Secure network-based system for the distributed printing of documents

• US 7,248,693 B1
• Filed: 01/13/2000
• Issued: 07/24/2007
• Est. Priority Date: 01/13/2000
• Status: Expired due to Fees

• Current Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Original Assignee: Hewlett-Packard Development Company, L.P. (HP Inc.)
• Inventors: Lin, Qian, Wong, Ping Wah, Kite, Thomas D., Tretter, Daniel R., Nguyen, Hugh P.
• Primary Examiner(s): Zand; Kambiz
• Assistant Examiner(s): Brown; Christopher J.
• Application Number:
  US09/483,183
• Time in Patent Office: 2,749 Days
• Field of Search: 380/55, 380/278, 713/185, 713/182
• US Class Current: 380/55
• CPC Class Codes: G06F 21/608 Secure printing
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853

Abstract

An Internet-based printing system allows for the distribution and printing of documents and images in a secure, controlled manner. The system includes a secure printer that receives, decrypts and prints documents supplied by a document server. Security of the system is realized by an aggregate of a secure communication protocol, smart card technology and the computational infeasibility of breaking a public key cryptographic system. The system may be used for electronic commerce, in which copies are made on a “pay-per-print” basis.

Claims

1. A method of using a printer to print a document stored on a server, the server being connected to a network, the method comprising:

placing an order for the document to be distributed to the printer;

establishing a connection between the server and the printer to which the document will be distributed, after the order is placed;

using a smart card to give an identity to the printer within a predetermined amount of time of the establishing of the connection, the printer not having the identity until the identity is given, wherein the identity includes at least one cryptographic key contained on the smart card; and

wherein the server times out, the server closes the connection established with the printer, and the server cancels the placed order if the smart card fails to give the identity to the printer within the predetermined amount of time and if the smart card gives the identity to the printer within the predetermined amount of time, the order for the document is further processed by;

using the printer and the at least one cryptographic key to establish the printer identity with the server in response to the smart card giving the identity to the printer within the predetermined amount of time, wherein the server encrypts the document and transmits the encrypted document to the printer via the network;

using the printer to receive the encrypted document from the network;

using the printer to decrypt the encrypted document; and

using the printer to print the decrypted document.

2. The method of claim 1, wherein the encrypted document includes a message indicating a number of copies to be printed;

and wherein the printer prints the number of document copies indicated in the message.

3. The method of claim 1, wherein the printer includes a smart card reader;

and wherein the printer identity is established by inserting a smart card into the reader and transferring the identity of the smart card to the printer at the time of document distribution.

4. The method of claim 3, wherein the smart card is used to perform the decryption.

5. The method of claim 1, wherein the printer includes an embedded processor, and wherein the embedded processor is used to perform the decryption.

6. The method of claim 1, further comprising the step of ordering the document prior to establishing the printer identity.

7. The method of claim 6, wherein the printer is used to order the document.

8. The method of claim 6, further comprising the step of previewing at least one low quality document prior to ordering the document.

9. The method of claim 1, further comprising the step of using at least one cryptographic key to authenticate the printer prior to ordering the document.

10. The method of claim 1, wherein the printer is used to render the decrypted document.

26. The method of claim 1, wherein using the printer and at least one cryptographic key to establish the printer identity with the server includes:

using an encryption key to establish a printer identity;

receiving an encrypted token from the server;

using a decryption key to decrypt the token; and

sending the decrypted token to a remote site.

11. A method of using a printer to distribute a document stored on a server, the method comprising:

placing an order for the document to be distributed to the printer;

establishing a connection between the server and the printer to which the document will be distributed, after the order is placed;

using the printer and at least one cryptographic key to establish a printer identity with the server within a predetermined time of the establishing of the connection, wherein the server times out, the server closes the connection established with the printer, and the server cancels the placed order if the printer fails to give the printer identity to the server within the predetermined amount of time and if the printer gives the printer identity to the server within the predetermined amount of time the server encrypts the document and transmits the encrypted document to the printer via a network and the order for the document is further processed by;

using the printer to receive the encrypted document from the server;

using the printer to decrypt the encrypted document;

using the printer to print the decrypted document; and

using the printer to indicate status of the printing so that the server can charge for copies that were actually printed, wherein the printer sends back a status acknowledgement to the server.

27. The method of claim 11, wherein using the printer and at least one cryptographic key to establish a printer identity with the server includes:

using an encryption key to establish a printer identity;

receiving an encrypted token from the server;

using a decryption key to decrypt the token; and

sending the decrypted token to a remote site.

