JP4423227B2 - Profile issuing system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To enhance convenience of a user when information constituting a profile is updated. <P>SOLUTION: A profile issuance system is provided with: a profile issuing device 100 which issues the profile 6 by setting an order and combining profile component paths in a profile component which is connection information to be connected to a network; and a communication terminal 200 which is connected to a desired network using the issued profile 6. The communication terminal 200 edits the information constituting the issued profile 6 and manages editing history, and when the profile issuance device 100 updates the information constituting the profile 6, the communication terminal 200 re-edits the updated information based on the editing history. <P>COPYRIGHT: (C)2007,JPO&amp;INPIT

Description

  The present invention relates to a profile issuing system that issues a profile representing connection information for connecting to a network.

  As a conventional profile issuing device, in a system having a communication terminal (wireless digital camera) connected to a network corresponding to a hot spot provided by each telecommunications carrier and an authentication server, between the communication terminal and the authentication server A profile server that manages and stores a profile representing unique communication information such as an authentication procedure used for each communication carrier is known (for example, see Patent Document 1).

  This profile includes information such as a user ID and a password, and a conventional profile server uses a communication terminal to provide a communication terminal with a profile managed for each carrier and each user. When connecting to the network, the user can save the trouble of inputting the user ID, password, etc. to the communication terminal, and connect to the network using the provided profile. Further, since the wireless digital camera shown in Patent Document 1 needs to log on twice in the order of an access point and an authentication server, the profile includes an authentication corresponding to the number of logons, the logon order, and the logon procedure. Contains information.

A user who uses a communication terminal can edit information constituting the profile by operating the communication terminal storing the profile provided from the profile server. For example, the user ID in the profile can be changed.
Japanese Patent Application Laid-Open No. 2004-128886 (14th to 19th paragraphs, FIG. 2)

  However, the profile issuing device does not reflect the contents edited by the user when the user edits the information constituting the profile and then updates the same information as this information. There was a problem that the updated information had to be edited again.

  The present invention has been made to solve the conventional problems, and an object of the present invention is to provide a profile issuing system that can improve user convenience when information constituting a profile is updated.

  The profile issuing system of the present invention is issued by a profile issuing device that issues a profile that is a combination of profile component paths that are set in order to profile components that are connection information for connecting to a network, and the profile issuing device. A communication terminal that connects to a desired network using the profile, and the communication terminal edits information constituting the profile issued by the profile issuing device, and the profile editing means performs the editing. A history management unit that manages a history of editing, and the profile editing unit replays the updated information based on the editing history when the profile issuing device updates the information constituting the profile. Has a configuration to edit

  With this configuration, when the information constituting the profile is updated, the information is re-edited based on the editing history, so that the user's convenience can be improved without the user editing again.

  Further, in the profile issuing system of the present invention, the profile includes a profile identifier for identifying the same profile, and the profile editing unit is configured to update the profile of the profile when the profile issuing device updates the profile. The profile identified by the identifier is re-edited based on the editing history.

  With this configuration, since the profile identified by the profile identifier is re-edited based on the editing history, the user's convenience can be improved without the user editing again.

  In the profile issuing system of the present invention, the profile part path includes a profile part path identifier for identifying the same profile part path, and the profile editing means updates the profile part path by the profile issuing unit. The profile part path identified by the profile part path identifier of the updated profile part path is re-edited based on the editing history.

  With this configuration, since the profile part path identified by the profile part path identifier is re-edited based on the editing history, the user's convenience can be improved without the user editing again.

  In the profile issuing system of the present invention, the profile component includes a profile component identifier for identifying the same profile component, and the profile editing means is updated when the profile issuing device updates the profile component. The profile part identified by the profile part identifier of the profile part is re-edited based on the editing history.

  With this configuration, since the profile part identified by the profile part identifier is re-edited based on the editing history, the user's convenience can be improved without the user editing again.

  In the profile issuing system of the present invention, there is a sub-part constituting the profile part, the sub-part includes a sub-part identifier for identifying the same sub-part, and the profile editing means is the profile issuing unit When the sub-part is updated, the sub-part identified by the sub-part identifier of the updated sub-part is re-edited based on the editing history.

  With this configuration, since re-editing is performed based on the editing history of the sub-part identified by the sub-part identifier, the user's convenience can be improved without the user editing again.

  Further, in the profile issuing system of the present invention, the profile issuing device has profile providing means for providing the updated profile to the communication terminal, and the communication terminal receives the updated profile based on the profile identifier. Profile acquisition means for acquiring from the profile issuing device, and when the profile has been updated, the communication terminal has a configuration for acquiring and applying the updated profile from the profile issuing device.

  With this configuration, when the profile has been updated, the communication terminal acquires and applies the updated profile from the profile issuing device, so that the user of the communication terminal performs an operation to update the profile from the profile issuing device. Since it is not necessary, convenience can be improved.

  Further, in the profile issuing system of the present invention, the profile issuing device has profile distribution means for distributing the updated profile to the communication terminal, and the communication terminal has a profile profile distributed from the profile issuing device. The profile used is changed based on the identifier, and the distributed profile is applied.

  With this configuration, the communication terminal changes the profile in use based on the profile identifier of the profile distributed from the profile issuing device and applies the distributed profile, so that the user of the communication terminal can Since it is not necessary to perform the work of updating the profile, the convenience can be improved.

  Further, in the profile issuing system of the present invention, the profile issuing device has profile encryption means for encrypting the profile, and the communication terminal uses a decryption key provided to a user who knows the password, A profile decrypting unit configured to decrypt the profile encrypted by the encrypting unit;

  With this configuration, the profile issuing device encrypts the profile, and the communication terminal decrypts the profile encrypted with the decryption key provided to the user who knows the password, so that only the user who knows the password can profile. Can be used to prevent unauthorized network connections from third parties.

