WO2020090443A1

WO2020090443A1 - Communication device, control method, and program

Info

Publication number: WO2020090443A1
Application number: PCT/JP2019/040469
Authority: WO
Inventors: 篤志皆川; 史英後藤
Original assignee: キヤノン株式会社
Priority date: 2018-11-02
Filing date: 2019-10-15
Publication date: 2020-05-07
Also published as: JP2020072441A

Abstract

According to the present invention, when an instruction to start a sharing process for sharing, with another communication device, a communication parameter for connection to a wireless network is received, an authentication process is performed with the other communication device, by using a fixed authentication code, when sharing a predetermined public key defined by the Wi-Fi Device Provisioning Protocol (DPP) standard, and when the authentication process is successful, the communication parameter is shared with the other communication device.

Description

Communication device, control method, and program

The present invention relates to a device that performs communication parameter sharing processing.

In recent years, the Wi-Fi DPP (Device Provisioning Protocol) standard has been established as a technology for sharing communication parameters for accessing a wireless network.

The DPP standard specifies that a device called a configurator provides communication parameters to a device called an enrollee (Patent Document 1). Further, in the DPP standard, one communication device captures a QR code (registered trademark) to identify the partner device, thereby preventing sharing of communication parameters with an erroneous partner device.

U.S. Patent Application Publication No. 2017/0295448

However, even when there is no device such as a smartphone or a camera that can capture a QR code, it is required to be able to perform a communication parameter sharing process compliant with the DPP standard with a simple user operation. ..

In view of the above problems, the present invention aims to improve user convenience in parameter sharing processing that complies with the DPP standard.

A communication device of the present invention includes a first receiving unit that receives a first instruction to start a sharing process for sharing a communication parameter for connecting to a wireless network with another communication device, and the first receiving unit. When the first instruction is accepted by the above, a predetermined public key defined by the Wi-Fi DPP (Device Provisioning Protocol) standard with the other communication device is used by using a fixed authentication code. A first authenticating unit that performs an authenticating process when shared with another communication device; and a sharing unit that shares the communication parameter with the other communication device when the authenticating process by the first authenticating unit is successful. , With.

According to the present invention, user convenience can be improved in the parameter sharing process based on the DPP standard.

The block diagram of a communication system. 3 is a hardware configuration diagram of the communication device 101. FIG. 3 is a flowchart realized by the communication device 101. 3 is a sequence diagram between the communication device 101 and the communication device 102. FIG. 3 is a flowchart realized by the communication device 101.

FIG. 1 shows the configuration of the communication system in this embodiment.

The communication device 101 operates as an access point, which is a wireless base station, and builds a wireless network 103. Specifically, the communication apparatus 101 periodically transmits a beacon including information on the wireless network 103, receives a connection request from another communication apparatus, and connects the other communication apparatus to the wireless network 103. Allow

Further, the communication device 101 operates as a configurator that complies with the DPP (Device Provisioning Protocol) standard. The configurator is a device having a role of providing communication parameters necessary for connecting to the wireless network 103. That is, the communication apparatus 101 provides the communication apparatus 102 with the communication parameters of the wireless network 103.

Note that the communication parameter is, for example, a credential that complies with the DPP standard, and includes information such as netAccessKey that is key information necessary for connecting to the wireless network 103. However, the key information is not limited to this, and may include information such as Pre Shared Key. Further, the communication parameter may include SSID (Service Set Identification) which is an identifier of the wireless network 103 and information on a frequency channel. Further, it may include information such as an encryption method and an authentication method used in the wireless network 103, and may include an expiration date of the communication parameter.

The communication device 101, which is a configurator, also notifies role information when providing communication parameters. The role information indicates a role after the communication parameter sharing process is performed. This role indicates either an access point that constructs a wireless network using the acquired communication parameters, or a connection device (hereinafter referred to as a station) that connects to the wireless network using the acquired communication parameters. Since the communication device 101 operates as an access point, it notifies role information indicating the access point.

On the other hand, the communication device 102 operates as a station connecting to the wireless network and connects to the wireless network 103. Further, the communication device 102 operates as an enrollee compliant with the DPP standard. That is, the communication device 102 can acquire communication parameters from the communication device 101 and connect to the wireless network 103.

