Patent Grant
12160736
The present disclosure discloses a technique related to a communication device capable of establishing a wireless connection with a parent station.
A technique is known for using a management device to change an access point to which a station is connected from a first access point to a second access point having higher security than the first access point. The management device obtains, from the first access point, a first communication parameter for connecting to the first access point, and sends the first communication parameter to the second access point. When the second access point receives the first communication parameter from the management device, the second access point changes a security scheme (that is, a combination of authentication scheme and encryption scheme) of the first communication parameter to a scheme with high security, and creates a second communication parameter. Further, the management device receives authentication information from the station, and sends the authentication information to the second access point. Thereby, the second access point uses the authentication information to send the second communication parameter including the scheme with high security to the station and establishes a connection with the station.
In a situation where the station changes the access point to which it is connected, it is not preferable that the station is connected to an access point having lower security than the first access point.
The disclosure herein discloses a technique which is capable of suppressing establishment of a second wireless connection between a communication device and a second parent station in a state where a first wireless connection is established between the communication device and a first parent station, where the second wireless connection has a security level lower than a first security level related to the first wireless connection.
A communication device disclosed herein may comprise a processor; and a memory storing first security information indicating a first security level related to a first wireless connection with a first parent station, the memory further storing computer-readable instructions therein, the computer-readable instructions, when executed by the processor, causing the communication device to: in a case where a first instruction for establishing a second wireless connection with a second parent station different from the first parent station is accepted under a state where the first wireless connection is established, obtain second security information indicating a second security level related to the second wireless connection; in a case where the second security information is obtained under a state where the first security information is stored in the memory, determine whether the second security level indicated by the second security information is lower than the first security level indicated by the first security information in the memory; in a case where it is determined that the second security level is lower than the first security level, execute at least one process of a notification process or an acceptance process, the notification process being for notifying that the second security level is lower than the first security level, the acceptance process being for accepting an input of authentication information for establishing the second wireless connection with the second parent station; and in a case where it is determined that the second security level is not lower than the first security level, establish the second wireless connection with the second parent station without executing the at least one process.
Further, another communication device disclosed herein may comprise a processor; and a memory storing first security information indicating a first security level related to a first wireless connection with a first parent station, the memory further storing computer-readable instructions therein, the computer-readable instructions, when executed by the processor, causing the communication device to: in a case where a first instruction for establishing a second wireless connection with a second parent station different from the first parent station is accepted under a state where the first wireless connection is established, obtain second security information indicating a second security level related to the second wireless connection; in a case where the second security information is obtained under a state where the first security information is stored in the memory, determine whether the second security level indicated by the second security information is lower than the first security level indicated by the first security information in the memory; and in a case where it is determined that the second security level is not lower than the first security level, establish the second wireless connection with the second parent station, wherein in a case where it is determined that the second security level is lower than the first security level, the second wireless connection is not established.
Computer programs for implementing the above communication devices and computer-readable media storing the computer programs are also novel and useful. Further, methods implemented by the above communication devices are also novel and useful. Further, a communication system comprising at least one of the above communication device or another device (e.g., a first parent station, a second parent station) is also novel and useful.
(Configuration of Communication System 2;
As shown in
(Configuration of Printer 10)
The printer 10 is a peripheral device (e.g., a peripheral device of the terminal 100, etc.) capable of executing a print function. The printer 10 comprises an operation unit 12, a display unit 14, a Wi-Fi interface 16, a print executing unit 18, and a controller 30. Hereinbelow, interface will be termed simply as “I/F”. The units 12 to 30 are connected to a bus line (reference number omitted).
The operation unit 12 comprises a plurality of keys. The user can input various instructions to the printer 10 by operating the operation unit 12. The display unit 14 is a display for displaying various types of information. The print executing unit 18 comprises a printing mechanism of an ink jet scheme, laser scheme, etc.
The Wi-Fi I/F 16 is a wireless interface configured to execute Wi-Fi communication according to the Wi-Fi scheme. The Wi-Fi scheme is a wireless communication scheme for executing wireless communication according to, for example, 802.11 standard of IEEE (abbreviation of The Institute of Electrical and Electronics Engineers, Inc.) and standards complying thereto (such as 802.11a, 11b, 11g, 11n, 11ac, etc.). The Wi-Fi I/F 16 especially supports Device Provisioning Protocol (DPP) scheme that has been established by the Wi-Fi Alliance. The DPP scheme is described in the standard “Device Provisioning Protocol Specification Version 1.0” created by the Wi-Fi Alliance, and is a wireless communication scheme for easily establishing a Wi-Fi connection between a pair of devices (such as the printer 10 and the AP 7) by using the terminal 100.
