JP2008228089A - Device, method, and program for selecting communication connection system - Google Patents

Abstract

<P>PROBLEM TO BE SOLVED: To reduce a time until the completion of connection required as a result of trying to execute invalid authentication while facilitating management of profile information in the operation form of a network in which a profile and a digital certificate are distributed separately from each other. <P>SOLUTION: In a communication terminal 100, if there is a digital certificate matched with information of an issuance origin and an issuance destination of a digital certificate described in profile information when connecting to a network, it is configured to select a communication connection system that executes authentication by the digital certificate. If there is no digital certificate, it is configured to select a communication connection system that does not execute authentication by the digital certificate. By this, it is possible to reduce a time required until the completion of connection since a user, who does not need the authentication, is not required to execute a connection trial by using an invalid digital certificate unlike the conventional one. It is possible for a manager to issue a valid digital certificate only to each user who needs it and to distribute a profile with the same configuration to all the users. <P>COPYRIGHT: (C)2008,JPO&INPIT

Description

  The present invention relates to a communication connection technique for connecting to a network based on profile information in a network connection service such as a public wireless LAN service.

Conventionally, there has been a system that distributes a profile including a digital certificate as connection setting information used by a user and performs network connection control (see, for example, Patent Document 1). The profile included authentication methods and digital certificates as information for authentication.
JP 2006-324980 A

  However, in the conventional method, since a digital certificate is attached to a profile, when a profile is issued according to a connection method used by a user, a user who uses a digital certificate for connection authentication and a user who does not use a connection certificate, There is a problem that it is necessary to distribute profiles having different connection methods, which is complicated to manage.

  When issuing a profile that includes the same connection method for all users, attach a digital certificate that cannot be used for users who do not use a digital certificate for connection authentication, or on the network side. However, the user's connection control cannot distinguish it from valid profile information that succeeds in authentication, and the connection is attempted and authentication fails. Also, the administrator who issues the digital certificate and the administrator who issues the profile cannot issue / distribute independently, and it is necessary to attach the issued digital certificate to the profile and distribute it. There was a problem.

  In view of the above problems, the present invention reduces the time until connection is completed by trying invalid authentication while facilitating management of profile information in a network operation mode in which a profile and a digital certificate are distributed separately. The problem is to reduce.

  A communication connection method selection device according to a first aspect of the present invention is a communication connection method selection device in a communication terminal connected to a network using profile information in which setting information of a plurality of communication connection methods is described. The first storage means for storing the digital certificate used for the communication, and the issuer and issuer of the digital certificate to be used for the setting information of the communication connection method for performing authentication using the digital certificate among a plurality of communication connection methods Second storage means for storing profile information in which at least one of the information is described; and a digital certificate matching the digital certificate information described in the profile information when connected to the network Select the communication connection method that performs authentication using the digital certificate if there is a matching digital certificate and the acceptance means that accepts the presence or absence, Characterized in that it comprises selecting means for selecting a communication connection method that does not perform authentication with digital certificates, the if barrel certificate no.

  In the present invention, when there is a digital certificate that matches the issuer and issuer information of the digital certificate described in the profile information when connecting to the network, the communication that performs authentication using the digital certificate When a connection method is selected and there is no digital certificate, a communication connection method that does not perform the authentication is selected. As a result, a user who does not need the above authentication does not need to attempt a connection using an invalid digital certificate as in the conventional case, and therefore, the time until the connection is completed can be shortened. In addition, the administrator can issue a digital certificate that is valid only to users who need it, and can distribute a profile having the same configuration to all users.

  A communication connection method selection method according to a second aspect of the present invention is a communication connection method selection method in a communication terminal connected to a network using profile information in which setting information of a plurality of communication connection methods is described. Storing a digital certificate to be used in the first storage means, and issuing a digital certificate to be used for setting information of a communication connection method for performing authentication using a digital certificate among the plurality of communication connection methods Storing the profile information in which at least one of the original information and the issue destination information is stored in the second storage means, and the digital certificate described in the profile information when connecting to the network by the accepting means Accepting the presence or absence of a digital certificate that matches the information in the certificate, and if the matching digital certificate exists by the selection means Selects the communication connection method of performing authentication by digital certificates, if the digital certificate is not characterized by having a step of selecting a communication connection method that does not perform authentication with a digital certificate, to.

