Printer identity and security

Patent metadata

Field	Value
Publication number	US-10872161-B2
Application number	US-201715821162-A
Country	US
Kind code	B2
Filing date	Nov 22, 2017
Priority date	Nov 23, 2016
Publication date	Dec 22, 2020
Grant date	Dec 22, 2020

Abstract

A system and method for establishing a secure identity for a printing device at the time of manufacturing is provided. The method includes obtaining a first private key for use with a first operation of the printing device and obtaining a second private key for use with a second operation of the printing device. The method also includes loading the first private key into a secure memory portion of the printing device during manufacturing of the printing device, and loading the second private key into the secure memory portion of the printing device during manufacturing of the printing device.

First claim

The invention claimed is:

1. A printing device comprising:
a housing;
a card input in the housing;
a card travel path that extends through the housing from the card input;
a print engine disposed along the card travel path;
a non-secure memory portion; and
a secure memory portion that is an isolated memory portion and is distinct and/or separate from the non-secure memory portion, wherein the secure memory portion includes a crypto processor, wherein the secure memory portion stores a unique and secure identity of the printing device,
wherein the secure memory portion has access to at least one private key, each of the at least one private key associated with an operation performed by the printing device,
wherein the crypto processor validates an authorization request associated with a requested operation to be performed by the printing device using the at least one private key associated with the requested operation, and
wherein the printing device performs the requested operation upon validation by the crypto processor of the authorization request,
wherein the printing device stores at least one public key or cryptographic hash associated with a secure boot operation.

2. The printing device of claim 1 , wherein the secure memory portion includes at least one factory established private key.

3. The printing device of claim 1 , wherein the print engine performs at least one of retransfer printing, direct to card printing, ink jet printing, laser marking, and laser engraving on a card.

4. The printing device of claim 1 , wherein the crypto processor identifies the at least one private key associated with the requested operation to be performed by the printing device.

5. The printing device of claim 1 , wherein the crypto processor validates the authorization request by decrypting the requested operation using the authorization request and the at least one private key.

6. The printing device of claim 1 , wherein the at least one private key stored in the secure memory portion is not accessible on a bus of the printing device.

7. The printing device of claim 1 , wherein the non-secure memory portion and the secure memory portion are part of a single memory device with the secure memory portion isolated from the non-secure memory portion.

8. The printing device of claim 1 , wherein the secure memory portion stores a storage root key that protects the at least one private key stored outside of the secure memory portion.

9. The printing device of claim 1 , wherein the secure memory portion stores the at least one private key.

10. The printing device of claim 1 , wherein the requested operation to be performed by the printing device includes at least one of: authentication of the printing device by a cloud server/service; authentication of supplies for use by the printing device; authentication of the printing device by a printer client using a printer protocol; authentication of signed firmware for modification; authentication of a print manager; authentication of a modular device security; authentication of a configuration setting of the printing device; authentication of a source of a print job and/or a configuration data; authentication of a secure and/or measured boot of the printing device; a Secure Sockets Layer/Transport Layer Security (SSL/TLS) authentication; authentication of a modular device security; a dual authentication; authentication of a private key storage; authentication of a file system encryption; and a payload encryption.

11. The printing device of claim 1 , further comprising a printer functionality component that performs a physical action on a customized personalization document.

12. The printing device of claim 11 , wherein the printer functionality component is at least one of:
a magnetic stripe station that reads and/or writes data on a magnetic stripe of a card; and
a chip programming station that reads and/or writes data on a chip of a card.

13. The printing device of claim 9 , wherein the card is a financial or identification card and the printer functionality component includes a print engine that prints custom specific information onto the financial or identification card.

14. The printing device of claim 11 , further comprising a second printer functionality component that performs a second physical action on the customized personalization document, wherein the second physical action is different than the first physical action.

15. The printing device of claim 1 , further comprising:
a network input/output receives the authorization request from an external secondary device,
wherein the secure memory portion retrieves a particular private key of the at least one private key associated with the requested operation,
wherein the printing device determines whether the requested operation is validated using the authorization request and the retrieved particular private key, and
wherein the printing device performs the requested operation when the requested operation is validated.

16. The printing device of claim 15 , wherein the authorization request is a public key.

17. The printing device of claim 15 , wherein the crypto processor validates the authorization request using the authorization request and the at least one private key associated with the requested operation.

Assignees

• Entrust Corp

Inventors

• Juriasingani Rajesh K

Classifications

• H04L9/321

  involving a third party or a trusted authority · CPC title

• H04L9/006

  involving public key infrastructure [PKI] trust models (network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823) · CPC title

• H04L9/0894

  Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage · CPC title

• H04N2201/0082

  Image hardcopy reproducer (H04N2201/0091 - H04N2201/0094 take precedence) · CPC title

• H04N1/4433

  to an apparatus, part of an apparatus or an apparatus function · CPC title