JP4584276B2 - Digital certificate search apparatus, method and program - Google Patents

Description

  The present invention relates to a technique using a digital certificate used for user authentication in a network connection service such as a public wireless LAN service or an online banking service of a financial institution.

Conventionally, there has been a system that distributes a profile including a digital certificate as setting information when connecting to a network and performs network connection control (see, for example, Patent Document 1). The profile included authentication methods and digital certificates as information for authentication.
JP 2006-324980 A

  However, the conventional method of attaching a digital certificate to a profile uses a special software to search for the digital certificate in the profile and use the extracted digital certificate. Even if it is a certificate, it cannot be used with other software. As described above, since the application range is restricted, there is a problem that it cannot be applied to an operation mode in which a digital certificate is distributed separately from a profile.

  Also, when distributing a digital certificate file and saving it on a PC, it is necessary for the user to select an appropriate digital certificate at the time of authentication. Therefore, a digital certificate that does not match the service provider is selected by mistake. There was a problem of causing failure.

  In view of the above problems, an object of the present invention is to reduce the number of authentication failures while enabling general-purpose use of a digital certificate when connecting to a network using profile information.

  A digital certificate search program according to a first aspect of the present invention is a digital certificate search program executed by a digital certificate search device for searching for a digital certificate used for authentication, wherein the digital certificate is stored in a first storage means. Storing in the second storage means profile information describing at least one of the issuer and issuer information of the digital certificate, and the digital certificate described in the profile information A digital certificate matching the information of the certificate is searched from the first storage means, and a step of selecting a digital certificate to be used is executed by the digital certificate search apparatus.

  In the present invention, at least one of the issuer and issuer of the digital certificate is described in the profile information, and the digital certificate that matches the information is searched and the digital certificate to be used is selected. As a result, the user does not need to select a digital certificate at the time of authentication. Further, since the profile information and the digital certificate are stored separately, the digital certificate can be used universally from a plurality of control software.

  Furthermore, if the network administrator knows at least one of the issuer and issuer information of the digital certificate, the network administrator can issue the profile independently of the digital certificate issued by the certificate authority administrator. Even in an operation mode in which a profile and a digital certificate are distributed separately, connection control based on profile information is possible.

  In the digital certificate search program, when there are a plurality of matching digital certificates, a step of notifying a user of information on the plurality of digital certificates, and a step of notifying information on the notified plurality of digital certificates The digital certificate search apparatus is configured to execute a step of accepting designation of one digital certificate from among them and a step of selecting a designated digital certificate as a digital certificate to be used.

  In the present invention, even when there are a plurality of digital certificates that match the information described in the profile information as a result of the search, the information about the plurality of digital certificates is notified to the user. The digital certificate specified by the user can be selected as a digital certificate to be used.

  In the digital certificate search program, when the information described in the selected digital certificate is stored in the third storage means as history information, and when the history information is stored in the third storage means Is configured to cause the digital certificate search apparatus to execute a step of selecting a digital certificate based on the history information.

  In the present invention, information described in the selected digital certificate is stored as history information. When history information is stored, the digital certificate is selected based on the history information. . Further, when authentication fails, the history information is deleted. As a result, only the digital certificate that has been successfully authenticated is stored as history information, and the user does not need to repeatedly select the digital certificate during user authentication. Therefore, authentication by selecting the wrong digital certificate is possible. Failure can be reduced.

  A digital certificate search method according to a second aspect of the present invention is a digital certificate search method for searching for a digital certificate used for authentication, and storing the digital certificate in a first storage means; Storing the profile information in which at least one of the issuer and issuer information of the digital certificate is stored in the second storage unit, and the digital certificate information described in the profile information by the search control unit And a step of searching the first storage means for a digital certificate matching the above and selecting a digital certificate to be used.

  In the digital certificate search method, when there are a plurality of matching digital certificates, a step of notifying the user of information about the plurality of digital certificates, and a step of notifying information about the notified plurality of digital certificates The method has a step of accepting designation of one digital certificate from among them, and a step of selecting the designated digital certificate as a digital certificate to be used.

