Patent Description:
Conventionally, there is a technique that, when it is time to renew an electronic certificate installed in a device, displays a procedure for renewing the electronic certificate on a display of the device (see, e.g., <CIT>).

<CIT> discloses a process for remotely accessing an aircraft computing system via a device using a certificate obtained using a VPN for connecting to a Network Operations Center. Each certificate has an expiration time, after which the certificate is no longer valid. <CIT> discloses techniques for easily adding and updating an electronic certificate in an information processing apparatus by which a certificate with an expired validity period/about to expire may be automatically detected in a multi-function peripheral, which executes the update process of the certificate.

However, in such a technique, the procedure for renewing the certificate is troublesome for a user unfamiliar with certificate renewal.

An object of the present disclosure is to provide an information processing device and a program capable of saving time and effort of a user.

Embodiments of the present disclosure will be described below with reference to the drawings.

According to a first aspect of the present disclosure, there is provided an information processing device including a storage configured to store an electronic certificate used for authentication for using a network, a detector configured to detect whether a time to renew the electronic certificate has arrived, and a communication unit (or communication interface) having a first communication mode in which the communication unit communicates with an external device via the network and a second communication mode in which the communication unit communicates with a certificate renewal device without using the network, wherein the communication unit connects with the certificate renewal device in the second communication mode and receives an electronic certificate for renewing the electronic certificate from the certificate renewal device, on the basis of the detection by the detector.

In a first embodiment to be described later, a printer <NUM> serves as the information processing device (see <FIG>). A certificate storage <NUM> serves as the storage, a controller <NUM> serves as the detector, and a communication unit <NUM> serves as the communication unit (see <FIG>). A network NT2 serves as the network (see <FIG>). A personal computer (PC) <NUM> serves as the external device and certificate renewal device. Thus, the external device and certificate renewal device are the same device.

In a second embodiment to be described later, a printer <NUM> serves as the information processing device (see <FIG>). A certificate storage <NUM> serves as the storage, a controller <NUM> serves as the detector, and a communication unit <NUM> serves as the communication unit (see <FIG>). A network NT2 serves as the network (see <FIG>). A personal computer (PC) <NUM> serves as the external device, and a certificate renewal device <NUM> serves as the certificate renewal device. Thus, the external device and certificate renewal device are separate devices.

In an example, when the detector detects that the time to renew the electronic certificate has arrived, the communication unit connects with the certificate renewal device in the second communication mode in which the information processing device operates as an access point.

In an example, the information processing device further includes a generator configured to generate connection information for connecting with the certificate renewal device in the second communication mode, and the communication unit communicates with the certificate renewal device in the second communication mode on the basis of the connection information. In the first embodiment, the controller <NUM> serves as the generator (see <FIG>). In the second embodiment, the controller <NUM> serves as the generator (see <FIG>).

In an example, the communication unit communicates with the certificate renewal device in the second communication mode on the basis of the connection information, via short-distance wireless communication.

In an example, when a specified time within a period from a time a predetermined time before expiration of the electronic certificate to a time of expiration of the electronic certificate has arrived, the detector detects that the time to renew the electronic certificate has arrived, and when the detector detects that the time to renew the electronic certificate has arrived, the communication unit connects with the certificate renewal device in the second communication mode and receives the electronic certificate for renewing the electronic certificate from the certificate renewal device. As such, the time to renew the electronic certificate may be a specified time within a period from a time a predetermined time before expiration of the electronic certificate to a time of expiration of the electronic certificate.

In an example, when the electronic certificate has expired, the detector detects that the time to renew the electronic certificate has arrived. As such, the time to renew the electronic certificate may be a time of expiration of the electronic certificate. This will be described in the first embodiment.

In an example, when a time a predetermined time before expiration of the electronic certificate has arrived, the detector detects that the time to renew the electronic certificate has arrived. As such, the time to renew the electronic certificate may be a time a predetermined time before expiration of the electronic certificate. This will be described in the second embodiment.

According to a second aspect of the present disclosure, there is provided an information processing device including a storage configured to store an electronic certificate used for authentication for using a network, a detector configured to detect whether the electronic certificate is stored in the storage and is valid, and a communication unit having a first communication mode in which the communication unit communicates with an external device via the network and a second communication mode in which the communication unit communicates with a certificate renewal device without using the network, wherein the communication unit connects with the certificate renewal device in the second communication mode and receives a new electronic certificate from the certificate renewal device, on the basis of the detection by the detector.

In the first embodiment, the printer <NUM> may serve as the information processing device (see <FIG>). The certificate storage <NUM> may serve as the storage, the controller <NUM> may serve as the detector, and the communication unit <NUM> may serve as the communication unit (see <FIG>). The network NT2 may serve as the network (see <FIG>). The PC <NUM> may serve as the external device and certificate renewal device. Thus, the external device and certificate renewal device may be the same device.

In the second embodiment, the printer <NUM> may serve as the information processing device (see <FIG>). The certificate storage <NUM> may serve as the storage, the controller <NUM> may serve as the detector, and the communication unit <NUM> may serve as the communication unit (see <FIG>). The network NT2 may serve as the network (see <FIG>). The PC <NUM> may serve as the external device, and the certificate renewal device <NUM> may serve as the certificate renewal device. Thus, the external device and certificate renewal device may be separate devices.

In an example, the detector detects whether the electronic certificate is stored in the storage, and when the detector detects that the electronic certificate is not stored in the storage, the communication unit connects with the certificate renewal device in the second communication mode and receives the new electronic certificate.

