JP4058258B2 - Authentication method, communication apparatus, and control program - Google Patents

Description

[0001]
BACKGROUND OF THE INVENTION
  The present inventionBetween communication devicesIt is related with the authentication technique of the communication partner in.
[0002]
[Prior art]
Conventionally, when information devices communicate with each other, in the simplest case, connection / communication is permitted regardless of the device with which the other party communicates. However, when you want to communicate with multiple devices, a method of managing and operating using a user ID and password is widely used to identify access devices and manage access rights and ensure security. I came.
[0003]
In recent years, access management using a user ID and a password has been widely performed on the Internet which has been widely spread. When the user is connected to the network, the user ID and password information are transmitted, and when authenticated, the user can start communication.
[0004]
In a server / client model network, the user ID and password are recorded and managed on the server side, and the user ID and password information sent when a connection request is received from the client are checked. It is configured to grant the right and start communication. When a user communicates for the first time, user information is set on the server side in advance, or after connecting with a guest account, the user ID and password are transmitted from the client terminal side and set on the server side. Yes.
[0005]
In recent years, wireless networks using radio waves have become widespread as physical network media. Also in the wireless network, the server / client model network manages the access right as described above.
[0006]
When such an access right management function is implemented in a short-range wireless network device represented by Bluetooth, particularly a portable device, it does not choose a place to be used. Opportunities for communication between devices that do not exist are expected to increase. In addition, since it is wireless communication, it is difficult for the user to know when and which devices are connected, and in order to prevent damage such as the user's information being stolen while not being aware of communication, it is robust. Realization of security is important.
[0007]
In the Bluetooth standard, a method of performing authentication before connection communication between devices is considered in order to deal with the security problem. The operation of link layer device authentication in the Bluetooth standard will be described below.
[0008]
Device authentication is performed between one-to-one devices. Details will be described with reference to FIG. FIG. 10 shows the exchange during the authentication process between the two terminals A and B equipped with the Bluetooth function and the process executed in each terminal in time series order. It is assumed that time elapses from the upper part to the lower part of FIG. The left side of the left solid line in FIG. 10 represents the inside of the terminal A, and the right side of the right solid line represents the inside of the terminal B. A dashed arrow between the solid line in the center of FIG. 10 indicates information communication using radio waves between the terminal A and the terminal B.
[0009]
At the time of communication connection, either the terminal A or the terminal B activates an authentication process as an authentication side for authenticating a communication partner or an authenticated side, and requests the start of an authentication procedure. Here, it is assumed that user A operates terminal A and user B operates terminal B.
[0010]
In FIG. 10, terminal A is the authenticating side that authenticates the communication partner and terminal B is the authenticated side that is authenticated as the communication partner, and terminal A sends an authentication request to terminal B in step S501 to start the authentication process. In step S502, the terminal B returns an authentication acceptance response and starts an authentication procedure. In step S503, the random number 1 (531) generated inside the terminal A is transmitted to the terminal B, while the user A of the terminal A inputs a character string or numeric string called a Bluetooth passkey (hereinafter referred to as a passkey) possessed by the terminal A itself. .
[0011]
The pass key is device-specific password information held in a Bluetooth-compatible terminal, and is information used when an authentication procedure is performed with a terminal that has never been connected, in other words, a terminal that is connected for the first time. The input passkey A (532) and the passkey A length (533) which is the length of the passkey A are used as the input of the arithmetic algorithm 1A (534).
[0012]
The calculation algorithm 1A (534) is an initialization key generation algorithm, and is executed inside the terminal A to generate an initialization key 1A (538) that is key information. In the terminal B that has received the random number 1 (531), as with the terminal A, the user B is caused to input the pass key A of the terminal A, and the input pass key A (535) and the pass key A length (536) which is the length of the pass key A ) Is used as an input of the arithmetic algorithm 1B (537).
[0013]
Note that the passkey A (532) input by the user A to the terminal A and the passkey A (535) input by the user B to the terminal B should be the same. In other words, the authenticated side is authenticated as the communicating party on the authenticating side on the condition that the authenticated side correctly inputs the passkey of the authenticating side.
[0014]
Accordingly, the passkey A length (533) and the passkey A length (536) should be the same. The calculation algorithm 1B (537) executed inside the terminal B and the calculation algorithm 1A (534) executed inside the terminal A are also the same algorithm. The terminal B generates the initialization key 1B (539) in the same manner as the terminal A, but this should also be the same as the initialization key 1A (538) generated by the terminal A.
[0015]
Next, terminal A generates a random number 2 (540) different from random number 1 (531), and transmits it to terminal B in step S504. Further, the random number 2 (540), the initialization key 1A (538) and the Bluetooth Device Address (hereinafter referred to as BD_ADDR_B) (541) of the terminal B that is the authentication side are used as inputs of the arithmetic algorithm 2A (542). Result A (545) is obtained.