The controller 30 comprises a CPU 32 and a memory 34. The CPU 32 executes various processes in accordance with a program 36 stored in the memory 34. The memory 34 is constituted of a volatile memory, a non-volatile memory, and the like. The memory 34 further stores connection information 38, authentication ranking information 40, and encryption ranking information 42. The connection information 38 includes information (that is, an SSID (abbreviation of Service Set Identifier), a password, etc.) for establishing a Wi-Fi connection with a connection target (that is, the AP 6) which the printer 10 is currently establishing the Wi-Fi connection with. In particular, the connection information 38 includes an authentication scheme and an encryption scheme used by the AP 6.
The authentication ranking information 40 indicates a ranking of a plurality of authentication schemes corresponding to security levels related to Wi-Fi connections established between the printer 10 and APs. The authentication schemes are classified into enterprise-type authentication scheme and personal-type authentication scheme. The enterprise-type authentication scheme includes, for example, LEAP (abbreviation of Lightweight Extensible Authentication Protocol), EAP-FAST (abbreviation of Extensible Authentication Protocol-Flexible Authentication via Secured Tunnel), and the like. The personal-type authentication scheme includes, for example, PSK (abbreviation of Pre-shared Key), DPP, and the like. In the authentication ranking information 40, the enterprise-type authentication schemes are ranked higher than the personal-type authentication schemes. Further, in the authentication ranking information 40, DPP is ranked higher than PSK among the personal-type authentication schemes. The authentication ranking information 40 may be stored in advance in the printer 10 by a vendor of the printer 10 prior to shipping of the printer 10, or may be stored in the printer 10 by the user after shipping of the printer 10. The ranking of the authentication schemes in the authentication ranking information 40 is not limited to the aforementioned ranking, and another ranking may be set.
The encryption ranking information 42 indicates a ranking of a plurality of encryption schemes corresponding to security levels. The encryption schemes include, for example, SAE (abbreviation of Simultaneous Authentication of Equals), CCMP (abbreviation of Counter mode CBC MAC Protocol), TKIP (abbreviation of Temporal Key Integrity Protocol), WEP (abbreviation of Wired Equivalent Privacy), and the like. In the encryption ranking information 42, SAE, CCMP, TKIP and WEP are ranked from highest to lowest in this order. The encryption ranking information 42 may be stored in advance in the printer 10 by the vendor of the printer 10 prior to shipping of the printer 10, or may be stored in the printer 10 by the user after shipping of the printer 10. Further, the ranking of the encryption schemes in the encryption ranking information 42 is not limited to the aforementioned ranking, and another ranking may be set.
(Configuration of Terminal 100)
The terminal 100 is a portable terminal device such as a cellphone (e.g., a smartphone), a PDA, a tablet PC, or the like. In a variant, the terminal 100 may be a desktop PC, a laptop PC or the like. The terminal 100 comprises a camera 115 and a Wi-Fi I/F 116. The camera 115 is a device configured to capture images of an object and, in this embodiment, is especially used to capture a QR code for the AP 7 and the printer 10. The Wi-Fi I/F 116 is similar to the Wi-Fi I/F 16 of the printer 10. That is, the terminal 100 supports the DPP scheme. Further, the terminal 100 stores a connection application (hereinbelow termed simply as “app”) 140 for establishing a Wi-Fi connection between a pair of devices according to the DPP scheme. The app 140 is installed on the terminal 100 from, for example, a server on the Internet provided by the vendor of the printer 10.
(Configurations of APs 6, 7)
The APs 6, 7 are each a known AP called a wireless AP, a wireless LAN router, and the like. The APs 6, 7 also support the DPP scheme. The AP 6 stores a combination of the authentication scheme “PSK” and the encryption scheme “TKIP”, or a combination of the authentication scheme “DPP” and the encryption scheme “SAE” as the combination of authentication scheme and encryption scheme supported by the AP 6. The AP 7 stores a combination of the authentication scheme “PSK” and the encryption scheme “CCMP”, or a combination of the authentication scheme “DPP” and the encryption scheme “CCMP” as the combination of authentication scheme and encryption scheme supported by the AP 7.
As above, the APs 6, 7 support different combinations of authentication schemes and encryption schemes. For this reason, there is a possibility that between the printer 10 and the AP 7, a Wi-Fi connection that has a security level lower than the security level of the Wi-Fi connection between the printer 10 and the AP 6 may be established. This embodiment suppresses a Wi-Fi connection having a security level lower than the security level of the Wi-Fi connection with the AP 6 from being established between the printer 10 and the AP 7.
