Secure print control and rights management system
View Patent ↗A system and method for enforcing a usage control for a document, including: receiving an encrypted message, the encrypted message including a first key and a usage information authorization for the document, the encrypted message responsive to a second key to extract the first key and the usage information authorization; accepting an encrypted device datastream and securely decrypting the encrypted device datastream using the first key by a device, the device manager: generating a decrypted device datastream derived from the encrypted device datastream, transmitting the decrypted device datastream to the device without writing the decrypted device datastream to a user-accessible memory; and using the second key to access a datastore and to update a usage record for the document with the usage information authorization and a device status signal, the serializer providing the device manager with the print authorization signal when a device request is consistent with the usage record.
1. A system for printing a document, the system comprising:
a print manager configured to receive an encrypted document for printing;
a mail monitor configured to receive an email authorization message including a decryption key for the encrypted document and document usage information for the encrypted document and tag the email authorization message to prevent a subsequent copy of the authorization message from being processed;
the print manager responsive to receiving a first request for printing the encrypted document further configured to:
process the email to retrieve the document usage information;
determine from the document usage information if the first request for printing the encrypted document is authorized;
if the first request for printing the encrypted document is authorized, then the print manager further configured to:
process the email to retrieve the decryption key for the encrypted document;
decrypt the encrypted document using the decryption key to generate an unencrypted document without writing a decrypted datastream to user-accessible memory; and
transmit the unencrypted document to a printer for printing.
2. The system of claim 1 further comprising:
a serializer configured to update the document usage information if the document is printed.
3. The system of claim 2 wherein the print manager, responsive to receiving a second request for printing, is further configured to:
determine from the updated document usage information if the second request for printing the encrypted document is authorized;
if the second request for printing the encrypted document is authorized, then the print manager further configured to:
decrypt the encrypted document using the decryption key to generate an unencrypted document; and
transmit the unencrypted document to a printer for printing.
4. The system of claim 2 further comprising:
a secure datastore configured to store the document usage information;
wherein the serializer is further configured to store the document usage information on the secure datastore.
5. The system of claim 4 wherein the secure datastore is not accessible to the user.
6. The system of claim 1 wherein the system is implemented in a commercial print shop.
7. A method for printing a document, the method comprising:
receiving an encrypted document for printing;
receiving an email authorization message including a decryption key for the encrypted document and document usage information for the encrypted document;
tagging the email authorization message to prevent a subsequent copy of the authorization message from being processed;
receiving a first request for printing the encrypted document;
processing the email to retrieve the document usage information;
determining from the document usage information if the first request is authorized;
processing the email to retrieve the decryption key for the encrypted document responsive to the first request being authorized;
decrypting the encrypted document using the decryption key to generate an unencrypted document without writing a decrypted datastream to user-accessible memory responsive to the first request being authorized; and
transmitting the unencrypted document to a printer for printing responsive to the first request being authorized.
8. The method of claim 7 further comprising:
updating the document usage information if the document is printed.
9. The method of claim 8 further comprising:
receiving a second request for printing the encrypted document;
determining from the updated documents usage information if the second request for printing the encrypted document is authorized;
decrypting the encrypted document using the decryption key to generate an unencrypted document responsive to the second request being authorized; and
transmitting the unencrypted document to a printer for printing responsive to the second request being authorized.
10. The method of claim 8 further comprising:
storing the document usage information on a secure datastore.
11. The method of claim 10 wherein the secure datastore is not accessible to the user.
12. A method for printing a document the method comprising:
receiving an encrypted document for printing;
receiving an email authorization message including a decryption key for the encrypted document and document usage information for the encrypted document;
tagging the email authorization message to prevent a subsequent copy of the authorization message from being processed;
receiving a first request for printing a first number of copies of the encrypted document;
processing the email to retrieve the number of copies authorized from the document usage information;
determining if the first request for the first number of copies is authorized based on the document usage information;
processing the email to retrieve the decryption key for the encrypted document responsive to the first request being authorized;
decrypting the encrypted document using the decryption key to generate an unencrypted document without writing a decrypted datastream to user-accessible memory;
transmitting the unencrypted document to a printer for printing the first number of copies;
updating the document usage information responsive to the first number of copies of the document printed; and
storing the document usage information on a secure datastore.
13. The method of claim 12 further comprising:
receiving a second request for printing a second number of copies of the encrypted document;
retrieving the document usage information from the secure datastore;
processing the document usage information to retrieve the number of copies authorized;
determining if the second request for the second number of copies is authorized based on the document usage information;
decrypting the encrypted document using the decryption key to generate an unencrypted document responsive to the second request being authorized;
transmitting the unencrypted document to a printer for printing the second number of copies;
updating the document usage information responsive to the second number of copies of the document printed; and
storing the document usage information on a secure datastore.
14. The method of claim 12 wherein the secure datastore is not accessible to the user.