Abstract:
A data-security printing method and a data-security printing system capable of preventing one-way encryption cracking (Brute-Force Attack), by randomly specifying a port to transmit printer data between a printer driver and a firmware using an authentication protocol and then transmitting the printer data. The data-security printing system includes a terminal and a network printer, wherein the terminal transmits a protocol frame for user authentication to the network printer and transmits the data to the network printer through a temporary data path formed as a result of the user authentication, and wherein the network printer receives the protocol frame from the terminal, execute the user authentication, receives the data from the terminal through the temporary data path formed as a result of the user authentication, and prints the received data. As a result, it is possible to prevent one-way encryption cracking (Brute-Force Attack).

Description:
CROSS-REFERENCE TO RELATED APPLICATIONS  
       [0001]     This application claims the priority of Korean Patent Application No. 2004-54, filed on Jan. 2, 2004, in the Korean Intellectual Property Office, the disclosure of which is incorporated herein in its entirety by reference.  
       BACKGROUND OF THE INVENTION  
       [0002]     1. Field of the Invention  
         [0003]     The present general inventive concept relates to a method and a system of generating a random port in a network printer and transmitting data, and more particularly, to a data-security printing method and a data-security printing system capable of preventing one-way encryption cracking (Brute-Force Attack) by randomly specifying a port to transmit printer data between a printer driver and a firmware using an authentication protocol and transmitting the printer data under a network environment.  
         [0004]     2. Description of the Related Art  
         [0005]      FIG. 1  is a block diagram illustrating a conventional security printing system, where the system comprises a terminal  100  and a network printer  110 . The terminal  100  includes a data processing unit  101 , a control unit  102 , and a transmitting and receiving unit  103 , and the network printer  110  includes an authentication processing unit &amp; ID and password storage unit  111 , a control unit  112 , a transmitting and receiving unit  113 , and a printing unit  114 .  
         [0006]     Referring to  FIG. 1 , the transmitting and receiving unit  103  transmits the same data as shown in  FIG. 2  including authentication contents to the network printer  110 .  
         [0007]     The data processing unit  101  processes the printer data and the authentication contents, thereby generating transmission data.  
         [0008]     The control unit  102  allows the data processing unit  101  to process documents prepared through application programs of the terminal  100  and to transmit the documents to the transmitting and receiving unit  103 .  
         [0009]     On the other hand, in the network printer  110 , the transmitting and receiving unit  113  receives the transmission data including the authentication contents from the terminal  100 .  
         [0010]     The authentication processing unit &amp; ID and password storage unit  111  extracts the authentication contents from the transmission data received from the terminal  100 , compares the authentication contents with the stored ID and password, and transmits the authentication result to the control unit  102 .  
         [0011]     The control unit  112  receives the authentication result from the authentication processing unit &amp; ID and password storage unit  111 , determines whether the printing of the transmission data should be executed, and transmits data to be printed to the printing unit  114  or abolishes the transmission data in accordance with the authentication result.  
         [0012]     The printing unit  114  receives the data to be printed from the control unit  112 , converts the data into binary data, and prints the data.  
         [0013]      FIG. 2  is a diagram illustrating a conventional security printing data format, where the data format comprises an IP header portion including a destination IP and printer data. In the meantime, the printer data has a header portion including a user ID and a password processed with a printer job language (PJL) and a main portion including the data to be printed.  
         [0014]     The network printer  110  extracts the user ID and password from the header portion of the printer data shown in  FIG. 2 , compares the user ID and password from the header portion with the user ID and password stored in the authentication processing unit &amp; ID and password storage unit  111  of the network printer  110 , and determines whether both correspond with each other.  
         [0015]     In the conventional security printing system as described above, the user ID and password may be stolen through one-way encryption cracking (Brute-Force Attack) and may also be exposed to denial-of-service attacks.  
       SUMMARY OF THE INVENTION  
       [0016]     The present general inventive concept provides a data-security printing method and a data-security printing system capable of preventing one-way encryption cracking (Brute-Force Attack) by randomly specifying a port to transmit printer data between a printer driver and a firmware using an authentication protocol and transmitting the printer data only when a printer is used.  
