KR100352344B1 - Apparatus and method for preventing disclosure through user-authentication at a printing node - Google Patents

Abstract

A system (100) and method for protecting a copy of a document from being output from a printing node until the printing node (130) authenticates the intended recipient. System 100 includes a transmitting node 110, a printing node 130, and a communication link 120 that connects these nodes 110, 130 together in a network form. The transmitting node 110 accesses the public key of the printing node 130 and transmits this public key to encrypt the header 265 and the document 255 before transmitting over the communication link 120 to the printing node 130. 210). The printing node 130 accesses the secret key 211 to decrypt the header to verify that authentication is required by the intended recipient before the document 255 is output.

Description

APAPATUS AND METHOD FOR PREVENTING DISCLOSURE THROUGH USER-AUTHENTICATION AT A PRINTING NODE}

As smaller, faster, and better computers continue to emerge, many businesses are now implementing "distributed" networks (for example, local area networks). Such a network is advantageous in that each user controls his or her personal computer. Furthermore, for economic reasons, many users can be connected to infrequently used hardware, such as printing nodes located in public areas accessible to all users. For the purposes of the present application, a "printing node" is defined as an independent hardware device capable of receiving, temporarily storing, printing and displaying data from a personal computer or some other transmission device. For example, a printing node may be represented as a printer, a printer operating in conjunction with a print server, a facsimile machine, a plotter, a remote monitor, or the like.

Frequent problems experienced by distributed networks include protecting confidential or proprietary information in documents (hereinafter referred to as "sensitive" documents) from being accidentally or intentionally read by unauthorized persons. Since the printing node is located in a public area, as soon as a print job is sent to the printing node, the sender must immediately walk or run to the printing node to obtain the sensitive document to protect the confidentiality of the information contained in the sensitive document. If the printing node experiences a momentary problem (e.g. jam, out of paper, low toner, etc.) or waits because of another print job, the sender waits on the printing node while the problem is corrected or the print job is being performed. Should be.

Alternatively, if possible, the sender returns to his computer to cancel print jobs related to sensitive documents. However, of course there is a risk that the document will be printed or displayed while the sender returns to his computer. However, if a print job is inadvertently sent to another printing node, perhaps an off-site printing node, it cannot prevent sensitive documents from being printed or displayed and possibly read to unauthorized individuals if a transmission error is detected after the print job has begun. There are relatively few options to protect them.

Regardless of whether a print job is canceled or not, for distributed networks, people waste valuable work time waiting around printing nodes because of sensitive documents. Such waste unfortunately affects the productivity of the sender and his company.

Another problem experienced by distributed networks is to protect sensitive documents' confidential information from public view when printed for others (eg business partners) at other sites. Of course, sensitive documents can be e-mailed to partners in an encrypted format. However, sometimes sending an electrically sensitive document may be undesirable because it is likely to be altered and / or electrically sent to an unintended recipient. Of course, the document can be printed and sent to the partner by mail, but there are obvious disadvantages such as time delay, postal stability and the like. Thus, it may also be beneficial to develop a system and method that eliminates the inefficiencies associated with protection of printed sensitive information from a sender's intended printing node or other intended recipient.

Summary of the Invention

The present invention is directed to a system and method for preventing a copy of a document from being output (printed, displayed, etc.) by a printing node until the printing node authorizes a locally intended recipient. The system includes a transmitting node, a printing node, and a communication link connecting these nodes in a network form. The sending node uses this public key to access the printing node's public key and encrypt the header and document before sending it over the communication link to the printing node. The printing node has access to a private key to decrypt the header to see whether the document is "sensitive" (ie, requesting recipient authorization prior to priority). If sensitive, the printing node stores the document locally until it receives an authorization to print the document.

The present invention relates to the field of data security. More specifically, the present invention relates to a system and method for preventing confidential information from being output by a printing node until the authorized recipient of the secret information is confirmed to be close to the printing node.

The features and advantages of the invention will be apparent from the detailed description of the invention that follows:

1 is a schematic diagram of a distributed, secure network system including a transmitting node and a printing node.

2A and 2B are block diagrams of network systems that use different verification methods involving the public node's public key and transmit both encrypted headers and documents from the transmitting node to the printing node.