Next, an outline of the present embodiment will be described with reference to
In the present embodiment, in a situation where the Wi-Fi connection is established between the printer 10 and the AP 6, the devices 7, 10 and 100 execute communication according to the DPP scheme to establish a Wi-Fi connection between the printer 10 and the AP 7 instead of between the printer 10 and the AP 6.
Hereinbelow, for easier understanding, operations executed by the CPUs of the respective devices (e.g., the CPU 32, etc.) will be described with the devices (e.g., the printer 10) as the subject of operation, not with the CPUs as the subject of operation.
In T2, the terminal 100 executes Bootstrapping (hereinbelow termed simply as “BS”) according to the DPP scheme with the AP 7. This BS is a process of providing information that is to be used in Authentication (hereinbelow termed simply as “Auth”) of T4 (to be described later) from the AP 7 to the terminal 100 in response to a QR code adhered to the AP 7 being captured by the terminal 100.
In T4, the terminal 100 executes Auth according to the DPP scheme with the AP 7 by using the information obtained in the BS of T2. This Auth is a process for the terminal 100 and the AP 7 to authenticate their communication counterparts.
In T6, the terminal 100 executes Configuration (hereinbelow termed simply as “Config”) according to the DPP scheme with the AP 7. This Config is a process of sending information for establishing a Wi-Fi connection between the printer 10 and the AP 7 to the AP 7. Specifically, in the Config, the terminal 100 creates a Configuration Object (hereinbelow, Configuration Object is simply be termed “CO”) for AP for establishing a Wi-Fi connection between the printer 10 and the AP 7, and sends the CO for AP to the AP 7. As a result, the CO for AP is stored in the AP 7.
In T8, the terminal 100 executes Network Access (hereinbelow simply termed “NA”) according to the DPP scheme with the AP 7. In this NA, the terminal 100 creates a CO for terminal and stores the CO for terminal in a memory (not shown) of the terminal 100. Then, the terminal 100 and the AP 7 share a connection key for establishing a Wi-Fi connection between the terminal 100 and the AP 7 by using the CO for terminal and the CO for AP.
In T10, the terminal 100 and the AP 7 execute 4 way-handshake communication. During at least a part of the 4 way-handshake communication, the terminal 100 and the AP 7 communicate encrypted information that is encrypted by the connection key shared in the NA of T8. Then, in a case where decryption of the encrypted information succeeds, a normal Wi-Fi connection is established between the terminal 100 and the AP 7. Thereby, the terminal 100 participates as a child station in a wireless network formed by the AP 7. In this case, the terminal 100 stores the authentication scheme “DPP” and the encryption scheme “CCMP” used by the AP 7.
Next, the terminal 100 executes BS according to the DPP scheme with the printer 10 in T12. This BS is a process of providing information that is to be used in Auth of T14 (to be described later) from the printer 10 to the terminal 100 in response to a QR code displayed in the printer 10 being captured by the terminal 100.
In T14, the terminal 100 executes Auth according to the DPP scheme with the printer 10 by using the information obtained in the BS of T12. This Auth is a process for the terminal 100 and the printer 10 to authenticate their communication counterparts.
In T16, the terminal 100 executes Config according to the DPP scheme with the printer 10. This Config is a process of sending information for establishing a Wi-Fi connection between the printer 10 and the AP 7 to the printer 10. In this Config, the terminal 100 creates a CO for printer for establishing a Wi-Fi connection between the printer 10 and the AP 7, and sends the CO for printer to the printer 10. As a result, the CO for printer is stored in the printer 10.
In T18, the printer 10 and the AP 7 execute NA according to the DPP scheme by using the stored CO for AP and CO for printer. By using the CO for printer and the CO for AP, the printer 10 and the AP 7 share a connection key for establishing a Wi-Fi connection between the printer 10 and the AP 7.
The printer 10 disconnects the Wi-Fi connection with the AP 6 in T20. Specifically, the printer 10 sends, to the AP 6, a disconnection request that requests disconnection of the Wi-Fi connection, and disconnects the Wi-Fi connection with the AP 6.