         [0017]     Additional aspects and advantages of the present general inventive concept will be set forth in part in the description which follows and, in part, will be obvious from the description, or may be learned by practice of the general inventive concept.  
         [0018]     The foregoing and/or other aspects and advantages of the present general inventive concept are achieved by providing a data-security printing system using an authentication protocol, the system comprising a terminal to transmit data to be printed to a network printer through a temporary data path formed using the authentication protocol and the network printer, wherein the terminal transmits a protocol frame for user authentication to the network printer and transmits the data to the network printer through the temporary data path formed as a result of the user authentication, and wherein the network printer receives the protocol frame from the terminal, executes the user authentication, receives the data from the terminal through the temporary data path formed as a result of the user authentication, and prints the received data.  
         [0019]     The terminal may comprise: an encryption processing unit that generates an encryption code obtained by encrypting a user ID and a password using a predetermined method for the user authentication; an authentication protocol processing unit that transmits the protocol frame including the encryption code to the network printer; a data transmitting unit that transmits the data to the network printer through the temporary data path formed as a result of the user authentication; and a control unit that controls all the units.  
         [0020]     The control unit may allow the encryption processing unit to generate the encryption code for the user authentication, allow the authentication protocol processing unit to transmit the protocol frame including the generated encryption code to the network printer, and allow the data transmitting unit to transmit the data to be printed to the network printer through the temporary data path formed as a result of the user authentication.  
         [0021]     The network printer may comprise: an ID and password storage unit that stores a user ID and a password; an encryption processing unit that generates an encryption code obtained by encrypting the stored user ID and password using a predetermined method, executes the user authentication by comparing the generated encryption code with an encryption code extracted from the protocol frame transmitted from the terminal, and encrypts the network port for transmitting the data; an authentication protocol processing unit that receives the protocol frame from the terminal for the user authentication, transmits the protocol frame to the encryption processing unit, receives the encrypted network port from the encryption processing unit, and transmits the encrypted network port to the terminal; a data receiving unit that receives the data through the temporary data path formed as the result of the user authentication; a printing unit that converts the received data into printable data and prints the converted data; and a control unit that controls all the units.  
         [0022]     The control unit may allow the encryption processing unit to extract the encryption code from the protocol frame received by the authentication protocol processing unit and to execute the user authentication, allow the encryption processing unit to encrypt the network port using the encryption code as an encryption key so as to form the temporary data path when the user authentication is completed, and allow the authentication protocol processing unit to transmit the encrypted network port to the terminal.  
         [0023]     The foregoing and/or other aspects and advantages of the present general inventive concept may also be achieved by providing a network printer that receives data from a terminal through a temporary data path formed using an authentication protocol and prints the received data, the network printer comprising: an ID and password storage unit that stores a user ID and a password; an encryption processing unit that generates an encryption code obtained by encrypting the stored user ID and password using a predetermined method, executes the user authentication by comparing the generated encryption code with an encryption code extracted from the protocol frame transmitted from the terminal, and encrypts the network port to transmit the data; an authentication protocol processing unit that receives the protocol frame from the terminal for the user authentication, transmits the protocol frame to the encryption processing unit, receives the encrypted network port from the encryption processing unit, and transmits the encrypted network port to the terminal; a data receiving unit that receives the data through the temporary data path formed as the result of the user authentication; a printing unit that converts the received data into printable data and prints the converted data; and a control unit that controls all the units.  
         [0024]     The control unit may allow the encryption processing unit to extract the encryption code from the protocol frame received by the authentication protocol processing unit and to execute the user authentication, allow the encryption processing unit to encrypt the network port using the encryption code as an encryption key so as to form the temporary data path when the user authentication is completed, and allow the authentication protocol processing unit to transmit the encrypted network port to the terminal.  
         [0025]     The foregoing and/or other aspects and advantages of the present general inventive concept may also be achieved by providing a data-security printing method of a data-security printing system using an authentication protocol, the system comprising a terminal to transmit data to be printed to a network printer through a temporary data path formed using the authentication protocol and the network printer, the method comprising: requesting a network port to the network printer using the authentication protocol and performing user authentication so as to form the temporary data path; and transmitting data to be printed to the network printer through the formed temporary data path.  