  A communication connection method selection program according to a third aspect of the present invention is a communication connection method selection program to be executed by a communication terminal connected to a network using profile information in which setting information of a plurality of communication connection methods is described. Storing a digital certificate used for authentication in the first storage means, and a digital certificate used for setting information of a communication connection method for performing authentication using a digital certificate among the plurality of communication connection methods Storing the profile information in which at least one of the issuer and issuer information is stored in the second storage means, and the digital certificate information described in the profile information when connecting to the network A step of accepting the presence or absence of a matching digital certificate and, if there is a matching digital certificate, the authentication by the digital certificate. Select a communication connection method of performing, if there is no its digital certificate, characterized in that to execute the steps of selecting a communication connection method that does not perform authentication with a digital certificate, to the communication terminal.

  According to the present invention, it is possible to reduce the time to complete connection by trying invalid authentication while facilitating management of profile information in a network operation mode in which profiles and digital certificates are distributed separately. it can.

  Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

  FIG. 1 shows a configuration of a communication network system 1 according to an embodiment. The communication network system 1 includes a communication terminal 100, an access point 200, a network 300, an authentication server 400, a certificate authority (CA) 500, and a profile creation device 600 managed by a network administrator. It has a configuration.

  The communication terminal 100 connects to the network while sequentially selecting a plurality of communication connection methods described in the profile. The profile is issued by the profile creation apparatus 600 and describes profile information that identifies a plurality of connection methods that can be used in the network 300. In this embodiment, a profile is defined as the actual state of a file in which profile information is described, and profile information is defined as data described in the profile.

  The access point 200 is a transfer device that accommodates the communication terminal 100 in a wireless local area network (LAN) and connects it to the network 300. Here, the same wireless LAN parameters as the communication terminal 100 (for example, ESSID (Extended Service Set Identification), WEP (Wired Equivalent Privacy) key, etc.) are set. In connection authentication using a digital certificate, authentication information between the communication terminal 100 and the authentication server 400 is based on an authentication protocol (for example, IEEE802.1x EAP-TLS (Extensive Authentication Protocol-Transport Layer Security)). Is transferred and connection control is performed.

  The certificate authority 500 is managed by a certificate authority administrator and issues a digital certificate for authenticating individual users. The digital certificate is information for authenticating the individual user who uses the communication terminal, and is used as authentication information when performing network connection. Here, for example, a digital certificate of PKCS (Public Key Cryptography Standard) # 12 format is used. The digital certificate describes information such as a character string that identifies the certificate authority 500 that issued the digital certificate and a character string that identifies the user that issued the digital certificate. The issued digital certificate is distributed in a secure state.

  The profile creation apparatus 600 issues a profile that is managed by a network administrator and that describes a plurality of connection methods that can be used in the network 300. In the profile, profile information for specifying a plurality of connection methods usable in the network 300 is described. Information such as ESSID and WEP key, which are wireless LAN parameters, is described as a connection method. Information for specifying a digital certificate is described for a connection method for performing connection authentication using a digital certificate such as IEEE 802.1x EAP-TLS. The issued profile is distributed by the network administrator. You may download to a communication terminal via a network from a profile creation apparatus, or you may distribute in the state recorded on the recording medium.

  The authentication server 400 determines connection authentication when the communication terminal 100 connects to the network 300.

  FIG. 2 shows a network configuration in the communication network system 1. As shown in the figure, in this network 300, a network administrator provides a connection service with IEEE802.1xEAP-TLS authentication and a connection service without authentication. Connected to the network 300 are an access point 200a corresponding to a connection service that is not authenticated and a 200b corresponding to a connection service with authentication. Here, both the access point 200a and the access point 200b are set with “Svc-a” as the ESSID. In the access point 200a, a character string “Key-a” serving as an encryption key is set as WEP. The access point 200b communicates with the authentication server 400, transfers user authentication information from the user, and performs connection control.