3 is a flow chart illustrating how to ensure that sensitive documents tagged as containing confidential information will not be output until the recipient exists.

The present invention is directed to a method and apparatus for preventing the printing of sensitive documents at a printing node until the intended recipient authorizes such printing to occur. Notwithstanding that many details will be set forth in order to provide a thorough understanding of the present invention, it is to be understood that the invention may be described through many different embodiments in addition to the described embodiments without departing from the spirit and scope of the invention. It will be apparent to those skilled in the art. For other examples, well-known circuits, devices, and the like are not described in detail in order to avoid unnecessary ambiguity of the present invention.

In the description, many cryptographic related terms are often used to describe certain characteristics or qualities defined herein. A "key" is an encoding and / or decoding parameter for a conventional encryption algorithm. More specifically, the key is a continuous distribution ("string") of binary data of length "n" bits, where "n" is any number. A "document" is generally defined as a certain amount of data, such as one or more data pages transmitted in a sequence of bus cycles. A "digital certificate" is any set of digital information that is cryptographically tied together through the use of a secret key by widely known credit institutions (e.g., banks, government, trade associations, equipment manufacturers, company security offices, systems departments, etc.). Is defined. "Digital signature" is a similar technique used to verify the integrity of a message using the message generator's private key.

In FIG. 1, a simplified version of a distributed security network configured to protect sensitive documents from being misprinted is shown. The secure network system 100 includes at least one transmitting node 110 connected to the printing node 130 via a communication line 120. Although not shown, one or more transmission nodes may be connected to the printing node 130 through shared or independent communication, similar to line 120. As secure network systems can gain greater commercial acceptance, documents will generally be encrypted within transmission node 110 before being placed on communication line 120. This will protect against unauthorized access with confidential information as it is sent to printing node 130. Accordingly, printing node 130 may be described in US patent application Ser. No. 08 / 251,486 (method and device for providing secure communication), US patent application Ser. No. 08 / 303,084 (software license roving for hardware agent), and US patent application no. 08 /. As disclosed in 472,951 (method for providing roving software in a hardware agent-based system), it preferably includes software or hardware for decrypting the document before printing.

In Figures 2A-2B, an illustrative embodiment of a network system using asymmetric key technology employed by the transmitting node and printing nodes 110 and 130 is shown. This asymmetric technique uses two separate keys (referred to as public and private keys) for encryption and decryption purposes. In order to make one-way communication from the transmitting node 110 to the printing node 130, the printing node's public key (“PUK”) is initialized of the network based printer key server, all networks with the appropriate printer public key added to the network. It is possible to initially access the transmitting node 110 via any one of several verification methods, or through other recognizable methods. Each of these possible methods may use one or more digital certificates issued by at least one credit institution to obtain a PUK and verify the printer node's approval.

One method for obtaining and verifying a PUK is shown in FIG. 2A. A credit institution, such as printing node manufacturer 225, has a public key (“PUK”) 210 and a private key (“PRK”) 211 in a nonvolatile memory device 205 implemented in printing node 130. Produces the printing node 130. In addition, manufacturer 225 stores printing node certificate (“PNCert”) 215 in nonvolatile memory device 205. The printing node certificate ("PNCert") 215 is equivalent to the printing node public key PUK 210 encrypted with the manufacturer 225's private key ("PRKM"). After authentication and storage of the PUK of the nonvolatile memory device 235 of the transfer node 110, the PNCert 215 may also be stored in the nonvolatile memory device 235. Such storage is optional because the PNCert 215 is not needed again unless the PUK 210 is broken or accidentally removed from the transmitting node 110.

After connecting the printing node to the network and distributing the PNCert 215 to the transmitting node 110 connected to the network, the transmitting node 110 may (i) authenticate the printer node's public key ("PUK") in the initial distribution. (ii) PNCert 215 may be used to verify the characteristics of the printing node (ie, whether it can force recipient authentication). Such a verification is a local credit agency, where the topic is that the verification certificate ("VCert") 240 is the manufacturer's public key ("PUKM") 227 encrypted with the local credit authority ("PRKLTA") 231 secret key. 230 (eg, the security office of the system administrator or the organization that owns the printing node). The public key of the local credit institution (“PUKLTA”) 232 can be widely used to users of the network. The verification certificate 240 can be decrypted to obtain a PUKM 207 that can be used to obtain the PUK 210 by decrypting the PNCert 215.