         [0026]     The requesting operation may comprise the operations of: determining whether a user is identified; and determining whether an encryption code is identified.  
         [0027]     The determining operation may comprise the operations of: transmitting a first protocol frame including a user ID to the network printer; determining whether the user is identified by comparing a user ID stored in the network printer with the user ID included in the first protocol frame transmitted to the network printer; and transmitting a second protocol frame to the terminal so as to request a first encryption code, when it is determined at the operation of transmitting a second protocol frame that the user is identified.  
         [0028]     The operation of determining whether an encryption code is identified may comprise the operations of: transmitting a third protocol frame including the first encryption code to the network printer; and transmitting a fourth protocol frame including a second encryption code obtained by encrypting the network port.  
         [0029]     The first encryption code may be generated by performing an XOR operation of a 128-bit code obtained by processing the user ID with an MD5 algorithm and a 128-bit code obtained by processing the password with the MD5 algorithm.  
         [0030]     The operation of transmitting a fourth protocol frame may comprise the operations of: extracting the first encryption code from the third protocol frame; determining whether the second encryption code generated using the user ID and password stored in the network printer corresponds with the first encryption code; and transmitting the fourth protocol frame including a third encryption code obtained by encrypting the network port to the terminal, when it is determined that the second encryption code corresponds with the first encryption code.  
         [0031]     The second encryption code may be generated by performing an XOR operation of a 128-bit code obtained by processing the user ID stored in the network printer with an MD5 algorithm and a 128-bit code obtained by processing the password stored in the network printer with the MD5 algorithm.  
         [0032]     At the operation of transmitting data to be printed to the network printer through the formed temporary data path, the data may include printer data and the printer data may include the third encryption code in a header portion thereof.  
         [0033]     The third encryption code may be generated by encrypting the network port using the first encryption code or the second encryption code as an encryption key.  
         [0034]     As described above, by randomly specifying a port to transmit printer data between a printer driver and a firmware using an authentication protocol and then transmitting the printer data, it is possible to prevent one-way encryption cracking (Brute-Force Attack). 
     
    
     BRIEF DESCRIPTION OF THE DRAWINGS  
       [0035]     These and/or other aspects and advantages of the present general inventive concept will become apparent and more readily appreciated from the following description of the embodiments, taken in conjunction with the accompanying drawings of which:  
         [0036]      FIG. 1  is a block diagram illustrating a conventional security printing system;  
         [0037]      FIG. 2  is a diagram illustrating a conventional security printing data format;  
         [0038]      FIG. 3  is a block diagram illustrating a security printing system according to an embodiment of the present general inventive concept;  
         [0039]      FIG. 4  is a diagram illustrating an authentication protocol procedure according to an embodiment of the present general inventive concept;  
         [0040]      FIG. 5  is a table illustrating protocol types according to an embodiment of the present general inventive concept;  
         [0041]      FIG. 6  is a diagram illustrating a basic format of a protocol frame according to an embodiment of the present general inventive concept;  
         [0042]      FIG. 7  is a diagram illustrating a network port request protocol frame (first protocol frame) according to an embodiment of the present general inventive concept;  
         [0043]      FIG. 8  is a diagram illustrating an encryption code request protocol frame (second protocol frame) according to an embodiment of the present general inventive concept;  
         [0044]      FIG. 9  is a diagram illustrating an encryption code transmitting protocol frame (third protocol frame) according to an embodiment of the present general inventive concept;  
         [0045]      FIG. 10  is a diagram illustrating a network port transmitting protocol frame (fourth protocol frame) according to an embodiment of the present general inventive concept;  
         [0046]      FIG. 11  is a diagram illustrating a method of generating an encrypted 128-bit code according to an embodiment of the present general inventive concept;  
         [0047]      FIG. 12  is a diagram illustrating a method of encrypting and decrypting a network port according to an embodiment of the present general inventive concept;  
         [0048]      FIG. 13  is a diagram illustrating a format of data transmitted to a network printer according to an embodiment of the present general inventive concept;  
         [0049]      FIG. 14  is a diagram illustrating an authentication procedure according to an embodiment of the present general inventive concept;  
         [0050]      FIG. 15  is a diagram illustrating in detail operation S 100  of  FIG. 14 ;  
         [0051]      FIG. 16  is a diagram illustrating in detail operation S 200  of  FIG. 15 ; and  
         [0052]      FIG. 17  is a diagram illustrating in detail operation S 210  of  FIG. 15 . 