Specific examples of the communication device 101 and the communication device 102 include, but are not limited to, an access point, a mobile phone, a digital camera, a video camera, a printer, a projector, a PC, a PDA, a smart phone, and a smart watch. ..

Also, the wireless network 103 is a wireless network conforming to the IEEE 802.11 series, and is a network constructed by the communication device 101. Here, IEEE is an abbreviation for The Institute of Electrical and Electronics Engineers. However, not limited to this, the wireless network 103 may be a network constructed by another access point different from the communication device 101 and the communication device 102. Alternatively, the communication device 101 or a device different from the communication device 101 may be a network constructed as a Group Owner that complies with the Wi-Fi Direct standard. Furthermore, the wireless network 103 may be a network based on wireless USB, MBOA, Bluetooth (registered trademark), UWB, ZigBee, NFC, or the like. Here, MBOA is an abbreviation of Multi Band OFDM Alliance, and UWB is an abbreviation of Ultra Wide Band. UWB includes wireless USB, wireless 1394, WINET, and the like.

FIG. 2 shows the hardware configuration of the communication device 101. The communication device 102 also has a similar hardware configuration.

The storage unit 201 is composed of one or more memories such as ROM and RAM, and stores programs for performing various operations described below and various information such as communication parameters for wireless communication. As the storage unit 201, in addition to a memory such as a ROM and a RAM, a storage medium such as a flexible disk, a hard disk, an optical disk, a magneto-optical disk, a CD-ROM, a CD-R, a magnetic tape, a non-volatile memory card, and a DVD. May be used.

The control unit 202 is composed of one or more processors such as a CPU and an MPU, and controls the entire communication device 101 by executing a program stored in the storage unit 201. The control unit 202 may control the entire communication device 101 by the cooperation of a program stored in the storage unit 201 and an OS (Operating System). In addition, the control unit 202 may include a plurality of processors such as a multi-core, and the plurality of processors may control the entire communication device 101.

The control unit 202 also controls the functional unit 203 to execute a predetermined process such as imaging, printing, and projection. The functional unit 203 is hardware for the communication apparatus 101 to execute a predetermined process. For example, when the communication device 101 is a camera, the functional unit 203 is an image capturing unit and performs image capturing processing. Further, for example, when the communication device 101 is a printer, the functional unit 203 is a printing unit and performs print processing. Further, for example, when the communication device 101 is a projector, the functional unit 203 is a projection unit and performs projection processing. The data processed by the functional unit 203 may be data stored in the storage unit 201 or data communicated with another communication device via the communication unit 206 described later.

The input unit 204 receives various operations from the user. The output unit 205 performs various outputs to the user. Here, the output by the output unit 205 includes at least one of display on a screen, voice output by a speaker, vibration output, and the like. Note that both the input unit 204 and the output unit 205 may be realized by one module like a touch panel.

The communication unit 206 controls wireless communication conforming to the IEEE 802.11 series and IP (Internet Protocol) communication control. In addition, the communication unit 206 controls the antenna 207 to send and receive wireless signals for wireless communication. The communication device 101 communicates content such as image data, document data, and video data with the communication device 102 via the communication unit 206.

FIG. 3 shows a flowchart of a process flow realized by the control unit 202 reading the program stored in the storage unit 201 and executing the program when the communication device 101 is powered on. Instead of turning on the power of the communication apparatus 101, when the communication apparatus 101 enters a predetermined operation mode such as a communication setting mode by a user operation or the like, or a predetermined application such as a communication setting application is activated. In some cases, it may be realized.

Also, at least part of the flowchart shown in FIG. 3 may be implemented by hardware. When it is realized by hardware, for example, a dedicated compiler may be used to automatically generate a dedicated circuit on the FPGA from a program for realizing each step. FPGA is an abbreviation for Field Programmable Gate Array. Further, a Gate Array circuit may be formed in the same manner as the FPGA and realized as hardware. Further, it may be realized by an ASIC (Application Specific Integrated Circuit). In this case, each block in the following flowcharts can be regarded as a hardware block. It should be noted that a plurality of blocks may be collectively configured as one hardware block, or one block may be configured as a plurality of hardware blocks.

