Methods and apparatus for secure document printing
View Patent ↗Methods and apparatus are provided for securely printing a print job on a networked printer. An application program running on a networked computer instructs the printer to generate and exchange cryptographic keys. The application program then encrypts the print job using the keys, and then communicates the encrypted print job to the printer. The printer decrypts the received print job and prints the document.
1. A system comprising:
a client computer adapted to:
(a) send first and second sets of computer program instructions to a printer, the first set of computer program instructions adapted to cause the printer to generate a first encryption key and a first decryption key, the second set of computer program instructions adapted to enable the printer to decrypt print data;
(b) encrypt print data at the client computer using the first encryption key; and
(c) send the encrypted print data to the printer;
wherein the printer is adapted to send the first encryption key to the client computer, and decrypt the encrypted print data using the first decryption key.
2. The system of claim 1 , wherein the first set of computer program instructions is adapted to cause the printer to generate a pair of cryptographic keys.
3. The system of claim 2 , wherein the pair of cryptographic keys are public and private keys of key encryption algorithm.
4. The system of claim 1 , wherein the first set of computer program instructions also is adapted to cause the printer to generate a second encryption key.
5. The system of claim 4 , wherein the second encryption key is a shared secret key.
6. The system of claim 1 , wherein the first set of computer program instructions also is adapted to cause the printer to provide a copy of the first encryption key to the client computer.
7. The system of claim 1 , wherein:
the client computer comprises a third encryption key; and
the first set of computer program instructions is adapted to cause the printer to generate a second encryption key.
8. The system of claim 7 , wherein the first set of computer instructions also is adapted to cause the printer to provide a copy of the second encryption key to the client computer.
9. The system of claim 1 , wherein the first set of computer program instructions comprises a PostScript procedure.
10. The system of claim 1 , wherein the second set of computer program instructions also is adapted to cause the printer to modify a file read operation.
11. The system of claim 10 , wherein the modified file read operation comprises a software filter that causes the printer to decrypt the print data.
12. The system of claim 1 , wherein the second set of computer program instructions comprises a PostScript procedure.
13. A system comprising:
a client computer adapted to:
(a) send first and second sets of computer program instructions to a printer, the first set of computer program instructions causing the printer to generate a first cryptographic key, the second set of computer program instructions causing the printer to decrypt encrypted print data using a second cryptographic key;
(b) use the first cryptographic key to generate the second cryptographic key;
(c) encrypt print data using the second cryptographic key; and
(d) send the encrypted print data to the printer;
wherein the printer is adapted to send the first cryptographic key to the client computer, and use the first cryptographic key to generate the second cryptographic key.
14. The system of claim 13 , wherein the first set of computer program instructions causes the printer to generate public and private keys of a key encryption algorithm.
15. The system of claim 14 , wherein the second cryptographic key is a shared secret key generated according to the Diffie-Hellman key agreement protocol.
16. The system of claim 13 , wherein the print data are encrypted using a cipher.
17. The system of claim 13 , wherein the first set of computer program instructions comprises a PostScript procedure.
18. The system of claim 13 , wherein the second set of computer program instructions comprises a PostScript procedure.
19. A system comprising:
a client computer adapted to:
(a) generate a public and private cryptographic key pair;
(b) send a key exchange program to a printer, the key exchange program generating a public and private cryptographic key pair at the printer and exchanging the public key of the printer with the public key of the client computer;
(c) generate a secret key using the printer's public key and the client computer's private key;
(d) provide a decryption program to the printer, wherein the decryption program is adapted to modify a file read operation at the printer;
(e) encrypt print data using the secret key; and
(f) send the encrypted print data to the printer;
wherein the printer is adapted to generate a copy of the secret key using the client computer's public key and the printer's private key, and implement the modified file read operation to decrypt the encrypted print data using the secret key.
20. The system of claim 19 , further comprising rendering the decrypted print data at the printer.
21. The system of claim 19 , wherein the key exchange program comprises a PostScript procedure.
22. The system of claim 19 , wherein the decryption program comprises a PostScript procedure.