     
    
     DETAILED DESCRIPTION OF THE PREFERRED EMBODIMENTS  
       [0053]     Hereinafter, exemplary embodiments of a data-security printing method and a data-security printing system according to the present general inventive concept will be described in detail with reference to the attached drawings. Like reference numerals in the drawings denote like elements, and thus their description will be omitted. The present general inventive concept may, however, be embodied in many different forms and should not be construed as being limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the general inventive concept to those skilled in the art.  
         [0054]      FIG. 3  is a block diagram illustrating a security printing system according to an embodiment of the present general inventive concept, where the system comprises a terminal  300  and a network printer  310 . The terminal  300  includes an encryption processing unit  301 , a control unit  302 , an authentication protocol processing unit  303 , and a data transmitting unit  304 . The network printer  310  includes an encryption processing unit  311 , a control unit  312 , an authentication protocol processing unit  313 , a data receiving unit  314 , an ID and password storage unit  315 , and a printing unit  316 . A path  320  is always connected between the terminal  300  and the network printer  310  and indicates a permanent path to exchange authentication protocol frames for user authentication. A path  330  indicates a temporary data path (TDP) formed when transmitting data to be printed after the user authentication is completed, and the path  330  is closed when transmission of data is completed.  
         [0055]     Referring to  FIG. 3 , in the terminal  300 , the encryption processing unit  301  converts a user ID and a password into a 128-bit encryption code under control of the control unit  302  for the purpose of the user authentication, by using the same method as shown in  FIG. 11  (to be described in detail later).  
         [0056]     The control unit  302  allows the encryption processing unit  301  to generate an encryption code obtained by encrypting the user ID and password for the purpose of the user authentication, allows the authentication protocol processing unit  303  to transmit a protocol frame including the generated encryption code to the network printer  310 , and allows the data transmitting unit  304  to transmit the data to be printed to the network printer  310  through the temporary data path  330  formed as a result of the user authentication.  
         [0057]     The authentication protocol processing unit  303  communicates with the authentication protocol processing unit  313  of the network printer  310  and forms the temporary data path  330  through which the data to be printed are transmitted to the network printer  310 .  
         [0058]     The data transmitting unit  304  transmits the data to be actually printed to the network printer  310  through the temporary data path  330  in accordance with the user authentication.  
         [0059]     Next, in the network printer  310 , the encryption processing unit  311  reads out the user ID and password stored in the encryption processing unit  311 , encrypts the user ID and password using the same method as shown in  FIG. 11 , and thus generates the encryption code. The encryption code generated in this way is used for authentication. That is, the encryption code is compared with the encryption code encrypted using the similar method by the terminal  300  to perform the user authentication.  
         [0060]     The control unit  312  allows the encryption processing unit  311  to extract the encryption code from the protocol frames received by the authentication protocol processing unit  313  and to execute the user authentication, and when the user authentication is completed, allows the authentication protocol processing unit  313  to encrypt the network port using the encryption code as an encryption key to generate the temporary data path  330  and to transmit the encrypted network port to the terminal  300 .  
         [0061]     The authentication protocol processing unit  313  communicates with the authentication protocol processing unit  303  of the terminal  300  and generates the temporary data path  330  to receive the data to be printed.  
         [0062]     The data receiving unit  314  receives the data to be actually printed from the terminal  300  through the temporary data path  330 .  
         [0063]     The ID and password storage unit  315  stores user IDs and passwords.  
         [0064]     The printing unit  316  converts the received data into binary data under control of the control unit  312 , thereby a printer engine (not shown) to print the converted data.  
         [0065]      FIG. 4  is a diagram illustrating an authentication protocol procedure according to an embodiment of the present general inventive concept, where the authentication procedure shown in  FIG. 4  is performed when data to be printed exists in the terminal  300 .  