First, the communication device 101 waits for a DPP start instruction from the user (S301). Here, the communication apparatus 101 receives a DPP start instruction from the user via the input unit 204. The input unit 204 may be a button as hardware or a button on a UI (User Interface) displayed on the output unit 205. The communication device 101 may also receive a DPP start instruction from an external device (not shown) (for example, a remote controller that performs infrared communication).

Upon receiving the DPP start instruction, the communication device 101 is a process conforming to the DPP standard, and sets a predetermined fixed character string as an authentication code used for the PKEX process conforming to the IETF draft (S302). Note that IETF is an abbreviation for Internet Engineering Task Force, and PKEX is an abbreviation for Public Key Exchange. The PKEX process based on the IETF draft is also called a public key exchange protocol.

Here, the fixed character string is, for example, a fixed number string such as “0000”, a fixed alphabetic character string such as “Push-Button-Configuration” (may include a symbol), or a combination of alphanumeric characters. It is an alphanumeric string. The fixed character string may be set as a common character string in the DPP standard, or may be set as a fixed character string corresponding to each service. For example, when the communication parameter sharing process is performed using the DPP standard to execute the print service, the first fixed character string “Print” is used as the authentication code. Then, when the communication parameter sharing process is performed using the DPP standard to execute the display service, the second fixed character string "Display" is used as the authentication code.

The print service is a service in which one device transmits print data and the other device receives the print data and prints. The display service is a service in which one device transmits display image data and the other device receives and displays the display image data.

The authentication code may also be a fixed character string corresponding to the number of times the user presses the button (for example, "0005" when the button is pressed 5 times). In this case, the user needs to press the button on the communication device 101 and the communication device 102 the same number of times.

Note: Which fixed code is used as the authentication code is determined in advance in the standard and the system.

When the authentication code is set, the communication apparatus 101 executes PKEX processing using the authentication code with the communication apparatus 102 (S303). Then, the communication apparatus 101 confirms whether or not the PKEX processing has succeeded (S304).

In the PKEX process, the authentication code is used to authenticate each other, and the public key for authentication (eg, bootstrapping key defined in the DPP standard) is used for subsequent processes. That is, when the PKEX process using the authentication code succeeds, the communication device 101 and the communication device 102 can share the mutual authentication public key. The details of the PKEX process will be described later with reference to FIG.

If the PKEX process fails due to a mismatch of authentication codes or a communication error (No in S304), the communication device 101 notifies the error (S305). Specifically, the communication apparatus 101 notifies the user of the error by displaying a message indicating an error indicating that the communication parameter sharing process has failed or the authentication process has failed on the output unit 205. .. The communication device 101 may additionally or alternatively notify the communication device 102 of an error. In addition, the error to be notified may include an error code indicating the reason of the error.

After that, the communication device 101 ends the processing shown in FIG. Instead of ending the process shown in FIG. 3, the process may return to step S301 to wait for a new DPP start instruction.

On the other hand, when the PKEX process is successful (Yes in S304), the communication device 101 is an authentication process different from the authentication process performed in the PKEX process and is an authentication for starting the authentication process conforming to the DPP standard. The request is transmitted to the communication device 102 (S306). Here, the authentication request is a DPP Authentication Request frame that complies with the DPP standard. Further, the authentication request includes the authentication information used for the authentication process, the identification information of the communication device 101, the random number generated by the communication device 101, and the public key for generating the shared key (communication key). The public key of the device 101) is included. The shared key is used when encrypting the random number for authentication.

Here, the authentication information is specifically a hash value of the authentication public key of the communication device 102 acquired by the PKEX process. Further, the identification information of the communication device 101 is specifically a hash value of the authentication public key of the communication device 101 transmitted to the communication device 102 by the PKEX process. Further, the random number is used for authentication when receiving the authentication response described above.

The communication device 101 that has transmitted the authentication request then waits for an authentication response from the communication device 102 for a predetermined time (S307). The time for waiting the authentication response may be a predetermined time after transmitting the authentication request, or may be a predetermined time after receiving the DPP start instruction in step S301.