In T30, the printer 10 executes various communications (Association, Authentication, 4-way handshake) with the AP 7. During at least a part of the 4 way-handshake communication, the printer 10 and the AP 7 communicate encrypted information that is encrypted by the connection key shared in the NA of T18. Then, in a case where decryption of the encrypted information succeeds, a Wi-Fi connection is established between the printer 10 and the AP 7. Thereby, the printer 10 can participate as a child station in the wireless network formed by the AP 7, as a result of which the printer 10 can execute communication, via the AP 7, with another device (e.g., the terminal 100) participating in this wireless network.
In the DPP scheme, in order to establish the Wi-Fi connection between the printer 10 and the AP 7, the user does not need to input information of the wireless network in which the AP 7 operates as a parent station (such as an SSID and a password) to the printer 10. As such, the user can easily establish the Wi-Fi connection between the printer 10 and the AP 7.
(Description of Processes;
Next, details of the processes executed in T12 to T30 of
(Bootstrapping (BS);
Firstly, a process of the BS in T12 of
In response to accepting a power-ON operation by the user in T100, the printer 10 causes the display unit 14 to display a menu screen in T105. The menu screen includes a print button for causing the printer 10 to execute print and a setting button for designating various settings (such as print setting) of the printer 10.
In response to the setting button in the menu screen being selected by the user in T106, the printer 10 causes the display unit 14 to display a setting screen in T107. The setting screen includes a print setting button for changing print settings of the printer 10 and a QR code button for causing the printer 10 to display its QR code.
In response to the QR code button in the setting screen being selected by the user in T120, the printer 10 causes the display unit 14 to display the QR code in T122. This QR code is a code image obtained by coding the public key PPK1 stored in advance in the memory 34, a channel list stored in advance in the memory 34, and a MAC address of the printer 10. The channel list is a list of values of a plurality of communication channels to be used in the Auth (see T14 of
The terminal 100 activates the app 140 in T130 in response to accepting an activation operation for the app 140 by the user, and further activates the camera 115. Following processes to be executed by the terminal 100 are realized by the app 140. Next, in T132, the terminal 100 captures the QR code displayed on the printer 10 (see T122) by using the camera 115. Further, in T134, the terminal 100 decodes the captured QR code and obtains the public key PPK1, the channel list, and the MAC address. When the process of T134 is completed, the process of the BS is terminated.
(Authentication (Auth);
Next, the process of the Auth in T14 of
In T210, the terminal 100 sends a DPP Authentication Request (hereinbelow termed simply as “AReq”) via the Wi-Fi I/F 116 to the printer 10 by setting the MAC address of the printer 10 obtained in T134 of
The capability is information that is pre-designated in a device supporting the DPP scheme, and includes any one of the following values: a value indicating that this device is capable of operating only as a Configurator according to the DPP scheme, a value indicating that this device is capable of operating only as an Enrollee according to the DPP scheme, and a value indicating that this device is capable of operating as any of the Configurator and the Enrollee. The Configurator refers to a device configured to send a CO used in NA (e.g., T18 of
The printer 10 receives the AReq from the terminal 100 via the Wi-Fi I/F 16 in T210. As above, this AReq is sent with the MAC address of the printer 10 as the destination. As such, the printer 10 can suitably receive this AReq from the terminal 100. Further, when the printer 10 displays the QR code in T122 of
Next, the printer 10 executes following processes for authenticating the sender of the AReq (that is, the terminal 100). Specifically, firstly, in T212, the printer 10 creates a shared key SK1 according to the ECDH by using the public key TPK1 of the terminal 100 in the AReq and the secret key psk1 of the printer 10 stored in advance in the memory 34. Here, the shared key SK1 created by the terminal 100 in T201 and the shared key SK1 created by the printer 10 in T212 are identical to each other. Thus, the printer 10 can suitably decrypt in T214 the encrypted data ED1 in the AReq by using the created shared key SK1, as a result of which it can obtain the random value RV1. In a case where the decryption of the encrypted data ED1 succeeds, the printer 10 determines that the sender of the AReq is the device that captured the QR code displayed on the printer 10, that is, determines that the authentication succeeded, and executes subsequent processes from T216. On the other hand, in a case where the decryption of the encrypted data ED1 does not succeed, the printer 10 determines that the sender of the AReq is not the device that captured the QR code displayed on the printer 10, that is, determines that the authentication failed, and does not execute the subsequent processes from T216.
In T216, the printer 10 creates a new public key PPK2 and a new secret key psk2 of the printer 10. In a variant, the public key PPK2 and the secret key psk2 may be stored in advance in the memory 34. Next, in T217, the printer 10 creates a shared key SK2 according to the ECDH by using the public key TPK1 of the terminal 100 in the AReq of T210 and the created secret key psk2 of the printer 10. Then, in T218, the printer 10 creates encrypted data ED2 by using the created shared key SK2 to encrypt the obtained random value RV1 and a new random value RV2.