         [0066]      FIG. 5  is a table illustrating protocol types according to an embodiment of the present general inventive concept,  FIG. 6  is a diagram illustrating a basic format of a protocol frame according to an embodiment of the present general inventive concept,  FIG. 7  is a diagram illustrating a network port request protocol frame (first protocol frame) according to an embodiment of the present general inventive concept,  FIG. 8  is a diagram illustrating an encryption code request protocol frame (second protocol frame) according to an embodiment of the present general inventive concept,  FIG. 9  is a diagram illustrating an encryption code transmitting protocol frame (third protocol frame) according to an embodiment of the present general inventive concept, and  FIG. 10  is a diagram illustrating a network port transmitting protocol frame (fourth protocol frame) according to an embodiment of the present general inventive concept.  
         [0067]     Firstly, a basic format of the protocol frame to be exchanged for the user authentication is the same as shown in  FIG. 6  and includes a protocol type, a user ID, a 128-bit encryption code, and a payload. Here, the payload refers to data to be actually transmitted.  
         [0068]     Referring to FIGS.  4  to  10 , the authentication protocol processing unit  303  requests the network port through which data can be transmitted to the network printer  310  (operation  400 ).  
         [0069]     In this case, a format of the protocol frame to be transmitted to the network printer  310  is the same as shown in  FIG. 7  and includes ID 0X101 indicating the transmission port request and the user ID.  
         [0070]     That is, referring to the table of  FIG. 5 , the control unit  302  fills the protocol type and the user ID and allows the authentication protocol processing unit  303  to transmit the protocol frame to the network printer  310 .  
         [0071]     When the network printer  310  receives the same protocol frame as shown in  FIG. 7 , the encryption processing unit  311  determines whether there exists a user ID in the ID and password storage unit  315  at a first authentication step. When it is determined that there exists the user ID, the protocol frame requesting the same encryption code as shown in  FIG. 8  is transmitted to the terminal  300  (operation  401 ). The protocol type shown in  FIG. 8  is generated with reference to the table shown in  FIG. 5  by performing an OR operation of 0X1000 as an Ack type and 0X102 as an encryption code request ID. When it is determined that the user ID does not exist in the ID and password storage unit  315 , the network printer does not open the network port.  
         [0072]     When the terminal  300  receives an encryption code request protocol frame shown in  FIG. 8 , the encryption processing unit  301  encrypts the user ID and password using the same method as shown in  FIG. 11  under control of the control unit  302 . The protocol frame of which the 128-bit encryption code is filled is shown in  FIG. 9 . The protocol type shown in  FIG. 9  is generated by performing an OR operation of 0X1000 as an Ack type and 0X104 as an encryption code response with reference to the table shown in  FIG. 5 , and the user ID and the 128-bit encryption code are added thereto and then transmitted.  
         [0073]     When the network printer  310  receives the protocol frame shown in  FIG. 9 , the encryption processing unit  311  generates a 128-bit encryption code from the user ID and password stored in the ID and password storage unit  315  using the same method as shown in  FIG. 11  under control of the control unit  312 . The generated 128-bit encryption code is compared with the 128-bit encryption code transmitted from the terminal  300  and the user authentication is performed.  
         [0074]     As a result of the user authentication, when the two encryption codes do not correspond with each other, a protocol session is closed and initialized. However, when the two encryption codes correspond with each other and the user authentication is passed, a port (UDP port or TCP port) is randomly generated, the formed network port is encrypted, and the same protocol frame as shown in  FIG. 10  is transmitted to the terminal  300 .  
         [0075]     When the terminal  300  receives the protocol frame shown in  FIG. 10 , as shown in  FIG. 12 , the network port is decrypted, and the data shown in  FIG. 13  are transmitted to the network printer  310  through the decrypted network port.  
         [0076]      FIG. 11  is a diagram illustrating a method of generating a 128-bit encryption code encrypted for the user authentication according to an embodiment of the present general inventive concept, where the 128-bit encryption code for the user authentication is generated by processing the user ID and password using a message digest 5 (MD5) method to generate the 128-bit codes an then performing an XOR operation on the 128-bit codes.  
