Abstract:
A method for secure communication and printing, comprising: user entering user and destination information to host; authentication server producing, saving encryption key for the job, user, and destination information into database, and sending to host; host encrypting the job using encryption key and sending job to destination; user entering user and destination information to device; authentication server retrieving encryption key from database, and sending to device; and device decrypting the job using encryption key and releasing job. Authentication at both host and MFP sides disables unauthorized, malicious attack to a user&#39;s mailbox, and results in jobs to a mailbox having different dynamic encryption keys, and no password or mailbox PIN trafficking on network. Furthermore, host and MFP can be at different domains. Methods also include secrecy encrypting encryption key; hashing key generator using SHA1, MD5, etc.; password, PIN, RFID, biometrics; and timer module deleting jobs older than threshold value from storage.

Description:
FIELD OF THE INVENTION 
       [0001]    This invention relates to secure communication of a job to a device, and more particularly to a secure mailbox printing system with authentication on both host and device sides. 
       BACKGROUND OF THE INVENTION 
       [0002]    When one intends to print a confidential document, it is undesirable for a random person in the office who happens to be walking by to see the document or a coworker to pick up and carry away the document by mistake. One way to avoid this undesirable situation is to require that identification information is entered into a printing device or an MFP. This identification information needs to be authenticated using a password or other means of identification. However, existing solutions regarding identification, authentication, and secure communication do not address the problem of a malicious attack by sending a large amount of print jobs to a mailbox to which the malicious sender has no authorization. Also unsolved is the problem of an interceptor of a print job analyzing the intercepted print job to obtain the decryption key and using the decryption key to read the other jobs from the same originating user. The present invention arose out of the above perceived needs and concerns associated with secure communication of printing jobs involving destination mailboxes. 
       SUMMARY OF THE INVENTION 
       [0003]    Methods, computer program products, computing and printing systems for secure communication of a job to a device, and more particularly to a secure mailbox printing system with authentication on both host and device sides, are described. 
         [0004]    The following effects and results are achieved by the present invention. Authentications at both host side and MFP side are performed so that user A can not pretend to be another user B and send print job to user B&#39;s user account that he is not authorized in MFP&#39;s hard disk. This solves the problem of a malicious attack by sending a large amount of print jobs to a mailbox (or mail box) to which the malicious sender has no authorization. 
         [0005]    In another aspect of the present invention, by performing authentication at both sides, a dynamic encryption key will be produced to encrypt documents even if all these documents are printed to the same mailbox. This solves the problem of an interceptor of a print job analyzing the intercepted print job to obtain the decryption key and using the decryption key to read the other jobs from the same originating user. 
         [0006]    In further aspects of the present invention, by performing authentication at both sides, no password or mailbox PIN (including an encrypted one) traffics on the network, and the host computer that releases the print job can sit in a different domain with the MFP which actually released the job. 
         [0007]    The invention will be more fully understood upon consideration of the detailed description below, taken together with the accompanying drawings. 
     
     
       DESCRIPTION OF THE DRAWINGS 
         [0008]      FIG. 1  is a simplified block diagram showing connection of a computing system to a printer, in accordance with a preferred embodiment of the present invention. 
           [0009]      FIG. 2  is a block diagram and flowchart showing the processing steps for a job issuing procedure, in accordance with a preferred embodiment of the present invention. 
           [0010]      FIG. 3  is a block diagram and flowchart showing the processing steps for a procedure of an MFP&#39;s job releasing procedure, in accordance with a preferred embodiment of the present invention. 
           [0011]      FIG. 4  is a block diagram showing the process of an authentication server sending a secrecy to a printer driver or MFP, in accordance with a preferred embodiment of the present invention. 
           [0012]      FIG. 5  is a block diagram showing the flow of data among components of an MFP controller including a Timer Module, in accordance with a preferred embodiment of the present invention. 
           [0013]      FIG. 6  is a block diagram showing the flow of data among components of an MFP controller including a Key Generator, in accordance with a preferred embodiment of the present invention. 