[0016]
The calculation algorithm 2A (542) is a connection authentication algorithm and is executed inside the terminal A. Note that BD_ADDR_B is an address number unique to each Bluetooth device, and is included in the information exchanged when the devices establish a connection before executing the authentication procedure process, that is, before executing step S501. Therefore, it is known information at this point.
[0017]
In the terminal B that has received the random number 2 (540), like the terminal A, the random number 2 (540), the initialization key 1B (539) and the BD_ADDR_B (543) of the terminal B are used as the input of the arithmetic algorithm 2B (544). The operation result B (546) is obtained. The calculation algorithm 2B (544) executed inside the terminal B and the calculation algorithm 2A (542) executed inside the terminal A are the same algorithm. The BD_ADDR_B (541) used in the terminal A and the BD_ADDR_B (543) used in the terminal B are the same information.
[0018]
Next, terminal B transmits operation result B (546) to terminal A in step S505. In terminal A, in step S506A, operation result A (545) calculated and generated inside terminal A itself is compared with operation result B (546) calculated and generated inside terminal B and transmitted from terminal B. To do. If the values of the operation result A and the operation result B are equal, the authentication is successful, and if the values are different, the authentication is unsuccessful. If the authentication is successful, the terminal B is authenticated as a valid communication partner, and the process proceeds to the next communication process. If the authentication fails, the connection is disconnected and the process is terminated.
[0019]
In order to further increase the security level, after successful authentication, the authentication roles of the terminal A and the terminal B are exchanged, that is, the terminal A becomes the authenticated side, the terminal B becomes the authenticating side, and the random number generated by the terminal B and the terminal Using the passkey B of B and the BD_ADDR_A of the terminal A as parameters, authentication can be performed by the same procedure as in FIG. However, the recognition process performed by exchanging the above roles can be omitted.
[0020]
The above-described authentication operation is a case where the user can input a passkey in both terminals that perform communication, but it is difficult or impossible for the user to input the passkey in a device equipped with Bluetooth. Equipment also exists.
[0021]
In the case of such a device, a fixed passkey is set in the device's built-in memory in advance, the user of the communication partner terminal is prompted to input the fixed passkey during authentication, and the own passkey reads the fixed passkey from the built-in memory. By using this method, a method is considered in which a user of a device that cannot input a passkey does not need to input a passkey.
[0022]
This example will be described with reference to FIG. In the example of FIG. 11, the terminal A is a terminal that can input a passkey, and the terminal C is a terminal that cannot input a passkey. Moreover, the expression method of FIG. 11 is the same as that of FIG.
[0023]
In step S601, terminal A sends an authentication request to terminal C as an authentication side, and starts an authentication process. Since the user C cannot input the pass key at the terminal C, in step S602, the terminal C refuses to execute the authentication process as the authenticated side, and exchanges the roles of the authenticating side and the authenticated side for the terminal A. The terminal C transmits an authentication role exchange request requesting that the terminal C becomes the authentication side.
[0024]
Since the user A can input the pass key at the terminal A, the authentication role exchange request from the terminal C is accepted, an authentication acceptance response is returned in step S603, and the authentication procedure is started. At this time, as shown in FIG. 11, the role of terminal A is exchanged with the authenticated side, and the role of terminal C is exchanged with the authentication side. Thereafter, processing equivalent to the processing after step S503 in FIG. 10 is performed with terminal A as the authenticated side and terminal C as the authenticating side. However, in this case, the terminal C is different in that a fixed passkey C (not shown) set in the terminal C in advance is used for input to the arithmetic algorithm 1C.
[0025]
Next, an example of an authentication procedure in the case where the user cannot input a passkey in both terminals that perform communication, that is, devices having fixed passkeys will be described with reference to FIG. The expression method of FIG. 12 is the same as that of FIG.
[0026]
In step S701, terminal C sends an authentication request to terminal D as an authentication side, and starts an authentication process. Since the terminal D cannot input the passkey, in step S702, the terminal D refuses to execute the authentication process as the authenticated side, and exchanges the roles of the authenticating side and the authenticated side for the terminal C. Sends an authentication role exchange request requesting to become the authenticator.
[0027]
However, since the user cannot input the passkey even at the terminal C, the authentication role exchange request cannot be accepted, and a role exchange rejection response is returned to the terminal D at step S703. At this time, since both terminal C and terminal D refused to become the authenticated side, the authentication procedure could not be started and the communication was cut off.