The communication device 102 that has received the authentication request verifies the device that has transmitted the authentication request. This determination is performed using the authentication information included in the authentication request. That is, the communication device 102 calculates the hash value of the authentication public key of the communication device 102, compares the calculated hash value and the hash value (authentication information) included in the authentication request, and when both match, It is determined that the verification is successful. The hash function used for calculating the hash value at this time is defined by the DPP standard and is the same as the hash function used by the communication apparatus 101 for calculating the hash value.

If the verification is successful, if the authentication is successful, the communication device 102 further uses both the public key for generating the shared key of the communication device 101 and the shared key for generating the shared key of the communication device 102. To generate. The shared key is generated based on, for example, the ECDH (Elliptic Curve Diffie-Hellman) method. The method of generating the shared key is not limited to the ECDH method, and other public key encryption methods may be used.

Then, the communication device 102 transmits an authentication response. If the verification fails, the communication device 102 does not send the authentication response. However, instead of this, when the verification fails, the communication device 102 may transmit an authentication response indicating that the verification fails.

Here, the authentication response is a DPP Authentication Response frame that complies with the DPP standard. The authentication response includes the public key for generating the shared key of the communication device 102, the random number generated by the communication device 102, and the tag information. Note that the tag information is the random number included in the authentication request transmitted by the communication device 101, encrypted with the shared key described above. The tag information is used for the authentication process in the communication device 101.

Return to the description of step S307. When the communication device 101 does not receive the authentication response within the predetermined time (No in S307), the communication device 101 notifies an error (S308). Even when an authentication response indicating that the verification has failed is received, the process proceeds to step S308.

Since the error notification method is the same as in step S305, the description is omitted. When the error code or the like is included, it may be notified that the error is due to a reason different from step S305. After that, the communication device 101 ends the processing illustrated in FIG. Instead of ending the process shown in FIG. 3, the process may return to step S301 to wait for a new DPP start instruction.

On the other hand, when the authentication response is received within the predetermined time (Yes in S307), the communication apparatus 101 authenticates the communication apparatus 102 based on the information included in the authentication response (S309). This will be described more specifically. First, the communication apparatus 101 uses the secret key for generating the shared key of the communication apparatus 101 and the public key for generating the shared key of the communication apparatus 102, and shares the same method by which the communication apparatus 102 generates the shared key. Generate a key.

Here, the secret key for the shared key generation of the communication apparatus 101 is the secret key of the communication apparatus 101 corresponding to the public key for the shared key generation of the communication apparatus 101 used when the communication apparatus 102 generated the shared key. Is. The public key for generating the shared key of the communication device 102 is a public key corresponding to the secret key for generating the shared key of the communication device 102, which was used when the communication device 102 generated the shared key. By using such a combination of keys, the communication apparatus 101 can generate the same shared key as the shared key generated by the communication apparatus 102.

It should be noted that if the mutual public keys for shared key generation are not correctly exchanged between the communication device 101 and the communication device 102 due to the above-mentioned transmission / reception of the authentication request and the authentication response, the same shared key cannot be generated. It will be.

Next, the communication device 101 decrypts the tag information included in the authentication response with the generated shared key, and confirms whether the random number included in the authentication request can be decrypted correctly. When the communication device 101 can be decrypted correctly, the communication device 101 determines that the communication device 102 has been successfully authenticated. On the other hand, if the decryption is not successful, it is determined that the authentication has failed. The case where the decryption cannot be correctly performed is, for example, the case where the same shared key cannot be generated.

If the authentication fails (No in S309), the communication device 101 notifies the error in step S308. On the other hand, when the authentication is successful (Yes in S309), the communication apparatus 101 transmits an authentication confirmation to the communication apparatus 102 (S310). Here, the authentication confirmation is a DPP Authentication Confirm frame complying with the DPP standard, and includes tag information. The tag information is the random number included in the authentication response transmitted by the communication device 102, which is encrypted by the communication device 101 using the shared key.

The communication device 101 that has transmitted the authentication confirmation then waits for a setting request from the communication device 102 for a predetermined time (S311). The time for waiting for the setting request may be a predetermined time after transmitting the authentication request or may be a predetermined time after receiving the DPP start instruction in step S301. Further, the predetermined time in this step may be the same time as the predetermined time in step S307 or may be a different time.

