WO2018115667A1

WO2018115667A1 - Method and system for secure remote printing from a mobile terminal

Info

Publication number: WO2018115667A1
Application number: PCT/FR2017/053632
Authority: WO
Inventors: Ali ABAZA; Hichem Taleb BENDIAB
Original assignee: Twipbox
Priority date: 2016-12-20
Filing date: 2017-12-18
Publication date: 2018-06-28
Also published as: FR3060785B1; FR3060785A1

Abstract

The invention concerns a method (100) for secure remote printing and a system for implementing this method. The method according to the invention comprises five levels of security in order to ensure the confidentiality of the operation. The method (100) according to the invention comprises, in particular, the following steps: a preliminary step of declaring and registering at least one printer, during which a pair of printing keys is associated with each of the at least one printers declared, the printing key pair being generated by a software platform and comprising a public printing key and a private printing key, the public printing key being transmitted to a server, and the private printing key being exclusively held by the software platform; a step (140) of generating, by the server, a pair of printing session keys, the pair of printing session keys comprising a public printing session key and a private printing session key, during which step (140) the public session key and the public printing key are transmitted to a mobile terminal of the user (300); a step (160) of generating a single-use user code during which the user code is transmitted to said user. The system according to the invention comprises at least three functional and software components ensuring the security of the printing: an interface; a server; and a software platform managing the at least one printer.

Description

METHOD AND SYSTEM FOR REMOTE SECURE PRINTING FROM

A MOBILE TERMINAL

FIELD OF THE INVENTION

The present invention belongs to the field of remote document printing.

More particularly, the invention belongs to the field of secure remote document printing, based on a concept of printing cloud, from a mobile terminal on a printer located in a local network connected to the Internet.

STATE OF THE ART

It is known to make secure remote impressions from a mobile terminal.

US patent application US 2008/0320296 for example describes a method and system for securing remote printing, including a mobile device, a server and a mobile printer. The data to be printed is transmitted via secure mobile / server and mobile / printer connections. The transmission channel is encrypted, thanks to a set of public and private keys.

A disadvantage of this method of remote printing is that it has only one level of security: the document being transmitted via secure connections, it could be accessible to third parties, for example in the case of hacking. one or the other of the connections.

US Pat. No. 9,377,979 discloses a method and system for facilitating remote printing of a document. For security reasons, the document in question can be protected by password, and the password encrypted using a key pair comprising a public key and a private key. The key pair is generated by the so-called "connector" printing tool. This method of remote printing has a double level of security: encryption of the document by password and encryption of the password. However, a disadvantage of this method is that the private key for decrypting the password, and therefore to read the document, is held by the printing tool called "connector". The level of security is therefore relatively low insofar as the hacking of the printing tool would thus make it possible to take cognizance of the document.

SUMMARY OF THE INVENTION

The invention provides a remote printing method and system that provides a high level of security and privacy through five layers of security.

The invention relates to a method of secure remote printing from a mobile terminal, for example tablets, smartphones or laptop, comprising at least the following steps:

- in advance a declaration and a record of at least one printer, during which step is associated with each of the at least one printer declared a pair of printer keys, the pair of printer key being generated by a software platform and comprising a public printer key and a printer private key, the public printer key being transmitted to a server, and the private printer key being held exclusively by the software platform;

- inventory of printers available and declared during the pre-registration and registration stage;

- selection by a user of the document to be printed;

- choice by the user of the printer;

- generating by the server of a pair of print session keys, the print session key pair including a print session public key and a print session private key, at during which step the session public key and the public printer key are transmitted to a mobile terminal of the user;

encryption of the document by the mobile terminal of the user using the public printer key and the public print session key;

- generation by the server of a one-time user code during which the user code is transmitted to said user;

- Transmission of the encrypted document twice to the server through at least one secure connection "mobile terminal / server"; scanning a QR code of the printer and entering the user code of the one-time user code to release the print;

- partial decryption of the document using the private key of printing session;

- transmitting the encrypted document once to the printer through at least one secure connection "server / printer";

- decryption of the document using the private printer key;

- printing the document. In one form of implementation, the method comprises, upstream of the document encryption, a step of converting the document to PDF format. The document subsequently encrypted during the encryption step is then the PDF document. In one form of implementation, the user selects the printer during the printer selection step among a map of geolocated printers.

In one form of implementation, the one-time user code is transmitted to the user by SMS and / or e-mail.