  The digital certificate search method includes a step of storing information described in the selected digital certificate as history information in a third storage unit, and a case where history information is stored in the third storage unit And a step of selecting a digital certificate based on the history information.

  A digital certificate search apparatus according to a third aspect of the present invention is a digital certificate search apparatus for selecting a digital certificate to be used for authentication, comprising a first storage means for storing a digital certificate, and a digital certificate Second storage means for storing profile information in which at least one of the issuer and issuer information of the certificate is described; and a digital certificate that matches the digital certificate information described in the profile information. Selection control means for searching from one storage means and selecting a digital certificate to be used.

  When there are a plurality of matching digital certificates, the selection control means in the digital certificate search apparatus notifies the user of information related to the plurality of digital certificates, and the plurality of digital certificates notified. One of the digital certificates is accepted, and the designated digital certificate is selected as a digital certificate to be used.

  The digital certificate search apparatus includes third storage means for storing information described in the digital certificate selected by the selection control means as history information, and the selection control means includes third storage means. In the case where the history information is stored, the digital certificate is selected based on the history information.

  According to the present invention, it is possible to reduce authentication failures while enabling general-purpose use of digital certificates when connecting to a network using profile information.

  Hereinafter, an embodiment of the present invention will be described with reference to the drawings.

  FIG. 1 shows a configuration of a communication network system 1 according to an embodiment. The communication network system 1 includes a communication terminal 100, an access point 200, a network 300, an authentication server 400, a certificate authority (CA) 500, and a profile creation device 600 managed by a network administrator. It has a configuration.

  The communication terminal 100 connects to the network while sequentially selecting a plurality of communication connection methods described in the profile. The profile is issued by the profile creation apparatus 600 and describes profile information that identifies a plurality of connection methods that can be used in the network 300. In this embodiment, a profile is defined as the actual state of a file in which profile information is described, and profile information is defined as data described in the profile.

  The access point 200 is a transfer device that accommodates the communication terminal 100 in a wireless local area network (LAN) and connects it to the network 300. Here, the same wireless LAN parameters as the communication terminal 100 (for example, ESSID (Extended Service Set Identification), WEP (Wired Equivalent Privacy) key, etc.) are set. In connection authentication using a digital certificate, authentication information between the communication terminal 100 and the authentication server 400 is based on an authentication protocol (for example, IEEE802.1x EAP-TLS (Extensive Authentication Protocol-Transport Layer Security)). Is transferred and connection control is performed.

  The certificate authority 500 is managed by a certificate authority administrator and issues a digital certificate for authenticating individual users. The digital certificate is information for authenticating the individual user who uses the communication terminal, and is used as authentication information when performing network connection. Here, for example, a digital certificate of PKCS (Public Key Cryptography Standard) # 12 format is used. The digital certificate describes information such as a character string that identifies the certificate authority 500 that issued the digital certificate and a character string that identifies the user that issued the digital certificate. The issued digital certificate is distributed in a secure state.

  The profile creation device 600 is managed by a network administrator and issues a profile. In the profile, profile information for specifying a plurality of connection methods usable in the network 300 is described. Information such as ESSID and WEP key, which are wireless LAN parameters, is described as a connection method. Information for specifying a digital certificate is described for a connection method for performing connection authentication using a digital certificate such as IEEE 802.1x EAP-TLS. The issued profile is distributed by the network administrator. The profile may be downloaded from the profile creation device to the communication terminal via the network, or may be distributed in a state recorded on a recording medium.

  The authentication server 400 determines connection authentication when the communication terminal 100 connects to the network 300.

  FIG. 2 shows a network configuration in the communication network system 1. As shown in the figure, in this network 300, a network administrator provides a connection service with IEEE802.1xEAP-TLS authentication and a connection service without authentication. Connected to the network 300 are an access point 200a corresponding to a connection service that is not authenticated and a 200b corresponding to a connection service with authentication. Here, both the access point 200a and the access point 200b are set with “Svc-a” as the ESSID. In the access point 200a, a character string “Key-a” serving as an encryption key is set as WEP. The access point 200b communicates with the authentication server 400, transfers user authentication information from the user, and performs connection control.