The communication device 102 that has received the authentication confirmation determines that the authentication is successful if the tag information included in the authentication confirmation can be correctly decrypted with the shared key generated by itself. When it is determined that the authentication is successful, the communication apparatus 102 recognizes the communication apparatus 101 that has transmitted the authentication request as a configurator, and transmits a setting request to the communication apparatus 101. Here, the setting request is a DPP Configuration Request frame that complies with the DPP standard. This setting request includes device information and role information of the communication device 102. The device information is a device name of the communication device 102 or the like. The role information is information indicating a role after receiving the communication parameters, and is an “access point” or a “station”. The information included in the setting request is encrypted with the shared key used by the communication device 102 to encrypt the tag information when transmitting the authentication response. On the other hand, if it is not determined that the authentication is successful, that is, if the authentication is unsuccessful, the communication device 102 does not transmit the setting request.

Return to the description of step S311. When the setting request from the communication device 102 is not received within the predetermined time (No in S311), the communication device 101 proceeds to step S308 and notifies an error. On the other hand, when the setting request from the communication device 102 is received within the predetermined time (Yes in S311), the communication device 101 performs a process of providing communication parameters for connecting to the wireless network 103 as a setting response ( S312). Here, the setting response is a DPP Configuration Response frame compliant with the DPP standard.

The setting response transmitted by the communication parameter processing unit 208 of the communication apparatus 101 includes communication parameters, an expiration date of the communication parameters, a public key dedicated to the configurator of the communication apparatus 101, role information, and the like. The communication parameter includes a credential compliant with the DPP standard and a public key included in the authentication response from the communication device 102. Further, in the setting response, the communication parameter is encrypted with the private key dedicated to the configurator of the communication apparatus 101. Further, the information included in the setting response is encrypted with the shared key generated in the communication device 101.

After transmitting the setting request, the communication device 102, which is an enrollee, waits for a setting response to be transmitted from the communication device 101, which is the configurator. The communication device 102 that has received the setting response decrypts the information sharing key included in the setting response. Further, the communication apparatus 102 decrypts the communication parameter encrypted with the private key dedicated to the configurator of the communication apparatus 101 with the public key dedicated to the configurator of the communication apparatus 101. The communication device 102 can connect to the wireless network 103 using the communication parameters obtained by decoding.

The operation of the communication device 101 and the communication device 102 until the communication device 101 performing the above processing provides the communication device 102 with communication parameters will be further described. FIG. 4 is a sequence diagram when the communication apparatus 101 provides the communication apparatus 102 with communication parameters.

First, when the communication device 102 receives a DPP start instruction from the push button from the user (S401), a fixed authentication code is set (S402). This authentication code corresponds to the password of the public key exchange protocol in the IETF draft.

On the other hand, when the communication apparatus 101 receives a DPP start instruction from the push button from the user (S403), it sets a fixed authentication code (S404). Specifically, the communication device 101 generates a cryptographic element Qa by combining the hash (Hash) of the set authentication code and the element (Pi) defined in the DPP standard. Further, the communication device 101 generates a temporary key pair (secret key x and public key X), adds the generated public key X of the temporary key pair to the encryption element Qa, and the information element M To generate. The public key X and the information element M are vectors that include an x component and ay component.
Qa = Hash (authentication code) * Pi
M = X + Qa

Then, the communication device 101 transmits a code exchange request including the generated cryptographic element Qa, the information element M, and the identifier (eg, MAC address) of the communication device 101 to the communication device 102 (S405). Here, it is assumed that the code exchange request is transmitted by using the action frame conforming to the IEEE 802.11 series. However, the present invention is not limited to this, and a signal conforming to NFC, Bluetooth, Transfer Jet (TransferJet), Ethernet, USB or the like may be used. NFC is an abbreviation for Near Field Communication, and USB is an abbreviation for Universal Serial Bus.

This starts the authentication phase (Authentication Phase) of the public key exchange protocol in the IETF draft.