  In the profile issuing system of the present invention, the communication terminal uses a key owned by a user who uses the communication terminal to encrypt information related to the editing history, and the encryption unit encrypts the information. And decryption means for decrypting the information related to the edited history using the paired key paired with the key.

  With this configuration, since the communication terminal encrypts and decrypts the editing history information using the key owned by the user, it is possible to prevent the editing history information from being referred to by a third party.

  Further, in the profile issuing system of the present invention, the profile issuing device has a configuration including a decrypting unit that decrypts the information related to the editing history encrypted by the encrypting unit using the key pair. ing.

With this configuration, when the key owned by the user is lost, the editing history information is decrypted with the key of the profile issuing device, so that the editing history information can be used again. It can be reflected in the profile.
The communication terminal according to the present invention uses a profile issued by a profile issuing device that issues a profile that is a combination of profile component paths that are set in order to profile components that are connection information for connecting to a network. A communication terminal connected to a network, a profile storage means for storing a profile issued by the profile issuing device, and a profile editing means for editing information constituting the profile stored in the profile storage means; A history management unit that manages a history of editing performed by the profile editing unit, and the profile editing unit is based on information constituting the updated profile issued from the profile issuing device. The profile case If profile stored in the unit has been updated, and a re-edited based information constituting the updated profile to the history of the editing.

  As described above, the present invention can provide a profile issuing system that can improve user convenience when information constituting a profile is updated.

  Hereinafter, embodiments of the present invention will be described in detail with reference to the drawings.

(First embodiment of the present invention)
FIG. 1 is a system configuration diagram of a profile issuing system according to the first embodiment of the present invention. The profile issuing system shown in FIG. 1 includes a profile issuing device 100 that issues a profile 6 used to connect to a network, and a communication terminal 200 that connects to a desired network using the profile issued by the profile issuing device 100. It has the composition provided with.

  The profile issuing apparatus 100 distributes the issued or updated profile 6. For example, the profile 6 issued or updated by the profile issuing device 100 may be attached to an electronic mail and distributed to the communication terminal 200, or the communication terminal 200 may download the profile 6 from the profile issuing device 100. Alternatively, a hardware token such as a USB token may be used to pass the hardware token storing the profile 6 to the user of the communication terminal 200 and input the profile 6 from the hardware token to the communication terminal 200. .

  Hereinafter, a profile issuing device and a communication terminal for realizing the profile issuing system according to the first embodiment of the present invention will be described.

  FIG. 2 is a device configuration diagram of the profile issuing device according to the first exemplary embodiment of the present invention. The profile issuing apparatus 100 has a CPU (Central Processing Unit), a memory, a hard disk, an input device such as a keyboard, a display, and the like as shown in FIG. ), The profile issuing device 100 includes a profile component database 110, a profile component path database 120, a profile database 130, a profile operation unit 101, and a database management unit (search means) 150. The profile operation unit 101 includes profile part path generation means 140 and profile issue means 160.

  Note that the profile component database 110, profile component path database 120, profile database 130, profile operation unit 101, database management unit 150, and the like constituting the profile issuing apparatus 100 are realized by using program modules processed by the CPU. Is done.

  Here, FIG. 3 shows an example of the structure related to the connection information handled by the profile issuing device according to the embodiment of the present invention.

  The profile component is authentication information of a protocol related to communication. For example, the profile component A conforms to IEEE 802.11, and further includes authentication information for performing communication and authentication conforming to IEEE 802.11a. The authentication information includes information such as ESSID, authentication method, and WEP key.

  The profile part path 5a to profile part path 5c are set in order of use for profile parts. For example, the profile part path 5a is obtained by setting this order for profile part A, profile part B, and profile part C.

  The profiles 6a to 6c are information for connecting to a desired network, and are set in the order of priority for use in the profile component path. For example, the profile 6a is obtained by setting the priority order of use to the profile component path 5a, the profile component path 5b, and the profile component path 5c.

  The priority order of use refers to a priority order in the case where connection is attempted using the profile component path 5b which is given the next highest priority when connection using the highest priority profile component path 5a fails.

  Here, an example of the configuration of the network corresponding to each profile component is shown in FIG.

  The profile part C is information for connecting to the network 10. The network 10 includes a communication device 11 configured by a layer 2 switch and functioning as an authenticator compliant with IEEE 802.1X, and a communication device 12 functioning as an authentication server compliant with IEEE 802.1X and EAP-TTLS.

  The profile part E is information for connecting to the network 20. Further, the network 20 includes a communication device 21 that requires settings relating to an IP address or the like.

  The profile part D is information for connecting to the network 30. In addition, the network 30 includes a communication device 31 that requires settings relating to an IP address or the like.

  The profile part H is information for connecting to the network 40. The network 40 includes a communication device 41 that functions as a WEB server.

  The profile part J is information for connecting to the network 50. The network 50 includes a communication device 51 that functions as a RAS server compliant with PPP.

  The profile part I is information for connecting to the network 60. Further, the network 60 includes a communication device 61 that requires settings relating to an IP address or the like.

  The profile part G is information for connecting to the network 70. The network 70 includes a communication device 71 that functions as a gateway that complies with IPsec.

  The profile part B is information for connecting to the network 80. The network 80 includes a communication device 81 that functions as a wireless LAN access point, and a communication device 82 that functions as an authentication server compliant with IEEE 802.1X and EAP-TTLS.

  The profile part A is information for connecting to the network 90. The network 90 includes a communication device 91 that functions as a wireless LAN access point, and a communication device 92 that functions as an authentication server compliant with IEEE 802.1X and EAP-TTLS.

  The profile component F is authentication information used for the communication device 9 that functions as an authentication server compliant with EAP-TTLS. The communication device 9 is shared by the communication device 12, the communication device 82, and the communication device 92. For this reason, the profile component F may be used via the communication device 12 of the network 10, may be used via the communication device 82 of the network 80, or is used via the communication device 92 of the network 90. Sometimes.