In an example, when the electronic certificate is stored in the storage, the detector detects whether the information processing device is not authenticated using the stored electronic certificate by a server (or whether the stored electronic certificate is determined to be invalid by a server), and when the detector detects that the information processing device is not authenticated using the electronic certificate by the server (or that the electronic certificate is determined to be invalid by the server), the communication unit connects with the certificate renewal device in the second communication mode and receives the new electronic certificate. In the first and second embodiments, the authentication server <NUM> may serve as the server.

In each of the first and second aspects, when connecting with the certificate renewal device in the second communication mode, the communication unit may transmit a request for an electronic certificate used for the authentication for using the network, to the certificate renewal device. The communication unit may transmit a service set identifier (SSID) of the information processing device as the request. The communication unit may transmit identification information for the information processing device held by the information processing device, to the certificate renewal device.

In each of the first and second aspects, the certificate renewal device, which may be a computer, may detect a request from the information processing device for an electronic certificate used for authentication for using the network, connect with the information processing device without using the network in response to the request, and transmit the electronic certificate to the connected information processing device. The certificate renewal device may detect an SSID of the information processing device as the request from the information processing device, and connect with the information processing device by using a password corresponding to the SSID. The certificate renewal device may obtain identification information for the information processing device held by the information processing device, and transmit, to the information processing device, the electronic certificate corresponding to the identification information. The certificate renewal device may include processing circuitry that performs the above process of the certificate renewal device. The processing circuitry may be implemented by hardware, software, or a combination thereof. For example, the certificate renewal device may include a memory that stores a program, and a processor that executes the program to perform the above process of the certificate renewal device. The program may be stored and provided in a non-transitory computer-readable storage medium. In the first embodiment, a controller <NUM> may serve as the processing circuitry or processor, and a memory <NUM> may serve as the memory (see <FIG>). In the second embodiment, a controller <NUM> may serve as the processing circuitry or processor, and a memory <NUM> may serve as the memory (see <FIG>).

In the first aspect, when the time to renew the electronic certificate has arrived, the information processing device can receive the electronic certificate for renewing the electronic certificate from the certificate renewal device without using the network requiring the electronic certificate.

The present disclosure can provide an information processing device and a program capable of saving time and effort of a user.

Hereinafter, electronic certificates may be referred to simply as certificates.

As illustrated in <FIG>, an electronic certificate renewal system <NUM> includes the printer <NUM>, an authentication switch <NUM>, an authentication server <NUM>, and the personal computer (PC) <NUM>, which are installed, for example, in one company. The printer <NUM>, authentication switch <NUM>, authentication server <NUM>, and PC <NUM> are connected to each other via a network NT1, the network NT2, and a network NT3, which are, for example, wired local area networks (LANs) in a company.

The printer <NUM> is connected to the authentication switch <NUM> via the network NT1. The printer <NUM> is authorized to communicate to the network NT2, through IEEE <NUM>. 1X EAP-TLS authentication by the authentication server <NUM>. A client certificate that is an electronic certificate unique to the printer <NUM> is installed in the printer <NUM> as a certificate used for the EAP-TLS authentication. To communicate to the network NT2, the printer <NUM> needs to periodically renew the certificate.

In an infrastructure mode as the first communication mode in which printing is performed, for example, the printer <NUM> communicates by wire with the PC <NUM> via the networks NT1 and NT2, and upon receiving a print job from the PC <NUM>, prints print data indicated by the print job on a predetermined medium.

In an access point mode as the second communication mode in which the printer <NUM> starts and operates as a wireless access point and is connected from the PC <NUM>, the printer <NUM> is wirelessly connected from the PC <NUM> and a certificate (e.g., certificate Co in <FIG>) in the certificate storage <NUM> (see <FIG>) is replaced with a new certificate (e.g., certificate Cn in <FIG>). In the access point mode, the printer <NUM> performs short-distance wireless communication as wireless communication with the PC <NUM> via a network NT4 without using the networks NT1 and NT2.

The authentication switch <NUM>, which is an access point for authentication, is connected to the printer <NUM> via the network NT1, the PC <NUM> via the network NT2, and the authentication server <NUM> via the network NT3. When the printer <NUM> is authenticated by the authentication server <NUM>, the authentication switch <NUM> allows the printer <NUM> to communicate to the network NT2. On the other hand, when the printer <NUM> is not authenticated by the authentication server <NUM>, the authentication switch <NUM> does not allow the printer <NUM> to communicate to the network NT2.

The authentication server <NUM> performs IEEE <NUM>. 1X EAP-TLS authentication on a certificate transmitted from the printer <NUM>. For example, when the certificate stored in the printer <NUM> is expired, the authentication server <NUM> determines that the certificate is invalid, and does not authenticate the printer <NUM>.

The printer <NUM> is assigned "Printer-<NUM>" as a name (hereinafter referred to as a printer name) identifying the printer <NUM>. When the printer <NUM> activates a wireless access point to place itself in the access point mode, the printer <NUM> generates an SSID and a password as connection information on the basis of the printer name of the printer <NUM> in the controller <NUM> (see <FIG>) as the generator. In this embodiment, the printer <NUM> combines the printer name to generate "expired-printer-<NUM>" as the SSID and "key-printer-<NUM>" as the password. The SSID of the printer <NUM> in the access point mode is an SSID dedicated to certificate renewal, and is a character string that is generated separately and different from an SSID of the printer <NUM> in the infrastructure mode.

The PC <NUM> rewrites the certificate (e.g., certificate Co in <FIG>) installed in the certificate storage <NUM> (see <FIG>) of the printer <NUM> with a new certificate (e.g., certificate Cn in <FIG>). The PC <NUM> has a wireless communication function, and is located at a position where the PC <NUM> can wirelessly communicate with the printer <NUM> when the printer <NUM> enters the access point mode and activates the wireless access point. The PC <NUM> is connected to the printer <NUM> via the network NT4, which is a wireless network.