The block diagram of FIG. 3 shows a schematic configuration of the communication terminal 100. As shown in the figure, the communication terminal 100 includes a digital certificate storage unit 101, a profile information storage unit 102,
A connection method selection control unit 103, a certificate search control unit 104, a certificate selection unit 105, a certificate use history recording unit 106, and a communication interface unit 110 are provided. The communication terminal 100 is a PC (Personal Computer) having hardware such as a CPU (Central Processing Unit), a memory, a communication interface, a display device, and an input device for inputting key operations. Processing by the connection method selection control unit 103 and the certificate search control unit 104 is realized by a module of a program executed by the CPU. The digital certificate storage unit 101, the profile information storage unit 102, and the certificate use history recording unit 106 are realized by a memory. Note that the digital certificate search process for searching for a digital certificate according to the present invention is realized by each part surrounded by a broken line in FIG.

  The digital certificate storage unit 101 stores digital certificate information as a first storage unit. The profile information storage unit 102 stores, as second storage means, profile information that is distributed separately from the digital certificate and in which information on the issuer and issuer of the digital certificate is described.

  The connection method selection control unit 103 reads profile information from the profile information storage unit 102 and transmits information such as a digital certificate search processing request and search conditions in the digital certificate storage unit 101 to the certificate search control unit 104. Based on the search result, communication connection method selection control is performed, and communication connection control is performed for the communication interface unit 110.

  The certificate search control unit 104 executes a search for a digital certificate in the digital certificate storage unit 101. In addition, exchange of information regarding the digital certificate to the certificate selection unit 105 is performed, and history information of the digital certificate is stored and referred to the certificate use history recording unit 106. In addition, the digital certificate to be used is selected based on the search result.

  The certificate selection unit 105 notifies the user of information related to a plurality of digital certificates notified from the certificate search control unit 104, accepts designation of one digital certificate from the information, and proves the designation information. To the document search control unit 104. Here, it is realized by a display device that displays information on a plurality of digital certificates on a screen and an input device that accepts designation by a user.

  The certificate use history recording unit 106 stores, as the third storage unit, information described in the digital certificate selected by the certificate search control unit 104 as history information.

  The communication interface unit 110 executes communication connection processing according to the communication connection method selected by the connection method selection control unit 103.

  Next, the configuration of the profile will be described with reference to the drawings. 4 to 5 show examples of profile information stored in the profile information storage unit 102 of the communication terminal 100. FIG. As shown in the figure, the profile is issued to all users who use the network 300 as the same default configuration. Each value can be changed according to the user. Also, the user himself can add / change / delete part of the profile information.

  In the profile, setting information for a plurality of communication connection methods is described. Here, the communication connection method includes management parameters (connection name, priority order, connection form) and connection parameters (ESDID, WEP, Issuer, Subject) for each connection method. Here, two types of connection methods, “connection name: connection A” and “connection name: connection B” are described.

  The “priority” indicates the order of connection attempts using each connection method, and is used in order from the connection method corresponding to the smaller number. “Connection form” indicates whether or not IEEE 802.1x EAP-TLS authentication is performed. “ESSID” represents an identifier of a wireless LAN access point connected by the connection method. “WEP” represents a character string serving as a key for encryption of the access point.

  Here, “Issuer” and “Subject” are the same information as the information described in the digital certificate used by the user in the IEEE 802.1x EAP-TLS authentication. “Issuer” represents a character string that identifies the certificate authority that issued the digital certificate. “Subject” represents a character string that identifies the user to whom the digital certificate is issued.

  Next, the configuration of the digital certificate will be described with reference to the drawings.

  6 to 8 show examples of digital certificates stored in the digital certificate storage unit 101 of the communication terminal 100. FIG. As shown in the figure, the digital certificate includes, for example, X.1, which is one of general public key certificate standards. 509 format digital certificates are used. The following information is described in the digital certificate. The serial number is a number assigned so as not to be duplicated in a digital certificate issued by one certificate authority. “Issuer” is a character string that represents the certificate authority that issued the digital certificate. “Subject” is a character string representing a user name to which a digital certificate is issued.