In T220, the printer 10 sends an DPP Authentication Response (hereinbelow termed simply as “ARes”) to the terminal 100 via the Wi-Fi I/F 16. This ARes includes the public key PPK2 of the printer 10 created in T216, the encrypted data ED2 created in T218, and a capability of the printer 10. This capability includes the value indicating that the printer 10 is capable of operating only as the Enrollee.
In response to receiving the ARes from the printer 10 via the Wi-Fi I/F 116 in T220, the terminal 100 executes following processes for authenticating the sender of the ARes (that is, the printer 10). Specifically, in T222, the terminal 100 creates a shared key SK2 according to the ECDH by using the secret key tsk1 of the terminal 100 created in T200 and the public key PPK2 of the printer 10 in the ARes. Here, the shared key SK2 created by the printer 10 in T217 and the shared key SK2 created by the terminal 100 in T222 are identical to each other. Thus, the terminal 100 can suitably decrypt in T224 the encrypted data ED2 in the ARes by using the created shared key SK2, as a result of which it can obtain the random values RV1 and RV2. In a case where the decryption of the encrypted data ED2 succeeds, the terminal 100 determines that the sender of the ARes is the device that displayed the captured QR code, that is, determines that the authentication succeeded, and executes subsequent processes from T230. On the other hand, in a case where the decryption of the encrypted data ED2 does not succeed, the terminal 100 determines that the sender of the ARes is not the device that displayed the captured QR code, that is, determines that the authentication failed, and does not execute the subsequent processes from T230.
In T230, the terminal 100 sends a Confirm to the printer 10 via the Wi-Fi I/F 116. The Confirm includes information indicating that the terminal 100 operates as the Configurator and the printer 10 operates as the Enrollee. As a result, the terminal 100 determines to operate as the Configurator in T232, and the printer 10 determines to operate as the Enrollee in T234. When the process of T234 is completed, the process of
(Configuration (Config);
Next, the process of Config in T16 of
The terminal 100 receives the CReq from the printer 10 in T300 via the Wi-Fi I/F 116. In this case, the terminal 100 obtains a group ID “Gr”, a public key TPK2, and a secret key tsk2 from the memory of the terminal 100 in T301. As aforementioned, the terminal 100 have already executed the Config in T6 of
The terminal 100 creates a hash value HV by hashing the public key TPK2 of the terminal 100. Further, the terminal 100 creates a first value by hashing a combination of the hash value HV, the group ID “Gr”, and the public key PPK2 of the printer 10 in the ARes of T220 of
In T10 of
When the printer 10 receives the CRes from the terminal 100 via the Wi-Fi I/F 16 in T310, the printer 10 obtains the scheme information from the CO for printer in the CRes and determines that the scheme information includes the authentication scheme but it does not include an encryption scheme. In this case, in T312, the printer 10 stores, in the memory 34, the CO for printer and the MAC address “Ma” in the CRes. When the process of T312 is completed, the process of
(Network Access (NA);
Next, the process of the NA in T18 of
In T400, the printer 10 sends a DPP Peer Discovery Request (hereinbelow termed simply as “DReq”) including the SC for printer to the AP 7 via the Wi-Fi I/F 16. The DReq is a signal requesting the AP 7 to execute authentication and send the SC for AP.
In response to receiving the DReq from the printer 10 in T400, the AP 7 executes a process for authenticating the sender of the DReq (that is, the printer 10) and the information in the DReq (that is, the hash value HV, the “Gr”, and the public key PPK2). Specifically, in T402, the AP 7 firstly executes a first AP determination process that is regarding whether or not the hash value HV and the group ID “Gr” in the received SC for printer are respectively identical to the hash value HV and the group ID “Gr” in the SC for AP included in the stored CO for AP. In the case of
Next, in T404, the AP 7 creates a connection key CK (that is, a shared key) by using the obtained public key PPK2 of the printer 10 and the stored secret key ask2 of the AP 7 in accordance with the ECDH.
In T410, the AP 7 sends a DPP Peer Discovery Response (hereinbelow termed simply as “DRes”) including the SC for AP to the printer 10.
