Encryption of image data in a digital copier

[0001] The present invention relates to digital copiers, and to systems in which original hard-copy data is scanned and recorded as digital data, for subsequent storing or printing.

[0002] Digital copiers are now common in the office equipment industry. Whereas traditional analog or light-lens copiers, available for many decades, in effect take a photograph of a hard-copy document desired to be copied, a digital copier first converts the original images to a set of digital data which is retained in a memory. At a later time, the digital data is used to print out copies based on the original documents; the copies can be exact copies of the original documents, or the data can be manipulated in various ways to create prints based on the original data. Temporary storage of the image data in memory provides an opportunity for the image data to be altered for various reasons, such as cleaning up the image; enlarging or reducing the image; shifting or inverting the image; inserting variable data, etc. The temporary storage of the data also facilitates exporting the image data from the copier in electronic form, such as for electronic archiving purposes.

[0003] The storage of digital data, and in particular the retaining of image data in memory after the data has been used, such as after printing, may present a security vulnerability. It is conceivable that such abandoned data relating to images that have been scanned, still resident in a memory within a digital copier, could be hacked and accessed by a hostile party, either by electronic means or even by physically taking the copier. The present invention relates to methods of protecting such data within a copier, or, more broadly, within any system in which image data is scanned and retained for subsequent printing.

[0004] U.S. Pat. No. 5,629,981 discloses the use of RFID security badges in the context of office equipment such as copiers.

[0005] U.S. Pat. No. 6,049,872 discloses a method for authenticating a channel in large-scale distributed systems.

[0006] How PGP Works, from Introduction to Cryptography, 1990-1999 Network Associates, Inc., describes various common methods of encrypting electronic data, including the method known as Pretty Good Privacy or PGP.

[0007] Primer on Electronic Commerce and Intellectual Property Issues, World Intellectual Property Organization, Geneva, May 2000, pp. 79-84, discusses encryption techniques and concerns for electronic documents in the context of a large organization.

[0008] The Canon imageRUNNER 5000 digital copier (as described in a Canon USA press release, Dec. 5, 2001) includes a Secure Print function, in which a selected job in the print driver is printed out only upon entry of a user password. A Mail Box Printing function creates 100 security-coded mail boxes for storing print jobs and scanned documents.

[0009] According to one aspect of the present invention, there is provided a method of operating a digital copier, the digital copier including a scanner for recording image data, a memory for retaining image data, and a printer for printing an image based on the image data on a print sheet, the method comprising encrypting image data in the memory.

[0010] According to another aspect of the present invention, there is provided a method of operating at least one digital copier, the digital copier including a scanner for recording image data, a memory for retaining image data, and a printer for printing an image based on the image data on a print sheet, the method comprising retaining a key for decrypting the data in the memory.

[0011] According to another aspect of the present invention, there is provided a method of operating at least one digital copier, the digital copier including a scanner for recording image data, a memory for retaining image data, and a printer for printing an image based on the image data on a print sheet, the method comprising causing data in the memory to become substantially inaccessible in response to an alert.

[0012] FIG. 1 is a simplified elevational view of a digital copier and an associated computer, showing the essential elements thereof relevant to the present invention.

[0013] FIG. 2 is a diagram of a set of digital copiers and associated computers arranged on a network, showing an embodiment of the present invention.

[0014] FIG. 1 is a simplified elevational view of a digital copier and an associated computer, showing the essential elements thereof relevant to the present invention. Although the Figure shows the scanning and printing functions of a digital copier 10 within a single box, it is conceivable that the present invention can be embodied in a combination of separate devices, such as a standalone scanner, general-purpose computer, and network-controlled printer. One or more such copiers 10 can in turn be interconnected to any number of computers, and/or to each other, using known network protocols and systems; the invention could also be directed to a context including a facsimile machine. Original sheets, bearing images to be copied, are placed on an input tray 12, where they are automatically fed by generally known means such as a document handler including a constant-velocity transport (CVT) roll 14, and then placed in catch-tray 16. While each sheet is moved on CVT roll 14 through what can be called a scanner process direction P1, successive small areas on the sheet are illuminated and recorded by a linear photosensor array 18, which may be of any type known in the art such as a charge-coupled device (CCD) or CMOS device, along with appropriate optics (riot shown), which converts the light reflected by the small areas into digital data. The array 18 may also be used for exposure of images on sheets which are placed on a platen, in a manner familiar in the art.