When the communication device 102 receives the code exchange request from the communication device 101, the communication device 102 calculates the temporary key X ′ from the information element M included in the code exchange request and the cipher element Qa ′ calculated by the own device. The communication device 102 combines the hash of the authentication code set by the communication device 102 and the element (Pi) defined in the DPP standard to generate the cryptographic element Qa ′.
Qa '= Hash (authentication code) * Pi
X '= M-Qa'

Here, when the fixed authentication code set by the communication device 101 and the fixed authentication code set by the communication device 102 are the same, Qa and Qa ′ have the same value. As a result, X and X'also have the same value. As a result, the communication device 102 can acquire the public key X of the temporary key pair of the communication device 101.

In addition, the communication device 102 further generates a cryptographic element Qb by combining the hash of the set authentication code and the element (Pr) defined in the DPP standard. Further, the communication device 101 generates a temporary key pair (secret key y and public key Y), adds the generated public key Y of the temporary key pair to the encryption element Qb, and the information element N To generate. The public key Y and the information element N are vectors including x component and y component.
Qb = Hash (authentication code) * Pr
N = Y + Qb

Then, the communication device 102 transmits a code exchange response including the generated cryptographic element Qb, the information element N, and the identifier (eg, MAC address) of the communication device 102 to the communication device 101 (S406).

When the communication device 101 receives the code exchange response from the communication device 102, the communication device 101 calculates the temporary key Y ′ from the information element N included in the code exchange response and the cipher element Qb ′ calculated by the own device. The communication device 101 combines the hash of the authentication code set by the communication device 101 and the element (Pr) defined in the DPP standard to generate the cryptographic element Qb ′.
Qb '= Hash (authentication code) * Pr
Y '= N-Qb'

Here, when the fixed authentication code set by the communication device 101 and the fixed authentication code set by the communication device 102 are the same, Qb and Qb 'have the same value. As a result, Y and Y'have the same value. As a result, the communication apparatus 101 can obtain the public key Y of the temporary key pair of the communication apparatus 102.

If the communication device 101 does not receive the code exchange response from the communication device 102 within a predetermined time after receiving the DPP start instruction, the communication device 101 may proceed as if the PKEX process failed. That is, the communication apparatus 101 may execute the error process of step S305 in FIG. 3 and end the sharing process without sharing the communication parameter. As a result, if the DPP start instruction is not issued between the communication device 101 and the communication device 102 within a predetermined time, the sharing process ends, and thus security is improved.

Next, the communication device 101 calculates temporary encryption information K from the secret key x of the communication device 101 and the public key Y ′ of the communication device 102. Here, the cryptographic information K is a vector value including an x component and ay component. The communication apparatus 101 further calculates a common key Z using a function KDF-n (Key Delivery Function) defined in the IETF draft.
K = x * Y '
Z = KDF-n (<>, identifier of communication device 101 | identifier of communication device 102 | Mx | Nx | authentication code, K.x)

Here, <> indicates that the first argument passed to the function is blank. Further, | indicates that the respective elements are combined. In addition, M. x, N.N. x and K. x shows the value of the x component of M, N, and K, respectively.

On the other hand, the communication device 102 calculates temporary encryption information K ′ from the secret key y of the communication device 102 and the public key X ′ of the communication device 101. Then, the common key Z ′ is calculated using the same function KDF-n.
K '= y * X'
Z = KDF-n (<>, identifier of communication device 101 | identification of communication device 102 | M.x | N.x | authentication code, K'.x)

Here, if X and X'have the same value and Y and Y'have the same value, K and K'have the same value. As a result, Z'and Z have the same value. As a result, the communication device 101 and the communication device 102 can share the same common key Z, and the authentication phase (Authentication Phase) of the public key exchange protocol is completed.

When the authentication phase (Authentication Phase) of the public key exchange protocol is completed, the public key sharing phase (Reveal Phase) of the public key exchange protocol in the IETF draft is started.

Specifically, the communication device 101 includes an identifier of the communication device 101, an authentication public key of the communication device 101 (eg, bootstrapping key defined by the DPP standard), an X. x and Y '. The information element u is calculated using x. Here, X. x and Y '. x represents the value of the x component of X and Y ', respectively. Then, the communication apparatus 101 encrypts the information element u and the authentication public key of the communication apparatus 101 with the common key Z and transmits the encrypted public key (S407).