[0028]
[Problems to be solved by the invention]
As described above, in the authentication method at the time of device connection in the conventional Bluetooth standard, when a user tries to connect devices that cannot input a passkey after executing the authentication process, both devices use a fixed passkey stored in the device. Since it is used for authentication and the authentication procedure is to be performed by the authentication side rather than the authenticated side, the division of roles of the authentication procedure is not established, and as a result, there is a disadvantage that connection / communication cannot be performed. Therefore, the usability of the device has been very bad for the user.
[0029]
  The present inventionIt is an object of the present invention to flexibly control whether or not to perform authentication processing as an authenticated side when an authentication request is received from a counterpart device.
[0030]
[Means for Solving the Problems]
  In order to solve the above problems, the present invention provides:When the communication device performs authentication with the other deviceAn authentication method,When an authentication request is received from the counterpart device on the authentication side, it is determined whether authentication information of the counterpart device is stored in a storage medium, and the authentication information of the counterpart device is stored in the storage medium. If it is determined that the communication device is to be authenticated, authentication processing is performed with the counterpart device using the authentication information, and the authentication information of the counterpart device is not stored in the storage medium. If determined, request the other device to exchange the roles of the authenticating side and the authenticated sideIt is configured as follows.
[0031]
  The present invention also provides:A communication device that receives an authentication request from a partner device serving as an authentication side, and determines whether authentication information of the partner device is stored in a storage medium when the authentication request is received When it is determined by the determination means and the determination means that the authentication information of the counterpart device is stored in the storage medium, the communication device becomes an authenticated side, and the authentication information is used to communicate with the counterpart device. If the authentication information of the counterpart device is determined not to be stored in the storage medium, control is performed to request the counterpart device to exchange the roles of the authentication side and the authenticated side. Control means tohave.
[0033]
DETAILED DESCRIPTION OF THE INVENTION
Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.
[0034]
[First Embodiment]
FIG. 1 is a block diagram of a digital camera equipped with a Bluetooth function according to the first embodiment of the present invention, and FIG. 2 is a block diagram of a printer equipped with a Bluetooth function. The printer according to the present embodiment is a device that does not have a pass key input unit, and stores a fixed pass key in the main body. The digital camera according to the present embodiment is configured to read out the BD_ADDR and pass key of the connected communication partner (printer) previously written in the memory in the digital camera from an external device, and use them during the authentication process.
[0035]
A digital camera 100 shown in FIG. 1 includes a CPU 101, a ROM 102, a RAM 103, a nonvolatile memory 104, a wireless communication circuit unit 105, an antenna 106, an external device connector 107, an interface circuit unit 108, an imaging unit 109, an operation unit 110, and a display unit. 111 and a secondary storage unit 112, which are connected to each other by an internal bus 113 as shown in the figure. In addition, the digital camera 100 includes a power supply circuit unit 114 and supplies power to the respective blocks through a power supply line 115.
[0036]
The CPU 101 operates according to a program stored in the ROM 102 and controls various operations of the digital camera. The ROM 102 is a non-volatile memory that stores in advance the control procedure of the digital camera (including control programs corresponding to FIGS. 4, 5, 7, and 10). The RAM 103 is used for temporary buffering of digital image data output from the imaging unit 109, temporary storage of data to be written to the secondary storage unit 112, data read from the secondary storage unit, calculation of the CPU 101, and the like. It is used as an area for temporarily storing work data, communication data transmitted and received from the wireless communication circuit unit, various settings, and the like.
[0037]
The nonvolatile memory 104 is rewritable, and stores / stores various settings of the device, a communication partner BD_ADDR used for Bluetooth communication, link key information used for communication with a previously connected Bluetooth device, and the like. The wireless communication circuit unit 105 includes a high-frequency circuit unit necessary for wireless communication, an encoding / combining circuit unit, a FIFO memory used at the time of wireless communication, its own BD_ADDR_D, its own passkey D, a non-volatile memory, etc. The antenna 106 is configured.
[0038]
The external device connection connector 107 is a connector for connecting the external device and the digital camera 100. The interface circuit unit 108 has a function of performing data communication with an external device connected via the external device connector 107. Under the control of the CPU 101, data is transmitted to the external device and data is received from the external device.
[0039]
The imaging unit 109 is a lens that forms incident light, a photoelectric converter (such as a CCD or CMOS sensor) that converts the formed light into an electrical signal, and an analog electrical signal output from the photoelectric converter into a digital electrical signal. It consists of an AD converter (analog-digital converter) for conversion. The operation unit 110 includes a release button for instructing photographing (not shown), a mode selection dial for selecting an operation mode of the digital camera 100, a menu button for calling a menu item, a button such as a cross cursor button for selecting and instructing a menu item, a dial, It is composed of switches, and outputs the state of these buttons, dials, and switches and their state changes as electrical signals.