  In this way, the digital certificate and the profile information describing the issuer and issuer information are stored separately, so that the digital certificate can be used universally from multiple control software. can do. Furthermore, if the network administrator knows at least one of the issuer and issuer information of the digital certificate, the network administrator can issue the profile independently of the digital certificate issued by the certificate authority administrator. Even in an operation mode in which a profile and a digital certificate are distributed separately, connection control based on profile information is possible.

  Next, the operation of the communication terminal 100 connecting to the network using the profile information will be specifically described with reference to FIGS. The flowchart in FIG. 9 mainly shows a flow of communication connection method selection processing by the connection method selection control unit 103.

  Step 1: First, in the first step, the current profile order is set to the initial state 0 (S1).

  Step 2: In the next step, profile information is read from the profile information storage unit 102, and the “priority” of the connection method described in the profile information is referred to. A connection method corresponding to the next highest priority order of the current profile order is selected (S2).

Step 3: In the next step, referring to the “connection form” of the selected connection method, in the case of “connection form: no authentication”, the wireless LAN (IEEE 802.11) connection process is executed, and “connection form” : If authentication is present, a request for search processing is transmitted to the certificate search control unit 104 to execute the certificate search processing (S3).
Step 4: In the next step, the certificate search control unit 104 searches for the digital certificate stored in the digital certificate storage unit 101. As a result of the certificate search process, the connection method selection control unit 103 receives information regarding the presence / absence of a digital certificate that matches the search condition from the certificate search control unit 104. Details of the certificate search processing by the certificate search control unit 104 will be described later (S4).

  Step 5: In the next step, when information indicating that the corresponding digital certificate exists is received, a communication connection method for performing authentication using the digital certificate is selected. Here, wireless LAN connection (IEEE 802.11, IEEE 802.1x) processing is performed. In the EAP-TLS authentication of the IEEE 802.1x connection process, the digital certificate retrieved in step 4 is used. If information indicating that the corresponding digital certificate does not exist is received, the process returns to step 2 to select a communication connection method that does not perform authentication using the digital certificate.

  Step 6: If the connection is normally completed as a result of the connection process of each wireless LAN, the connection is continued. On the other hand, if the connection is not normally completed, the certificate value stored in step 48 described later as the history information of the corresponding digital certificate is deleted, and the process returns to step 2.

  Next, digital certificate search processing by the certificate search control unit 104 in step 4 will be described with reference to the flowchart of FIG.

  Step 40: In the first step, prior to the search, it is determined whether there is a certificate value stored as history information of the corresponding digital certificate in the certificate use history recording unit 106 (S40).

  Step 41: If a certificate value exists in Step 40, the presence or absence of a digital certificate that matches the certificate value is confirmed. If the digital certificate exists, the search result is set as (1) A digital certificate is selected (S41).

  Step 42: If there is no certificate value in step 40, or if there is no digital certificate that matches the certificate value in step 41, the following processing is performed (S42).

  Refer to the profile information and search for a digital certificate that meets the following search conditions i) and ii). i) The character string described in “Issuer” of the profile information matches the character string described in “Issuer” of the digital certificate. ii) The entire character string described in “Subject” of the profile information matches the character string described in “Subject” of the digital certificate.

  Step 43: The number of digital certificates that match as a result of the search is determined. If the number of matched digital certificates is 0, the search result is (0). If the number of matched digital certificates is 1, the search result is (1) and the digital certificate is selected (S43).

  Steps 44 and 45: If the number of digital certificates matched in step 43 is two or more, the user is notified of information regarding a plurality of digital certificates, and the user is requested to select. A digital certificate designation from the user is accepted (S44, S45).

  Step 46 and Step 47: When a designated response from the user is received and the designated digital certificate exists, the digital certificate is selected with the search result as (1). If a predetermined time has passed without accepting a designated response from the user, and if the designated digital certificate does not exist, the search result is set to (0) (S46, S47).