Further, the communication device 102 has an identifier of the communication device 101, an authentication public key of the communication device 101, X ′. x and Y. The information element u'is calculated using x. Then, the communication device 102 encrypts the information element u'and the authentication public key of the communication device 102 with the common key Z and transmits the encrypted public key (S408).

The communication device 101 uses the common key Z to decrypt the information element u ′ received from the communication device 102 and the authentication public key of the communication device 102. As a result, when the acquired information element u ′ matches the information element u calculated by the own device, it is determined that the PKEX processing has succeeded. In addition, as described above, when the authentication codes set to each other match, the information element u and the information element u ′ match. In this way, the authentication process using the authentication code in the PKEX process is performed, and the mutual authentication public key is shared. When the public keys for authentication are shared with each other, the public key sharing phase (Reveal Phase) of the public key exchange protocol is completed.

Next, the communication device 101 generates and sends an authentication request (S409). The communication device 102 receives this authentication request and verifies the content of the received authentication request (S410). Then, the communication device 102 generates and transmits an authentication response (S411). The communication device 102 that has transmitted the authentication response to the communication device 101 waits for the authentication confirmation to be transmitted from the communication device 101.

The communication device 101 that has received the authentication response performs authentication based on the authentication response (S412). When the communication apparatus 101 determines that the authentication is successful, the communication apparatus 101 transmits an authentication confirmation to the communication apparatus 102 (S413). Upon receiving the authentication confirmation from the communication device 101, the communication device 102 verifies the content of the authentication confirmation (S414). Then, when it is determined that the authentication is successful, the communication apparatus 102 transmits a setting request for performing communication parameter setting processing (S415), and waits for a setting response to be transmitted from the communication apparatus 101. Upon receiving the setting request, the communication apparatus 101 transmits the communication parameter encrypted with the private key dedicated to the configurator of the communication apparatus 101 and the public key dedicated to the configurator in the setting response (S416). Upon receiving the setting response, the communication device 102 decrypts the communication parameter with the public key dedicated to the configurator of the communication device 101. After that, the communication device 102 connects to the wireless network 103 using the decrypted communication parameter (S417).

As described above, the communication device 101 can provide the communication parameter to the communication device 102 by the processing described with reference to FIGS. 3 and 4. Although the communication device 101, which is the configurator, transmits the code exchange request in the above-described embodiment, it may be transmitted by the communication device 102, which is the enrollee. In that case, the communication device 101, which is a configurator, waits for a code exchange request and transmits a code exchange response. Alternatively, the communication device 101 and the communication device 102 may alternately transmit and receive the code exchange request at appropriate time intervals so that transmission and reception can be performed.

As described above, even when performing communication parameter sharing processing using DPP, it becomes possible to use a simple user interface, and user convenience is improved. More specifically, for example, the user can perform communication parameter sharing processing using DPP simply by pressing buttons on two devices.

Further, in the above-described embodiment, the communication device 101 operates as a configurator to provide communication parameters. The configuration is not limited to this, and the communication device 101 may operate as an enrollee and the communication device 102 may operate as a configurator so that the communication device 101 receives communication parameters from the communication device 102.

Further, the communication device 101 may operate as shown in FIG. 5 instead of FIG. That is, the communication apparatus 101 waits for a DPP start instruction from the user (S501). Here, it is assumed that the user can instruct the start of DPP by a plurality of methods. For example, the communication device 101 may have a plurality of buttons each corresponding to a different instruction, or may have a switch. Further, these buttons and switches may be realized by hardware or software.

Then, when receiving the DPP start instruction from the user, the communication apparatus 101 determines whether the DPP start instruction is a predetermined DPP start instruction (S502). When it is the predetermined DPP start instruction (Yes in S502), the communication apparatus 101 executes the processes of steps S302 to S312 described above. On the other hand, when it is not the predetermined DPP start instruction (No in S502), the user is prompted to input the authentication code (S503). Then, the communication apparatus 101 uses the authentication code input by the user instead of the fixed authentication code to perform the PKEX processing (S504). After that, the communication apparatus 101 executes the processes of steps S304 to S312 described above.