The invention also relates to a secure remote printing system. The system includes means for: - declare and register at least one printer and generate a pair of printer keys for each of the at least one declared printer, the printer key pair including a printer public key and a printer private key, and transmit the public printer key;

- identify available printers;

- allow a user to select a document to print;

- allow the user to choose a printer;

generating a pair of print session keys, the print session key pair comprising a print session public key and a print session private key, and transmitting the session public key of impression ;

- encrypt the document using the print session public key and the public printer key;

- generate a one-time user code and transmit it to said user;

- transmit the encrypted document twice through at least one secure connection;

- enable the scanning of a printer identification code and the entry of the one-time user code to release printing;

- partially decrypt the document using the print session private key;

transmitting the encrypted document once to the printer via at least one secure connection;

- decrypt the document using the printer private key;

- to print.

In one embodiment, the system comprises three functional and software blocks:

an FO front-office brick representing an interface with a user;

a "Back Office" brick BO materialized by a software platform representing a smart printing terminal and managing a network printers associated with it, making them accessible to at least some of the public;

- a brick "Middle Office" MO ensuring the connection between the brick FO and the brick BO.

In one embodiment, the FO brick is a mobile application.

In one embodiment, the FO brick is a virtual printer. In one embodiment, the MO brick includes an application server with a presentation layer, a service layer, and a persistence layer.

In one embodiment, the BO brick includes a server-based software tool in a local area network hosting printers.

In one embodiment, the BO brick includes a software tool on a PC bound to printers.

BRIEF DESCRIPTION OF THE FIGURES

The invention will be better understood on reading the description which follows and on examining the figures which accompany it. These are presented only as an indication and in no way limitative of the invention.

Figure 1 illustrates the different steps of the method according to the invention. Figure 2 illustrates the bricks component of the system according to the invention in a preferred embodiment, as well as the data exchange between these bricks and between these bricks and the user for securing printing. DETAILED DESCRIPTION

FIG. 1 illustrates the different steps of the secure remote printing method from a mobile terminal according to the invention.

The method 100 according to the invention comprises the following steps:

a preliminary step of declaring and recording at least one printer during which is associated with each of the at least one printer a pair of printer keys;

a step 1 10 census of the available printers declared during the preliminary step of declaration and registration;

a step 120 of selection by a user 300 of the document to be printed;

a step 130 of choosing the printer;

a step 140 of generation by a server of a pair of print session keys;

a step 150 of encryption of the document;

a step of transmitting to the server, through at least one secure connection, the double-encrypted document;

a step 160 of generation by the server of a user code and transmission to the user 300 of said user code;

a step 170 of scanning a QR code identification code of the printer and user input 300 of the user code;

a step 180 of decrypting the document;

a printing step 190.

In one embodiment of the method 100, the printers declared and recorded during the prior step are identified by geolocation in step 1 10. Each printer is associated with a pair of printer keys consisting of a public printer key and a private printer key. The printer key pair is unique to the printer and does not change from print to print. This pair of printer keys is created during the declaration and registration of the printer during the prior declaration and registration step.

The printers are managed for example by a software platform which is the only one to hold the private printer key of each of the printers. The public printer key is passed to a server.

During step 120, the document to be printed can be retrieved by the user 300, for example locally or on a remote server, for example a cloud.

When the document has been selected, the printer on which the printing is to be performed is selected 130 by the user 300. The display of available printers identified in step 1 can be performed on the mobile terminal by example in the form of a list or map of available printers.

A pair of print session keys, including a print session public key and a print session private key, is then generated by the server, which provides the link between the mobile terminal and the software platform. This key pair is unique to the current print session and only the server holds the print session private key.

Once the print session key pair has been generated, the print session public key and the printer public key pair are transmitted by the server to the user's mobile terminal 300.

The document is then encrypted by the mobile terminal during the encryption step 150. The encryption is performed initially by the public printer key and then in a second time through the public session key printing .

Advantageously, the document is converted beforehand in PDF format, this format having certain advantages such as good portability.

The double-encrypted document is then transmitted to the server via at least one secure connection, a secure connection being able for example to be a secure communication channel by a public / private set of keys.

A user code is then generated 160 by the server. It's a one-time code that we'll call later OTP code, for "One Time Password ". The OTP user code can be transmitted to the user 300 by e-mail and or by SMS for example and will serve to authenticate the print session.