  Step 48: If the search result is 0 as a result of step 43 to step 47, the certificate value is deleted, and if the search result is 1, the certificate value is saved (S48).

[First operation example]
Next, as a first operation example, referring to the flowchart of FIG. 9 for the operation in the case of connecting to a network from a communication terminal in which a digital certificate is not stored using the profile 1 shown in FIG. While explaining.

  Step 1: In the first step, the current profile order is set to the initial state 0 “Pri0”.

  Step 2: In the next step, the profile information is read from the profile information storage unit 102, the "priority order" described in the profile information is referred to, and the "priority order: Pri1" next to the current profile order is set. Select the appropriate connection method “Connection A”.

Step 3: In the next step, since the connection method “connection A” is “connection type: authenticated”, a request for search processing is transmitted to the certificate search control unit 104 in order to execute certificate search processing.
Step 4: In the next step, the certificate search control unit 104 searches for the digital certificate stored in the digital certificate storage unit 101. Here, since the digital certificate is not stored, information indicating that there is no digital certificate that matches the conditions is accepted as a result of the certificate search process.

  Step 5: In the next step, information that the corresponding digital certificate does not exist is received, and the process returns to Step 2 without performing the connection process.

  In step 2 ′, the next highest “priority: Pri2” connection method “connection B” is selected. In the next step 3 ′, since the connection method “connection B” is “connection type: no authentication”, wireless LAN connection processing is performed.

  Step 6: At this time, if there is an access point that matches the parameters “ESSID: Svc-a” and “WEP key: Key-a” of the wireless LAN, the connection process is completed and the connection is continued.

[Second operation example]
Next, as a second operation example, the profile 1 shown in FIG. 4 is used to connect to a network from a communication terminal in which the digital certificates 1 and 2 shown in FIGS. The operation will be described with reference to the flowcharts of FIGS.

  Step 1: First, in the first step, the current profile order is set to the initial state 0 “Pri0”.

  Step 2: In the next step, the profile information is read from the profile information storage unit 102, the "priority order" described in the profile information is referred to, and the "priority order: Pri1" next to the current profile order is set. Select the appropriate connection method “Connection A”.

Step 3: In the next step, since the connection method “connection A” is “connection type: authenticated”, a request for search processing is transmitted to the certificate search control unit 104 in order to execute certificate search processing.
Step 4: In the next step, the certificate search control unit 104 searches for the digital certificate stored in the digital certificate storage unit 101.

  Step 40: Here, it is assumed that the history information of the digital certificate is not stored in the certificate use history recording unit 106, and the process proceeds to Step 42.

  Step 42: In the step of searching for a digital certificate that matches the profile information by the certificate search control unit 104, the profile information is referenced to search for a certificate that matches the following search conditions i) and ii). i) “Issuer: Auth0” of profile 1 and “Issuser: Auth0” of digital certificate 1 match. Here, “Issuer: Auth1” of the digital certificate 2 does not match the condition. ii) The entire character string of “Subject: Pref0-User0” of profile 1 is forward-matched with “Subject: Pref0-User1” of digital certificate 1.

  Step 43: As a result of the search, the number of matched digital certificates is 1, so that the search result is (1), and the digital certificate 1 that matches the search conditions i) and ii) is selected.

  Step 48: The certificate value “Issuer: Auth0, serial number: 12345678” of the digital certificate 1 is stored in the certificate use history recording unit 106 as history information.

  Step 5: In the next step, information indicating that the corresponding digital certificate exists is received, and a communication connection method for performing authentication using the digital certificate 1 is selected. Here, after performing wireless LAN connection (IEEE802.11, IEEE802.1x) processing and establishing a wireless LAN link with an access point whose ESSID is Svc-a, in step 4 in EAP-TLS authentication of the IEEE802.1x connection processing. Authentication is performed using the selected digital certificate 1. The authentication information is authenticated by the authentication server, and the access point performs connection processing. as a result. The connection process to the network at the communication terminal ends.