With such a configuration, it is possible to switch between performing DPP communication parameter sharing processing using a fixed authentication code and performing DPP communication parameter sharing processing using an authentication code input by the user.

The present invention supplies a program that implements one or more functions of the above-described embodiments to a system or apparatus via a network or a storage medium, and one or more processors in a computer of the system or apparatus read and execute the program. It can also be realized by the processing. It can also be realized by a circuit (for example, ASIC) that realizes one or more functions.

The present invention is not limited to the above embodiments, and various changes and modifications can be made without departing from the spirit and scope of the present invention. Therefore, the following claims are attached to open the scope of the present invention.

This application claims priority on the basis of Japanese patent application Japanese Patent Application No. 2018-207194 filed on November 2, 2018, and the entire content of the description is incorporated herein.

Claims

A communication device,
A first accepting means for accepting a first instruction to start a sharing process for sharing the communication parameter for connecting to the wireless network with another communication device;
When the first instruction is accepted by the first accepting unit, a fixed authentication code is used to establish a connection with the other communication device according to the Wi-Fi DPP (Device Provisioning Protocol) standard. A first authentication means for performing an authentication process when sharing a predetermined public key with the other communication device;
Sharing means for sharing the communication parameter with the other communication device when the authentication processing by the first authenticating means is successful,
A communication device comprising:
The communication device according to claim 1, wherein the predetermined public key is a bootstrapping key compliant with the DPP standard.
Second accepting means for accepting a second instruction to start the sharing process,
Further comprising input means for allowing a user to input an authentication code when the second instruction is received by the second receiving means,
When the second instruction is accepted, the first authenticating means performs an authentication process with the other communication device using the authentication code input by the inputting means. Item 2. The communication device according to Item 1 or 2.
The communication device according to any one of claims 1 to 3, wherein the sharing means shares the communication parameter by transmitting and receiving a signal conforming to the DPP standard with the other communication device.
When the authentication process by the first authentication means is successful, the public key of the other communication device obtained from the other communication device is used to perform the authentication process defined by the DPP standard with the other communication device. Further comprising a second authentication means for performing,
The said sharing means shares the said communication parameter with the said other communication apparatus, when the authentication process by the said 2nd authentication means succeeds, The any one of Claim 1 to 4 characterized by the above-mentioned. Communication device.
The communication device according to claim 5, further comprising a first notification unit that notifies an error when the authentication processing by the second authentication unit fails.
The communication device according to claim 6, wherein the first notifying unit notifies the user of an error.
The communication device according to claim 6 or 7, wherein the first notification means notifies the other communication device of an error.
The communication device according to any one of claims 1 to 8, further comprising a second notifying unit for notifying an error when the authentication process by the first authenticating unit fails.
The communication device according to claim 9, wherein the second notifying unit notifies the user of an error.
The communication device according to claim 9 or 10, wherein the second notifying unit notifies the other communication device of an error.
The said sharing means shares the said communication parameter with the said other communication apparatus by providing the said communication parameter to the said other communication apparatus, The any one of Claim 1 to 11 characterized by the above-mentioned. Communication device.
12. The sharing unit shares the communication parameter with the other communication device by receiving the communication parameter from the other communication device, according to any one of claims 1 to 11. Communication device.
The said 1st authentication means performs the authentication process based on the authentication phase in Public Key Exchange specified by IETF (Internet Engineering Task Force), The authentication method according to any one of claims 1 to 13 characterized in that Communication device.
The communication device according to any one of claims 1 to 14, wherein the first reception means is a button.
A method for controlling a communication device, comprising:
A receiving step of receiving an instruction to start a sharing process for sharing a communication parameter for connecting to a wireless network with another communication device,
When the instruction is accepted, a predetermined public key defined by the Wi-Fi DPP (Device Provisioning Protocol) standard with the other communication device is used by using a fixed authentication code. An authentication process that performs authentication processing when sharing with
A sharing step of sharing the communication parameter with the other communication device when the authentication process is successful;
A control method comprising:
A program for operating a computer as the communication device according to any one of claims 1 to 15.