12. A system for the distributed printing of documents over a computer network, the system comprising:

a server connected to the network, the documents being stored on the server, wherein the server is operable to establish a connection with a printer;

a client machine connected to the network for placing a document order and identifying the printer to which the documents will be distributed to allow the server to establish a connection with the printer after the document order is placed;

the printer connected to the network, the printer being programmed to receive at least one cryptographic key after the document order has been placed and use said at least one key to establish a printer identity, and then to establish the printer identity with the server via the network, within a predetermined amount of time of the server establishing the connection with the printer;

the server being programmed to encrypt at least one of the documents and to send the at least one encrypted document to the printer via a network after the document order has been placed and the printer identity has been established, wherein the server times out, the server closes the connection established with the printer, and the server cancels the document order if the printer fails to give the printer identity to the server within the predetermined amount of time and if the printer gives the printer identity to the server within the predetermined amount of time, the server does not time out, does not close the connection established with the printer, and does not cancel the document order;

the printer being further programmed to retrieve the at least one encrypted document, decrypt the retrieved at least one encrypted document, and print the decrypted document according to the document order.

13. The system of claim 12, further comprising a client for placing the document order.

14. The system of claim 13, wherein the printer stores low quality documents for customer preview.

15. The system of claim 12, further comprising a smart card for providing at least one cryptographic key to the printer and for performing the decryption, the smart card passing the decrypted document to the printer.

16. The system of claim 12, further comprising a smart card for providing at least one cryptographic key to the printer, and wherein the printer includes an embedded processor for using at least one cryptographic key to perform the decryption.

17. The system of claim 12, wherein the printer is further programmed to indicate status of the printing so that the server can charge for copies that were actually printed.

28. The system of claim 12, wherein the printer establishes the printer identity with the server by using the at least one decryption key to establish a printer identity;

receiving an encrypted token from the server;

using a decryption key to decrypt the token; and

sending the decrypted token to the server.

18. A network printer comprising:

means for establishing a connection with a remote site over a network, wherein the remote site includes a server storing a document, and wherein the connection is established after an order for the document is placed;

means for reading at least one decryption key from a smart card;

means for using the at least one decryption key to establish a printer identity, wherein the printer identity includes at least one cryptographic key contained on the smart card;

means for communicating the printer identity to the server within a predetermined amount of time of establishing the connection with the remote site, wherein the server times out, the server cancels the order for the document, and the server closes the connection established with the network printer if the network printer fails to give the printer identity to the server within the predetermined amount of time, and if the printer gives the printer identity to the server within the predetermined amount of time the server does not time out, does not cancel the order for the document, and does not close the connection established with the network printer to allow the server to encrypt the document and transmit the encrypted document to the network printer;

means for receiving an encrypted token from the remote site;

means for using a decryption key to decrypt the token; and

means for sending the decrypted token to the remote site.

24. The printer of claim 18, further comprising:

means for receiving an encrypted document from the network;

means for using a decryption key to decrypt the document; and

means for printing the decrypted document.

19. A network printer that can communicate with a document server, the printer comprising:

a smart card reader;

a network interface for receiving a print order for a document and for establishing a network connection with the document server after the print order is received, wherein the document server stores encrypted documents;

a processor; and

memory for storing a program that, when executed, causes the processor to use the smart card reader to read a cryptographic key from a smart card,

use the cryptographic key to create an identity for the printer;

use the network interface to establish the identity with the document server within a predetermined amount of time of establishing the network connection with the document server, wherein the document server times out, the document server closes the connection established with the network printer, and the document server cancels the print order for the document if the identity is not established within the predetermined amount of time and if the identity is established within the predetermined amount of time, the processor is further configured to,

use the network interface to receive the document, which has been encrypted by the document server and transmitted to the network printer via a network,

decrypt the encrypted document, and

print the decrypted document.

20. The printer of claim 19, further comprising a keypad and display;

wherein the program further causes the processor to receive a document order from the keypad.

21. The printer of claim 19, wherein the program further causes the processor to send printing status to the network interface so that the server can charge for copies that were actually printed, wherein the printer sends back a status acknowledgement to the server.

22. The printer of claim 19, wherein the program further causes the processor to parse a message from the decrypted document, the message indicating a number of ordered copies, and wherein the program further causes the processor to print the ordered number of copies of the decrypted document.

23. The printer of claim 19, wherein the program further causes the processor to render the decrypted document.

29. The printer of claim 19, wherein using the network interface to establish the identity with the server includes receiving an encrypted token from the server;

using a decryption key to decrypt the token; and

sending the decrypted token to the server.

25. A server storing a document comprising:

means for receiving a print order for the document;

means for establishing a connection with a remote network printer after receiving the print order;

means for receiving a message identifying the remote network printer;

means for receiving a cryptographic key from the remote network printer within a predetermined amount of time of establishing the connection with the remote network printer;

means for encrypting the document using the cryptographic key received from the network printer;

means for closing the connection established with the remote network printer and canceling the print order for the document if the server fails to receive the cryptographic key from the remote network printer within the predetermined amount of time, and if the server receives the cryptographic key from the remote network printer within the predetermined amount of time, not closing the connection established with the remote network printer and not canceling the print order for the document;

means for encrypting a token with the key;

means for sending the encrypted token to the remote network printer;

means for determining whether the remote network printer was able to decrypt the token; and

means for sending encrypted information directly to the remote network printer via a network if the remote network printer was able to decrypt the token.