[0040]
The display unit 111 is configured by a liquid crystal display device or the like, and displays the operation state of the digital camera 100 and captured image data. The secondary storage unit 112 stores captured digital image data and the like. The power supply circuit unit 114 includes a battery, a DC / DC converter, and the like, and supplies power to each block described above.
[0041]
2 includes a CPU 201, a ROM 202, a RAM 203, a nonvolatile memory 204, a wireless communication circuit unit 205, an antenna 206, an external device connector 207, an interface circuit unit 208, a printing unit 209, an operation unit 210, and a display unit 211. And are interconnected by an internal bus 212 as shown. In addition, the printer 200 includes a power supply circuit unit 213 and supplies power to each block through a power supply line 214.
[0042]
The CPU 201 operates in accordance with a program stored in the ROM 202 and controls various operations of the printer. A ROM 202 is a non-volatile memory that stores in advance printer control procedures (including control programs corresponding to FIGS. 4, 5, 7, and 10), font data, and the like. The RAM 203 is temporarily sent and received from a wireless communication circuit unit, a work area for temporary buffering of print data transmitted from an external device, a work area for conversion work to data to be sent to a print unit, a CPU 101 operation, and the like. Used as an area for temporarily storing communication data and various settings.
[0043]
The non-volatile memory 204 is rewritable, and stores / stores various settings of the device, a communication partner BD_ADDR used for Bluetooth communication, link key information used for communication with a previously connected Bluetooth device, and the like. The wireless communication circuit unit 205 includes a high-frequency circuit unit necessary for wireless communication, an encoding / combining circuit unit, a FIFO memory used at the time of wireless communication, its own BD_ADDR_P, its own passkey P, a non-volatile memory, and the like An antenna 206 is connected.
[0044]
The external device connection connector 207 is a connector for connecting the external device and the printer 200. The interface circuit unit 208 has a function of performing data communication with an external device connected via the external device connector 207. Under the control of the CPU 201, data is transmitted to the external device and data is received from the external device.
[0045]
The printing unit 209 is a print engine unit that includes a print head for printing print data on paper, a print head drive motor, a paper transport roller, a paper transport gear drive motor, and a gear. The operation unit 210 includes a power button, a reset button, and the like for instructing power ON / OFF of a printer (not shown), and outputs the state of these buttons and the state change as an electrical signal. The display unit 211 is configured by an LED lamp or the like, and indicates an operation state or the like of the printer 200. The power supply circuit unit 213 includes an AC / DC converter, a DC / DC converter, and the like, and supplies power to each block described above.
[0046]
The digital camera 100 according to the first embodiment performs the following settings to perform authentication processing with a device (printer) that does not have a passkey input function. That is, the personal computer is connected to the external device connector 107 of the digital camera 100 shown in FIG. 1 with a cable, and the Bluetooth address (BD_ADDR_P) of the printer 200 and the passkey information (passkey P) of the printer 200 that have been checked in advance are listed information. Is written in a predetermined area of the secondary storage unit 112 of the digital camera 100.
[0047]
FIG. 3 shows an example of the passkey list (1201) stored in the secondary storage unit 112. BD_ADDR and passkey are stored as a pair. In FIG. 3, there are two pairs of [BD_ADDR_P (1202), passkey P (1203)], [BD_ADDR_R (1204), passkey R (1205)]. Here, two pairs of passkey lists are illustrated, but the number of pairs is not particularly limited.
[0048]
Next, an authentication process for Bluetooth communication performed between the digital camera 100 and the printer 200 will be described in detail with reference to the drawings.
[0049]
FIG. 4 is a diagram illustrating an authentication process when the printer 200 performs the authentication procedure on the authentication side and the digital camera 100 performs the authentication procedure.
[0050]
The printer 200 requests an authentication procedure from the digital camera 100 (step S801). Upon receiving the authentication request from the printer 200, the digital camera 100 executes a passkey search process (831). As a result of the passkey search process (831), if BD_ADDR_P and passkey P of the printer 200 are present, an authentication request acceptance response is not received. If not present, an authentication request as an authenticated side is not accepted, and the printer 200 and the authenticated side are not accepted. The role with the authentication side is exchanged, and an authentication role exchange request for requesting that the digital camera 100 becomes the authentication side is transmitted as a response (step S802).
[0051]
Next, details of the passkey search process (831) shown in FIG. 4 will be described with reference to FIG. Note that FIG. 5 shows the processing contents in a generalized manner, but here, description will be made along the example used in the above description.