As illustrated in <FIG>, the printer <NUM> includes the controller <NUM>, the communication unit <NUM>, the certificate storage <NUM>, a clock <NUM>, and a display operation unit <NUM>. The controller <NUM>, which is or includes a processor, such as a central processing unit (CPU), reads predetermined programs from a memory <NUM> and controls the printer <NUM>. The display operation unit <NUM>, which is or includes, for example, a touch screen, outputs information to a user and receives operation inputs from a user. The clock <NUM> obtains the current date.

The communication unit <NUM> includes a wired communication unit <NUM>, a wireless communication unit <NUM>, and a near field communication (NFC) communication unit <NUM>.

The wired communication unit <NUM>, which is, for example, a wired local area network (LAN) board installed in the printer <NUM>, is connected to the network NT1 via a wired LAN cable and transmits and receives data to and from the outside via the network NT1. The wireless communication unit <NUM>, which is, for example, a wireless LAN board installed in the printer <NUM>, serves as a wireless access point, establishes wireless communication according to Wi-Fi (registered trademark) as short-distance wireless communication with the PC <NUM> or the like, and transmits and receives data. The NFC communication unit <NUM> has a near field communication (NFC) communication function, which is a short-distance wireless communication function, and when an NFC communication unit of a communication device (e.g., a mobile terminal) (not illustrated) having an NFC communication function is placed over the NFC communication unit <NUM> and brought into a predetermined range close to the NFC communication unit <NUM>, performs NFC communication with the NFC communication unit of the communication device and transmits and receives data.

The certificate storage <NUM> is a storage that stores a certificate used by the printer <NUM>. In this embodiment, the certificate storage <NUM> stores a certificate used for IEEE <NUM>. 1X authentication. <FIG> illustrates certificate Co, which is an example of the certificate stored in the certificate storage <NUM>. In <FIG>, certificate Co complies with the X. <NUM> format, and the attribute names of the main information items contained in certificate Co include X. <NUM> version, serial number, certificate issuer, validity period, subject, and public key. In the field of X. <NUM> version, the value "<NUM>", which is defined by the standard, is specified.

In the field of serial number, the value "<NUM>", which is a unique number for certificate Co assigned by the issuer of certificate Co, is specified. In the field of certificate issuer, the value "ABC-company CA", which is a name of the organization that issues certificate Co, is specified. In the field of validity period, the value "<NUM>/<NUM>/<NUM> to <NUM>/<NUM>/<NUM>", which is the validity period of certificate Co, is specified. When the current date is <NUM>/<NUM>/<NUM>, certificate Co is expired. In the field of subject, the value "Printer-<NUM>", which is a name identifying the printer <NUM>, is specified. The information in the field of subject, which serves as the identification information, indicates the subject to which certificate Co was issued. In the field of public key, information representing a public key used in the EAP-TLS authentication by the authentication server <NUM> is specified. In this embodiment, for example, a <NUM>-bit string in "RSA Encryption" format is specified in the field of public key.

In the above configuration, the controller <NUM> uses the certificate (e.g., certificate Co) stored in the certificate storage <NUM> to perform IEEE <NUM>. 1X authentication via the wired communication unit <NUM>. Also, the controller <NUM> controls the wireless communication unit <NUM> to activate and deactivate the wireless access point, on the basis of the validity period of the stored certificate (e.g., certificate Co) and information indicating the current date obtained from the clock <NUM>. This will be described in detail later.

As illustrated in <FIG>, the PC <NUM> includes the controller <NUM>, a wired communication unit <NUM>, a wireless communication unit <NUM>, a certificate storage <NUM>, and a display <NUM>. The controller <NUM>, which is or includes a processor, such as a CPU, reads predetermined programs from the memory <NUM> and controls the PC <NUM>. The display <NUM>, which is, for example, a liquid crystal display, displays a result of certificate renewal.

The wired communication unit <NUM>, which is, for example, a wired LAN board installed in the PC <NUM>, is connected to the network NT2 via a wired LAN cable and transmits and receives data to and from the outside via the network NT2. The wireless communication unit <NUM>, which is, for example, a wireless LAN board installed in the PC <NUM>, establishes wireless communication according to Wi-Fi with the printer <NUM> serving as a wireless access point or other devices and transmits and receives data.

The certificate storage <NUM> is a storage that stores a new certificate (e.g., certificate Cn) for renewing the certificate (e.g., certificate Co) stored in the certificate storage <NUM> of the printer <NUM>. <FIG> illustrates certificate Cn, which is an example of the certificate stored in the certificate storage <NUM>. In <FIG>, certificate Cn is different from certificate Co (see <FIG>) in serial number and validity period. In the field of serial number, the value "<NUM>", which is different from the serial number of certificate Co, is specified. In the field of validity period, the value "<NUM>/<NUM>/<NUM> to <NUM>/<NUM>/<NUM>", which is the validity period of certificate Cn, is specified. When the current date is <NUM>/<NUM>/<NUM>, certificate Cn is unexpired and valid.

In the above configuration, the controller <NUM> searches for the wireless access point to be searched for having the SSID indicating that the certificate stored in the printer <NUM> has expired, via the wireless communication unit <NUM>. In this embodiment, the SSID of the wireless access point activated by the printer <NUM> with its certificate expired is an SSID starting with "expired-". When the SSID to be searched for is found, the controller <NUM> connects to the SSID according to the Wi-Fi protected access <NUM> pre-shared key (WPA2-PSK) protocol, using as a password a character string obtained by combining "key-" and the character string following "expired-" of the SSID. In this embodiment, since the SSID of the wireless access point activated by the printer <NUM> is "expired-printer-<NUM>", the password is "key-printer-<NUM>". Then, the controller <NUM> writes the certificate (e.g., certificate Cn) stored in the certificate storage <NUM> into the certificate storage <NUM> of the printer <NUM> that has been found and whose certificate has expired, via the wireless communication unit <NUM>.