         [0077]      FIG. 12  is a diagram illustrating a method of encrypting and decrypting the network port according to an embodiment of the present general inventive concept, which means encrypting raw data as the network port into encrypted data or decrypting vice versa. Here, the  
         [0078]      FIG. 13  is a diagram illustrating a format of data to be transmitted to the network printer according to an embodiment of the present general inventive concept, where the data format comprises a header such as a destination IP, a source IP, a TCP or UDP, a destination port, and a source port and printer data. In the printer data, the user ID and password encrypted are described in the header portion thereof with a printer job language, and the data to be actually printed is included in the main portion thereof. According to an embodiment of the present general inventive concept, the 128-bit encryption code encrypted using the method shown in  FIG. 11  is included in the header portion of the printer data.  
         [0079]      FIG. 14  is a diagram illustrating an authentication procedure according to an embodiment of the present general inventive concept, where the authentication procedure comprises an authentication operation S 100  and a data transmitting operation S 110 . Referring to  FIG. 14 , at the authentication operation S 100 , the protocol frames are exchanged between the terminal  300  and the network printer  310  for the user authentication, and at the data transmitting operation S 110 , the transmission data shown in  FIG. 13  are transmitted to the network printer  310  from the terminal  300  through the temporary data path formed when the user authentication is passed at the operation S 100  and are printed on a printing paper.  
         [0080]      FIG. 15  is a diagram illustrating in detail the operation S 100  of  FIG. 14 , where the operation S 100  comprises a first authentication operation S 200  and a second authentication operation S 210 .  
         [0081]     At the first authentication operation S 200 , the first authentication using the user ID is performed.  FIG. 16  is a diagram illustrating in detail the operation S 200  of  FIG. 15 , where the operation S 200  comprises a first protocol frame transmitting operation S 300 , a user correspondence determining operation S 310 , and a second protocol frame transmitting operation S 320 .  
         [0082]     The first authentication operation S 200  will be described with reference to  FIG. 16 .  
         [0083]     At the first protocol frame transmitting operation S 300 , the protocol frame including the user ID shown in  FIG. 7  is transmitted to the network printer  310  through a permanent path (PP)  320 .  
         [0084]     At the user correspondence determining operation S 310 , the first authentication procedure is performed by searching the ID and password storage unit  315  and determining whether the user ID is included in the protocol frame shown in  FIG. 7 .  
         [0085]     At the second protocol frame transmitting operation S 320 , when the user authentication at step  310  is passed, the protocol frame requesting the encryption code shown in  FIG. 8  is transmitted to the terminal  300 .  
         [0086]     At the second authentication operation S 210 , the second authentication using the user ID and password is performed.  FIG. 17  is a diagram illustrating in detail the operation S 210  of  FIG. 15 , where the operation S 210  comprises a third protocol frame transmitting operation S 400 , a first encryption code extracting and comparing operation S 410 , and a fourth protocol transmitting operation S 420 .  
         [0087]     At the third protocol frame transmitting operation S 400 , the protocol frame shown in  FIG. 9  is transmitted to the network printer  310  through the permanent path (PP)  320 .  
         [0088]     At the first encryption code extracting and comparing operation S 410 , the first encryption code, that is, the encrypted 128-bit code, is extracted from the third protocol frame. Further, the user ID and password stored in the ID and password storage unit  315  are encrypted using the method shown in  FIG. 11  and thus the 128-bit code is generated. The second authentication procedure is performed by comparing the two codes.  
         [0089]     At the fourth protocol transmitting operation S 420 , when the second authentication at step S 410  is passed, the network port is encrypted as shown in  FIG. 12 , and the encrypted network port is transmitted to the terminal  300  together with the encrypted 128-bit code.  
         [0090]     The terminal  300  having received the fourth protocol frame decrypts the encrypted network port using the 128-bit encryption code as an encryption key as shown in  FIG. 12  and transmits the data shown in  FIG. 13  through the network port.  
         [0091]     The data received by the network printer  310  are converted into binary data by the printing unit  316  and then are printed on a printing sheet through the printer engine.  
         [0092]     Although a few embodiments of the present general inventive concept have been shown and described, it will be appreciated by those skilled in the art that changes may be made in these embodiments without departing from the principles and spirit of the general inventive concept, the scope of which is defined in the appended claims and their equivalents.