In response to receiving the DRes from the AP 7 in T410 via the Wi-Fi I/F 16, the printer 10 executes a process for authenticating the sender of the DRes (that is, the AP 7) and the information in the DRes (that is, the hash value HV, the “Gr”, and the public key APK2). Specifically, in T412, the printer 10 firstly executes a first PR determination process that is regarding whether or not the hash value HV and the group ID “Gr” in the received SC for AP are respectively identical to the hash value HV and the group ID “Gr” in the SC for printer included in the stored CO for printer. In the case of
In T414, the printer 10 creates a connection key CK by using the stored secret key psk2 of the printer 10 and the public key APK2 of the AP 7 in the received SC for AP in accordance with the ECDH. Here, the connection key CK created by the AP 7 in T404 and the connection key CK created by the printer 10 in T414 are identical to each other. Due to this, the connection key CK for establishing the Wi-Fi connection is shared between the printer 10 and the AP 7. When T414 is completed, the process of
(Establishment of Wi-Fi Connection;
Next, details of processes executed in T20 to T30 of
The printer 10 sends a Probe Request (hereinbelow termed simply as “PReq”) by broadcast via the Wi-Fi I/F 16 in T500 and, receives in T502 from the AP 7 a Probe Response (hereinbelow termed simply as “PRes”) including the MAC address “Ma” of the AP 7. Then, the printer 10 sends a PReq including the MAC address “Ma” to the AP 7 via the Wi-Fi I/F 16 in T510 and, receives in T512 from the AP 7 a PRes including the MAC address “Ma”, the authentication scheme “DPP”, and the encryption scheme “CCMP”. In this case, the printer 10 uses the authentication ranking information 40 and the encryption ranking information 42 in the memory 34 to determine whether the authentication scheme “DPP” and the encryption scheme “CCMP” in the PRes are respectively ranked the same as or higher than the authentication scheme and the encryption scheme in the connection information 38 stored in the memory 34.
Firstly, a case A in which the connection information 38 includes the authentication scheme “PSK” and the encryption scheme “TKIP” will be described. Firstly, the printer 10 determines, by using the authentication ranking information 40 in the memory, that the two authentication schemes “DPP” and “PSK” are both personal-type authentication schemes and that the authentication scheme “DPP” is ranked higher than the authentication scheme “PSK”. Next, by using the encryption ranking information 42 in the memory, the printer 10 determines that the encryption scheme “CCMP” is ranked higher than the encryption scheme “TKIP”. In this case, the printer 10 sends the disconnection request to the AP 6 via the Wi-Fi I/F 16 in T520 and disconnects the Wi-Fi connection with the AP 6 in T522. Thereafter, the printer 10 establishes the Wi-Fi connection with the AP 7 in T530. When the process of T530 is completed, the process of case A is terminated.
Next, a case B in which the connection information 38 includes the authentication scheme “DPP” and the encryption scheme “SAE” will be described. Firstly, the printer 10 determines, by using the authentication ranking information 40 in the memory, that the authentication schemes “DPP” are the personal-type authentication schemes and that the authentication schemes “DPP” are ranked the same. Next, by using the encryption ranking information 42 in the memory, the printer 10 determines that the encryption scheme “CCMP” is ranked lower than the encryption scheme “SAE”. In this case, in T540, the printer 10 displays, on the display unit 14, a notification screen notifying the user that the security level of a Wi-Fi connection with the AP 7 is lower than the security level of the Wi-Fi connection with the AP 6. By viewing the notification screen displayed on the printer 10, the user can be informed that the security level of a Wi-Fi connection with the AP 7 is lower than the security level of the Wi-Fi connection with the AP 6. The notification screen includes an OK button indicating that a Wi-Fi connection is to be established between the printer 10 and the AP 7, and a Cancel button indicating that a Wi-Fi connection is not to be established between the printer 10 and the AP 7.
In a case where the OK button in the notification screen is selected by the user in T550, the printer 10 causes, in T552, the display unit 14 to display an acceptance screen for accepting an input of a password for establishing a Wi-Fi connection between the printer 10 and the AP 7, from the user. The acceptance screen includes an input field to which a password is inputted, an OK button indicating that a Wi-Fi connection is to be established between the printer 10 and the AP 7, and a Cancel button indicating that a Wi-Fi connection is not to be established between the printer 10 and the AP 7.
In T560, the printer 10 accepts the input of a password P and accepts selection of the OK button in the acceptance screen. In this case, the printer 10 executes the same processes as T520 to T530, and establishes a Wi-Fi connection with the AP 7. Thereby, even in a case where the security level of the Wi-Fi connection with the AP 7 is lower than the security level of the Wi-Fi connection with the AP 6, the Wi-Fi connection can be established between the printer 10 and the AP 7 in response to the operation by the user. When the process of T530 is completed, the process of case B is terminated.