  Here, the route 1 is a route connected to the network 40 via the network 10 and the network 30.

  The path 2 is a path connected to the network 40 via the network 80 and the network 20.

  The path 3 is a path connected to the network 40 via the network 90 and the network 20.

  The route 4 is a route connected to the network 40 via the network 60 and the network 70.

  The path 5 is a path connected to the network 40 via the network 50 and the network 70.

  The profile part includes a profile part identifier for identifying the same profile part, and the profile part path includes a profile part path identifier for identifying the same profile part path. In addition, the profile includes a profile identifier that identifies the same profile.

  The operation of the profile issuing device according to the first embodiment of the present invention configured as described above will be described with reference to the drawings.

  FIG. 5 is a flowchart showing the operation of the profile issuing device according to the first exemplary embodiment of the present invention.

(Profile parts creation phase)
First, a network administrator who uses the profile issuing device 100 inputs profile parts, which are connection information for connecting to a network, to the profile operation unit 101 (S11). Next, the database management unit 150 stores the profile component input to the profile operation unit 101 in the profile component database 110 (S12).

  For example, the network administrator stores profile parts corresponding to networks and communication devices included in each of the paths 1 to 5 shown in FIG.

(Profile part path creation phase)
First, the network administrator inputs information indicating profile parts corresponding to, for example, a network included in the route 1 to the profile operation unit 101 (S21). Next, the database management unit 150 searches the profile component database 110 for a profile component corresponding to the input information (S22).

The profile operation unit 101 displays the searched profile part on the display (S23). The network administrator sets user information (for example, authentication information) of the output profile component if necessary via the profile operation unit 101, and uses the retrieved profile component for the profile operation unit 101. The order to be performed is designated (S24).

  The profile component path generation unit 140 generates a profile component path formed by setting the specified order of the profile components specified by the network administrator, and stores the profile component path in the profile component path database 120 (S25). For example, the network administrator repeatedly stores the profile part paths corresponding to each of the path 1 to the path 5 in the profile part path database 120. It should be noted that the profile issuing apparatus 100 may store the profile part paths from the path 1 to the path 5 in the profile part path database 120 in S25 by repeating from S21 to S24.

  Here, the profile component path stored in the profile component path database 120 is shown in FIG. The profile component path 8 is a profile component path corresponding to each of the route 1 to the route 5.

  For example, the profile of user A is formed by combining the profile part paths of paths 1, 2, 4, and 5, for example, by setting the priority order of use. The profile of user B is a combination of profile parts paths of paths 1, 2, and 3, for example, by setting a priority order of use.

(Profile creation phase)
In FIG. 5, the network administrator inputs information indicating a profile part path corresponding to a route connected to a desired network (for example, the network 40) to the profile operation unit 101 (S31). The database management unit 150 searches the profile component path database 120 for a profile component path corresponding to the input information (S32).

  The profile operation unit 101 displays the searched profile part path on the display (S33). If necessary, the network administrator sets user information (for example, authentication information) in the output profile component path via the profile operation unit 101 and searches the profile operation unit 101 for the retrieved profile component. The priority order of use of the path is designated (S34).

After the profile part path corresponding to the designated route is input via the profile operation unit 101, the profile issuing unit 160 combines the profile part paths input via the profile operation unit 101, and selects the combined profile part path. The copied profile is issued and stored in the profile database 130 (S35).

  It should be noted that the profile issuing device 100 may store the profiles from the route 1 to the route 5 in the profile database 130 in S35 by repeating from S31 to S34.

  FIG. 6A shows a state in which the profile issuing unit 160 issues a profile formed by combining profile part paths corresponding to each route to each of the users A and B.

  In FIG. 6A, the profile issuing unit 160 issues a profile formed by combining a plurality of profile part paths. Of course, a profile consisting of one profile part path may be issued.

  In FIG. 6B, when the user A and the user B belong to the same organization and the user C and the user D belong to the same organization, a plurality of users are grouped for each organization, and the profile component for which the organization has usage authority. An example of a profile including In this example, the organization to which the user C and the user D belong does not have the usage authority for the profile parts A, B, C, D, E, and F to which the organization to which the user A and the user B belong.

  Further, the profile operation unit 101 is stored in the profile part stored in the profile part database 110, the profile part path stored in the profile part path database 120, or the profile database 130 by the operation of the network administrator. You can also edit and update your profile.

  FIG. 7 is a device configuration diagram of the communication terminal according to the first embodiment of the present invention. The communication terminal 200 has a CPU, a memory, an input device such as a keyboard, a display, and the like (not shown), and may be a mobile phone or a personal computer. Also, a profile storage unit 210, a profile editing unit 220, and a history management unit 230. , A profile update unit 240, and a connection unit 250.

  The profile storage unit 210 is for storing, for example, a profile issued by the profile issuing device 100, and the profile editing unit 220 is information constituting the profile stored in the profile storage unit 210 in response to a user input. Editing is to be performed.

  The history management unit 230 manages the history of editing performed by the profile editing unit 220, and the profile update unit 240 inputs information constituting the profile from a hardware token or an e-mail. It is supposed to be updated. The connection means 250 is configured to connect to a network desired by the user using a profile.

  The profile storage unit 210, the profile editing unit 220, the history management unit 230, the profile update unit 240, the connection unit 250, and the like are realized by using program modules processed by the CPU.

  The operations of the profile issuing device and the communication terminal according to the first embodiment of the present invention configured as described above will be described with reference to the drawings. FIG. 8 is a diagram for explaining the operation of the communication terminal according to the first embodiment of the present invention.

  The history management unit 230 manages the editing history when the user has edited the profile through the profile editing unit 220 as difference information. For example, the difference information is, as shown in FIG. 8A, editing contents when a profile part constituting the previous profile is edited and editing contents when a profile part path priority is edited. If you edit the profile part of the previous profile and then update the profile, if there is a profile part with the same identifier in the current profile, the edited content is reflected (in this example, the profile part (a, b, Difference information is applied to d, e, f, g).