  The block diagram of FIG. 3 shows a schematic configuration of the communication terminal 100. As shown in the figure, the communication terminal 100 includes a digital certificate storage unit 101, a profile information storage unit 102, a connection method selection control unit 103, a certificate search control unit 104, a certificate selection unit 105, A certificate use history recording unit 106 and a communication interface unit 110 are provided. The communication terminal 100 is a PC (Personal Computer) having hardware such as a CPU (Central Processing Unit), a memory, a communication interface, a display device, and an input device for inputting key operations. Processing by the connection method selection control unit 103 and the certificate search control unit 104 is realized by a module of a program executed by the CPU. The digital certificate storage unit 101, the profile information storage unit 102, and the certificate use history recording unit 106 are realized by a memory. Note that the connection method selection processing for selecting the communication connection method of the present invention is realized by each part surrounded by a broken line in FIG.

  The digital certificate storage unit 101 stores digital certificate information as a first storage unit. The profile information storage unit 102 stores, as second storage means, profile information that is distributed separately from the digital certificate and in which information on the issuer and issuer of the digital certificate is described.

  The connection method selection control unit 103 reads profile information from the profile information storage unit 102 and transmits information such as a digital certificate search processing request and search conditions in the digital certificate storage unit 101 to the certificate search control unit 104. In this case, the receiving unit functions as a search result to receive the presence / absence of a digital certificate that matches the issuer and issuer information of the digital certificate described in the profile information. If there is, a communication connection method that performs authentication using a digital certificate is selected. If there is no digital certificate, a communication connection method that does not perform authentication using a digital certificate is selected. Furthermore, communication connection control based on the selected communication connection method is performed for the communication interface unit 110.

  The certificate search control unit 104 executes a search for a digital certificate in the digital certificate storage unit 101. In addition, exchange of information regarding the digital certificate to the certificate selection unit 105 is performed, and history information of the digital certificate is stored and referred to the certificate use history recording unit 106. In addition, the digital certificate to be used is selected based on the search result.

  The certificate selection unit 105 notifies the user of information related to a plurality of digital certificates notified from the certificate search control unit 104, accepts designation of one digital certificate from the information, and proves the designation information. To the document search control unit 104. Here, it is realized by a display device that displays information on a plurality of digital certificates on a screen and an input device that accepts designation by a user.

  The certificate use history recording unit 106 stores, as the third storage unit, information described in the digital certificate selected by the certificate search control unit 104 as history information.

  The communication interface unit 110 executes communication connection processing according to the communication connection method selected by the connection method selection control unit 103.

  Next, the configuration of the profile will be described with reference to the drawings. 4 to 5 show examples of profile information stored in the profile information storage unit 102 of the communication terminal 100. FIG. As shown in the figure, the profile is issued to all users who use the network 300 as the same default configuration. Each value can be changed according to the user. Also, the user himself can add / change / delete part of the profile information.

  In the profile, setting information for a plurality of communication connection methods is described. Here, the communication connection method includes management parameters (connection name, priority order, connection form) and connection parameters (ESDID, WEP, Issuer, Subject) for each connection method. Here, two types of connection methods, “connection name: connection A” and “connection name: connection B” are described.

  The “priority” indicates the order of connection attempts using each connection method, and is used in order from the connection method corresponding to the smaller number. “Connection form” indicates whether or not IEEE 802.1x EAP-TLS authentication is performed. “ESSID” represents an identifier of a wireless LAN access point connected by the connection method. “WEP” represents a character string serving as a key for encryption of the access point.

  Here, “Issuer” and “Subject” are the same information as the information described in the digital certificate used by the user in the IEEE 802.1x EAP-TLS authentication. “Issuer” represents a character string that identifies the certificate authority that issued the digital certificate. “Subject” represents a character string that identifies the user to whom the digital certificate is issued.

  Next, the configuration of the digital certificate will be described with reference to the drawings.