[0052]
First, it is determined whether or not the printer 200 that has transmitted the authentication request is the first partner to be connected this time (step S901). Specifically, whether the BD_ADDR that matches the BD_ADDR_P of the printer 200 and the link key P necessary for the connection are listed in the device connection list stored in the nonvolatile memory 104 of the digital camera 100. Search for. If it is not listed, it is the first device to be connected, so the process proceeds to step S902. If it is listed, the process proceeds to step S904.
[0053]
FIG. 6 shows an example of the device connection list. BD_ADDR and LINK KEY generated at the time of previous authentication connection are stored as a pair (1101). FIG. 6 stores three pairs of [BD_ADDR_A (1102), KEY_A (1103)], [BD_ADDR_F (1104), KEY_F (1105)], [BD_ADDR_Z (1106), and KEY_Z (1107)]. In step S901, the BD_ADDR_P that is the BD_ADDR of the printer 200 is searched from the device connection list 1101 to determine whether it exists. Since BD_ADDR_P is not registered in the device connection list 1101 in FIG. 6, the printer 200 is determined to be the first device to be connected, and the process proceeds to step S902.
[0054]
Next, it is searched whether the BD_ADDR_P and the passkey P of the printer 200 are listed in the passkey list 1201 stored in the secondary storage unit 112 of the digital camera 100 (step S902). Then, it is determined whether or not the pass key P (1203) corresponding to BD_ADDR_P (1202) of the printer 200 is listed (step S903). If the passkey P exists, the process proceeds to step S904, and if not, the process proceeds to step S905.
[0055]
In step S904, authentication request acceptance is selected as a response to be returned to the printer 200. In step S905, it is determined whether or not the factor that activates the passkey search process 831 is an authentication request. As a result, if it is an authentication request, the process proceeds to step S906, and if it is an authentication role exchange request, the process proceeds to step S907.
[0056]
In step S906, an authentication role exchange request is selected as a response to be returned to the printer 200. In step S907, authentication request rejection is selected as a response to be returned to the printer 200. After performing any of the processes in steps S904, 906, and 907, the passkey search process (831) is terminated.
[0057]
Next, on the contrary to FIG. 4, an authentication process when the printer 200 performs the authentication procedure with the authentication side and the digital camera 100 as the authentication side will be described with reference to FIG.
[0058]
Here, as shown in FIG. 4, the printer 200 does not request an authentication procedure from the digital camera 100, but the digital camera 100 acts as an authentication side and requests an authentication procedure from the printer 200 (step S1001). . The printer 200 that has received the authentication request from the digital camera 100 does not have a passkey input unit, and therefore rejects the authentication request and transmits an authentication role exchange request to the digital camera 100 (step S1002).
[0059]
Upon receiving the authentication role exchange request from the printer 200, the digital camera 100 executes a passkey search process (1031). The passkey search process (1031) performed here is the same as the passkey search process (831) shown in FIG. 4 (FIG. 5). If the BD_ADDR_P and the passkey P of the printer 200 exist as a result of the passkey search process (1031), an authentication request acceptance response is received. If not, the authentication request as the authenticated side is not accepted and the printer 200 rejects the authentication request. A response is transmitted (step S1003).
[0060]
As described above, according to the first embodiment, when a user cannot input a passkey or when terminals that are difficult to input a passkey perform authentication processing at the start of communication, conventionally, the authentication procedure cannot be executed. However, according to the present embodiment, either one of the terminals (in this embodiment, the digital camera 100) is connected to the BD_ADDR and pass key (the present embodiment) of the communication partner terminal previously set in the memory in the main body by the external device. In the embodiment, the authentication process can be performed by reading out and using the BD_ADDR_P and the passkey P) of the printer 200. Therefore, there is an effect that connection communication can be performed while security is ensured.
[0061]
If the BD_ADDR_P or the passkey P of the printer 200 that has transmitted the authentication request to the digital camera 100 is not set, the digital camera 100 does not accept the authentication request as in the conventional case, so that it is arbitrarily connected from an unknown device. It is possible to eliminate the danger of end.
[0062]
Furthermore, since the address and passkey stored in advance are used for the authentication process, it is possible to save the trouble of inputting them at the start of communication, and it is possible to quickly complete the authentication process and start communication. In addition, since it is not necessary to input an address and a passkey, for example, the present information communication system can be applied only by installing a communication function in a type of electronic device that originally does not have an input function and a communication function. The types of information communication apparatuses that can use the information communication system can be increased, and convenience can be improved.
[0063]
[Second Embodiment]
FIG. 8 is a block diagram of a digital camera equipped with the Bluetooth function according to the second embodiment of the present invention, and FIG. 9 is a block diagram of a printer equipped with the Bluetooth function. The printer in the second embodiment is a device that does not have a pass key input means, and stores a fixed pass key in the main body. The digital camera according to the second embodiment has a memory card in which a BD_ADDR and a passkey of a connected communication partner are written in advance by an external device, and reads and uses the passkey from the memory card during authentication processing.