Another example of how to obtain a PUK as well as verifying it is shown in FIG. 2B that the local credit authority 230 authenticates the PUK 210 internally before providing the PUK 210 to the transmitting node 110. As shown, local credit authority 230 obtains PUK 210 from printing node 130 by decrypting PNCert 215 using the public key of printing node manufacturer (“PUKM”) 227. Thereafter, the local credit authority 230 generates a locally generated verification certificate (“LVCert”) 245 and sends the LVCert 245 to the transmitting node 110. Similar to the PNCert of FIG. 2A, the LVCert 245 may be stored in the nonvolatile memory 235 after verification of the PUK 210 if desired. The sending node 110 decrypts the LVCert 245 using the widely available PUKLTA 231. As a result, the transfer node 110 obtains the PUK 210 stored in the nonvolatile memory device 235.

As shown in FIGS. 2A and 2B, after the public key (“PUK”) 210 of the priority node 130 is made available to the transmitting node 110, the transmitting node 110 is connected to the PUK 210. The document 250 can be encrypted under an asymmetric "Rivest Shamir Adlemann" ("RSA") algorithm using. This forms an encrypted document 255 to be sent to the printing node 130. In addition, the header 260 for the document is encrypted using the public key " PUK " 210 of the target printing node 130 which generates the encrypted header 265. As an alternative to RSA encryption of print jobs, the "header" may include a "session key" that is used by both the transmitter and the receiver to perform the required encryption operation on the document. "Headers" are known as general techniques for reducing computational operations generally associated with public key cryptography, particularly for large data sets. However, for the present invention, the header 260 includes control information that allows the printing node 130 to support various functions.

For example, the header 260 may include control information indicating that the document is a "sensitive" document by selecting a document with some "confidentiality", whereby the confidentiality level is at a predetermined (or normal) level. If exceeded, the author's authorization on the site is required before printing. Another example is that header 260 includes the public key of the intended recipient of the printed copy of the sensitive document. Thus, prior to printing a "sensitive" document, printing node 130 can be sure that the recipient exists through one of many authentication techniques (discussed below) using the intended recipient's public key. Another example is that the control information may include tag information, such as a "print only" tag. This tag allows the "sensitive" document 250 to be printed from the printing node 130 but does not store the document 250 in a text format in memory. The logical extension of the "print only" tag is control information that includes a parameter indicating the number at which the "sensitive" document is printed.

In a preferred embodiment, the linked print job of encrypted header 265 and encrypted document 255 is sent to printing node 130 via public domain 270. The printing node 130 is a secret that requires the printing node to cause the printing node 130 to inhibit the encrypted document from printing at least the document 250 until the intended recipient is present in the printing node 130. The encrypted header 265 using the PRK 211 is first decrypted to see if it contains information. Thus, document 250 is preferably temporarily stored in a buffer memory (not shown) in printing node 130, but if not needed, in an encrypted format. As soon as a confirmation is received that the intended recipient exists, the encrypted document 250 is received from (i) the buffer memory, (ii) decryption, and (iii) printed.

It is expected that a condition may exist when the document is not retrieved or the buffer memory is full. In things other than those related to conditions, it may be necessary to "flush" (ie, delete from memory) a document that is not reliably retrieved from buffer memory and thereby expand memory space. This can be done manually by the system administrator, the user of the network, or automatically through software and / or hardware.

There are many authentication techniques for verifying that the intended recipient exists at the printing node. One technique is to wait for the intended recipient's personal identification number ("PIN") to be entered through the number pad on the keyboard and printing node before starting to print the sensitive document. In such a case, the printing node may include a memory that stores a PIN associated with each recognized secret key or the PIN may be sent to the printing node via a header.

Another technique is to enter the "release code" through the keyboard. The release code is a job characteristic generated by the sending node at print-time and included in the header. The unlock code is displayed on the computer's display monitor for a short period of time to provide the user with sufficient information to retrieve the print job. If the intended recipient is not the sending user, the sending user may communicate the release code to the intended recipient via telephone call, electronic mail, or some other means.