Next, a certificate renewal process by the printer <NUM> will be described using the flowchart illustrated in <FIG>. The controller <NUM> starts a certificate renewal process RT1 illustrated in <FIG> by reading a certificate renewal program from the memory <NUM> and executing it, and proceeds to step SP1. At this time, the printer <NUM> is in the infrastructure mode. In the certificate renewal process RT1, the controller <NUM> sets a time to renew the certificate stored in the certificate storage <NUM> to the same date as the expiration date of the certificate stored in the certificate storage <NUM>, determines whether the stored certificate has expired, and when it has expired, waits until a valid certificate is stored in the certificate storage <NUM> by the PC <NUM>.

Here, it is assumed that certificate Co is stored in the certificate storage <NUM> and the current date is <NUM>/<NUM>/<NUM>.

In this case, the certificate (i.e., certificate Co) stored in the certificate storage <NUM> of the printer <NUM> has expired (i.e., the time to renew has passed), the IEEE <NUM>. 1X authentication by the authentication server <NUM> is denied, and the printer <NUM> cannot connect to the network NT2. The following describes an operation from this state until the certificate stored in the certificate storage <NUM> is renewed and the printer <NUM> becomes able to connect to the network NT2 again.

In step SP1, the controller <NUM> of the printer <NUM> compares the validity period of the certificate stored in the certificate storage <NUM> with information indicating the current date obtained from the clock <NUM>, and proceeds to step SP2. In step SP2, the controller <NUM> determines whether the current date is not within the validity period of the certificate and the certificate has expired. When the determination is negative, this indicates that the certificate is unexpired and valid, and the controller <NUM> returns to step SP1. The controller <NUM> repeats steps SP1 and SP2, and periodically checks whether the certificate has expired. On the other hand, when the determination in step SP2 is positive, this indicates that the certificate is expired and invalid, and the controller <NUM> proceeds to step SP3. Here, since the current date is <NUM>/<NUM>/<NUM> and certificate Co has expired, the controller <NUM> makes a positive determination in step SP2.

In step SP3, the controller <NUM> controls the wireless communication unit <NUM> to activate the wireless access point, thereby placing the printer <NUM> into the access point mode, and proceeds to step SP4. At this time, the controller <NUM> sets the SSID of the activated wireless access point to the character string "expired-printer-<NUM>" generated from "expired-" and the printer name, and sets the password to the character string "key-printer-<NUM>" generated from "key-" and the printer name. At this time, the printer <NUM> is in a state in which it is asking the PC <NUM> for a new certificate.

When the printer <NUM> starts as a wireless access point, the PC <NUM> wirelessly connects to the printer <NUM> and replaces the certificate (here, certificate Co) in the certificate storage <NUM> with a new certificate (here, certificate Cn) in a certificate writing process RT2 (see <FIG>) to be described later.

In step SP4, the controller <NUM> of the printer <NUM> compares the validity period of the certificate stored in the certificate storage <NUM> with information indicating the current date obtained from the clock <NUM>, and proceeds to step SP5. In step SP5, the controller <NUM> determines whether the current date is within the validity period of the certificate and the certificate has not expired. When the determination is positive, this indicates that the certificate is unexpired and valid, and the controller <NUM> proceeds to step SP6. On the other hand, when the determination in step SP5 is negative, this indicates that the certificate is expired and invalid, and the controller <NUM> returns to step SP4. The controller <NUM> repeats steps SP4 and SP5, and periodically checks whether the certificate is valid.

In step SP6, the controller <NUM> controls the wireless communication unit <NUM> to deactivate the wireless access point, thereby restoring the printer <NUM> to the infrastructure mode, and proceeds to step SP7. In step SP7, the controller <NUM> uses the renewed certificate (here, certificate Cn) to ask the authentication server <NUM> for the IEEE <NUM>. 1X authentication, via the wired communication unit <NUM>, and after the printer <NUM> is authenticated, the controller <NUM> is allowed to resume the connection to the network NT2, proceeds to step SP8, and ends the certificate renewal process RT1.

Next, a certificate writing process by the PC <NUM> will be described using the flowchart illustrated in <FIG>. The certificate writing process is a process of finding the printer <NUM> with its certificate expired and writing a new certificate into the printer <NUM>. The controller <NUM> starts the certificate writing process RT2 illustrated in <FIG> by reading a certificate writing program from the memory <NUM> and executing it, and proceeds to step SP11.

In step SP11, the controller <NUM> of the PC <NUM> searches for the wireless access point to be searched for having the SSID indicating that the certificate has expired, via the wireless communication unit <NUM>, and proceeds to step SP12.

In this embodiment, as described above, the SSID of the wireless access point activated by the printer <NUM> with its certificate expired is an SSID starting with "expired-". Thus, the controller <NUM> searches for a wireless access point having an SSID starting with "expired-".

In step SP12, the controller <NUM> determines whether the SSID of the wireless access point to be searched for has been found. When the determination is negative, this indicates that the SSID of the wireless access point to be searched for has not been found, and the controller <NUM> returns to step SP11. The controller <NUM> repeats steps SP11 and SP12, and periodically searches for the SSID of the wireless access point to be searched for. On the other hand, when the determination in step SP12 is positive, this indicates that the SSID of the wireless access point to be searched for has been found, and the controller <NUM> proceeds to step SP13. In step SP13, the controller <NUM> connects to the SSID of the wireless access point to be searched for, according to the WPA2-PSK protocol, using as a password a character string obtained by combining "key-" and the character string following "expired-" of the SSID, and proceeds to step SP14. In this embodiment, since the SSID of the wireless access point activated by the printer <NUM> is "expired-printer-<NUM>", the password is "key-printer-<NUM>".

