Methods and systems for securely routing documents through third party infrastructures

Patent metadata

Field	Value
Publication number	US-10271206-B2
Application number	US-201615266189-A
Country	US
Kind code	B2
Filing date	Sep 15, 2016
Priority date	Sep 15, 2016
Publication date	Apr 23, 2019
Grant date	Apr 23, 2019

Abstract

A system may include a device having a program that includes a workflow system public key associated with a workflow system and programming instructions that allow the device to communicate with the workflow system over a communication network. The system may initialize a device by sending communications to the workflow system, receiving a response that includes information encrypted with a workflow system private key, and verifying the authenticity of the response by using the workflow system public key to decrypt the information in the response. The system may register the device for privacy treatment by the workflow system by generating a key pair that includes a client private key and a client public key, generating an encrypted client key by encrypting the client public key with the workflow system public key, including the encrypted client key in a privacy request, and sending the privacy request to the workflow system.

First claim

What is claimed is:

1. A method of securely transmitting information pertaining to a document to be printed, the method comprising, by a mobile electronic device:
initializing a mobile electronic device for communication with a print workflow system by:
sending one or more communications to the print workflow system, wherein the mobile electronic device comprises a mobile client application program that comprises a print workflow system public key and one or more programming instructions that allow the mobile electronic device to communicate with the print workflow system over a communication network, wherein the print workflow system is located remotely from the mobile electronic device and is associated with a document service provider,
receiving a response from the print workflow system that includes information encrypted with a print workflow system private key, wherein the information comprises a unique identifier associated with the mobile electronic device that has been assigned by the print workflow system, and
verifying the authenticity of the response by using the print workflow system public key to decrypt the information in the response;
registering the mobile electronic device for privacy treatment by the print workflow system by:
generating an encrypted client key by encrypting a client public key of the mobile electronic device with the print workflow system public key, and
generating a privacy request comprising:
a request from the mobile electronic device that the print workflow system process all submissions from the mobile electronic device in a secure manner, and the encrypted client key, and

sending the privacy request to the print workflow system;

identifying a submission stored on the mobile electronic device to securely send to the print workflow system;
creating a document based on the identified submission, wherein the document comprises three parts, wherein at least one part of the document comprises the unique identifier associated with the mobile electronic device encrypted with the print workflow system public key; and

sending the document to the print workflow system via one or more intermediaries to be securely printed, wherein each intermediary is associated with a different service provider than the document service provider.

2. A method of securely transmitting information pertaining to a document to be processed, the method comprising, by a client electronic device:
initializing a client electronic device for communication with a workflow system by:
sending one or more communications to the workflow system, wherein the client electronic device comprises a mobile client application program that comprises a workflow system public key and one or more programming instructions that allow the client electronic device to communicate with the workflow system over a communication network, wherein the workflow system is located remotely from the client electronic device and is associated with a document service provider;
receiving a response from the workflow system that includes information encrypted with a workflow system private key, and

verifying the authenticity of the response by using the workflow system public key to decrypt the information in the response; and
registering the client electronic device for privacy treatment by the workflow system by:
generating a key pair that includes a client private key and a client public key,
generating an encrypted client key by encrypting the client public key with the workflow system public key,

generating a privacy request comprising:
a request from the mobile electronic device that the print system process all submissions from the mobile electronic device in a secure manner, and the encrypted client key,
sending the privacy request to the workflow system;

identifying a submission to securely send to the workflow system;
creating a document based on the identified submission, wherein the document comprises three parts, wherein at least one part of the document comprises the unique identifier associated with the mobile electronic device encrypted with the workflow system public key.

3. The method of claim 2 , further comprising:
identifying a submission to securely send to the workflow system;
creating a document based on the identified submission; and
sending the document to the workflow system for processing.

4. The method of claim 2 , wherein creating a document based on the identified submission comprises creating a secure document comprising three parts.

5. The method of claim 2 , further comprising:
constructing a first part of the document by identifying the workflow system public key and an identifier associated with the workflow system, and including the workflow system public key and the identifier in the first part.

6. The method of claim 2 , further comprising constructing a second part of the document by:
generating, by a clock of the client electronic device, a timestamp associated with the submission;
encrypting the timestamp with the client private key;
identifying metadata associated with the submission, wherein the metadata includes:
a unique identifier associated with the client electronic device, wherein the unique identifier is assigned by the workflow system and included in the received response, and
a symmetric key;

encrypting the identified metadata with the workflow system public key; and adding the encrypted timestamp and the encrypted identified metadata to the second part.

7. The method of claim 2 , further comprising constructing a second part of the document by:
identifying metadata associated with the submission, wherein the metadata includes:
a unique identifier associated with the client electronic device, wherein the unique identifier is assigned by the workflow system and included in the received response, and a symmetric key;
encrypting the identified metadata with the workflow system public key and adding the encrypted identified metadata to the second part.

8. The method of claim 7 , further comprising constructing a third part of the document by:
identifying content of the submission;
encrypting the identified content using the symmetric key; and
including the encrypted identified content in the third part.

9. The method of claim 3 , wherein sending the document to the workflow system comprises sending the document to the workflow system via one or more intermediaries, wherein each intermediary is associated with a different service provider than the service provider.

10. A method of securely transmitting information pertaining to a document to be processed, the method comprising, by a workflow system:
receiving an initializing request from a client electronic device to initialize communication with the workflow system, wherein the client electronic device comprises a mobile client application program that comprises a workflow system public key and one or more instructions that allows the client electronic device to communicate with the workflow system via a communication network, wherein the workflow system is located remotely from the client electronic device;
generating a unique identifier associated with the client electronic device; sending a response to the client electronic device comprising content that is encrypted with a workflow system private key, wherein the content comprises the unique identifier;
receiving, from the client electronic device, a privacy request to treat data exchanged between the client electronic device and the workflow system in a secure manner, wherein the privacy request comprises an encrypted client key, wherein the encrypted client key comprises a client public key of the client electronic device that

Assignees

• Xerox Corp

Inventors

• Zehler Peter J

Classifications

• H04L63/0407

  wherein the identity of one or more communicating identities is hidden (cryptographic mechanisms or cryptographic arrangements for anonymous credentials or for identity based cryptographic systems H04L9/00) · CPC title

• G06F2221/2103

  Challenge-response · CPC title

• G06K15/4095

  Secure printing (computer driven secure printing G06F3/1238) · CPC title

• H04W12/02 Primary

  Protecting privacy or anonymity, e.g. protecting personally identifiable information [PII] · CPC title

• H04W12/04

  Key management, e.g. using generic bootstrapping architecture [GBA] · CPC title