       
    
    
     DETAILED DESCRIPTION OF THE INVENTION 
       [0014]    In the following detailed description, numerous specific details are set forth in order to provide a thorough understanding of the present invention. However, it will be apparent to one of ordinary skill in the art that these specific details need not be used to practice the present invention. In other instances, well known structures, interfaces, and processes have not been shown in detail in order not to unnecessarily obscure the present invention. 
         [0015]      FIG. 1  is a simplified block diagram showing connection of a computing system to a printer, in accordance with a preferred embodiment of the present invention.  FIG. 1  shows a general printing system setup  100  that includes a host computer  110  and a printer  150 . Here, the printer  150  may be any device that can act as a printer, e.g. an inkjet printer, a laser printer, a photo printer, or an MFP (Multifunction Peripheral or Multi-Functional Peripheral) that may incorporate additional functions such as faxing, facsimile transmission, scanning, and copying. 
         [0016]    The host computer  110  includes an application  120  and a printer driver  130 . The application  120  refers to any computer program that is capable of issuing any type of request, either directly or indirectly, to print information. Examples of an application include, but are not limited to, commonly used programs such as word processors, spreadsheets, browsers and imaging programs. Since the invention is not platform or machine specific, other examples of application  120  include any program written for any device, including personal computers, network appliance, handheld computer, personal digital assistant, handheld or multimedia devices that is capable of printing. 
         [0017]    The printer driver  130  is a software interfacing with the application  120  and the printer  150 . Printer drivers are generally known. They enable a processor, such as a personal computer, to configure an output data from an application that will be recognized and acted upon by a connected printer. The output data stream implements necessary synchronizing actions required to enable interaction between the processor and the connected printer. For a processor, such as a personal computer, to operate correctly, it requires an operating system such as DOS (Disk Operating System) Windows, Unix, Linux, Palm OS, or Apple OS. 
         [0018]    A printer I/O (Input/Output) interface connection  140  is provided and permits host computer  110  to communicate with a printer  150 . Printer  150  is configured to receive print commands from the host computer and, responsive thereto, render a printed media. Various exemplary printers include laser printers that are sold by the assignee of this invention. The connection  140  from the host computer  110  to the printer  150  may be a traditional printer cable through a parallel interface connection or any other method of connecting a computer to a printer used in the art, e.g., a serial interface connection, a remote network connection, a wireless connection, or an infrared connection. The varieties of processors, printing systems, and connection between them are well known. 
         [0019]    The present invention is suited for printer drivers, and it is also suited for other device drivers. The above explanations regarding  FIG. 1  used a printer driver rather than a general device driver for concreteness of the explanations, but they also apply to other device drivers. Similarly, the following descriptions of the preferred embodiments generally use examples pertaining to printer driver, but they are to be understood as similarly applicable to other kinds of device drivers. 
         [0020]    This invention presents a secure mailbox printing method. This method ensures that one mailbox user can not fake his identity to print to other user&#39;s mailbox to which he is not authorized, thus MFP&#39;s hard disk is protected from being attacked and overflowed with. malicious user&#39;s garbage files. Moreover, the security is enforced by producing different encryption key even for those documents that will be printed into the same mailbox. By doing this, even if the administrator has not changed the mailbox PIN number frequently, security still will not be compromised. The above functions are accomplished through requiring the user to authenticate to the authentication server both when he wants to print a job and when he wants the MFP to release his job. Also host computer which prints the files can stay in different domains with MFP which actually releases the files. 
         [0021]      FIG. 2  is a block diagram and flowchart showing the processing steps for a job issuing procedure, in accordance with a preferred embodiment of the present invention. The procedure of job issuing is illustrated in  FIG. 2  as well as described as follows. 
         [0022]    In Step  210 , printing is initiated from an application, which calls a print driver or printer driver  220 . 
         [0023]    In Step  230 , the printer driver pauses for user to enter user account information, password, mailbox ID, and PIN. Alternatively this information can be entered into an application: when user wants to print to a mailbox in a MFP, he first inputs his account and password or mailbox ID and PIN to the application which pauses for this information. By a user&#39;s mailbox or account in MFP, we mean a portion of space in MFP&#39;s hard disk used to store temporally or permanently a user&#39;s print job. Each mailbox is identified by a user&#39;s name and password. 
