Apparatus and method for preventing disclosure through user-authentication at a printing node

• US 5,633,932 A
• Filed: 12/19/1995
• Issued: 05/27/1997
• Est. Priority Date: 12/19/1995
• Status: Expired due to Term

• Current Assignee: Intel Corporation
• Original Assignee: Intel Corporation
• Inventors: Davis, Derek L., Smith, Lionel
• Primary Examiner(s): Gregory, Bernarr E.
• Application Number:
  US08/574,843
• Time in Patent Office: 525 Days
• Field of Search: 380/3, 380/4, 380/23, 380/25, 380/30, 380/49, 380/50, 380/51, 380/55, 380/59, 340/825.31, 340/825.34
• US Class Current: 713/176
• CPC Class Codes: B41J 29/54 Locking devices applied to printing mechanisms
• CPC Class Codes: G06F 21/608 Secure printing
• CPC Class Codes: G06K 15/005 only locally
• CPC Class Codes: G06K 15/02 using printers
• CPC Class Codes: G06K 15/1803 Receiving particular commands
• CPC Class Codes: H04L 63/0442 wherein the sending and receiving network entities apply asymmetric encryption, i.e. different keys for encryption and decryption cryptographic mechanisms or cryptographic arrangements for public-key encryption H04L9/30
• CPC Class Codes: H04L 63/08 for authentication of entities cryptographic mechanisms or cryptographic arrangements for entity authentication H04L9/32
• CPC Class Codes: H04L 63/104 Grouping of entities
• CPC Class Codes: H04L 9/321 involving a third party or a trusted authority
• CPC Class Codes: H04L 9/3226 using a predetermined code, e.g. password, passphrase or PIN network architectures or network communication protocols for supporting authentication of entities using passwords in a packet data network H04L63/083
• CPC Class Codes: H04L 9/3234 involving additional secure or trusted devices, e.g. TPM, smartcard, USB or software token network architectures or network communication protocols for supporting authentication of entities using an additional device in a packet data network H04L63/0853
• CPC Class Codes: H04L 9/3263 involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823
• CPC Class Codes: H04N 1/00838 Preventing unauthorised reproduction
• CPC Class Codes: H04N 1/4413 involving the use of passwords, ID codes or the like, e.g. PIN
• CPC Class Codes: H04N 1/444 to a particular document or image or part thereof
• CPC Class Codes: H04N 1/4486 using digital data encryption

Abstract

A system and method for preventing a copy of a document to the output from a printing node until the printing node authenticates the intended recipient. The system includes a sending node, a printing node and a communication link coupling these nodes together in a network fashion. The sending node has access to a public key of the printing node and uses this public key to encrypt a header and document before transmission to the printing node over the communication link. The priority node has access to its private key to decrypt the header to ascertain whether the document requires authentication by the intended recipient before being output.

Claims

1. A method for preventing a printing node from outputting a copy of a document until an intended recipient of the document is authenticated, the method comprising the steps of:

selecting a confidentiality level for a print job including the document, said confidentiality level is selected to be equal to at least a predetermined level when the document contains sensitive information;

creating a header for said print job, said header being a first header when said confidentiality level is equal to at least the predetermined level, said first header including at least (i) information used to authenticate the intended recipient, and (ii) control information including at least said confidentiality level;

transmitting said print job to the printing node;

analyzing said header by the printing node; and

outputting the document once the intended recipient is authenticated, and thus, is physically proximate to the printing node.

2. The method according to claim 1, wherein said header created by said creating step being a second header when said confidentiality level is selected to be less than said predetermined level, said second header consists of control information.

3. The method according to claim 2, wherein prior to said transmitting step, the method further includes the step of encrypting said header with a public key of the printing node.

4. The method according to claim 3, wherein prior to said transmitting step, the method further includes the step of encrypting the document with said public key of the printing node.

5. The method according to claim 3, wherein said analyzing step includes the step of decrypting said header with a private key of the printing node to determine said confidentiality level.

6. The method according to claim 5, wherein said analyzing step further includes the step of

buffering the document in a format encrypted by said public key of the printing node when the confidentiality level is at least equal to the predetermined level.

7. The method according to claim 1, wherein the outputting step includes the step of decrypting the document with a private key of the printing node upon completing authentication of the intended recipient.