(First Determination Process;
Next, a first determination process executed by the CPU 32 of the printer 10 in order to realize the processes of
In S10, the printer 10 determines whether the scheme information included in the CO for printer in the CReq includes an authentication scheme and an encryption scheme. As above, the scheme information includes any one of values among the authentication scheme “PSK”, the authentication scheme “DPP”, the encryption scheme “SAE”, and the combination of the authentication scheme “PSK” and the encryption scheme “SAE”. In case of determining that the scheme information includes an authentication scheme and an encryption scheme (YES in S10), that is, in a case where the combination of the authentication scheme “PSK” and the encryption scheme “SAE” is included in the scheme information, the printer 10 obtains the authentication scheme and the encryption scheme in the scheme information in S12. The situation where the combination of the authentication scheme “PSK” and the encryption scheme “SAE” is included in the scheme information is a situation where a Wi-Fi connection is established between the terminal 100 and the AP 7 by communication of a scheme different from the above-described communication according to the DPP scheme, for example, by the user inputting an SSID and a password of the AP 7 to the terminal 100 and various communications (Probe, Association, Authentication, 4-way handshake, etc.) being executed between the terminal 100 and the AP 7. On the other hand, in case of determining that the scheme information includes only one of an authentication scheme and an encryption scheme (NO in S10), that is, in a case where the scheme information includes any of the authentication scheme “PSK”, the authentication scheme “DPP”, and the encryption scheme “SAE”, the printer 10 executes a second determination process in S15.
In S20, the printer 10 uses the authentication ranking information 40 in the memory 34 to determine whether the obtained authentication scheme is ranked the same as or higher than the authentication scheme included in the connection information 38 (hereinafter termed “current authentication scheme”) in the memory 34. In case of determining that the obtained authentication scheme is ranked the same as or higher than the current authentication scheme (YES in S20), the printer 10 proceeds to S25. On the other hand, in case of determining that the obtained authentication scheme is ranked lower than the current authentication scheme (NO in S20), the printer 10 proceeds to S27.
In S25, the printer 10 uses the encryption ranking information 42 in the memory 34 to determine whether the obtained encryption scheme is ranked the same as or higher than the encryption scheme included in the connection information 38 (hereinafter termed “current encryption scheme”) in the memory 34. In case of determining that the obtained encryption scheme is ranked the same as or higher than the current encryption scheme (YES in S25), the printer 10 proceeds to S40. On the other hand, in case of determining that the obtained encryption scheme is ranked lower than the current encryption scheme (NO in S25), the printer 10 proceeds to S27.
In S27, the printer 10 causes the display unit 14 to display the notification screen. The notification screen includes the OK button and the Cancel button.
In S28, the printer 10 determines whether the OK button in the notification screen is selected by the user. The printer 10 proceeds to S30 in a case where the OK button in the notification screen is selected by the user, while the printer 10 terminates the process of
In S30, the printer 10 causes the display unit 14 to display the acceptance screen. The acceptance screen includes the password input field, the OK button, and the Cancel button. In S35, the printer 10 determines whether authentication of the password succeeds. In case of accepting input of the correct password and selection of the OK button in the acceptance screen from the user, the printer 10 determines YES in S35 and proceeds to S40. On the other hand, in case of accepting input of an incorrect password and selection of the OK button in the acceptance screen from the user, or in case of accepting selection of the Cancel button in the acceptance screen from the user, the printer 10 determines NO in S35 and terminates the process of
In S40, the printer 10 sends the disconnection request to the AP 6 via the Wi-Fi I/F 16 and disconnects the Wi-Fi connection with the AP 6.
In S45, the printer 10 executes various communications with the AP 7 (NA, Probe, Association, Authentication, 4-way handshake, etc.) and establishes a Wi-Fi connection with the AP 7. When the process of S45 is completed, the process of
(Second Determination Process;
Next, the second determination process executed in S15 of
In S105, the printer 10 sends a PReq by broadcast via the Wi-Fi I/F 16 (T500 of
In S110, the printer 10 sends, to the AP 7 via the Wi-Fi I/F 16, a PReq including the MAC address “Ma” of the AP 7 (T510 of
In S115, the printer 10 obtains the authentication scheme and the encryption scheme included in the received PRes.