[Third operation example]
Next, as a third operation example, the profile 2 shown in FIG. 5 is used to transfer the digital certificate 1, 2, 3 shown in FIGS. 6, 7, and 8 from the communication terminal to the network. The operation for connection will be described with reference to the flowcharts of FIGS.

  Step 1: First, in the first step, the current profile order is set to the initial state 0 “Pri0”.

  Step 2: In the next step, the profile information is read from the profile information storage unit 102, the "priority order" described in the profile information is referred to, and the "priority order: Pri1" next to the current profile order is set. Select the appropriate connection method “Connection A”.

Step 3: In the next step, since the connection method “connection A” is “connection type: authenticated”, a request for search processing is transmitted to the certificate search control unit 104 in order to execute certificate search processing.
Step 4: In the next step, the certificate search control unit 104 searches for the digital certificate stored in the digital certificate storage unit 101.

  Step 40: Here, it is assumed that the history information of the digital certificate is not stored in the certificate use history recording unit 106, and the process proceeds to Step 42.

  Step 42: In the step of searching for a digital certificate that matches the profile information by the certificate search control unit 104, the profile information is referenced to search for a certificate that matches the following search conditions i) and ii). i) “Issuer: Auth0” of profile 2 matches “Issuer: Auth0” of digital certificate 1 and digital certificate 3. Here, “Issuer: Auth1” of the digital certificate 2 does not match the condition. ii) The entire character string of “Subject: Pref0-User0” of profile 2 is forward-matched with “Subject: Pref0-User1” of digital certificate 1 and “Subject: Pref0-User2” of digital certificate 3.

  Step 43: Since the digital certificate 1 and the digital certificate 3 match as a result of the search, the search result is (2).

  Steps 44 and 45: Since the number of digital certificates matched in step 43 is 2, the user is notified of information related to the digital certificate 1 and the digital certificate 3, and the user is requested to select. Accepts a digital certificate specification from the user. Here, it is assumed that the designation of the digital certificate 3 is received from the user within a certain time.

  Step 46 and Step 47: Since the designated digital certificate 3 exists, the digital certificate 3 is selected with the search result as (1).

  Step 48: Since the search result is (1), the certificate value (Issuer: Auth0, serial number: 345678) of the digital certificate 3 is stored in the certificate use history recording unit 106 as history information.

  Step 5: In the next step, a communication connection method for performing authentication using the digital certificate 3 is selected. Here, after performing wireless LAN connection (IEEE802.11, IEEE802.1x) processing and establishing a wireless LAN link with an access point whose ESSID is Svc-a, in step 4 in EAP-TLS authentication of the IEEE802.1x connection processing. Authentication is performed using the selected digital certificate 3. The authentication information is authenticated by the authentication server, and the access point performs connection processing. as a result. The connection process to the network at the communication terminal ends.

  However, if the authentication fails, the connection history is not completed and the stored history information is deleted. As described above, even when a plurality of digital certificates that match the conditions specified by the profile information are searched, the history information is stored only for the certificates that have been successfully authenticated. Furthermore, at the time of reconnection after successful authentication, the certificate is selected by referring to the history information in step 40, so that the operation of repeated selection by the user becomes unnecessary, and authentication failure due to incorrect digital certificate selection Can be reduced.

  As described above, according to this embodiment, according to the present embodiment, the information on the issuer and issuer of the digital certificate is described in the profile information, and the digital certificate that matches the information is searched and used. Since the digital certificate to be selected is selected, it is not necessary to select the digital certificate by the user at the time of authentication. Further, since the profile information and the digital certificate are stored separately, the digital certificate can be used universally from a plurality of control software. Furthermore, if the network administrator knows at least one of the issuer and issuer information of the digital certificate, the network administrator can issue the profile independently of the digital certificate issued by the certificate authority administrator. Even in an operation mode in which a profile and a digital certificate are distributed separately, connection control based on profile information is possible.

  Further, according to the present embodiment, even when there are a plurality of digital certificates that match the information described in the profile information as a result of the search, the user is notified of information related to the plurality of digital certificates, One digital certificate can be designated from among them, and the digital certificate designated by the user can be selected as a digital certificate to be used.