  6 to 8 show examples of digital certificates stored in the digital certificate storage unit 101 of the communication terminal 100. FIG. As shown in the figure, the digital certificate includes, for example, X.1, which is one of general public key certificate standards. 509 format digital certificates are used. The following information is described in the digital certificate. The serial number is a number assigned so as not to be duplicated in a digital certificate issued by one certificate authority. “Issuer” is a character string that represents the certificate authority that issued the digital certificate. “Subject” is a character string representing a user name to which a digital certificate is issued.

  In this way, the administrator issues a digital certificate that is valid only for users who use the digital certificate, and distributes profile information having the same configuration to users who do not use the digital certificate. Thereby, profile information having the same configuration can be distributed to all users.

  Next, the operation of the communication terminal 100 connecting to the network using the profile information will be specifically described with reference to FIGS. The flowchart in FIG. 9 mainly shows a flow of communication connection method selection processing by the connection method selection control unit 103.

  Step 1: First, in the first step, the current profile order is set to the initial state 0 (S1).

  Step 2: In the next step, profile information is read from the profile information storage unit 102, and the “priority” of the connection method described in the profile information is referred to. A connection method corresponding to the next highest priority order of the current profile order is selected (S2).

Step 3: In the next step, referring to the “connection form” of the selected connection method, in the case of “connection form: no authentication”, the wireless LAN (IEEE 802.11) connection process is executed, and “connection form” : If authentication is present, a request for search processing is transmitted to the certificate search control unit 104 to execute the certificate search processing (S3).
Step 4: In the next step, the certificate search control unit 104 searches for the digital certificate stored in the digital certificate storage unit 101. As a result of the certificate search process, the connection method selection control unit 103 receives information regarding the presence / absence of a digital certificate that matches the search condition from the certificate search control unit 104. Details of the certificate search processing by the certificate search control unit 104 will be described later (S4).

  Step 5: In the next step, when information indicating that the corresponding digital certificate exists is received, a communication connection method for performing authentication using the digital certificate is selected. Here, wireless LAN connection (IEEE 802.11, IEEE 802.1x) processing is performed. In the EAP-TLS authentication of the IEEE 802.1x connection process, the digital certificate retrieved in step 4 is used. If information indicating that the corresponding digital certificate does not exist is received, the process returns to step 2 to select a communication connection method that does not perform authentication using the digital certificate.

  Step 6: If the connection is normally completed as a result of the connection process of each wireless LAN, the connection is continued. On the other hand, if the connection is not normally completed, the certificate value stored in step 48 described later as the history information of the corresponding digital certificate is deleted, and the process returns to step 2.

  Next, digital certificate search processing by the certificate search control unit 104 in step 4 will be described with reference to the flowchart of FIG.

  Step 40: In the first step, prior to the search, it is determined whether there is a certificate value stored as history information of the corresponding digital certificate in the certificate use history recording unit 106 (S40).

  Step 41: If a certificate value exists in Step 40, the presence or absence of a digital certificate that matches the certificate value is confirmed. If the digital certificate exists, the search result is set as (1) A digital certificate is selected (S41).

  Step 42: If there is no certificate value in step 40, or if there is no digital certificate that matches the certificate value in step 41, the following processing is performed (S42).

  Refer to the profile information and search for a digital certificate that meets the following search conditions i) and ii). i) The character string described in “Issuer” of the profile information matches the character string described in “Issuer” of the digital certificate. ii) The entire character string described in “Subject” of the profile information matches the character string described in “Subject” of the digital certificate.

  Step 43: The number of digital certificates that match as a result of the search is determined. If the number of matched digital certificates is 0, the search result is (0). If the number of matched digital certificates is 1, the search result is (1) and the digital certificate is selected (S43).

  Steps 44 and 45: If the number of digital certificates matched in step 43 is two or more, the user is notified of information regarding a plurality of digital certificates, and the user is requested to select. A digital certificate designation from the user is accepted (S44, S45).

  Step 46 and Step 47: When a designated response from the user is received and the designated digital certificate exists, the digital certificate is selected with the search result as (1). If a predetermined time has passed without accepting a designated response from the user, and if the designated digital certificate does not exist, the search result is set to (0) (S46, S47).