In step SP14, the controller <NUM> obtains, from the printer <NUM> connected thereto, i.e., the printer <NUM> to be subjected to renewal of the certificate (hereinafter also referred to as the printer to be subjected to renewal), information indicating the subject of the certificate currently stored in the certificate storage <NUM> of the printer <NUM>, and proceeds to step SP15. Here, the controller <NUM> obtains, from the printer <NUM>, "Printer-<NUM>" as the information indicating the subject of certificate Co. In step SP15, on the basis of the obtained information (here, "Printer-<NUM>") indicating the subject of the certificate (here, certificate Co), the controller <NUM> searches information indicating the subjects of certificates stored in the certificate storage <NUM>, and proceeds to step SP16.

In step SP16, the controller <NUM> determines whether a certificate in which a subject identical to the subject of the certificate (here, certificate Co) of the printer to be subjected to renewal is specified is stored in the certificate storage <NUM>. When the determination is positive, this indicates that a certificate in which a subject identical to the subject of the certificate (here, certificate Co) of the printer to be subjected to renewal is specified is already stored in the certificate storage <NUM>, and the controller <NUM> proceeds to step SP17. In step SP17, the controller <NUM> transmits the certificate (here, certificate Cn in <FIG>) stored in the certificate storage <NUM>, to the printer <NUM> via the wireless communication unit <NUM>, replaces the expired certificate (here, certificate Co) in the printer <NUM> with the valid certificate (here, certificate Cn) by writing the valid certificate (here, certificate Cn) into the certificate storage <NUM> of the printer <NUM>, proceeds to step SP19, and ends the certificate writing process RT2.

On the other hand, when the determination in step SP16 is negative, this indicates that although the printer to be subjected to renewal has been found, no certificate in which a subject identical to the subject of the certificate of the printer to be subjected to renewal is specified has been installed in the PC <NUM> and is stored in the certificate storage <NUM> (i.e., no certificate available for the renewal is stored), and the controller <NUM> proceeds to step SP18. In step SP18, the controller <NUM> informs a user of the PC <NUM> that a new certificate for renewing the certificate in the printer should be installed in the PC <NUM>, by indicating on the display <NUM> that no certificate for the renewal is stored in the certificate storage <NUM>, proceeds to step SP19, and ends the certificate writing process RT2.

In the above configuration, the electronic certificate renewal system <NUM> is configured to set the time to renew the certificate to the same date as the expiration date, and periodically determine whether the certificate has expired, and when it has expired (or when a specified time within a period from a time a predetermined time before expiration of the certificate to a time of expiration of the certificate has arrived), activate the printer <NUM> as a wireless access point and shift the printer <NUM> from the infrastructure mode to the access point mode, and after the PC <NUM> wirelessly connects to the printer <NUM> and renews the certificate by storing a valid certificate in the certificate storage <NUM> of the printer <NUM>, restore the printer <NUM> to the infrastructure mode.

Thus, the electronic certificate renewal system <NUM> eliminates the need to impose an operation for renewing the certificate on a user, and can greatly save time and effort for the user to renew the certificate.

Conventionally, in a case where a device such as a printer is connected to a network using IEEE <NUM>. 1X authentication, when the electronic certificate of the device has expired, the device cannot communicate with the network using the authentication, and thus cannot obtain an electronic certificate from an apparatus connected via the network. Thus, in order to renew the electronic certificate of the device, it is necessary to manually connect an apparatus, such as a PC, to the device and renew the electronic certificate of the device from the apparatus, which takes time and effort.

On the other hand, the electronic certificate renewal system <NUM> is configured so that the printer <NUM> and PC <NUM> wirelessly connect directly to each other via the network NT4 in the access point mode and the certificate for renewal is transmitted from the PC <NUM> to the printer <NUM>. Thus, in the electronic certificate renewal system <NUM>, even when the certificate has expired, the printer <NUM> can communicate with the PC <NUM> and renew the certificate, without using the networks NT1 and NT2, requiring the certificate.

Also, the electronic certificate renewal system <NUM> is configured so that the certificate for renewal is transmitted to the printer <NUM> from the PC <NUM>, which is connected to the printer <NUM> via the networks NT1 and NT2 and uses the printer <NUM> to print a print job. Thus, in the electronic certificate renewal system <NUM>, it is possible to renew the certificate without separately providing a device for renewing the certificate that is a PC that is not connected to the networks NT1 and NT2 and is wirelessly connected to the printer <NUM>. Thus, the electronic certificate renewal system <NUM> eliminates the need to provide a device dedicated to renewal of the certificate, which can prevent the system configuration from being complicated.

As above, the printer <NUM> includes the certificate storage <NUM> that stores an electronic certificate used for authentication for using the network NT2; the controller <NUM> that detects whether the time to renew the certificate has arrived; and the communication unit <NUM> having the infrastructure mode as the first communication mode in which the communication unit <NUM> communicates with the PC <NUM> as the external device via the network NT2, and the access point mode as the second communication mode in which the communication unit <NUM> communicates with the PC <NUM> as the certificate renewal device without using the network NT2. The communication unit <NUM> connects with the PC <NUM> in the access point mode and receives a certificate for renewing the certificate from the PC <NUM>, on the basis of the detection by the controller <NUM> as to whether the time to renew the certificate has arrived.

Thereby, when the time to renew the certificate has arrived, the printer <NUM> can receive a certificate for renewing the certificate from the PC <NUM> via the network NT4, which does not require the certificate, and renew the certificate.