In order to start the printing process, the user 300 presents himself and scans the printer identification code (QR Code) and then enters the OTP code in the software platform during the step 170 to release the printer. 'impression.

The entry of the OTP code triggers the decryption process 180 of the document using the session private key and the printer private key. The document having first been encrypted with the public printer key, it is then first decrypted by the server using the private print session key and then transmitted to the printer in a second step. , through at least one secure connection, to be decrypted by the software platform using the private printer key.

Once the document is decrypted, printing is started 190. In one form of implementation of the method, the user 300 accesses the server using a login identifier and a password.

The document is thus encrypted twice, moreover the private keys making it possible to decrypt it are held by two separate entities, the server and the software platform managing the printer. As a result, the document is protected and, in case of hacking of one of the two entities, there remains a level of protection to the document. In addition, the need for the OTP user code to unblock the printing adds a third level of security. The QR Code adds a fourth level of security (identification step). Finally, the transmission of the document via secure connections provides a fifth layer of security.

If the printer private key and / or print session private key and or OTP code is corrupted, hacked, or erroneous, printing can not take place. In addition, printing can not take place if the user does not appear in front of the printer for mutual identification. In the embodiment described above, the identification is via a code QR code without operator and in a so-called self-service mode or "self-service". In another embodiment, identification is via an operator agent in front of its PC, which PC is connected to a printer.

The invention also relates to a system 200 for implementing method 100, which system comprises means for:

- declare and register at least one printer and generate a pair of printer keys for each of the at least one declared printer;

- identify available printers;

allow the user 300 to select a document to be printed;

allow the user 300 to choose a printer;

- generate a pair of print session keys;

- encrypt the document;

generating a single-use OTP user code and transmitting it to the user 300;

transmitting to a server the document encrypted twice through at least one secure connection;

allow the user 300 to scan the QR Code identification code on the printer and enter the OTP code on the mobile terminal to release the printing;

- decipher the document;

- to print

In one embodiment, the system 200 according to the invention comprises three functional and software blocks illustrated in FIG. 2:

- a brick "Front Office" FO;

- a brick "Back Office" BO;

- a "Middle Office" brick MO; The brick FO represents the interface with the user 300. As a non-limiting example, the brick FO may be a mobile application, a virtual printer installed on a PC or MAC or a specific API installed on the mobile terminal. In a non-exhaustive manner, the FO brick performs the following functions:

- display the geolocated printers;

allow the user 300 to select a document to be printed, for example from a mailbox of the mobile terminal of the user;

allow the user 300 to choose a printer;

- optionally convert the document to PDF;

- encrypt the document using the public printer key and the public print session key;

- transmit the encrypted document twice to the MO brick. The brick BO is materialized by a software platform representing a smart printing terminal and managing a private network of printers associated with it, making them accessible to at least part of the public.

In one embodiment, this intelligent terminal includes a server-based software tool in a private local area network hosting printers identified by QR Code generated by this tool (self-service mode).

In one embodiment, this smart terminal includes a software tool on a PC connected to printers via a private LAN or directly via a cable and managed by a human operator. In a non-exhaustive manner, the brick BO performs the following functions:

- declare at least one printer;

- send the public printer key to the MO brick;

recovering the encrypted document from the brick MO after the user 300 has entered the OTP code via the input interface and after the brick MO has partially decrypted the document using the private session key of impression ;

- decrypt the encrypted document with the printer private key;

- to print. The brick MO ensures the link between the brick FO and brick BO. It allows to control and transform the requests of the brick FO into Web Service requests for the brick BO. The MO brick includes an application server with a presentation layer, a service layer, and a persistence layer.

Non-exhaustively, the MO brick performs the following functions:

- generate the print session key pair;

transmitting the public printer key received from the brick BO to the brick FO;

generating an OTP user code and transmitting it to the user 300;

transmitting the user code to the user 300;

- decrypt the encrypted document with the private print session key;

- Transmit the decrypted document with the print session private key to the BO brick for decryption with the printer private key.

Algorithmic devices including encryption and decryption functions of the documents are set up on the various bricks of the system 200.

Thus five levels of security are put in place:

an end-to-end encrypted communication channel between the FO and the MO as well as between the MO and the BO, for example by a public / private key ring system;

- pair of print session keys generated by the brick MO, only the brick MO knows the private key of print session;

- pair of printer keys generated by the brick BO, only the brick BO knows the private key printer;

OTP user code generated by the brick MO and transmitted to the user 300 for authentication of the printing session.