[0015] The resulting digital data relating to all the images in a job to be copied is retained in what is here called a computer 20, which in a practical embodiment is a board comprising any number of processors, memory devices, etc., as is generally familiar in digital copiers. The computer 20 retains image data collected in the scanning process, and holds it temporarily until the image data is used to print copies. The computer may also be associated with a user interface (UI) 22 at the copier to receive instructions, such as through a touchscreen (not shown), or to accept physical items bearing digital data for any purpose, such as magnetic-stripe cards, wireless ID devices, or smart cards, as is familiar in the art.

[0016] In a digital copier using a xerographic laser printer to create images, the computer 20 ultimately operates hardware including a laser 30 which is used to discharge areas on a photoreceptor 32 in accordance with a page image desired to be printed (laser 30 could also be in the form of an LED array). The resulting electrostatic latent image is then developed with marking material at developer station 34. Blank sheets are then drawn one at a time from a stack 40 and moved through process direction P, and the marking material on the photoreceptor 32 is transferred to each sheet at transfer station 36. The output prints are then deposited in a tray 42, which may have associated therewith any number of finishing devices such as a stapler or folder (not shown).

[0017] Although the printer elements shown in FIG. 1 are xerographic or more broadly electrostatographic, other types of digital printing technology are of course also useable, such as ink-jet.

[0018] Various programs running within computer 20, as is generally known in the art, can perform certain basic image-manipulation operations on image data between the recordation thereof by array 18 and the digital output thereof through laser 30. For instance, known software techniques can be performed on the image data to effect a magnification or reduction of the original image in the images on the output sheets; the original images can be cleaned up in various ways through image processing algorithms; multiple original images can be printed 2-up or 4-up on each output sheet, such as for booklet making; the image data from hard-copy originals can be combined with variable data (such as addresses) originating from an external computer, etc.

[0019] The computer 20 on board the copier 10 includes what is here generally called a memory 50. This memory 50, which may in a practical embodiment include any number of memory chips and associated circuitry and software, retains image data (in compressed or uncompressed form, in some predetermined format) from original images from the scanner hardware, until the data is caused to operate the printer hardware to output prints.

[0020] With particular reference to the invention, there is provided, associated with memory 50, what is here called an encrypt device 52 and a decrypt device 54. The devices 52, 54 may be embodied within chips designed for the purpose, or could exist as software within the general functions of computer 20. As can be seen, the encrypt device 52 encrypts image data entering the memory 50 from the scanner hardware, and decrypt device 54 decrypts the data in memory 50 so that it may be used to output prints. The effect is that all image data, in whatever format, retained in memory 50 is encrypted.

[0021] As generally described in the article referenced above, most common encryption methods involve using some sort of encryption key, which is basically a number, in combination with an encryption algorithm which is applied to the data, yielding encrypted data. To decrypt the data, the key (or a special decryption key, which is related to the encryption key) is used in combination with a decryption algorithm. According to various generally-known techniques, these keys may be public or private: generally, while a public key can be used to encrypt data, a private key may be required to decrypt it. In particular, the method known as Pretty Good Privacy or PGP uses a session key which is a one-time-only symmetric private key, which is itself encrypted using a public key and sent to a recipient. In PGP as commonly practiced, digital data to be encrypted is itself encrypted with a session key, and then the session key is itself encrypted with a public key.