  It is assumed that, for example, a priority order is assigned to a profile part path among the profiles issued by the profile issuing device 100. As shown in FIG. 8B, in the previous state, the profile component path 911 has the highest priority, and the profile component path 912 and profile component path 913 have the lowest priority. The connection means 250 connects to a desired network according to this priority order.

  Here, the user changes the priority order through the profile editing unit 220 and edits the profile part path 913 having the highest priority order, then the profile part path 912 and the profile part path 911 in order of decreasing priority order. And The history management unit 230 manages the history of editing performed by the profile editing unit 220 as difference information in which the profile part path identifier of each profile part path corresponds to the priority order.

  Thereafter, the profile update unit 240 inputs information constituting the profile issued by the profile issuing device 100, and each profile component path constituting the profile is updated.

  Any one or more of the profile part path 911, the profile part path 912, the profile part path 913, and the information a to information n constituting each of them are updated.

  When the profile is updated by the profile update unit 240, the profile editing unit 220 re-edits the profiles by rearranging them in the priority order corresponding to the profile part path identifier of the profile part path based on the difference information managed by the history management unit 230. To do.

  The profile component path 911, profile component path 912, and profile component path 913 have been described as profile component paths. However, if these pieces of information are profile 911, profile 912, and profile 913, and a profile identifier is assigned to each profile, the same applies. Even if the priority of the profile is changed and edited, it is re-edited based on the difference information at the time of update.

  Further, as shown in FIG. 9, profile parts constituting the profile are set as items, and a profile part identifier is assigned to this item. The history management unit 230 and the like manage information 921 corresponding to the items 1 to n as the previous state.

  Here, it is assumed that the user has edited information corresponding to items 5 and 6 via the profile editing unit 220. The history management unit 230 manages the history of editing performed by the profile editing unit 220, that is, the information 922 corresponding to the changed profile part identifiers of the items 5 and 6 as difference information.

  Thereafter, the profile update unit 240 inputs information constituting the profile issued by the profile issuing device 100, and the information 921 constituting the profile is updated. At this time, the profile part identifier of the item constituting the updated profile is unchanged from the previous time.

  When the profile is updated by the profile update unit 240, the profile editing unit 220 re-applies information 922 corresponding to the profile part identifiers of the items 5 and 6 based on the difference information managed by the history management unit 230. Edit and create new information 923 corresponding to item 1 to item n.

  As described above, in the profile issuing system according to the first exemplary embodiment of the present invention, there is a case where the information constituting the profile issued by the profile issuing apparatus 100 is edited by the user. When the information that constitutes the profile issued by is updated, it is re-edited based on the editing history, so that the user's convenience is improved without re-editing by the user when the information constituting the profile is updated. Can be able to.

  Further, as a modification of the first embodiment of the present invention, there may be a sub-part that constitutes a profile part. For example, as illustrated in FIG. 10, when the communication terminal 200 includes a profile component 931, it is assumed that the profile editing unit 220 edits the subcomponent B having a subcomponent identifier of 2 in accordance with a user input. After editing, the history management unit 230 manages the history of editing performed by the profile editing unit 220 as difference information 932.

  Here, when the profile part 931 is updated by the profile issuing device 100, the profile update unit 240 inputs the profile part 933 that replaces the profile part 931, and the profile editing part 220 includes the sub-part identifier included in the profile part 933. Re-edit the sub-part for which becomes 2. Based on the difference information 932.

  Accordingly, the re-edited profile part becomes the profile part 934, and the history of editing is reflected on the updated profile part 933.

(Second embodiment of the present invention)
FIG. 11 is a system configuration diagram of a profile issuing system according to the second embodiment of the present invention.

  The profile issuing system shown in FIG. 11 has a configuration in which a profile issuing device 300 that issues a profile used for connecting to a network and a communication terminal 400 that uses an already issued profile are connected to the network. Have. The network is the Internet, for example, and communication between the profile issuing device 300 and the communication terminal 400 is based on a protocol such as HTTP.

  Further, as the network configuration as described with reference to FIG. 4 is changed, the profile needs to be updated according to the changed network configuration, so that the profile issuing device 300 is already provided to the communication terminal 400. Update the profile.

  The profile includes the profile identifier described in the first embodiment of the present invention. For example, the profile identifier is configured by a combination of a user ID for identifying the user, a terminal ID for identifying the communication terminal 400, a version ID for managing the generation of the profile, and the like.

  The communication terminal 400 inquires about the update status of the profile at a predetermined timing (S101), and acquires the updated profile from the profile issuing device 300 based on the profile identifier.

  For example, the predetermined timing is every fixed time or immediately after connecting to a desired network using a profile. Note that the information related to the predetermined timing may be set in a profile. Further, when confirming the update of the profile, the communication terminal 400 transmits the profile identifier to the profile issuing device 300, so that whether or not the profile has been updated based on the version ID constituting the profile identifier is determined. Confirmed by the device 300.

  When the profile issuing device 300 confirms that the profile has been updated, the communication terminal 400 acquires and applies the updated profile from the profile issuing device 300 (S102).

  For example, when the profile has been updated, the profile issuing device 300 transmits the updated profile corresponding to the profile identifier to the communication terminal 400, that is, the communication terminal 400 transmits the updated profile from the profile issuing device 300. Download and apply the downloaded profile immediately. Note that “application” corresponds to an operation in which, if software for connecting to a desired network is installed in the communication terminal 400, a profile is imported and the profile becomes valid.

  The profile issuing device and communication terminal for realizing the profile issuing system according to the second embodiment of the present invention will be described below.

