Methods and apparatus for secure document printing

• US 7,831,830 B2
• Filed: 11/12/2007
• Issued: 11/09/2010
• Est. Priority Date: 07/10/2002
• Status: Active Grant

• Current Assignee: Fiery LLC
• Original Assignee: Electronics For Imaging Incorporated
• Inventors: Partelow, Michael, Farimani, Mehran, Fulton, Truxton
• Primary Examiner(s): Revak; Christopher A
• Application Number:
  US11/938,538
• Publication Number:
  US 20100023769A1
• Time in Patent Office: 1,093 Days
• Field of Search: None
• US Class Current: 713/171
• CPC Class Codes: G06F 3/1205 resulting in increased flexibility in print job configuration, e.g. job settings, print requirements, job tickets
• CPC Class Codes: G06F 3/1222 Increasing security of the print job
• CPC Class Codes: G06F 3/1238 Secure printing, e.g. user identification, user rights for device usage, unallowed content, blanking portions or fields of a page, releasing held jobs
• CPC Class Codes: G06F 3/1285 Remote printer device, e.g. being remote from client or server
• CPC Class Codes: H04L 9/00 Cryptographic mechanisms or cryptographic arrangements for secret or secure communications; Network security protocols

Abstract

Methods and apparatus are provided for securely printing a print job on a networked printer. An application program running on a networked computer instructs the printer to generate and exchange cryptographic keys. The application program then encrypts the print job using the keys, and then communicates the encrypted print job to the printer. The printer decrypts the received print job and prints the document.

Claims

1. A method comprising:

sending a first set of computer program instructions from a client computer to a printer, the first set of computer program instructions adapted to cause the printer to generate a first encryption key and a first decryption key;

sending the first encryption key from the printer to the client computer;

encrypting the print data at the client computer using the first encryption key;

sending a second set of computer program instructions from the client computer to the printer, the second set of computer program instructions adapted to enable the printer to decrypt print data;

sending the encrypted print data from the client computer to the printer; and

decrypting the encrypted print data at the printer using the first decryption key.

2. The method of claim 1, wherein the first set of computer program instructions is adapted to cause the printer to generate a pair of cryptographic keys.

3. The method of claim 2, wherein the pair of cryptographic keys are public and private keys of key encryption algorithm.

4. The method of claim 1, wherein the first set of computer program instructions also is adapted to cause the printer to generate a second encryption key.

5. The method of claim 4, wherein the second encryption key is a shared secret key.

6. The method of claim 1, wherein the first set of computer program instructions also is adapted to cause the printer to provide a copy of the first encryption key to the client computer.

7. The method of claim 1, wherein:

the client computer comprises a third encryption key; and

the first set of computer program instructions is adapted to cause the printer to generate a second encryption key.

8. The method of claim 7, wherein the first set of computer instructions also is adapted to cause the printer to provide a copy of the second encryption key to the client computer.

9. The method of claim 1, wherein the first set of computer program instructions comprises a PostScript procedure.

10. The method of claim 1, wherein the second set of computer program instructions also is adapted to cause the printer to modify a file read operation.

11. The method of claim 10, wherein the modified file read operation comprises a software filter that causes the printer to decrypt the print data.

12. The method of claim 1, wherein the second set of computer program instructions comprises a PostScript procedure.

13. A method comprising:

sending a first set of computer program instructions from a client computer to a printer, the first set of computer program instructions causing the printer to generate a first cryptographic key;

sending the first cryptographic key from the printer to the client computer;

using the first cryptographic key to generate a second cryptographic key at the client computer;

using the first cryptographic key to generate the second cryptographic key at the printer;

encrypting the print data using the second cryptographic key;

sending the encrypted print data from the client computer to the printer; and

sending a second set of computer program instructions from the client computer to the printer, the second set of computer program instructions causing the printer to decrypt the encrypted print data using the second cryptographic key.

14. The method of claim 13, wherein the first set of computer program instructions causes the printer to generate public and private keys of a key encryption algorithm.

15. The method of claim 14, wherein the second cryptographic key is a shared secret key generated according to the Diffie-Hellman key agreement protocol.

16. The method of claim 13, wherein the print data are encrypted using a cipher.

17. The method of claim 13, wherein the first set of computer program instructions comprises a PostScript procedure.

18. The method of claim 13, wherein the second set of computer program instructions comprises a PostScript procedure.

19. A method comprising:

generating a public and private cryptographic key pair at a client computer;

sending a key exchange program from the client computer to a printer, the key exchange program generating a public and private cryptographic key pair at the printer and exchanging the public key of the printer with the public key of the client computer;

generating a secret key at the client computer using the printer'"'"'s public key and the client computer'"'"'s private key;

generating a copy of the secret key at the printer using the client computer'"'"'s public key and the printer'"'"'s private key;

providing a decryption program from the client computer to the printer, the decryption program modifying a file read operation at the printer;

encrypting the print data at the client computer using the secret key, and sending the encrypted print data to the printer; and

implementing the modified file read operation at the printer to decrypt the encrypted print data using the secret key.

20. The method of claim 19, further comprising rendering the decrypted print data at the printer.

21. The method of claim 19, wherein the key exchange program comprises a PostScript procedure.

22. The method of claim 19, wherein the decryption program comprises a PostScript procedure.