System and method for securing a content creation device connected to a cloud service
A certified application is installed onto a content creation device and a mobile certified application is installed onto a mobile device, the applications establish first and second trust relationships with the cloud service. The certified application and mobile certified application establish the third trust relationship via a proximity network. The mobile certified application generates a first ephemeral key pair having a private part. The certified application generates a second ephemeral key pair having a private part. The mobile certified application requests a service from the content creation device involving the transfer of data between the content creation device and the cloud service. The data is protected by at least one of the first and second ephemeral key pairs in response to invocation of the service. The service results in the data being stored at the cloud service and/or rendered at the content creation device.
1. A method comprising:
installing a certified application onto a content creation device from a cloud service, the certified application establishing a first trust relationship with the cloud service, wherein the content creation device comprises a multifunction printer;
installing a mobile certified application onto a mobile device from the cloud service, the mobile certified application establishing a second trust relationship with the cloud service;
coupling the mobile device to the content creation device via a proximity network to establish a third trust relationship via the certified application and mobile certified application, particulars of the third trust relationship being managed by the cloud service wherein the certified application and the mobile certified application can rely on the third trust relationship as being valid for at least a single transaction;
generating, via the mobile certified application, a first ephemeral key pair having a private part that is private to the mobile device;
generating, via the certified application, a second ephemeral key pair having a private part that is private to the content creation device; and
requesting, via the mobile certified application, a service from the content creation device, the service involving transfer of data of a document between the content creation device and the cloud service or transfer of the data of the document between the mobile device and the content creation device, the data being protected by at least one of the first and second ephemeral key pairs in response to invocation of the service, wherein protecting the document involves performing one of: sending a public part of the first ephemeral key pair to the content creation device; or sending a public part of the second ephemeral key pair to the mobile device.
2. The method of claim 1 , wherein the service comprises scanning of the document by the content creation device and the data comprises a digital file of the scanned document, the protecting of the digital file comprising encrypting the digital file using the public part of the first ephemeral key pair before storing the encrypted digital file at the cloud service via the first trust relationship.
3. The method of claim 2 , wherein the public part of the first ephemeral key pair is sent from the mobile certified application to the certified application of the content creation device.
4. The method of claim 2 , wherein the public part of the first ephemeral key pair is sent from the cloud service to the certified application of the content creation device at the request of the mobile certified application.
5. The method of claim 1 , wherein the data comprises an encrypted file stored on the cloud service that is encrypted with the first ephemeral key pair, the service comprising:
transferring the encrypted file from the cloud service to the mobile device;
decrypting the encrypted file at the mobile device using the first ephemeral key pair to obtain a digital copy of the document;
encrypting the digital copy of the document using the public part of the second ephemeral key pair received from the content creation device to create a second encrypted file;
decrypting the second encrypted file at the content creation device; and
printing the decrypted digital copy of the document at the content creation device.
6. The method of claim 5 , wherein the public part of the second ephemeral key pair is sent from the certified application on the content creation device to the mobile certified application.
7. The method of claim 5 , wherein the encrypted file is transferred from the cloud service to the mobile device via the content creation device.
8. The method of claim 1 , wherein the proximity network comprises a Bluetooth connection.
9. A system comprising:
a cloud service configured to provide a data storage service and first and second certified applications, the cloud service operable to establish a peer trust relationship between the first and second certified applications;
a content creation device onto which the first certified application is installed, the content creation device comprising a multifunction printer that is network-coupled to the cloud service via a first trust relationship;
a mobile device onto which the second certified application is installed, the mobile device being network-coupled to the cloud service via second trust relationship and locally network coupled to the content creation device using the peer trust relationship, particulars of the peer trust relationship being managed by the cloud service wherein the first certified application and the second certified application can rely on the peer trust relationship as being valid for at least a single transaction, the mobile device configured via the second certified application to:
generate a first ephemeral key pair comprising a private part that is private to the mobile device; and
request a service from the content creation device using the peer trust relationship, the service involving transfer of data of a document between the content creation device and the cloud service or transfer of the data between the mobile device and the content creation device, the data being protected by at least one of the first ephemeral key pair and a second ephemeral key pair of the content creation device in response to invocation of the service, the second ephemeral key pair having a private part that is private to the content creation device, wherein protecting the document involves performing one of: sending a public part of the first ephemeral key pair to the content creation device; or sending a public part of the second ephemeral key pair to the mobile device.