  FIG. 12 is a device configuration diagram of a profile issuing device according to the second exemplary embodiment of the present invention. As shown in FIG. 12, the profile issuing device 300 includes a profile part database 110, a profile part path database 120, a profile database 130, a profile operation unit 101, a database management unit 150, and a profile providing unit 310.

  Of the components constituting the profile issuing device according to the second embodiment of the present invention, the same components as those constituting the profile issuing device according to the first embodiment of the present invention are included. The same code | symbol is attached | subjected and each description is abbreviate | omitted.

  When the communication terminal 400 receives a profile identifier from the communication terminal 400 when the communication terminal 400 confirms the update of the profile, the profile providing unit 310 acquires the update status of the profile corresponding to the received profile identifier from the profile database 130. Thus, it is confirmed whether or not the profile has been updated.

  Further, when the profile providing unit 310 confirms that the profile has been updated, the profile providing unit 310 acquires the updated profile corresponding to the profile identifier from the profile database 130 and transmits it to the communication terminal 400.

  The profile providing unit 310 is realized by using a program module processed by the CPU.

  FIG. 13 is an apparatus configuration diagram of a communication terminal according to the second embodiment of the present invention. As shown in FIG. 13, the communication terminal 400 includes a profile storage unit 210, a profile editing unit 220, a history management unit 230, a profile update unit 440, a connection unit 250, and a profile acquisition unit 410.

  Of the components constituting the communication terminal according to the second embodiment of the present invention, the same components as those constituting the communication terminal according to the first embodiment of the present invention are the same. Reference numerals are assigned and explanations thereof are omitted.

  The profile acquisition unit 410 acquires an updated profile from the profile issuing device 300 based on the profile identifier at a predetermined timing. For example, the profile identifier is a profile identifier of a profile stored in the profile storage unit 210. The profile acquisition unit 410 acquires a profile if the profile is updated, and does not acquire a profile if the profile is not updated.

  When the profile has been updated, the profile acquisition unit 410 downloads from the profile issuing device 300, and the profile update unit 440 immediately applies the updated profile.

  The profile acquisition unit 410 and the profile update unit 440 are realized by using a program module processed by the CPU.

  As described above, in the profile issuing system according to the second embodiment of the present invention, when the profile is updated, the communication terminal 400 acquires the updated profile from the profile issuing device 300 and applies it. As a result, the user of the communication terminal 400 does not need to perform the work of updating the profile from the profile issuing device 300, so that the work of shifting to the new profile becomes smooth and the convenience can be improved.

  The profile issuing device 300 can centrally manage network connections performed by the communication terminal 400. For example, when a desired network is an in-house network, when a user who is connected to the in-house network and performs an illegal act such as acquisition of personal information is identified, the communication terminal 400 used by the user is in-house Profiles that cannot be connected to the network can be forcibly applied, and connection to the corporate network can be prohibited.

  In the conventional case where the user is responsible for updating the profile, when changing the network configuration, both the old and new network configurations exist within the transition period, and the user is aware of the network configuration within the transition period. However, the profile issuing system according to the second embodiment of the present invention can make it unnecessary for the user to be aware of changes in the network configuration.

(Third embodiment of the present invention)
FIG. 14 is a system configuration diagram of a profile issuing system according to the third embodiment of the present invention.

  The profile issuing system shown in FIG. 14 has a configuration in which a profile issuing device 350 that issues a profile used for connecting to a network and a communication terminal 450 that uses an already issued profile are connected to the network. Have. The network is the Internet, for example, and communication between the profile issuing device 350 and the communication terminal 450 is based on a protocol such as HTTP.

  Further, as the network configuration as described with reference to FIG. 4 is changed, it is necessary to update the profile according to the changed network configuration. Therefore, the profile issuing device 350 is already provided to the communication terminal 450. Update the profile.

  The profile includes the profile identifier described in the first embodiment of the present invention. For example, the profile identifier is configured by a combination of a user ID for identifying the user, a terminal ID for identifying the communication terminal 400, a version ID for managing the generation of the profile, and the like.

  The profile issuing device 350 distributes the updated profile to the communication terminal 450 at the scheduled timing or as soon as the profile is updated.

  For example, the scheduled timing is a timing at which the network configuration is changed when a change in the network configuration is scheduled at a certain time in the future. The profile may be updated before this timing, but the updated profile is distributed at this timing.

  When the communication terminal 450 is distributed from the profile issuing device 350, the communication terminal 450 compares the profile identifier of the distributed profile with the profile identifier of the currently used profile to determine whether to update the profile. It has become. For example, if the profile is the same profile and the version ID of the profile identifier is raised, the communication terminal 450 updates the profile distributed from the profile issuing device 350 and applies it immediately. Note that “application” corresponds to an operation in which, if software for connecting to a desired network is installed in the communication terminal 450, the profile is imported and the profile becomes valid.

  When the profile is distributed from the profile issuing device 350 while the communication terminal 450 is connected to the desired network with the profile currently used, the communication terminal 450 is temporarily connected with the profile being used. Disconnect from the network, change to the updated profile, and reconnect to the desired network.

  The profile issuing device and communication terminal for realizing the profile issuing system according to the third embodiment of the present invention will be described below.

  FIG. 15 is a device configuration diagram of a profile issuing device according to the third embodiment of the present invention. As shown in FIG. 15, the profile issuing device 350 includes a profile part database 110, a profile part path database 120, a profile database 130, a profile operation unit 101, a database management unit 150, and a profile distribution unit 360.

  Of the constituent elements constituting the profile issuing apparatus according to the third embodiment of the present invention, the same constituent elements as those constituting the profile issuing apparatus according to the first embodiment of the present invention are included. The same code | symbol is attached | subjected and each description is abbreviate | omitted.

  The profile distribution unit 360 acquires the updated profile from the profile database 130 and distributes it to the communication terminal 450. For example, when distributing at a scheduled timing, the profile distribution unit 360 acquires and distributes a profile corresponding to a profile identifier determined to be distributed in advance from the profile database 130, and also updates an updated profile. Is immediately distributed, the profile identifier corresponding to the updated profile identifier and the corresponding profile are acquired from the profile database 130 and distributed.