[0064]
8 includes a CPU 301, a ROM 302, a RAM 303, a nonvolatile memory 304, a wireless communication circuit unit 305, an antenna 306, an imaging unit 307, an operation unit 308, a display unit 309, and a memory card interface circuit unit 310. The memory card 314 can be attached to the memory card interface circuit unit 310. Each block is connected to each other by an internal bus 311 as shown. The digital camera 300 includes a power supply circuit unit 312 and supplies power to each block through a power supply line 313.
[0065]
The CPU 301 operates in accordance with a program stored in the ROM 302 and controls various operations of the digital camera. The ROM 302 is a non-volatile memory that stores in advance a digital camera control procedure (including a control program corresponding to FIGS. 4, 5, 7, and 10). The RAM 303 is used for temporary buffering of digital image data output from the imaging unit 307, data to be written to the memory card 314 attached to the main body, temporary storage of data read from the memory card 314, calculation by the CPU 301, and the like. It is used as an area for temporarily storing a work area to be used, communication data transmitted and received from the wireless communication circuit unit, various settings, and the like.
[0066]
The nonvolatile memory 304 is rewritable, and stores / stores various settings of the device, BD_ADDR of the communication partner used for Bluetooth communication, link key information used for communication with the previously connected Bluetooth device, and the like. The wireless communication circuit unit 305 includes a high-frequency circuit unit necessary for wireless communication, an encoding / combining circuit unit, a FIFO memory used at the time of wireless communication, its own BD_ADDR_D, a non-volatile memory storing its own passkey D, etc. An antenna 306 is connected.
[0067]
The imaging unit 307 includes a lens that forms incident light, a photoelectric converter that converts the formed light into an electric signal, an AD converter that converts an analog electric signal output from the photoelectric converter into a digital electric signal, and the like. . The operation unit 308 includes a release button for instructing photographing (not shown), a mode selection dial for selecting an operation mode of the digital camera 300, a menu button for calling a menu item, a button such as a cross cursor button for selecting and instructing a menu item, a dial, It is composed of switches, and the state of these buttons, dials, and switches and state changes are output as electrical signals.
[0068]
The display unit 309 is configured by a liquid crystal display device or the like, and displays an operation state of the digital camera 300 and captured image data. The memory card / interface circuit unit 310 has functions for reading and writing data to / from a memory card 314 that has been mounted, and detecting whether or not a card is mounted. The power supply circuit unit 312 includes a battery, a DC / DC converter, and the like, and supplies power to each block described above.
[0069]
9 includes a CPU 401, a ROM 402, a RAM 403, a nonvolatile memory 404, a wireless communication circuit unit 405, an antenna 406, an external device connector 407, an interface circuit unit 408, a printing unit 409, an operation unit 410, and a display unit 411. , A memory card interface circuit unit 412, and a memory card 413, which are connected to each other by an internal bus 414 as shown. In addition, the printer 400 includes a power supply circuit unit 415 and supplies power to the respective blocks through a power supply line 416.
[0070]
The CPU 401 operates in accordance with a program stored in the ROM 402, and controls various operations of the printer. A ROM 402 is a non-volatile memory in which printer control procedures (including control programs corresponding to FIGS. 4, 5, 7, and 10), font data, and the like are stored in advance. The RAM 403 is transmitted / received from / to a temporary buffering of print data transmitted from an external device, a work area for conversion work to data to be sent to a print unit, a work area used for calculation by the CPU 401, and a wireless communication circuit unit. Used as an area for temporarily storing communication data and various settings.
[0071]
The nonvolatile memory 404 is rewritable, and stores / stores various settings of the device, a communication partner BD_ADDR used for Bluetooth communication, link key information used for communication with a previously connected Bluetooth device, and the like. The wireless communication circuit unit 405 includes a high-frequency circuit unit necessary for wireless communication, an encoding / decoding circuit unit, a FIFO memory used at the time of wireless communication, its own BD_ADDR_P, a non-volatile memory storing its own passkey P, etc. An antenna 406 is connected.
[0072]
The external device connection connector 407 is a connector for connecting the external device and the printer 400. The interface circuit unit 408 has a function of performing data communication with an external device connected via the external device connector 407. Under the control of the CPU 401, data is transmitted to the external device and data is received from the external device.