As illustrated in <FIG>, in which elements corresponding to those in <FIG> are given the same reference characters, an electronic certificate renewal system <NUM> of the second embodiment is different from the electronic certificate renewal system <NUM> of the first embodiment in that it includes the printer <NUM> instead of the printer <NUM> and additionally includes the certificate renewal device <NUM>, but otherwise the same.

As illustrated in <FIG>, the printer <NUM> of the second embodiment is different from the printer <NUM> of the first embodiment in that it includes the controller <NUM> instead of the controller <NUM>, but otherwise the same.

The certificate renewal device <NUM> is a personal computer that rewrites the certificate (e.g., certificate Co) installed in the certificate storage <NUM> of the printer <NUM> with a certificate (e.g., certificate Cn). The certificate renewal device <NUM> has a wireless communication function, and is located at a position where the certificate renewal device <NUM> can wirelessly communicate with the printer <NUM> when the printer <NUM> enters the access point mode and activates the wireless access point. The certificate renewal device <NUM> is not connected to any of the networks NT1, NT2, and NT3, and connected to the printer <NUM> via a network NT5 that is a wireless network.

As illustrated in <FIG>, the certificate renewal device <NUM> includes the controller <NUM>, a wireless communication unit <NUM>, a certificate storage <NUM>, and a display <NUM>. The controller <NUM>, which is or includes a processor, such as a CPU, reads predetermined programs from the memory <NUM> and controls the certificate renewal device <NUM>. The display <NUM>, which is, for example, a liquid crystal display, displays a result of certificate renewal.

The wireless communication unit <NUM>, which is, for example, a wireless LAN board installed in the certificate renewal device <NUM>, establishes wireless communication according to Wi-Fi with the printer <NUM> operating as a wireless access point or other devices and transmits and receives data. The certificate storage <NUM> is a storage that stores a certificate (e.g., certificate Cn) for renewing the certificate (e.g., certificate Co) stored in the certificate storage <NUM> of the printer <NUM>.

Next, a certificate renewal process by the printer <NUM> will be described using the flowchart illustrated in <FIG>, in which steps corresponding to those in <FIG> are given the same reference characters. The controller <NUM> starts a certificate renewal process RT101 illustrated in <FIG> by reading a certificate renewal program from the memory <NUM> and executing it, and proceeds to step SP1. In the certificate renewal process RT101, the controller <NUM> sets the time to renew the certificate stored in the certificate storage <NUM> to a date one month before the expiration date of the stored certificate, determines whether the time to renew the stored certificate has arrived (i.e., whether the date one month before the expiration date has arrived), and when the date one month before the expiration date has arrived, waits until a valid certificate is stored in the certificate storage <NUM> by the certificate renewal device <NUM>.

Here, it is assumed that certificate Co is stored in the certificate storage <NUM> and the current date is <NUM>/<NUM>/<NUM>. In this case, the remaining time until the expiration date of the certificate (i.e., certificate Co) stored in the certificate storage <NUM> of the printer <NUM> is one month (i.e., the time to renew has just arrived), and on and after the date that is one month after the current date, the IEEE <NUM>. 1X authentication by the authentication server <NUM> is denied, and the printer <NUM> cannot connect to the network NT2. The following describes an operation until the certificate stored in the certificate storage <NUM> is renewed before the expiration and the printer <NUM> becomes able to connect to the network NT2 again.

In step SP1, the controller <NUM> of the printer <NUM> compares the validity period of the certificate stored in the certificate storage <NUM> with information indicating the current date obtained from the clock <NUM>, and proceeds to step SP102. In step SP102, the controller <NUM> determines whether the current date is on or after the date one month before the expiration date of the certificate and the time to renew has arrived. When the determination is negative, this indicates that the time to renew has not arrived, and the controller <NUM> returns to step SP1. The controller <NUM> repeats steps SP1 and SP102, and periodically checks whether the time to renew has arrived. On the other hand, when the determination in step SP102 is positive, this indicates that the time to renew has arrived, and the controller <NUM> proceeds to step SP3. Here, since the current date is <NUM>/<NUM>/<NUM> and one month before the expiration date of certificate Co, the controller <NUM> makes a positive determination in step SP102.

In step SP3, the controller <NUM> controls the wireless communication unit <NUM> to activate the wireless access point, thereby placing the printer <NUM> into the access point mode, and proceeds to step SP4.

When the printer <NUM> starts as a wireless access point, the certificate renewal device <NUM> wirelessly connects to the printer <NUM> and replaces the certificate (here, certificate Co) in the certificate storage <NUM> with a new certificate (here, certificate Cn) in a certificate writing process RT102 (see <FIG>) to be described later.

In step SP4, the controller <NUM> of the printer <NUM> compares the validity period of the certificate stored in the certificate storage <NUM> with information indicating the current date obtained from the clock <NUM>, and proceeds to step SP105. In step SP105, the controller <NUM> determines whether the current date is before the date that is one month before the expiration date of the certificate and sufficient time remains in the validity period of the certificate. When the determination is positive, this indicates that there is sufficient time before the expiration date of the certificate, and the controller <NUM> proceeds to step SP6. On the other hand, when the determination in step SP105 is negative, this indicates that there is insufficient time before the expiration date of the certificate, and the controller <NUM> returns to step SP4. The controller <NUM> repeats steps SP4 and SP105, and periodically checks whether the time until the expiration date of the certificate stored in the certificate storage <NUM> is longer than one month.

In step SP6, the controller <NUM> controls the wireless communication unit <NUM> to deactivate the wireless access point, thereby restoring the printer <NUM> to the infrastructure mode, and proceeds to step SP7. In step SP7, the controller <NUM> uses the renewed certificate (here, certificate Cn) to ask the authentication server <NUM> for the IEEE <NUM>. 1X authentication, via the wired communication unit <NUM>, and after the printer <NUM> is authenticated, the controller <NUM> is allowed to resume the connection to the network NT2, proceeds to step SP8, and ends the certificate renewal process RT101.