  The profile distribution unit 360 is realized using a program module processed by the CPU.

  FIG. 16 is a device configuration diagram of a communication terminal according to the third embodiment of the present invention. As shown in FIG. 16, the communication terminal 450 includes a profile storage unit 210, a profile editing unit 220, a history management unit 230, a profile update unit 460, and a connection unit 250.

  Of the constituent elements constituting the communication terminal according to the third embodiment of the present invention, the same constituent elements as those constituting the communication terminal according to the first embodiment of the present invention are the same. Reference numerals are assigned and descriptions thereof are omitted.

  The profile update means 460 compares the profile identifier of the profile distributed from the profile issuing device 350 with the profile identifier of the currently used profile to determine whether or not to update the profile. . For example, when the version ID of the profile identifier of the distributed profile is higher than the profile identifier of the profile stored in the profile storage unit 210, the profile update unit 460 changes the profile in use, The profile distributed from the profile issuing device 350 is updated and applied immediately.

  As described above, in the profile issuing system according to the third exemplary embodiment of the present invention, the communication terminal 450 changes the profile in use based on the profile identifier of the profile distributed from the profile issuing device 350, and By applying the distributed profile, the user of the communication terminal 450 does not need to perform the work of updating the profile from the profile issuing device 350, so that the work of shifting to the new profile becomes smooth and the convenience is improved. be able to.

  In the conventional case where the user is responsible for updating the profile, when changing the network configuration, both the old and new network configurations exist within the transition period, and the user is aware of the network configuration within the transition period. However, the profile issuing system according to the third embodiment of the present invention can make it unnecessary for the user to be aware of changes in the network configuration.

(Fourth embodiment of the present invention)
FIG. 17 is a system configuration diagram of a profile issuing system according to the fourth embodiment of the present invention.

  The profile issuing system shown in FIG. 17 includes a profile issuing device 500 that issues an encrypted profile 941 and an authentication token 942, and communication that uses the profile 941 and the authentication token 942 issued by the profile issuing device 500 (S201). And a terminal 600.

  The authentication token 942 includes a decryption key for decrypting the encrypted profile 941, and a password is set in the authentication token 942. The user of the communication terminal 600 is notified of this password when receiving the profile 941 and the authentication token 942 from the network administrator.

  The user takes the authentication token 942 and the profile 941 into the communication terminal 600 (S202), and inputs the notified password to the communication terminal 600 (S203), whereby the communication terminal 600 takes out the decryption key from the authentication token 942. The profile 941 can be decrypted with the extracted decryption key (S204), and the profile 941 can be used.

  The profile issuing device and communication terminal for realizing the profile issuing system according to the fourth embodiment of the present invention will be described below.

  FIG. 18 is a device configuration diagram of a profile issuing device according to the fourth embodiment of the present invention.

  As shown in FIG. 18, the profile issuing device 500 includes a profile part database 110, a profile part path database 120, a profile database 130, a profile operation unit 501, and a database management unit 150. In addition, the profile operation unit 501 includes a profile part path generation unit 140, a profile issue unit 160, a profile encryption unit 570, and an authentication token issue unit 580.

  Of the constituent elements constituting the profile issuing apparatus according to the fourth embodiment of the present invention, the same constituent elements as those constituting the profile issuing apparatus according to the first embodiment of the present invention are included. The same code | symbol is attached | subjected and each description is abbreviate | omitted.

  When the profile issuing unit 160 issues a profile, the profile encryption unit 570 encrypts the issued profile. The profile 941 encrypted by the profile encryption unit 570 is stored in a hardware token or the like by the network administrator.

  The authentication token issuing unit 580 issues an authentication token 942 including a decryption key and a password for decrypting the encrypted profile 941. The authentication token 942 issued by the authentication token issuing unit 580 is stored in a hardware token or the like by the network administrator.

  Note that the profile encryption unit 570 and the authentication token issuing unit 580 are realized using a program module processed by the CPU.

  FIG. 19 is a device configuration diagram of a communication terminal according to the fourth embodiment of the present invention. As shown in FIG. 19, the communication terminal 600 includes a profile storage unit 210, a profile editing unit 220, a history management unit 230, a profile update unit 240, a connection unit 250, and a profile decoding unit 660.

  Of the constituent elements constituting the communication terminal according to the fourth embodiment of the present invention, the same constituent elements as those constituting the communication terminal according to the first embodiment of the present invention are the same. Reference numerals are assigned and explanations thereof are omitted.

  For example, when a hardware token storing an encrypted profile 941 and an authentication token 942 is attached to the communication terminal 600, the profile decryption unit 660 displays information prompting the user to input a password on a display or the like. .

  When the user inputs the password, if the input password is correct, the profile decryption means 660 retrieves the decryption key from the authentication token 942 stored in the hardware token, and decrypts the profile 941 with the retrieved decryption key. The decrypted profile 941 is stored in the profile storage unit 210.

  The profile decrypting means 460 is realized by using a program module processed by the CPU.

  As described above, in the profile issuing system according to the fourth embodiment of the present invention, the profile issuing device 500 encrypts the profile, and the communication terminal 600 encrypts with the decryption key provided to the user who knows the password. Since the profile is used only by the user who knows the password by decrypting the converted profile, unauthorized network connection from a third party can be prevented.

(Fifth embodiment of the present invention)
FIG. 20 is a system configuration diagram of a profile issuing system according to the fifth embodiment of the present invention.

  The profile issuing system shown in FIG. 20 includes a profile issuing device 700 that issues a profile, and a communication terminal 800 that uses the profile issued by the profile issuing device 700.