8. The method according to claim 7, wherein the outputting step further includes the step of printing the document.

9. The method according to claim 1, wherein the intended recipient is authenticated by performing one of a plurality of authentication techniques including (i) inputting a personal identification number into the printing node, (ii) inputting a release code into the printing node, and (iii) inserting an authenticating token into the printing node.

10. The method according to claim 1, wherein the intended recipient is authenticated by a capturing device of the printing node obtaining biometric data of the intended recipient and comparing the biometric data to a pre-stored data.

11. A method for preventing a printing node from outputting a copy of a document associated with a print job until an intended recipient of the document is authenticated, the method comprising the steps of:

creating a first header for said print job, said first header including at least (i) information used to authenticate the intended recipient, and (ii) control information including at least a confidentiality level to indicate whether the document contains sensitive information;

encrypting said first header and the document of said print job with a public key of the printing node;

transmitting said print job to the printing node;

storing the encrypted document in the printing node; and

decrypting the encrypted document and queuing the document to be output once the intended recipient has been authenticated to signify that the intended recipient is physically proximate to the printing node.

12. The method according to claim 11, wherein said control information of said header includes a public key of the intended recipient.

13. The method according to claim 11, wherein said control information further includes a print-only tag.

14. The method according to claim 11, wherein said control information further includes a parameter indicating a number of times the document can be output.

15. A method for preventing a printing node from outputting a copy of a document associated with a print job until an intended recipient of the document is determined to be physically proximate to the printing node, the method comprising the steps of:

selecting a confidentiality level for the print job;

creating a header for said print job, wherein

if said confidentiality level is at least equal to a predetermined level, said header being a first header including at least (i) information to authenticate the intended recipient, and (ii) a first set of control information including at least said confidentiality level, and

if said confidentiality level is less than said predetermined level, said header being a second header including a second set of control information;

encrypting said print job;

transmitting said print job to the printing node; and

decrypting said header to obtain the confidentiality level, wherein

if the confidentiality level is at least equal to said predetermined level,

temporarily storing the document, and

outputting the document once the intended recipient is authenticated and physically proximate to the printing node, and

if the confidentiality level is less than said predetermined level,

preparing the document to be output by the printing node.

16. A system that prevents a copy of a document from being output from a printing node until the printing node receives local authentication from an intended recipient of the document, the system comprising:

a communication link;

a sending node coupled to said communication link, said sending node includes a storage element which contains at least a public key associated with the printing node, said sending node utilizes said public key to encrypt both a header of the document and the document prior to transmission to the printing node via said communication link; and

the printing node coupled to said communication link, the printing node includes a storage element which contains at least a private key associated with the printing node, the printing node decrypts said header to obtain a confidentiality level of the document and prevents the document from being output until authentication that the recipient is physically proximate to the printing node when the confidentiality level exceeds a predetermined level.

17. The system according to claim 16, wherein said sending node is a computer.

18. The system according to claim 16, wherein said printing node is one of a printer, a plotter, a facsimile machine and a display monitor.

19. The system according to claim 16, wherein both said storage element of said sending node and said storage element of said printing node are non-volatile memory.

20. The system according to claim 16, wherein said storage element of said printing node further contains a digital certificate being at least said public key of the printing node encrypted with a private key of a trusted authority.

21. The system according to claim 16, wherein said printing node includes internal memory to store the document until the intended recipient is authenticated, and thus, physically proximate to the printing node.

22. A system that either immediately queues a non-confidential document to be output from a printing means or prevent a copy of a confidential document from being output from the printing means, the system comprising:

sending means for encrypting a print job having a first header and the confidential document with a public key of the printing node and for transmitting the encrypted first header and encrypted confidential document to the printing means, said sending means includes a first storage means for containing at least said public key;

printing means for decrypting said first header, analyzing said first header to determine that said print job contains the encrypted confidential document and for preventing the confidential document from being printed until authentication that an intended recipient is physically proximate to the printing means; and

means for communicating between said sending means and said printing means.

23. The system according to claim 22, wherein said sending means further encrypts another print job having a second header and the non-confidential document with said public key of the printing node and transmits the encrypted second header and encrypted non-confidential document to said printing means.

24. The system according to claim 23, wherein the printing means further decrypts said second header thereby determining that said another print job has the non-confidential document and prepares the non-confidential document to be output without authentication of the recipient.