  Step 48: If the search result is 0 as a result of step 43 to step 47, the certificate value is deleted, and if the search result is 1, the certificate value is saved (S48).

[First operation example]
Next, as a first operation example, referring to the flowchart of FIG. 9 for the operation in the case of connecting to a network from a communication terminal in which a digital certificate is not stored using the profile 1 shown in FIG. While explaining.

  Step 1: In the first step, the current profile order is set to the initial state 0 “Pri0”.

  Step 2: In the next step, the profile information is read from the profile information storage unit 102, the "priority order" described in the profile information is referred to, and the "priority order: Pri1" next to the current profile order is set. Select the appropriate connection method “Connection A”.

Step 3: In the next step, since the connection method “connection A” is “connection type: authenticated”, a request for search processing is transmitted to the certificate search control unit 104 in order to execute certificate search processing.
Step 4: In the next step, the certificate search control unit 104 searches for the digital certificate stored in the digital certificate storage unit 101. Here, since the digital certificate is not stored, information indicating that there is no digital certificate that matches the conditions is accepted as a result of the certificate search process.

  Step 5: In the next step, information that the corresponding digital certificate does not exist is accepted, and the process returns to Step 2 without performing the connection process.

  In step 2 ′, the next highest “priority: Pri2” connection method “connection B” is selected. In the next step 3 ′, since the connection method “connection B” is “connection type: no authentication”, wireless LAN connection processing is performed.

  Step 6: At this time, if there is an access point that matches the parameters “ESSID: Svc-a” and “WEP key: Key-a” of the wireless LAN, the connection process is completed and the connection is continued. Such processing eliminates the need for a user who does not use a digital certificate to make a connection attempt using an invalid digital certificate as in the prior art, so the time until connection is completed can be reduced.

[Second operation example]
Next, as a second operation example, the profile 1 shown in FIG. 4 is used to connect to a network from a communication terminal in which the digital certificates 1 and 2 shown in FIGS. The operation will be described with reference to the flowcharts of FIGS.

  Step 1: First, in the first step, the current profile order is set to the initial state 0 “Pri0”.

  Step 2: In the next step, the profile information is read from the profile information storage unit 102, the "priority order" described in the profile information is referred to, and the "priority order: Pri1" next to the current profile order is set. Select the appropriate connection method “Connection A”.

Step 3: In the next step, since the connection method “connection A” is “connection type: authenticated”, a request for search processing is transmitted to the certificate search control unit 104 in order to execute certificate search processing.
Step 4: In the next step, the certificate search control unit 104 searches for the digital certificate stored in the digital certificate storage unit 101.

  Step 40: Here, it is assumed that the history information of the digital certificate is not stored in the certificate use history recording unit 106, and the process proceeds to Step 42.

  Step 42: In the step of searching for a digital certificate that matches the profile information by the certificate search control unit 104, the profile information is referenced to search for a certificate that matches the following search conditions i) and ii). i) “Issuer: Auth0” of profile 1 and “Issuser: Auth0” of digital certificate 1 match. Here, “Issuer: Auth1” of the digital certificate 2 does not match the condition. ii) The entire character string of “Subject: Pref0-User0” of profile 1 is forward-matched with “Subject: Pref0-User1” of digital certificate 1.

  Step 43: As a result of the search, the number of matched digital certificates is 1, so that the search result is (1), and the digital certificate 1 that matches the search conditions i) and ii) is selected.

  Step 48: The certificate value “Issuer: Auth0, serial number: 12345678” of the digital certificate 1 is stored in the certificate use history recording unit 106 as history information.

  Step 5: In the next step, information indicating that the corresponding digital certificate exists is received, and a communication connection method for performing authentication using the digital certificate 1 is selected. Here, after performing wireless LAN connection (IEEE802.11, IEEE802.1x) processing and establishing a wireless LAN link with an access point whose ESSID is Svc-a, in step 4 in EAP-TLS authentication of the IEEE802.1x connection processing. Authentication is performed using the selected digital certificate 1. The authentication information is authenticated by the authentication server, and the access point performs connection processing. as a result. The connection process to the network at the communication terminal ends. In this way, the user who uses the digital certificate does not need to select the digital certificate and try to connect, so the time until the connection is completed can be shortened.