  One communication terminal 800 may be used by a plurality of users. The edit history information 952 related to the edit history described in the first embodiment of the present invention is encrypted with a key distributed to each user in order to ensure confidentiality.

  More specifically, the distributed key is a pair such as a secret key and a public key, and a hardware token 951 storing a key A (secret key) and a key B (public key) is provided to each user. Distributed to. The editing history information 952 is encrypted with the key A after the editing history is updated, and the encrypted editing history information 952 is decrypted with the key B when the editing history is updated.

  Note that the key B is managed by the profile issuing device 700 and is not known to a third party except the user who owns the key B.

  Here, if the user loses the hardware token 951 (S301), the communication terminal 800 cannot decrypt the encrypted editing history information 952, so the editing history information 952 is sent to the profile issuing device by e-mail or the like. It is handed over to 700 (S302).

  The profile issuing device 700 decrypts the editing history information 952 with the key B (S303), and returns the decrypted editing history information 952 to the communication terminal 800 together with a new pair of keys that substitute for the lost pair of keys ( S304). If the profile corresponding to the editing history information 952 is also encrypted, the profile issuing device 700 passes this profile to the communication terminal 800 as well.

  The communication terminal 800 re-edits the profile according to the returned editing history information 952 and reflects the editing history information 952 in the profile.

  Hereinafter, a communication terminal and a profile issuing device for realizing a profile issuing system according to a fifth embodiment of the present invention will be described.

  FIG. 21 is an apparatus configuration diagram of a communication terminal according to the fifth embodiment of the present invention. As shown in FIG. 21, the communication terminal 800 includes a profile storage unit 210, a profile editing unit 220, a history management unit 230, a profile update unit 240, a connection unit 250, a profile decryption unit 660, an editing history information encryption unit 870, and an editing unit. A history information decoding unit 880 is provided.

  Of the components constituting the communication terminal according to the fifth embodiment of the present invention, the same components as those constituting the communication terminal according to the fourth embodiment of the present invention are the same. Reference numerals are assigned and explanations thereof are omitted.

  The editing history information encryption unit 870 updates the editing history information 952, and then encrypts the editing history information 952 with the key A stored in the hardware token 951. The key A is a secret key, for example.

  When the edit history information decrypting means 880 updates the edit history information 952, it decrypts the edit history information 952 encrypted with the key B paired with the key A. The key B is a public key, for example. The hardware token 951 that stores the key A and the key B is provided to the user, and the pair of keys stored in the hardware token 951 is different for each user.

  When the editing history information 952 decrypted by the profile issuing device 700 is input because the hardware token 951 is lost, the profile editing means 220 re-edits the profile corresponding to the editing history information 952. The editing history information 952 is reflected on the profile.

  The edit history information encryption unit 870 and the edit history information decryption unit 880 are realized by using a program module processed by the CPU.

  FIG. 22 is a device configuration diagram of a profile issuing device according to the fifth embodiment of the present invention.

  As shown in FIG. 22, the profile issuing device 700 includes a profile part database 110, a profile part path database 120, a profile database 130, a profile operation unit 501, a database management unit 150, and an editing history information decoding unit 790.

  Of the components constituting the communication terminal according to the fifth embodiment of the present invention, the same components as those constituting the communication terminal according to the fourth embodiment of the present invention are the same. Reference numerals are assigned and explanations thereof are omitted.

  For example, when the user loses the key and receives the editing history information 952 by e-mail or the like, the editing history information decrypting unit 790 encrypts the editing history information encrypted with the key B of the user holding the editing history information 952. 952 is decoded. The key B is, for example, a public key and is paired with the key A. The editing history information decoding unit 790 is realized using a program module processed by the CPU.

  As described above, in the profile issuing system according to the fifth embodiment of the present invention, since the communication terminal 800 decrypts and decrypts the editing history information 952 using the key owned by the user, the editing history information 952 can be prevented from being referred to by a third party. Further, when the key owned by the user is lost, the editing history information 952 is decrypted with the key of the profile issuing device 700, so that the editing history information 952 can be used again. 952 can be reflected in the profile.

  As described above, the profile issuing system according to the embodiment of the present invention has the effect of improving the convenience for the user when the information constituting the profile is updated, and the connection information for connecting to the network. This is useful as a system that issues a profile representing

1 is a system configuration diagram of a profile issuing system according to a first embodiment of the present invention. The apparatus block diagram of the profile issuing apparatus which concerns on the 1st Embodiment of this invention. The figure which shows an example of the structure regarding the connection information which the profile issuing apparatus which concerns on embodiment of this invention handles. The figure which shows an example of the structure of the network corresponding to each profile component. The flowchart which shows operation | movement of the profile issuing apparatus which concerns on the 1st Embodiment of this invention. The figure which shows an example of the profile components path | pass and profile which concern on embodiment of this invention. The apparatus block diagram of the communication terminal which concerns on the 1st Embodiment of this invention. The figure for demonstrating the operation | movement regarding the profile component path | pass of the communication terminal which concerns on the 1st Embodiment of this invention. The figure for demonstrating in detail the operation | movement regarding the profile components of the communication terminal which concerns on the 1st Embodiment of this invention. The figure for demonstrating in detail the operation | movement regarding the sub components of the communication terminal which concerns on the 1st Embodiment of this invention. The system block diagram of the profile issuing system which concerns on the 2nd Embodiment of this invention. The apparatus block diagram of the profile issuing apparatus which concerns on the 2nd Embodiment of this invention. The apparatus block diagram of the communication terminal which concerns on the 2nd Embodiment of this invention. The system block diagram of the profile issuing system which concerns on the 3rd Embodiment of this invention. The apparatus block diagram of the profile issuing apparatus which concerns on the 3rd Embodiment of this invention. The apparatus block diagram of the communication terminal which concerns on the 3rd Embodiment of this invention. The system block diagram of the profile issuing system which concerns on the 4th Embodiment of this invention. The apparatus block diagram of the profile issuing apparatus which concerns on the 4th Embodiment of this invention. The apparatus block diagram of the communication terminal which concerns on the 4th Embodiment of this invention. The system block diagram of the profile issuing system which concerns on the 5th Embodiment of this invention. The apparatus block diagram of the profile issuing apparatus which concerns on the 5th Embodiment of this invention. The apparatus block diagram of the communication terminal which concerns on the 5th Embodiment of this invention.