         [0024]    In Step  240 , the printer driver first produces a print job ID number, then in Step  250 , the driver sends the job ID number and user account or mailbox ID to the authentication server. An authentication server is a server with a database that contains all user mailboxes&#39; ID and its matching password. The authentication server, user and MFP can sit in different domains. Kerberos authentication server may also be included. 
         [0025]    In Step  260 , the authentication server then produces some secrecy that only the real user who possesses the correct password or PIN number of that can decrypt. Whether or not the mailbox printing procedure will continue to proceed depends on whether or not the secrecy from authentication server is decrypted successfully or not. 
         [0026]    The authentication server produces a secrecy through the following procedure: First, authentication server queries from the database the corresponding PIN number or password stored based on the ID or user account name received. Secondly, authentication server runs some hash function such as SHA1 or MD5 on user ID and password to produce an encryption key. Finally, the authentication server uses this encryption key to encrypt a random number by using some encryption algorithm. This random number is the key used to encrypt the specified print job. The encrypted random number is the secrecy the authentication server sends back in Step  270 . Authentication server also saves this user&#39;s job ID number and encryption key into database. The encryption and decryption procedures involve running some symmetric key encryption algorithm including RC4, AES, DES, etc. 
         [0027]    In Step  280 , the printer driver decrypts the secrecy to get the encryption key by using user account and password or mailbox ID and PIN that the user entered. Then in Step  290 , once the authentication server&#39;s secrecy is successfully decrypted, user can use the decrypted random number to encrypt the document by some encryption algorithm and send it to the mailbox that user specified. 
         [0028]      FIG. 3  is a block diagram and flowchart showing the processing steps for a procedure of an MFP&#39;s job releasing procedure, in accordance with a preferred embodiment of the present invention. Job releasing is in the similar procedure as in job issuing. 
         [0029]    In Step  310 , the user first enters his account and password or mailbox ID and PIN to the MFP or some printing device  320 . 
         [0030]    In Step  330 , the MFP lets user select one job by selecting one job number from this user&#39;s mailbox. 
         [0031]    In Step  340 , the MFP authenticates the user to the authentication server by sending the job number user selected, user account or mailbox ID to the authentication server. 
         [0032]    In Step  350  and  360 , the authentication server queries the encryption key for the specified job by looking it up and retrieving it from the database, and then sends back a secrecy in which the decryption key to the document is included. This secrecy is calculated by the following procedure: First, authentication server fetches encryption key to the specified job based on user account and job number. Secondly authentication server fetches this user&#39;s password or PIN. Thirdly, the authentication server runs some hash function such MD5 or SHA1 on user&#39;s account and password to produce an encryption key. This encryption key is used to encrypt the encryption key to the print job. The encrypted encryption key to the print job is the secrecy the authentication server sends back. 
         [0033]    In Step  370 , the MFP decrypts the secrecy to get a decryption key to the print job by using user account and password or mailbox ID and PIN that the user entered. Only when the user present to the MYP the same password or PIN number as what is stored in the authentication server can the MFP decrypt the secrecy and use the decrypted encryption key included in the secrecy to decrypt the document and release the job successfully. 
         [0034]    In Step  380 , if the decryption succeeds, the MFP uses the decryption key to decrypt the print job and release it. Typically this causes the pages of the print job to be printed out. 
         [0035]      FIG. 4  is a block diagram showing the process of an authentication server sending a secrecy to a printer driver or MFP, in accordance with a preferred embodiment of the present invention. 
         [0036]    In Step  410 , the authentication server creates a secrecy from the encryption key by running a key generator on the job, destination and user ID as well as his credential information stored in the authentication server. Here the key generator uses a hash algorithm such as SHA1, MD5, etc. 
         [0037]    In Step  420 , the created secrecy is sent back to the Printer Driver or MFP. The authentication server sends the created secrecy to a printer driver during the job-issuing process, and to an MFP during the job-releasing process. In either case, the basic handling procedure of the encrypting, sending, and decrypting of the secrecy is the same. 
         [0038]    In Step  430 , the Printer Driver or the MFP (printing device) decrypts the secrecy to obtain the encryption key by running the same key generator used by the authentication server. Only when the job, destination and user ID as well as his credential information are the same as those used by authentication server key generator can the host decrypt the secrecy. 