[0073]
The printing unit 409 is a print engine unit that includes a print head for printing print data on paper, a print head drive motor, a paper transport roller, a paper transport gear drive motor, a gear, and the like. The operation unit 410 includes a power button, a reset button, and the like for instructing power ON / OFF of a printer (not shown), and outputs the state of these buttons and the state change as an electrical signal. A display unit 411 includes an LED lamp or the like, and indicates an operation state of the printer 400. The memory card / interface circuit unit 412 has functions of reading / writing data from / into the memory card 413 installed, and detecting the presence / absence of card installation. The power supply circuit unit 415 includes an AC / DC converter, a DC / DC converter, and the like, and supplies power to each block described above.
[0074]
Similarly to the digital camera 100 according to the first embodiment, the digital camera 300 according to the second embodiment also performs the following setting in order to perform authentication processing with a device (printer) that does not have a passkey input function. Is done. That is, the memory card 314 that can be attached to the digital camera 300 shown in FIG. 8 is attached to the memory card slot of an external device such as a personal computer, and the Bluetooth address (BD_ADDR_P) of the printer 400 that has been checked in advance and the printer 400 Pass key information (pass key P) is written in a predetermined area of the memory card 314.
[0075]
When performing communication, the memory card 314 is attached to the digital camera 300. The BD_ADDR and the passkey list set in the memory card 314 are the same as the passkey list 1201 (see FIG. 3) in the nonvolatile memory 104 built in the digital camera 100 in the first embodiment.
[0076]
Since the authentication process in the second embodiment is the same as that in the first embodiment, a description thereof will be omitted. However, in the first embodiment, the digital camera reads the BD_ADDR and pass key of the printer from the secondary storage unit of the digital camera. However, in the second embodiment, the digital camera reads from the memory card attached to the digital camera. .
[0077]
Conventionally, when a user cannot input a passkey or terminals that are difficult to input a passkey, that is, terminals using a fixed passkey perform authentication processing at the start of communication, the authentication procedure cannot be executed. According to the embodiment, either one of the terminals (in this embodiment, the digital camera 300) writes the BD_ADDR and passkey (BD_ADDR_P and passkey P of the printer 400 in this embodiment) of the communication partner terminal in advance by an external device. The authentication process can be performed by mounting the memory card and reading out from the memory card when the authentication is executed. Therefore, there is an effect that connection communication can be performed while security is ensured.
[0078]
Further, since the BD_ADDR_P and the passkey P of the printer 400 are stored in the memory card, the digital camera or the like is authenticated with the printer 400 by mounting the memory card on another Bluetooth-equipped digital camera or the like. The process can be executed.
[0079]
Furthermore, an apparatus that normally does not require key input does not need to have an input means only for inputting a pass key, so that an authentication process can be executed without incurring an increase in cost.
[0080]
In the first embodiment and the second embodiment, the printer BD_ADDR_P and the passkey P are written in the secondary storage unit 112 built in the digital camera or the memory card 314 that can be attached to the digital camera, and are used when executing authentication. However, on the contrary, the BD_ADDR_D and the passkey D of the digital camera are written in the memory nonvolatile memory 204 built in the printer or the memory card 413 that can be attached to the printer, and the passkey search process is performed in the printer at the time of authentication execution. It is also possible to read out the BD_ADDR_D and the passkey D and use them for the authentication process, and operate the digital camera and the printer described in the first and second embodiments by switching roles.
[0081]
Furthermore, in the first and second embodiments, the Bluetooth passkey is used as the authentication information used at the time of executing the authentication. However, a password composed of a different character string or the like may be used instead of the Bluetooth passkey. . When a Bluetooth passkey is used, authentication processing is performed at the link layer of the network hierarchy. When a password is used, the authentication processing is performed at the application layer.
[0082]
When using a Bluetooth passkey, as described above, authentication processing is performed in the link layer of the network hierarchy, so that application development can be performed efficiently. Further, when a password is used as authentication information, authentication processing is performed in the application layer as described above, so that it is possible to increase the number of information communication devices corresponding to this information communication system.
[0083]
【The invention's effect】
  As explained above, according to the present invention,When the authentication information of the counterpart device is stored in the storage medium, the communication device can perform authentication processing with the counterpart device as the authenticated side, and the authentication information of the counterpart device is stored in the storage medium. If not, a role exchange between the authenticating side and the authenticated side can be requested. Therefore, for example, even if the communication device has no function for inputting authentication information of the counterpart device or is difficult to input, depending on whether or not the authentication information of the counterpart device is stored, The authentication process can be performed by flexibly switching the role of the authentication side.
[Brief description of the drawings]
FIG. 1 is a block diagram illustrating a configuration of a digital camera according to a first embodiment of the present invention.
FIG. 2 is a block diagram illustrating a configuration of a printer according to the first embodiment of the present invention.
FIG. 3 is a diagram showing an example of a passkey list in the first embodiment and the second embodiment of the present invention.