Another technique is to use some type of authentication token, such as a PCMCIA confirmation card or a smart card that can be inserted into a printing node. Instead of requiring the printing node to keep a record of token confirmation, the token's public key can be included in the header and sent to the printing node, preferably in an encrypted format. Thus, the printing node needs to simply match the public key of the token to the public key previously received in the header of the print job, and execute a standard challenge / response protocol with the token. Such challenge / response protocols assure that the token is authenticated by proving that it owns the private key corresponding to the header specific public key.

The fourth technique primarily uses access control techniques called "biometrics," which use a capturing device for resource security (e.g., buildings, rooms, etc.). Biomechanics recognizes and captures a user's characteristics (eg, fingerprint, iris, retina, etc.) to capture single frame data of that characteristic (commonly referred to as a "data frame") or more multiple data frames. Comparing the data frame with a previously stored master. If each captured data frame is correctly compared to the stored master, the user is verified and authenticated.

Referring now to FIG. 3, a flowchart illustrating the operation of a network system is shown. First, it should be identified as a "sensitive" document or a normal document depending on whether confidential and / or proprietary information is included in the document (step 300). If the document is a normal document, as soon as the document is sent to the printing node, the sending node simply generates a header containing exposure protection information, such as a "print only" tag, which restricts the document to be printed and alleviates any chance of modifying the document. (Steps 305-310). After that, the header and document are encrypted before being sent to the printing node.

However, if the document is a "sensitive" document, as soon as the document is sent to the printing node, the sending node has the information necessary to authenticate the intended recipient (public key, token, etc.) and any additional information necessary to protect the exposure. Generates a header to include. If the authentication information is a release code, then the release code must be displayed on the display monitor of the sending node that allows the intended recipient to be directed to the printing node to begin printing the sensitive document (steps 320 and 325). Thereafter, the header and document are encrypted forming a print job and the print job is sent to the printing node (step 330).

Upon receiving the print job, the printing node decrypts the header (steps 335 and 340) to determine whether the document is a "sensitive document". If the document is a normal document, the printing node decrypts the document (step 335) and continuously prints the document (step 360). However, if it is a sensitive document, the printing node stores the encrypted document in an internal buffer memory (step 345) and waits for authentication by the intended recipient (step 350) whether the intended recipient is close to the printing node. Upon receiving authentication through the provision of a PIN, unlock code, authentication token, etc., the printing node decrypts the document and then prints the document (steps 355 and 360). It is anticipated that the sensitive document may be decrypted prior to step 345 so that the intended recipient is identified, and the sensitive document is printed in line to print (step 360).

The invention described herein can be designed using many different methods and many different configurations. While the invention can be described in various embodiments, it will be apparent to those skilled in the art that other embodiments do not depart from the spirit and scope of the invention. Accordingly, the present invention may be measured by the following claims.

Claims (21)