[0022] Another aspect of encryption alluded to in the article cited above is the use of incidental data as an aid in random number generation, such as could be used as keys at various times. In the PGP example, the incidental keyboard strokes and mouse movements by a human user are used to help generate random numbers for a particular session key. In the copier context, other sources of incidental data present themselves as well: for instance, any entry into a user interface for whatever reason, such as a job account number; the number of sheets scanned in the current or a previous job; the duration or time of day of scanning the current or a previous job; the size of a paper stack in a tray; etc., or a combination of these incidental data. Also, the fact each job may contain a plurality of page images facilitates a system whereby each page image in a job is assigned a different key, the different keys possibly being derived from different types of incidental data.

[0023] For various security requirements, different uses of keys may be carried out according to the invention. In the most basic case, a single key is used to encrypt data entering memory 50, and then to decrypt it incidental to printing. This will have the effect of encrypting all the data in memory 50. For more security, each job in memory, and perhaps even each page image in memory, can be assigned a different key, and these keys can be generated either by a random-number generator associated with computer 20 and/or some incidental data accessible to computer 20.

[0024] Another strategy is to retain all keys, or at least all necessary private keys, retained external to a particular copier 10, so that, if the copier 10 is stolen or otherwise inappropriately accessed, the keys will not be resident in the machine. Thus, an external computer 60, which communicates through a secure connection to the copier 10, can maintain a list (which may itself be encrypted) of keys for every job or page image in memory 50. The computer 60 may further keep track of keys as they relate to various human users who identify themselves (such as by entering passwords, ID numbers, or matter numbers) to particular copiers 10 at various times. The external computer may also serve as a source of incidental data (keystrokes, mouse clicks, etc., or incidental data from computers or copiers elsewhere on the network) from which keys can be derived. Alternately, a key could reside on a smart card or equivalent device which is retained by a human user and in effect read through, for instance, user interface 22 when the user walks up to the copier 10; in such a case, the user may also be required to enter a password which is consistent with his smart card.

[0025] In one embodiment of the invention, Pretty Good Privacy (PGP) is the basic encryption technique used in copier 10: in brief, the scanner acts as a sender and the printer acts as the recipient. Using PGP, the original data (as recorded by the scanner from scanned hard-copy images) is compressed according to any one of known techniques, such as LZ compression or its variants; as it happens, this is a typical step in digital copying anyway. The compression not only reduces the amount of data that must be encrypted, but also would confound many straightforward cryptological attack techniques. PGP then creates the session key, which is a random number typically derived from incidental data, such as keystrokes to UI 22, the behavior of feeders and paper trays, etc., as described above. A session key can alternately be created using the input of a smart card or similar device via UI 22. The session key is used with an algorithm to encrypt the data from the scanner hardware, yielding encrypted image data. Once the image data is encrypted, the session key is then encrypted using a public key, resulting in a public-key-encrypted session key. Incidental to printing, the copier uses a private key to recover the session key, which is then used to decrypt the image data stored in memory 50.

[0026] In a PGP embodiment of the present invention, different keys could be retained at different locations and exploited in different ways as desired. First, the public key used to encrypt the data may reside within computer 20 within copier 10, or can reside in an external computer 60, and would never be retained in a copier 10. The public key used may relate to an identified user who enters, as part of a copying job, a login code, security password, account identification, or network password in UI 22: indeed, different passwords or other identifications may invoke the use of different public keys. (In a sense, an entered password or other identification is a type of incidental data useful in random number generation.)

[0027] As for the private key necessary for decryption, similarly, such private keys could be invoked by entry of a suitable password or identification at UI 22, i.e., only a correct code would provide access to a private key, without which copying would be impossible. Even if a login or other security code (possibly in combination with entry of a smart card or other physical token) is entered at a copier 10, the actual invoked private key may reside elsewhere, such as at an external computer 60.

[0028] The session keys, which are unique to every session, can be created at every new copying job, or with every scanned page image even within a job, or can relate to a time of day or other incidental data.