[Third operation example]
Next, as a third operation example, the profile 2 shown in FIG. 5 is used to transfer the digital certificate 1, 2, 3 shown in FIGS. 6, 7, and 8 from the communication terminal to the network. The operation for connection will be described with reference to the flowcharts of FIGS.

  Step 1: First, in the first step, the current profile order is set to the initial state 0 “Pri0”.

  Step 2: In the next step, the profile information is read from the profile information storage unit 102, the "priority order" described in the profile information is referred to, and the "priority order: Pri1" next to the current profile order is set. Select the appropriate connection method “Connection A”.

Step 3: In the next step, since the connection method “connection A” is “connection type: authenticated”, a request for search processing is transmitted to the certificate search control unit 104 in order to execute certificate search processing.
Step 4: In the next step, the certificate search control unit 104 searches for the digital certificate stored in the digital certificate storage unit 101.

  Step 40: Here, it is assumed that the history information of the digital certificate is not stored in the certificate use history recording unit 106, and the process proceeds to Step 42.

  Step 42: In the step of searching for a digital certificate that matches the profile information by the certificate search control unit 104, the profile information is referenced to search for a certificate that matches the following search conditions i) and ii). i) “Issuer: Auth0” of profile 2 matches “Issuer: Auth0” of digital certificate 1 and digital certificate 3. Here, “Issuer: Auth1” of the digital certificate 2 does not match the condition. ii) The entire character string of “Subject: Pref0-User0” of profile 2 is forward-matched with “Subject: Pref0-User1” of digital certificate 1 and “Subject: Pref0-User2” of digital certificate 3.

  Step 43: Since the digital certificate 1 and the digital certificate 3 match as a result of the search, the search result is (2).

  Steps 44 and 45: Since the number of digital certificates matched in step 43 is 2, the user is notified of information related to the digital certificate 1 and the digital certificate 3, and the user is requested to select. Accepts a digital certificate specification from the user. Here, it is assumed that the designation of the digital certificate 3 is received from the user within a certain time.

  Step 46 and Step 47: Since the designated digital certificate 3 exists, the digital certificate 3 is selected with the search result as (1).

  Step 48: Since the search result is (1), the certificate value (Issuer: Auth0, serial number: 345678) of the digital certificate 3 is stored in the certificate use history recording unit 106 as history information. As described above, even when a plurality of digital certificates that match the conditions specified by the profile information are searched, only the certificate that has been successfully authenticated stores the history information. This eliminates the need for repeated user selection operations, and reduces authentication failures due to incorrect digital certificate selection.

  Step 5: In the next step, a communication connection method for performing authentication using the digital certificate 3 is selected. Here, after performing wireless LAN connection (IEEE802.11, IEEE802.1x) processing and establishing a wireless LAN link with an access point whose ESSID is Svc-a, in step 4 in EAP-TLS authentication of the IEEE802.1x connection processing. Authentication is performed using the selected digital certificate 3. The authentication information is authenticated by the authentication server, and the access point performs connection processing. as a result. The connection process to the network at the communication terminal ends.

  As described above, according to the present embodiment, when the communication terminal 100 is connected to the network, the communication terminal 100 matches the digital certificate issuer and issuer information described in the profile information. When there is a digital certificate, a communication connection method for performing authentication using the digital certificate is selected. When there is no digital certificate, a communication connection method for not performing the authentication is selected. As a result, a user who does not need the above authentication does not need to attempt a connection using an invalid digital certificate as in the conventional case, and therefore, the time until the connection is completed can be shortened. In addition, the certificate authority administrator issues a digital certificate that is valid only to the users who need it, and the network administrator can distribute the profile with the same configuration to all users.

  Therefore, in a network operation mode in which profile information and digital certificates are distributed separately, it is possible to reduce the time until connection is completed by trying invalid authentication while facilitating management of profile information.