FIG. 4 is a diagram illustrating a processing operation up to an authentication request and a response between terminals in the first embodiment and the second embodiment of the present invention.
FIG. 5 is a flowchart showing details of a passkey search process that is one of the processing operations of FIG. 4;
FIG. 6 is a diagram showing an example of a device connection list in the first embodiment and the second embodiment of the present invention.
FIG. 7 is a diagram showing an operation when an authentication role exchange is performed in a processing operation up to an authentication request and a response between two terminals in the first embodiment and the second embodiment of the present invention.
FIG. 8 is a block diagram illustrating a configuration of a digital camera according to a second embodiment of the present invention.
FIG. 9 is a block diagram illustrating a configuration of a printer according to a second embodiment of the present invention.
FIG. 10 is a diagram illustrating an authentication procedure operation between two conventional terminals.
FIG. 11 is a diagram illustrating an operation in which authentication role exchange is performed among authentication procedure operations between two conventional terminals.
FIG. 12 is a diagram illustrating an operation in which authentication role exchange is not performed and an authentication procedure fails and ends among authentication procedure operations between two conventional terminals.
[Explanation of symbols]
100, 300: Digital camera body
101, 201, 301, 401: CPU
102, 202, 302, 402: ROM
103, 203, 303, 403: RAM
104, 204, 304, 404: Non-volatile memory
105, 205, 305, 405: Wireless communication circuit unit
107,207,307,407: External device connector
112, 211: Secondary storage unit
200, 400: Printer
314, 413: Memory card
1101: Device connection list
1201: Passkey list

Claims (16)

An authentication method when a communication device performs authentication processing with a partner device ,
When receiving an authentication request from the counterpart device serving as an authentication side, it is determined whether authentication information of the counterpart device is stored in a storage medium;
When it is determined that the authentication information of the counterpart device is stored in the storage medium, the communication device becomes an authenticated side, performs authentication processing with the counterpart device using the authentication information,
If the authentication information of the counterpart device is determined not to be stored in the storage medium, to the destination apparatus, the authenticator and authentication how to, wherein the requesting the exchange of roles of the authenticator . The authentication method according to claim 1, wherein the communication device is a device that does not have an input unit for a user to input authentication information manually. The authentication information, authentication method according to claim 1 or 2, wherein the a password information or address information. The counterpart device and the communication device, authentication method according to any one of claims 1 to 3, characterized in that previously stores address information of the device as one of the authentication information. The authentication process, authentication method according to any of claims 1-4, characterized in that it is performed when performing wireless communication with a predetermined standard. The storage medium is, authentication method according to any one of claims 1 to 5, characterized in that a pre-built-in storage medium before Symbol communications device. Prior Symbol communications device, according to claim 1 to 5, characterized in that the previously stored crisis憶媒body from the information communication device connected by a cable to the vent communication apparatus acquires the authentication information of the partner device authentication method according to any one. The storage medium is, authentication method according to any one of claims 1 to 5, characterized in that a freely storage medium detachable prior Symbol communications device. When the authentication between the communication device and the partner device is successful , the communication device stores link information with the partner device, and when the authentication process is performed again with the partner device, the link information is stored. authentication method according to any of claims 1-8, characterized by using. A communication device,
A receiving means for receiving an authentication request from the counterpart device on the authenticating side;
A determination unit that determines whether authentication information of the counterpart device is stored in a storage medium when the authentication request is received;
When it is determined by the determination means that the authentication information of the counterpart device is stored in the storage medium, the communication device becomes an authenticated side, and an authentication process is performed with the counterpart device using the authentication information. Control means for controlling to request the counterpart device to exchange roles of the authenticating side and the authenticated side when it is determined that the authentication information of the counterpart device is not stored in the storage medium. ,
A communication apparatus comprising: When the determination means determines that the authentication information of the counterpart device is stored in the storage medium, the information sent from the counterpart device and the authentication information stored in the storage medium based on, communication apparatus according to claim 10, wherein the performing the authentication process with the partner apparatus. The communication device according to claim 10 or 11, wherein the communication device is a device that does not have an input means for a user to input authentication information manually. Having a connection means for connecting another information processing apparatus to the outside by wire;
The authentication information, communication apparatus according to any one of claims 10 to 12, characterized in that it is stored from the other information processing apparatus connected by said connection means to said storage medium. The storage medium is, communication device according to any one of claims 10 to 12, characterized in that a removable storage medium. The link information with the partner device is stored when the authentication with the partner device is successful , and the link information is used when the authentication process is performed again with the partner device. communication apparatus according to any one of 10 to 14. A control program for causing a computer to execute the authentication method according to claim 1.

Images