S120 is the same as S20 of
S125 is the same as S25 of
S127 and S128 are the same as S27 and S28 of
S130 and S135 are the same as S30 and S35 of
S140 is the same as S40 of
According to the present embodiment, in a case where the QR code button in the setting screen is selected by the user (T122 of
(Correspondence Relationships)
The printer 10, the terminal 100, the AP 6, and the AP 7 are examples of “communication device”, “external device”, “first parent station”, and “second parent station”, respectively. The security level of the AP 6 and the security level of the AP 7 are examples of “first security level” and “second security level”, respectively. The process of displaying the notification screen and the process of displaying the acceptance screen are examples of “notification process” and “acceptance process”, respectively. The Wi-Fi connection between the printer 10 and the AP 6, and the Wi-Fi connection between the printer 10 and the AP 7 are examples of “first wireless connection”, and “second wireless connection”, respectively.
The Wi-Fi I/F 16 and the display unit 14 of the printer 10 are examples of “wireless interface” and “output unit”, respectively. The CReq and the CRes are examples of “first information request” and “first information response”, respectively. The PReq of T510 and the PRes of T512 in
The process of S12 (or S115 of
Next, a second embodiment will be described with reference to
S205 and S210 are the same as S5 and S10 of
(Variant 1) The processes of S30 and S35 of
(Variant 2) In S27 of
(Variant 3) In S27 of
(Variant 4) In S30 of
(Variant 5) The printer 10 may omit the process of
(Variant 6) In S20 of
(Variant 7) The processes of S40 in
(Variant 8) The Wi-Fi connection between the printer 10 and the AP 6 simply needs to be disconnected before the Wi-Fi connection is established between the printer 10 and the AP 7. For example, in the case where the QR code button in the setting screen is selected by the user in T120 of
(Variant 9) The process of S45 in
(Variant 10) For example, the QR code displayed on the printer 10 in T122 of
(Variant 11) The processes for creating the shared key (for example, SK1) (such as T201, T212 of
(Variant 12) The printer 10 may cause the print executing unit 18 to print the QR code on a print medium, instead of causing the display unit 14 to display the QR code in T122 of
(Variant 13) The standard “Device Provisioning Protocol Technical Specification Version 1.0” created by the Wi-Fi Alliance describes that a shared code, a key, a phrase, and a word are called “code”. Therefore, in T122, the printer 10 may display, on the display unit 14, an image including a shared code, a key, a phrase, and a word obtained by coding the public key PPK1, the channel list, and the MAC address, instead of the QR code.
(Variant 14) “Communication device” may not be the printer, and may be another device such as a scanner, a multi-function peripheral, mobile terminal, a PC, and a server.
(Variant 15) In the embodiments above, the processes of
| Number | Date | Country | Kind |
|---|---|---|---|
| 2018-200036 | Oct 2018 | JP | national |
This application is a continuation of U.S. patent application Ser. No. 17/564,577 filed Dec. 29, 2021 which is a continuation of U.S. patent application Ser. No. 16/575,988 filed Sep. 19, 2019, issued as U.S. Pat. No. 11,218,874 on Jan. 4, 2022, which claims priority to Japanese Patent Application No. 2018-200036, filed on Oct. 24, 2018, the entire contents of which are hereby incorporated by reference into the present application.
| Number | Name | Date | Kind |
|---|---|---|---|
| 9426733 | Hamachi | Aug 2016 | B2 |
| 20100082978 | Suzuki | Apr 2010 | A1 |
| 20120233338 | Hamachi | Sep 2012 | A1 |
| 20140307874 | Adachi et al. | Oct 2014 | A1 |
| 20160007200 | Shibata | Jan 2016 | A1 |
| 20170180342 | Hamachi | Jun 2017 | A1 |
| 20240048976 | Miyake | Feb 2024 | A1 |
| Number | Date | Country |
|---|---|---|
| 2011-066561 | Mar 2011 | JP |
| 2012-199906 | Oct 2012 | JP |
| 2016-019085 | Feb 2016 | JP |
| 2017-112552 | Jun 2017 | JP |
| 2018-042280 | Mar 2018 | JP |
| 2018075135 | Apr 2018 | WO |
| Entry |
|---|
| Wi-Fi Alliance, “Device Provisioning Protocol Specification”, Version 1.0, pp. 1-124, Apr. 2018. |
| Aug. 9, 2022—(JP) Notice of Reasons for Refusal—App 2018-200036. |
| Number | Date | Country | |
|---|---|---|---|
| 20230397003 A1 | Dec 2023 | US |
| Number | Date | Country | |
|---|---|---|---|
| Parent | 17564577 | Dec 2021 | US |
| Child | 18235938 | US | |
| Parent | 16575988 | Sep 2019 | US |
| Child | 17564577 | US |
