Methods and apparatus for secure document printing
View Patent ↗A secure document printing system is provided. A policy server is used to define access rules for a document, and select individual users and/or groups that will have access to the document. The policy server stores the access rules along with a document decryption key. The policy server's name and address are packed in the document, and then encrypted and sent to a print server which stores it for later access. A recipient is notified that the document resides on a particular print server. The print server retrieves the specified document, contacts the policy server named in the document, and requests the document decryption key and access rules for the user, print server, and document from the policy server which replies with the related decryption key and access rules. The print server decrypts the document and prints the document based on the access rules.
1. A method for securely transporting and printing documents in a networked environment, the method comprising:
providing a policy server configured for storing at least one decryption key for at least one document, wherein said at least one decryption key is used in enforcing a corresponding set of print access rules;
wherein an access-managing user defines said corresponding set of print access rules for the at least one document through the policy server;
wherein the corresponding set of print access rules include rules relating to a number of times a document may be printed,
wherein the corresponding set of print access rules include rules relating to an expiration date after which the document may no longer be printed,
wherein the print access rules apply to any of: an individual user and a group of users at a receiving computer;
wherein the print access rules define any of: the expiration date and the maximum number of prints;
wherein the policy server stores the corresponding set of print access rules and the at least one decryption key for the at least one document;
wherein a computer of the access-managing user is configured for encrypting the at least one document and attaching any of the policy server's name, IP address or URL address to the at least one document;
sending, from said access-managing user's computer, said encrypted document to a receiving user's computer;
wherein the receiving user's computer stores the document locally for later access;
responsive to the receiving user requesting, at a later time than when said document was locally stored, the at least one document be printed, the receiving user's computer retrieving the at least one document from local storage, contacting the policy server, and requesting therefrom said corresponding set of print access rules and the at least one decryption key for the at least one document, wherein the policy server references the document, an identifier of the receiving user, and a computer ID of the user's computer to retrieve the decryption key and access rules for the document and wherein the policy server tracks which computers can print the document and which printer that the user's computer is connected to can print the document;
responsive to said receiving user's computer receiving said corresponding set of print access rules and the at least one decryption key, decrypting the at least one document using the at least one document's at least one decryption key from the policy server;
wherein said receiving user's computer is configured for evaluating the print access rules for the at least one document in relation to the receiving user and the receiving user's computer and configured for sending the pages of the at least one document that are printable by the receiving user and receiving user's computer to a printer for printing; and
causing the pages that are printable to be printed on said printer.
2. The method of claim 1 , wherein the receiving user is notified when the at least one document is not printable.
3. The method of claim 1 , wherein the print access rules specify one or more print servers that are allowed to print the at least one document.
4. Apparatus for securely transporting and printing documents in a networked environment, the apparatus comprising:
a policy server configured for storing at least one decryption key for at least one document, wherein said at least one decryption key is used in enforcing a corresponding set of print access rules;
wherein an access-managing user defines said corresponding set of print access rules for the at least one document through the policy server;
wherein the corresponding set of print access rules include rules relating to a number of times a document may be printed,
wherein the corresponding set of print access rules include rules relating to an expiration date after which the document may no longer be printed;
wherein the print access rules apply to any of: an individual user and a group of users at a receiving computer;
wherein the policy server stores the corresponding set of print access rules and the at least one decryption key for the document;
wherein the computer of the access-managing user is configured for encrypting the at least one document and attach any of the policy server's name, IP address or URL address to the document;
said access-managing user's computer configured for sending the encrypted document to a receiving user's computer;
wherein the receiving user's computer stores the document locally for later access;
wherein the receiving user's computer is configured for retrieving the at least one document from local storage, contacting the policy server, and requesting therefrom said corresponding set of print access rules and the at least one decryption key for the at least one document, responsive to the receiving user requesting, at a later time than when said document was locally stored, the at least one document be printed, wherein the policy server references the document, an identifier of the receiving user, and a computer ID of the user's computer to retrieve the decryption key and access rules for the document and wherein the policy server tracks which computers can print the document and which printer that the user's computer is connected to can print the document;
wherein the receiving user's computer is configured for decrypting, at the receiving user's computer, the at least one document using the at least one document's at least one decryption key from the policy server, responsive to said receiving user's computer receiving said corresponding set of print access rules and the at least one decryption key; and
wherein the receiving user's computer is configured for evaluating the print access rules for the at least one document in relation to the receiving user and the receiving user's computer and for sending the pages of the at least one document that are printable by the receiving user and receiving user's computer to a printer for printing; and
wherein the printer is configured to print the pages that are printable.
5. The apparatus of claim 4 , wherein the receiving user is notified when the at least one document is not printable.
6. The apparatus of claim 4 , wherein the print access rules specify one or more print servers that are allowed to print the at least one document.