Next, a certificate writing process by the certificate renewal device <NUM> will be described using the flowchart illustrated in <FIG>, which corresponds to <FIG>. The controller <NUM> starts the certificate writing process RT102 illustrated in <FIG> by reading a certificate writing program from the memory <NUM> and executing it, and proceeds to step SP111.

In step SP111, the controller <NUM> of the certificate renewal device <NUM> searches for the wireless access point to be searched for, via the wireless communication unit <NUM>, and proceeds to step SP112. In step SP112, the controller <NUM> determines whether the SSID of the wireless access point to be searched for has been found. When the determination is negative, this indicates that the SSID of the wireless access point to be searched for has not been found, and the controller <NUM> returns to step SP111. The controller <NUM> repeats steps SP111 and SP112, and periodically searches for the SSID of the wireless access point to be searched for. On the other hand, when the determination in step SP112 is positive, this indicates that the SSID of the wireless access point to be searched for has been found, and the controller <NUM> proceeds to step SP113. In step SP113, the controller <NUM> connects to the SSID of the wireless access point to be searched for, and proceeds to step SP114.

In step SP114, the controller <NUM> obtains, from the printer <NUM> that is connected thereto and a printer to be subjected to renewal, information indicating the subject of the certificate (here, certificate Co in <FIG>) currently stored in the certificate storage <NUM> of the printer <NUM>, and proceeds to step SP115. In step SP115, on the basis of the obtained information (here, "Printer-<NUM>") indicating the subject of the certificate (here, certificate Co), the controller <NUM> searches information indicating the subjects of certificates stored in the certificate storage <NUM>, and proceeds to step SP116.

In step SP116, the controller <NUM> determines whether a certificate in which a subject identical to the subject of the certificate (here, certificate Co) of the printer to be subjected to renewal is specified is stored in the certificate storage <NUM>. When the determination is positive, this indicates that a certificate in which a subject identical to the subject of the certificate (here, certificate Co) of the printer to be subjected to renewal is specified is already stored in the certificate storage <NUM>, and the controller <NUM> proceeds to step SP117. In step SP117, the controller <NUM> transmits the certificate (here, certificate Cn in <FIG>) stored in the certificate storage <NUM>, to the printer <NUM> via the wireless communication unit <NUM>, replaces the expired certificate (here, certificate Co) in the printer <NUM> with the valid certificate (here, certificate Cn) by writing the valid certificate (here, certificate Cn) into the certificate storage <NUM> of the printer <NUM>, proceeds to step SP119, and ends the certificate writing process RT102.

On the other hand, when the determination in step SP116 is negative, this indicates that although the printer to be subjected to renewal has been found, no certificate in which a subject identical to the subject of the certificate of the printer to be subjected to renewal is specified has been installed in the certificate renewal device <NUM> and is stored in the certificate storage <NUM> (i.e., no certificate available for the renewal is stored), and the controller <NUM> proceeds to step SP118. In step SP118, the controller <NUM> informs a user of the certificate renewal device <NUM> that a new certificate for renewing the certificate in the printer should be installed in the certificate renewal device <NUM>, by indicating on the display <NUM> that no certificate for the renewal is stored in the certificate storage <NUM>, proceeds to step SP119, and ends the certificate writing process RT102.

In the above configuration, the electronic certificate renewal system <NUM> is configured so that the time to renew the certificate is set to a date one month before the expiration date, and when the date one month before the expiration date has arrived (or when a specified time within a period from a time a predetermined time before expiration of the certificate to a time of expiration of the certificate has arrived), the certificate renewal device <NUM> stores a valid certificate in the certificate storage <NUM> of the printer <NUM>.

Thus, the electronic certificate renewal system <NUM> can renew the certificate with a new certificate before the certificate expires. Thereby, the electronic certificate renewal system <NUM> can eliminate the period in which the printer <NUM> cannot connect to the network NT2 due to expiration of the certificate, and can reduce inconvenience to a user more than the electronic certificate renewal system <NUM>.

Moreover, the electronic certificate renewal system <NUM> of the second embodiment can provide the same effects and advantages as the electronic certificate renewal system <NUM> of the first embodiment.

In the above second embodiment, the certificate renewal device <NUM> may be omitted so that the electronic certificate renewal system <NUM> has a similar configuration to the electronic certificate renewal system <NUM>, and when the date one month before the expiration date of the certificate has arrived, the PC <NUM> may write the new certificate in the printer <NUM>, as with the first embodiment.

In the above first embodiment, the new certificate is transmitted to the printer <NUM> from a personal computer. However, the present disclosure is not limited to this. The new certificate may be transmitted to the printer <NUM> from another device, such as a mobile terminal or portable terminal, such as a smartphone or tablet, having a wireless communication function. When the new certificate is transmitted to the printer <NUM> from a portable terminal having an NFC communication unit, the electronic certificate renewal system <NUM> may be configured as follows. The fact that the time to renew the certificate has arrived is displayed on the display operation unit <NUM> of the printer <NUM> or a display operation unit of the portable terminal. When the NFC communication unit of the portable terminal is placed over the NFC communication unit <NUM> of the printer <NUM>, a request to renew the certificate is transmitted from the printer <NUM> to the portable terminal via NFC communication, and then the new certificate is transmitted from the portable terminal to the printer <NUM> via NFC communication. The same applies to the second embodiment.

