned. The information processing apparatus according to item.   The information processing apparatus according to any one of claims 14 to 23, wherein the wireless parameter is a wireless parameter in wireless communication between the wireless communication apparatus and a base station.   The information processing apparatus according to any one of claims 14 to 24, wherein the wireless parameter includes at least one of a communication channel, a network identifier, an encryption method, an encryption key, an authentication method, and an authentication key.   Until the wireless communication apparatus receives the wireless parameter and the authentication information provided by the providing unit, the wireless communication apparatus uses a specific packet defined by the wireless parameter setting method to perform wireless communication. The wireless communication is performed by setting the wireless parameter after performing communication and receiving the wireless parameter and the authentication information provided by the providing unit. The information processing apparatus described. A control method for a management apparatus that is connected via a network to a certificate authority that issues a certificate for authenticating a wireless communication apparatus, and that provides wireless parameters to the wireless communication apparatus by a wireless parameter setting method,
Storing a wireless parameter to be provided to the wireless communication device in a storage unit;
Using the timing related to the setting process by the wireless parameter setting method as a trigger, an acquisition step of acquiring a certificate from the certificate authority,
Providing the wireless communication apparatus together with the wireless parameter stored in the storage unit by the storing step and the certificate acquired in the acquiring step by the wireless parameter setting method;
A control method characterized by comprising: A method for controlling an information processing apparatus that is connected to an external apparatus that issues authentication information for performing authentication of a wireless communication apparatus via a network and that provides a wireless parameter to the wireless communication apparatus by a wireless parameter setting method,
Storing a wireless parameter to be provided to the wireless communication device in a storage unit;
An acquisition step of acquiring authentication information from the external device using a timing related to the setting process by the wireless parameter setting method as a trigger,
A providing step of providing the wireless communication device together with the authentication information acquired in the acquiring step together with the wireless parameter stored in the storage unit by the storing step by the wireless parameter setting method;
A control method characterized by comprising:   A computer program for causing a computer to execute the control method according to claim 27 or 28.

Images