  In the present embodiment, the communication terminal 100 is a PC including hardware such as a CPU, a memory, a communication interface, a display device, an input device for inputting key operations, etc., but information including the above-described units. If it is an apparatus, it will not be restricted to this.

  In the embodiment, the communication connection method selection processing by the connection method selection control unit 103 is realized by a program executed by the CPU. However, it is realized by dedicated hardware for executing the above processing. Also good.

1 is a system configuration diagram of a communication network according to an embodiment. It is a network block diagram in the said communication system. It is a block diagram which shows schematic structure of the communication terminal connected to a network in the said communication system. It is a chart figure which shows the 1st example of the profile information memorize | stored in the profile information storage part of the said communication terminal. It is a chart figure which shows the 2nd example of the profile information memorize | stored in the profile information storage part of the said communication terminal. It is a chart figure which shows the 1st example of the digital certificate memorize | stored in the digital certificate memory | storage part of the said communication terminal. It is a chart figure which shows the 2nd example of the digital certificate memorize | stored in the digital certificate memory | storage part of the said communication terminal. It is a chart figure which shows the 3rd example of the digital certificate memorize | stored in the digital certificate memory | storage part of the said communication terminal. It is a flowchart which shows the selection process of the communication connection system in the said communication terminal. It is a flowchart which shows the search process of the digital certificate in the said communication terminal.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Communication network system 100 ... Communication terminal 101 ... Digital certificate memory | storage part 102 ... Profile information memory | storage part 103 ... Connection method selection control part 104 ... Certificate search control part 105 ... Certificate selection part 106 ... Certificate utilization log | history recording part 110: Communication interface unit 200 ... Access point 200a ... Access point (no authentication)
200b ... Access point (with authentication)
300 ... Network 400 ... Authentication server 500 ... Certificate Authority (CA)
600 ... Profile creation device

Claims (3)

A communication connection method selection device in a communication terminal connected to a network using profile information in which setting information of a plurality of communication connection methods is described,
First storage means for storing a digital certificate used for authentication;
Among the plurality of communication connection methods, setting information of a communication connection method that performs authentication using a digital certificate stores profile information in which at least one of the issuer and issuer information of the digital certificate to be used is described. A second storage means;
Accepting means for accepting the presence or absence of a digital certificate that matches the information of the digital certificate described in the profile information when connecting to the network;
Selection means for selecting a communication connection method for performing authentication using a digital certificate if there is a matching digital certificate, and selecting a communication connection method for not performing authentication using a digital certificate if there is no digital certificate. When,
A communication connection system selection device comprising: A communication connection method selection method in a communication terminal connected to a network using profile information in which setting information of a plurality of communication connection methods is described,
Storing a digital certificate used for authentication in the first storage means;
Among the plurality of communication connection methods, the communication connection method setting information for authentication using a digital certificate includes profile information in which at least one of the issuer and issuer information of the digital certificate to be used is described in the second storage. A step of memorizing the means;
A step of receiving presence / absence of a digital certificate that matches information of the digital certificate described in the profile information when connecting to the network by a receiving unit;
When there is a matching digital certificate, the selection unit selects a communication connection method for performing authentication using a digital certificate. When there is no digital certificate, a communication connection method for not performing authentication using a digital certificate is selected. A step to choose;
A method for selecting a communication connection method, characterized by comprising: A communication connection method selection program to be executed by a communication terminal connected to a network using profile information in which setting information of a plurality of communication connection methods is described,
Storing a digital certificate used for authentication in the first storage means;
Among the plurality of communication connection methods, the communication connection method setting information for authentication using a digital certificate includes profile information in which at least one of the issuer and issuer information of the digital certificate to be used is described in the second storage. A step of memorizing the means;
Accepting the presence or absence of a digital certificate matching the digital certificate information described in the profile information when connecting to the network;
Selecting a communication connection method for performing authentication with a digital certificate if there is a matching digital certificate, and selecting a communication connection method for not performing authentication with a digital certificate if there is no such digital certificate; ,
A communication connection method selection program characterized by causing a communication terminal to execute.

Images