10. The system of claim 9 , wherein the service comprises scanning of the document by the content creation device and the data comprises a digital file of the scanned document, the protecting of the digital file comprising encrypting the digital file using the public part of the first ephemeral key pair before storing the encrypted digital file at the cloud service via the first trust relationship.
11. The system of claim 10 , wherein the public part of the first ephemeral key pair is sent from the mobile certified application to the certified application of the content creation device.
12. The system of claim 10 , wherein the public part of the first ephemeral key pair is sent from the cloud service to the certified application of the content creation device at the request of the mobile certified application.
13. The system of claim 9 , wherein the data comprises an encrypted file stored on the cloud service that is encrypted with the first ephemeral key pair, the service comprising:
transferring the encrypted file from the cloud service to the mobile device;
decrypting the encrypted file at the mobile device using the first ephemeral key pair to obtain a digital copy of a document;
encrypting the digital copy of the document using the public part of the second ephemeral key pair received from the content creation device to create a second encrypted file;
decrypting the second encrypted file at the content creation device; and
printing the decrypted digital copy of the document at the content creation device.
14. The system of claim 13 , wherein the public part of the second ephemeral key pair is sent from the certified application on the content creation device to the mobile certified application.
15. The system of claim 13 , wherein the encrypted file is transferred from the cloud service to the mobile device via the content creation device.
16. The system of claim 9 , wherein the mobile device is coupled to the content creation device via a Bluetooth connection.
17. A system comprising:
a cloud service configured to provide a data storage service and first and second certified applications, the cloud service operable to establish a peer trust relationship between the first and second certified applications;
a content creation device onto which the first certified application is installed, the content creation device comprising a multifunction printer that is network-coupled to the cloud service via a first trust relationship;
a mobile device onto which the second certified application is installed, the second certified application generating a mobile ephemeral key pair, the mobile device being network-coupled to the cloud service via second trust relationship and locally network coupled to the content creation device using the peer trust relationship, particulars of the peer trust relationship being managed by the cloud service wherein the first certified application and the second certified application can rely on the peer trust relationship as being valid for at least a single transaction, the content creation device configured via the first certified application to:
generate an ephemeral key pair comprising a private part that is private to the content creation device; and
service a request from the mobile device using the peer trust relationship, the service involving transfer of data of a document between the content creation device and the cloud service or transfer of the data between the mobile device and the content creation device, the data being protected by at least one of the ephemeral key pair and the mobile ephemeral key pair in response to invocation of the service, wherein protecting the document involves performing one of: sending a public part of the mobile ephemeral key pair to the content creation device; or sending a public part of the ephemeral key pair to the mobile device.
18. The system of claim 17 , wherein the service comprises scanning of the document and the data comprises a digital file of the scanned document, the protecting of the digital file comprising encrypting the digital file using the public part of the mobile ephemeral key pair generated by the second certified application before storing the encrypted digital file at the cloud service via the first trust relationship.
19. The system of claim 18 , wherein the public part of the mobile ephemeral key pair is sent from the second certified application to the first certified application of the content creation device.
20. The system of claim 18 , wherein the public part of the mobile ephemeral key pair is sent from the cloud service to the first certified application of the content creation device at the request of the second certified application of the mobile device.
21. The system of claim 17 , wherein the data comprises an encrypted file stored on the cloud service that is encrypted with the mobile ephemeral key pair generated by the second certified application, the service comprising:
transferring the encrypted file from the cloud service to the mobile device;
decrypting the encrypted file at the mobile device using the mobile ephemeral key pair to obtain a digital copy of the document;
encrypting the digital copy of the document using the public part of the ephemeral key pair received from the content creation device to create a second encrypted file;
decrypting the second encrypted file at the content creation device; and
printing the decrypted digital copy of the document at the content creation device.