[0029] With regard to external computer 60, such a computer, which may in fact be embodied in multiple computers and servers, may be provided by an independent arbiter, such as a trusted vendor who is independent of the owners or lessors of one or more copiers 10. FIG. 2 is a diagram of a set of digital copiers and associated computers arranged on a network, showing an embodiment of the present invention. In FIG. 2, a plurality of digital copiers 10 are connected, through known means such as one or more subnetworks 72, 74 connected through a router 76, to one or more computers 60, which can each retain keys for whatever purpose for copiers on its own subnetwork or another subnetwork.

[0030] External computer 60 may run an ongoing tally of all jobs or individual page images in all copiers associated therewith, maintaining the necessary decryption keys (such as session keys) and sending or otherwise invoking decryption keys as necessary. As such the ongoing tally of decryption keys may be retained in the computer 60 itself in encrypted form.

[0031] Another function of an independent arbiter controlling a computer 60 is to provide emergency services when a security breach has occurred or detected, or is suspected by a human operator (generally speaking, when an alert occurs). Returning to FIG. 1, a copier 10 can further be provided with a location device 56, which may be in the form of an RF identification badge, GPS-compatible device, or some other known device which can react to a change in physical location of the copier 10. Such a device 56 interacts with computer 20 to signal a change in physical location possibly consistent with a security breach, e.g., a person trying to steal copier 10. In response to such an alert, it is important to prevent access to or dissemination of encrypted data, such as could be stored in any copier 10 on a network, so that it cannot be decrypted in an unauthorized manner. There are several general approaches to this problem, and a specific implementation may include one or more aspects of the following approaches:

[0032] a) In the event of an alert, one or more copiers, such as defined by physical location or presence on a certain network or subnetwork, have the contents of their memories 50 made inaccessible (such as by causing hardware associated with the memory 50 to be disabled) or in effect erased (such as by overwriting data on the files). This can be initiated on a network basis by having a control computer 60 send to one or more selected copiers 10 a special instruction code, which each copier is programmed to respond to. For an individual copier 10, an alert can be initiated when an unanticipated network disruption occurs, or its location device 56 determines that the copier 10 is being moved. In a network context, a detected or suspected security breach at one copier 10 can trigger an alert involving, for example, all copiers sharing the same subnetwork, or all copiers in a predetermined physical relationship to the affected copier, such as all other copiers on the same floor or in the same building.

[0033] b) If all data is crucial to be retained, the contents of the memories of the copiers can be transferred to a special repository controlled by, or even resident in, control computer 60, which would also segregate (i.e., identify and keep track of) the keys of files entering the repository, before erasing the memories. The files can then be accessed from the repository and decrypted under more secure conditions. The repository can be controlled by the independent arbiter, and may itself be protected by various forms of firewall, such as could be put into place with a router such as 76.

[0034] c) In choosing to erase or transfer data from a memory 50 in a copier 10 in response to an alert, there may be discrimination. For example, a system in the computer can be designed to not erase files associated with a print job in progress; or will choose to erase only files associated with certain sensitive users (as determined by any login or smart card features associated with various job data) or jobs which users have in some manner indicated as sensitive. To save resources, files in a copier 10 which are, by an algorithm, determined to be too old may be simply erased without being transferred to the repository.

[0035] d) When a copier 10 is removed from a network, there may be provided a security procedure, such as entry of a password into a control computer 60. If the procedure is not followed, the keys for any jobs within the copier 10 which is illegally removed can be erased from computer 60, or otherwise segregated (such as by sending to another computer) for special treatment.

[0036] e) Another strategy against physical taking of a copier 10 is to cause the entire memory 50 to be erased in the event of unauthorized removal of the copier from the network, or even removal of the copier from a certain defined physical area (as can be enforced, for example, by using a RF tag, or GPS system associated with the copier). This erasure process can be initiated by re-power-up of the board containing memory 50 (but, of course, could be avoided by entry of a password or other procedure at power up).