Explanation of symbols

5, 8 Profile parts path 6, 941 Profile 9, 11, 12, 21, 31, 41, 51, 61, 71, 81, 82, 91, 92 Communication device 10, 20, 30, 40, 50, 60, 70 , 80, 90, network 100, 300, 350, 500, 700 profile issuing device 101, 501 profile operation unit 110 profile part database 120 profile part path database 130 profile database 140 profile part path generation means 150 database management part (search means)
160 Profile issuing means 200, 400, 450, 600, 800 Communication terminal 210 Profile storage means 220 Profile editing means 230 History management means 240, 440, 460 Profile update means 250 Connection means 310 Profile provision means 360 Profile distribution means 410 Profile acquisition means 570 Profile encryption means 580 Authentication token issuing means 660 Profile decryption means 790, 880 Edit history information decryption means 870 Edit history information encryption means 911, 912, 913 Profile parts path 921, 922, 923 Information 931, 933, 934 Profile parts 932 Difference Information 942 Authentication token 951 Hardware token 952 Editing history information

Claims (11)

A profile issuing device that issues a profile that is a combination of profile part paths that are set in order to profile parts that are connection information for connecting to a network;
A communication terminal connected to a desired network using the profile issued by the profile issuing device,
The communication terminal is
Profile storage means for storing a profile issued by the profile issuing device ;
Profile editing means for editing information constituting the profile stored in the profile storage means;
History management means for managing the history of editing performed by the profile editing means,
The profile editing means, the issued from the profile issuing device, on the basis of the information forming the profile is updated, if the profile profile stored in the storage means is updated, it constitutes a profile which is the updated The profile issuing system is characterized in that information to be edited is re-edited based on the editing history. The updated profile issued from the profile issuing device includes a profile identifier corresponding to the profile identifier included in the profile before update ,
The profile editing means re-edits a profile including a profile identifier corresponding to a profile identifier included in an updated profile issued from the profile issuing device based on the editing history. The profile issuing system according to 1. A profile issuing device that issues a profile that is a combination of profile part paths that are set in order to profile parts that are connection information for connecting to a network;
A communication terminal connected to a desired network using the profile issued by the profile issuing device,
The communication terminal is
Profile editing means for editing information constituting the profile issued by the profile issuing device;
History management means for managing the history of editing performed by the profile editing means,
The profile editing means is a profile issuing system that re-edits updated information based on the editing history when the profile issuing device updates the information constituting the profile,
The profile part path includes a profile part path identifier for identifying the same profile part path,
The profile editing means re-edits the profile part path identified by the profile part path identifier of the updated profile part path based on the editing history when the profile issuing device updates the profile part path. features and to Help profile issue system. The profile part includes a profile part identifier for identifying the same profile part,
The profile editing means, when the profile issuing device updates the profile part, re-edits the profile part identified by the profile part identifier of the updated profile part based on the editing history. The profile issuing system according to claim 1. A profile issuing device that issues a profile that is a combination of profile part paths that are set in order to profile parts that are connection information for connecting to a network;
A communication terminal connected to a desired network using the profile issued by the profile issuing device,
The communication terminal is
Profile editing means for editing information constituting the profile issued by the profile issuing device;
History management means for managing the history of editing performed by the profile editing means,
The profile editing means is a profile issuing system that re-edits updated information based on the editing history when the profile issuing device updates the information constituting the profile,
There is a sub-part constituting the profile part, and the sub-part includes a sub-part identifier for identifying the same sub-part,
The profile editing means, when the profile issuing device updates the sub-part, re-edits the sub-part identified by the sub-part identifier of the updated sub-part based on the editing history. Help profile issue system. The profile issuing device
Profile providing means for providing the updated profile to the communication terminal;
The communication terminal is
Profile acquisition means for acquiring a profile updated based on the profile identifier from the profile issuing device;
The profile issuing system according to claim 1, wherein when the profile is updated, the communication terminal acquires and applies the updated profile from the profile issuing device. The profile issuing device
Profile distribution means for distributing the updated profile to the communication terminal;
The communication terminal is
3. The profile issuing system according to claim 2, wherein the profile being used is changed based on a profile identifier of the profile distributed from the profile issuing device, and the distributed profile is applied. The profile issuing device
Profile encryption means for encrypting the profile;
The communication terminal is
6. The apparatus according to claim 1, further comprising profile decrypting means for decrypting the profile encrypted by the encrypting means using a decryption key provided to a user who knows the password. Profile issuing system described in The communication terminal is
An encryption means for encrypting information relating to the editing history, using a key owned by a user using the communication terminal;
The decryption means for decrypting the information related to the editing history encrypted by the encryption means by using a pair key paired with the key. A profile issuing system according to any one of the above.   The profile issuing system according to claim 9, wherein the profile issuing device includes a decrypting unit that decrypts information related to the editing history encrypted by the encrypting unit using the key pair. . A communication terminal that connects to a desired network using a profile issued by a profile issuing device that issues a profile that is a combination of profile component paths that are set in order to profile components that are connection information for connecting to a network. There,
Profile storage means for storing a profile issued by the profile issuing device;
Profile editing means for editing information constituting the profile stored in the profile storage means;
History management means for managing the history of editing performed by the profile editing means,
The profile editing means configures the updated profile if the profile stored in the profile storage means is updated based on the information constituting the updated profile issued from the profile issuing device. A communication terminal, wherein information to be edited is re-edited based on the editing history .

Images