A method of preventing a printing node from outputting a copy of a document until it is authenticated that the intended recipient of the document is close to the printing node, Selecting a secret level for the document to be sent; If the secret level is greater than or equal to a predetermined level, generating a header that is a first header comprising at least (i) information for authenticating the intended recipient and (ii) control information including at least the secret level; Encrypting the document and header; Sending the encrypted document and header to a printing node; Analyzing the received header to determine if the secret level is greater than or equal to the predetermined level; And If the secret level is greater than or equal to the predetermined level, decrypting and outputting the received document once the intended recipient is authenticated. 2. The method of claim 1, wherein the header generated by generating the header comprises a second header composed of control information if the secret level is less than the predetermined level. 3. The method of claim 2, wherein encrypting the header further comprises encrypting with a public key of a printing node. 4. The method of claim 3, wherein encrypting the document further comprises encrypting with a public key of a printing node. 4. The method of claim 3, wherein decrypting the header further comprises decrypting with a private key of a printing node to determine the secret level. The method of claim 4, after analyzing the header and prior to outputting the document based on the recipient's authentication: Storing a document in a format encrypted by the public key of a printing node, Decrypting the received document further comprises decrypting with a private key of a printing node. A method of preventing a printing node from outputting a copy of a document until it is authenticated that the intended recipient of the document is close to the printing node, Selecting a secret level for the document to be transmitted; Generating a first header comprising at least (i) information for authenticating the intended recipient and (ii) control information including at least the secret level; Encrypting the first header and the document to be transmitted with a public key of a printing node; Sending the encrypted header and document to a printing node; Analyzing the received header to determine a secret level; If the secret level is greater than or equal to a predetermined level, storing the encrypted document at a printing node; And Decrypting and outputting the encrypted document once the intended recipient is authenticated. 8. The method of claim 7, wherein the control information of the header comprises a recipient's public key. 2. The method of claim 1 wherein the control information comprises a print-only tag. A method of preventing a printing node from outputting a copy of a document until it is authenticated that the intended recipient of the document is close to the printing node, Selecting a secret level for the document to be transmitted; If the secret level is greater than or equal to a predetermined level, the header comprises a first set of at least (i) information for authenticating the intended recipient and (ii) a first set of control information including at least the secret level. A header, wherein if the secret level is less than the predetermined level, the header is a second header comprising control information of a second set of information; Encrypting the document and header; Sending the encrypted document and header to a printing node; Decrypting the header to obtain a secret level; If the secret level is greater than or equal to the predetermined level, Store temporarily encrypted documents, Decrypting and outputting the encrypted document once the intended recipient is authenticated, If the secret level is smaller than the predetermined level, Decrypting and outputting the encrypted document; Method comprising a. In a system configured to prevent a copy of a document from being output from a printing node until the printing node receives a local certificate from the intended recipient of the document, Communication link; A storage device coupled to the communication link, the storage device comprising at least a public key associated with a printing node, and if the secret level is greater than or equal to a predetermined level, at least (i) information for authenticating the intended recipient and (ii) A transmitting node that generates a header that is a first header that includes at least control information including the secret level and uses the public key to encrypt the header and document prior to transmission to the printing node via the communication link. ; And A storage device coupled to the communication link, the storage device including at least a secret key associated with a printing node, decrypting the header to obtain a secret level of a document and the recipient at the printing node if the secret level exceeds a predetermined level. And a printing node that protects the document from being printed until it is authenticated. 12. The system of claim 11, wherein the transmitting node is a computer. 12. The system of claim 11, wherein said printing node is one of a group consisting of a printer, a plotter, a facsimile machine, and a display monitor. 12. The system of claim 11, wherein both the memory element of the transfer node and the memory element of the printing node are non-volatile memory. 12. The system of claim 11, wherein the storage element of the printing node further comprises a digital certificate that is at least the public key of the printing node encrypted with a private key of a credit institution. 12. The system of claim 11, wherein the printing node includes an internal memory that stores documents until the recipient is authenticated at the printing node. Configured to wait for a non-secret document to be output from the printing means or to prevent a copy of the secret document from being output from the printing means until the printing means is authenticated by the intended recipient of the document that the recipient is near the printing means. In the system, Select a secret level of the document to be sent, generate a first header comprising at least (i) information for authenticating the intended recipient and (ii) control information including at least the secret level, and publishing the printing node Transmission means for encrypting the first header and the secret document to be transmitted with a key, transmitting the encrypted first header and the encrypted secret document to printing means, and including first storage means including at least the public key; The received header is analyzed to determine if the secret level is greater than or equal to a predetermined level, and if the secret level is greater than or equal to a predetermined level, decrypting the received document once the intended recipient is authenticated Printing means for outputting; And Means for communicating between said transmission means and said printing means. 18. The apparatus of claim 17, wherein the transmitting means further encrypts another print job having a second header and a non-secret document with the public key of a printing node, and prints the encrypted second header and the encrypted non-secret document. Further comprising transmitting by means. 19. The apparatus according to claim 18, wherein the printing means further decrypts the second header, thereby determining whether the another print job has a non-secret document and preparing the non-secret document to be output without authentication of the recipient. System characterized in that. The method of claim 1 wherein the intended recipient is (i) entering a personal identification number into the printing node, (ii) entering a release code into the printing node, and (iii) inserting an authentication token into the printing node. A method characterized by being authenticated by performing any one of a plurality of authentication techniques comprising a. The method of claim 1, wherein the intended recipient is authenticated by a capturing device of the printing node that obtains its own biometric data and compares the biometric data with previously stored data.