  Furthermore, according to the present embodiment, information described in the selected digital certificate is stored as history information, and if history information is stored, the digital certificate is based on the history information. When the authentication fails, the history information is deleted, so that only the digital certificate that succeeds in authentication is saved as history information, and the user repeatedly repeats the digital certificate during user authentication. Therefore, it is possible to reduce authentication failure due to selection of an incorrect digital certificate.

  In the present embodiment, the communication terminal 100 is a PC including hardware such as a CPU, a memory, a communication interface, a display device, an input device for inputting key operations, etc., but information including the above-described units. If it is an apparatus, it will not be restricted to this.

  In the present embodiment, the digital certificate search processing by the certificate search control unit 104 is realized by a program executed by the CPU, but is realized by dedicated hardware for executing the above processing. May be.

1 is a system configuration diagram of a communication network according to an embodiment. It is a network block diagram in the said communication system. It is a block diagram which shows schematic structure of the communication terminal connected to a network in the said communication system. It is a chart figure which shows the 1st example of the profile information memorize | stored in the profile information storage part of the said communication terminal. It is a chart figure which shows the 2nd example of the profile information memorize | stored in the profile information storage part of the said communication terminal. It is a chart figure which shows the 1st example of the digital certificate memorize | stored in the digital certificate memory | storage part of the said communication terminal. It is a chart figure which shows the 2nd example of the digital certificate memorize | stored in the digital certificate memory | storage part of the said communication terminal. It is a chart figure which shows the 3rd example of the digital certificate memorize | stored in the digital certificate memory | storage part of the said communication terminal. It is a flowchart which shows the selection process of the communication connection system in the said communication terminal. It is a flowchart which shows the search process of the digital certificate in the said communication terminal.

Explanation of symbols

DESCRIPTION OF SYMBOLS 1 ... Communication network system 100 ... Communication terminal 101 ... Digital certificate memory | storage part 102 ... Profile information memory | storage part 103 ... Connection method selection control part 104 ... Certificate search control part 105 ... Certificate selection part 106 ... Certificate utilization log | history recording part 110: Communication interface unit 200 ... Access point 200a ... Access point (no authentication)
200b ... Access point (with authentication)
300 ... Network 400 ... Authentication server 500 ... Certificate Authority (CA)
600 ... Profile creation device

Claims (5)

A digital certificate search program for causing a digital certificate search device to search for a digital certificate used for authentication,
Storing the digital certificate in a first storage means;
Storing profile information in which information of at least one of an issuer and an issuer of the digital certificate is described in a second storage unit;
Retrieving a digital certificate that matches the digital certificate information described in the profile information from the first storage means, and selecting a digital certificate to be used;
A digital certificate search program characterized by causing a digital certificate search device to execute. If there are a plurality of matching digital certificates, the step of notifying the user of information related to the plurality of digital certificates, and one digital certificate from among the notified information related to the plurality of digital certificates. A step of accepting the designation;
Selecting the designated digital certificate as a digital certificate to be used;
2. The digital certificate search program according to claim 1, wherein the digital certificate search apparatus is executed. Storing the information described in the selected digital certificate in the third storage means as history information;
A step of selecting a digital certificate based on the history information when history information is stored in the third storage means;
The digital certificate search program according to claim 1 or 2, wherein the digital certificate search apparatus is executed. A digital certificate search method for searching for a digital certificate to be used for authentication,
Storing the digital certificate in a first storage means;
Storing profile information in which information of at least one of an issuer and an issuer of the digital certificate is described in a second storage unit;
Searching the first storage means for a digital certificate that matches the information of the digital certificate described in the profile information by the search control means, and selecting a digital certificate to be used;
A digital certificate search method characterized by comprising: A digital certificate retrieval device for retrieving a digital certificate used for authentication,
First storage means for storing the digital certificate;
Second storage means for storing profile information in which information of at least one of an issuer and an issuer of the digital certificate is described;
Search control means for searching the first storage means for a digital certificate that matches the digital certificate information described in the profile information, and selecting a digital certificate to be used;
A digital certificate retrieval apparatus comprising:

Images