- QR code Printer / user identification code All printing is conditioned by knowledge of the quadruplet: print session keys, printer keys,, OTP user code, and QR code. Printer code. Any incorrect, corrupt, or hacked key or code prevents 'impression.

The container of the act of printing as well as the contents are thus secured simultaneously.

Each key pair contains a public key, transmitted to the FO brick, and a private key to decrypt the document. Each private key is kept by the brick that generated it. Thus, the security is reinforced by the fact that the piracy of one of the two blocks BO or MO does not recover the document to print.

The method according to the invention therefore allows a user to print a document remotely, for example from a smartphone, a tablet or a laptop, with high levels of security and confidentiality.

The prints concerned by the invention can be made on any type of printer, for example:

- A4, A3, or other type of paper format printer;

- black and white and or color printer;

- photo printer;

- 3D printer.

Claims

1. Method (100) remote secure printing characterized in that it comprises the following steps:

- before a declaration and a registration of at least one printer, during which step is associated with each of the at least one printer declared a pair of printer keys, said pair of printer keys being generated by a software platform and comprising a public printer key and a private printer key, said public printer key being transmitted to a server, and said private printer key being held exclusively by said software platform;

- census (1 10) of printers available and declared during the pre-registration and registration stage;

- selection (120) by a user (300) of the document to be printed;

- choice (130) by the user (300) of the printer;

- generation (140) by the server of a pair of print session keys, said pair of print session keys including a print session public key and a print session private key, during from which step (140) the session public key and the public printer key are transmitted to a user's mobile terminal (300);

- encrypting (150) the document by the user's mobile terminal (300) using the public printer key and the print session public key;

generation (160) by the server of a single-use OTP user code during which said user code is transmitted to said user;

- Transmission of the encrypted document twice to the server through at least one secure connection "mobile terminal / server";

scanning a QR code of the printer code and entering (170) the user (300) of the one-time user code to release the print; - Partial decryption (180) of the document using the private key of printing session;

- transmitting the encrypted document once to the printer through at least one secure connection "server / printer"; decrypting (180) the document using the printer private key;

- printing (190) of the document.

2. The method (100) of secure remote printing according to claim 1 comprising, upstream of the document encryption, a step of converting the document to PDF, the document subsequently encrypted during step (150). encryption then being the PDF document.

A remote secure printing method (100) according to claim 1 or claim 2 wherein the user (300) selects the printer during the step (130) of choosing the printer from a map of the printer. geolocated printers.

A secure remote printing method (100) according to any one of the preceding claims wherein the one-time user code is transmitted to the user (300) by SMS and or e-mail.

5. Remote secure printing system (200) characterized in that it comprises means for:

- declare and register at least one printer and generate a pair of printer keys for each of the at least one declared printer, said pair of printer keys including a public printer key and a printer private key, and transmit said public printer key;

- identify available printers;

- allow a user (300) to select a document to be printed;

- allow the user (300) to choose a printer;

generating a pair of print session keys, said pair of print session keys including a session public key printing and a private print session key, and transmitting said print session public key;

generating one-time OTP user code and transmitting it to said user;

- transmit the encrypted document twice through at least one secure connection;

- enable the scanning of a printer identification code and the entry of the OTP single-use user code to release printing;

- partially decrypt the document using the print session private key;

- decrypt the document using the printer private key;

- to print.

6. Remote secure printing system (200) according to claim 5 characterized in that said system comprises three functional and software bricks:

a front office brick FO representing an interface with a user (300);

- A "Back Office" brick BO materialized by a software platform representing a smart printing terminal and managing a private network of printers associated with it, making them accessible to at least part of the public;

7. remote secure printing system (200) according to claim 6 characterized in that the brick FO is a mobile application.

8. remote secure printing system (200) according to claim 6 characterized in that the brick FO is a virtual printer.

The secure remote printing system (200) according to any one of claims 6 to 8, characterized in that the MO brick comprises an application server with a presentation layer, a service layer and a persistence layer.

10. Remote secure printing system (200) according to any one of claims 6 to 9 characterized in that the brick BO includes a server software tool in a local area network hosting printers.

1 1. Remote secure printing system (200) according to any one of claims 6 to 9, characterized in that the brick BO comprises a software tool on a PC linked to printers.