In the above first embodiment, techniques of the present disclosure are applied to the electronic certificate renewal system <NUM> in which when the certificate installed in the printer <NUM> has expired, the certificate is renewed with a new certificate by the PC <NUM>. However, the present disclosure is not limited to this. Techniques of the present disclosure may be applied to an electronic certificate renewal system in which when the certificate is not installed in the printer <NUM> (i.e., when the certificate is not stored in the certificate storage <NUM>), a certificate that is a valid electronic certificate to be initially installed in the printer <NUM> is installed in the printer <NUM> by the PC <NUM>. The same applies to the second embodiment.

In the above first embodiment, when the certificate stored in the printer <NUM> is expired, the authentication server <NUM> determines that the certificate is invalid, and does not authenticate the printer <NUM>. However, the present disclosure is not limited to this. For example, the authentication server <NUM> may be configured so that regardless of the expiration date of the certificate stored in the printer <NUM>, when the certificate has a specific serial number or public key, the authentication server <NUM> determines that the certificate is invalid, and does not authenticate the printer <NUM>. In this case, when the certificate is renewed with a new certificate so that the serial number or public key is renewed, the authentication server <NUM> determines that the renewed certificate is valid, and authenticates the printer <NUM>. Thus, techniques of the present disclosure may be applied to an electronic certificate renewal system in which regardless of the expiration date, when the certificate is determined by the authentication server <NUM> to be invalid on the basis of other information item(s) of the certificate, a new certificate as a valid electronic certificate is installed in the printer <NUM> by the PC <NUM>. The same applies to the second embodiment.

In the above first embodiment, the short-distance wireless communication between the printer <NUM> and the PC <NUM> is performed according to Wi-Fi. However, the present disclosure is not limited to this. The short-distance wireless communication between the printer <NUM> and the PC <NUM> may be performed according to another communication protocol, such as Bluetooth (registered trademark) or ZigBee (registered trademark). The same applies to the second embodiment.

In the above first embodiment, the networks NT1, NT2, and NT3 are wired communication networks. However, the present disclosure is not limited to this. At least one of the networks NT1, NT2, and NT3 may be wireless communication network. The same applies to the second embodiment.

In the above first embodiment, in the access point mode, the printer <NUM> and PC <NUM> perform wireless communication. However, the present disclosure is not limited to this. In the access point mode, the printer <NUM> and PC <NUM> may perform a wired communication that does not require the authentication by the authentication server <NUM>. The same applies to the second embodiment.

In the above first embodiment, techniques of the present disclosure are applied to the electronic certificate renewal system <NUM> that renews the client certificate installed in the printer <NUM>. However, the present disclosure is not limited to this. Techniques of the present disclosure may be applied to an electronic certificate renewal system that renews another certificate, such as a certificate for server verification, installed in the printer <NUM>. The certificate for server verification is, for example, such that in accessing the printer <NUM> functioning as a server from the PC <NUM> to view a Web page regarding the printer <NUM>, when the certificate for server verification is not installed in the printer <NUM> or invalid, the fact is displayed on the PC <NUM>, and the PC <NUM> is prevented from accessing the printer <NUM>. The same applies to the second embodiment.

In the above first embodiment, techniques of the present disclosure are applied to the printer <NUM>. However, the present disclosure is not limited to this. Techniques of the present disclosure may be applied to other image forming apparatuses, such as copiers, facsimile machines, or multi-function peripherals (MFPs) having functions, such as copier and facsimile functions, having various functions. Also, techniques of the present disclosure may be applied to other various electronic devices, such as home electric appliances or sensors, that perform network communication. The same applies to the second embodiment.

The present disclosure is not limited to the above embodiments. Specifically, the scope of the present disclosure covers embodiments obtained by arbitrarily combining some or all of the above embodiments. Also, the scope of the present disclosure covers embodiments obtained by extracting part of the configuration described in one of the above embodiments and replacing part of the configuration of another of the above embodiments with the extracted part, and embodiments obtained by extracting part of the configuration described in one of the above embodiments and adding the extracted part to another of the above embodiments.

In the above first embodiment, the printer <NUM> as an information processing device is constituted by the certificate storage <NUM> as a storage, the controller <NUM> as a detector, and the communication unit <NUM>. However, the present disclosure is not limited to this. Information processing devices may be constituted by storages, detectors, and communication units that have other various configurations.

Claim 1:
An information processing device (<NUM>, <NUM>) comprising:
a storage (<NUM>) configured to store an electronic certificate used for authentication for using a first network (NT2);
a detector (<NUM>, <NUM>) configured to detect at least one of whether a time to renew the electronic certificate has arrived and whether the electronic certificate is stored in the storage (<NUM>) and is valid; and
a communication unit (<NUM>) having a first communication mode in which the communication unit (<NUM>) communicates with an external device (<NUM>) via the first network (NT2) and a second communication mode in which the communication unit (<NUM>) operates as a wireless access point and communicates with a certificate renewal device (<NUM>, <NUM>) via a wireless network (NT4, NT5),
wherein the communication unit (<NUM>) performs at least one of:
when the detector (<NUM>, <NUM>) detects that the time to renew the electronic certificate has arrived, transmitting a service set identifier of the information processing device (<NUM>, <NUM>) as a request for an electronic certificate used for the authentication for using the first network (NT2) to the certificate renewal device (<NUM>, <NUM>) in the second communication mode and receiving, as an electronic certificate for renewing the electronic certificate, an electronic certificate transmitted from the certificate renewal device (<NUM>, <NUM>) in response to the service set identifier, and
when the detector (<NUM>, <NUM>) detects that the electronic certificate is not stored in the storage (<NUM>) or invalid, transmitting a service set identifier of the information processing device (<NUM>, <NUM>) as a request for an electronic certificate used for the authentication for using the first network (NT2) to the certificate renewal device (<NUM>, <NUM>) in the second communication mode and receiving, as a new electronic certificate, an electronic certificate transmitted from the certificate renewal device (<NUM>, <NUM> in response to the service set identifier.