         [0039]      FIG. 5  is a block diagram showing the flow of data among components of an MFP controller including a Timer Module, in accordance with a preferred embodiment of the present invention.  FIG. 5  and  FIG. 6  describe processing within the MFP during the job releasing procedure. 
         [0040]    After the MFP  500  receives an encrypted printed job  510  from the host or elsewhere, the I/O buffer controller  510  receives the job and stores it temporarily in memory. 
         [0041]    The command parser  540  checks the format of the job to make sure it is well-formed. By analyzing information attached to the encrypted job  530 , the received job is recognized as a job that is subject to the processing of the present invention, and is determined to be processed for storing in the mailbox. The body message portion of the job is not yet decoded at this point. 
         [0042]    Data store manager  560  timestamps the job, and prepares the job for storage in the mailbox in the storage device  580 . The optional timer module  590  periodically checks the timestamps of the jobs, and according to the specified threshold value time limit, deletes jobs that have been kept in the mailbox for too long without being retrieved. In an embodiment of the present invention, a job is deleted if it is older than a threshold time limit value, where the threshold time limit value is optionally shortened if a storage capacity of the device exceeds a threshold capacity limit value. This prevents overflow of the mailbox storage space which can be caused by users forgetting to release jobs from the mailbox. 
         [0043]      FIG. 6  is a block diagram showing the flow of data among components of an MFP controller including a Key Generator, in accordance with a preferred embodiment of the present invention. Following the processing described in reference to  FIG. 5 , at this point, the job is stored in the mailbox. 
         [0044]    The user  640  enters user account and password or mailbox ID and PIN into the User I/F controller  650 , which is responsible for the front panel and other user interface components of the MFP. In embodiments of the present invention, entering of user information may involve methods of entering password, PIN (personal identification number), RFID (radio frequency identification), retinal scan, fingerprint, biometric identification, and combinations thereof. User I/F controller  650  of the MFP retrieves job list from the data store manager, and lets the user manually select a job from a list of jobs in the mailbox. 
         [0045]    Then the MFP sends job number user, user account or mailbox ID to the authentication server  610  through the authentication manager  620 . The authentication server queries for an encryption key for the specified job, and the authentication server sends back secrecy to the authentication manager  620  of the MFP. 
         [0046]    Using the secrecy and the user ID together with the password, a key is generated by the key generator  630  of the UP to decode the encrypted print job. This procedure has been described in reference to the earlier figures. Then the authentication manager sends back the decode key to User I/F Controller, and the user I/F controller asks the job manger  680  to create Printer Job with decode key. 
         [0047]    Although this invention has been largely described using terminology pertaining to printer drivers, one skilled in this art could see how the disclosed methods can be used with other device drivers. The foregoing descriptions used printer drivers rather than general device drivers for concreteness of the explanations, but they also apply to other device drivers. Similarly, the foregoing descriptions of the preferred embodiments generally use examples pertaining to printer driver settings, but they are to be understood as similarly applicable to other kinds of device drivers. 
         [0048]    Although the terminology and description of this invention may seem to have assumed a certain platform, one skilled in this art could see how the disclosed methods can be used with other operating systems, such as Windows, DOS, Unix, Linux, Palm OS, or Apple OS, and in a variety of devices, including personal computers, network appliance, handheld computer, personal digital assistant, handheld and multimedia devices, etc. One skilled in this art could also see how the user could be provided with more choices, or how the invention could be automated to make one or more of the steps in the methods of the invention invisible to the end user. 
         [0049]    While this invention has been described in conjunction with its specific embodiments, it is evident that many alternatives, modifications and variations will be apparent to those skilled in the art. There are changes that may be made without departing from the spirit and scope of the invention. 
         [0050]    Any element in a claim that does not explicitly state “means for” performing a specific function, or “step for” performing a specific function, is not to be interpreted as a “means” or “step” clause as specified in 35 U.S.C. 112, Paragraph 6. In particular, the use of “step(s) of” or “method step(s) of” in the claims herein is not intended to invoke the provisions of 35 U.S.C. 112, Paragraph 6.