Encrypted printing data analysis method, system and equipment based on IPP protocol and medium

Abstract

The invention provides an encrypted printing data analysis method, system and device based on an IPP protocol and a medium, and belongs to the technical field of printing data processing.The method comprises the following steps that an access control list, printer firmware and a firmware vulnerability list are configured in a printing server; a user extracts a key field from the IPP protocol data to carry out Hash operation, then calculates a signature as an extension field, adds the extension field into the IPP protocol data, and then sends the extension field to a print server; when the print server verifies that the user is in the access control list, key fields and signature data are analyzed from the IPP protocol data, and hash values of the key fields are calculated for signature verification; and the printing server regularly performs firmware integrity detection on the printers and sends the IPP protocol data passing the signature verification to the printers passing the firmware integrity detection. The security and reliability of the printing system are improved, and security threats caused by unauthorized access, data tampering and firmware vulnerabilities can be prevented.

Description

Technical Field

[0001] The present invention belongs to the technical field of print data processing, and provides an encrypted print data analysis method, system, device and medium based on the IPP protocol. Background Art

[0002] IPP, short for Internet Printing Protocol, is a standard network protocol for printing on the Internet. It is a protocol based on the Internet application layer, facing end users and end printing devices, enabling users to remotely print and manage printing jobs through the Internet.

[0003] In the current printing environment, as a widely used network printing protocol, the IPP protocol allows users to remotely manage and print files through the network. However, on the one hand, many printers supporting the IPP protocol do not enable necessary security measures, resulting in these devices being vulnerable to network attacks. Attackers can anonymously connect to these devices through the IPP protocol, manipulate printing jobs, and even obtain sensitive information of the printers, which may be used for further network attacks or intelligence collection. On the other hand, the IPP protocol uses means such as digital signatures and hash algorithms to ensure the integrity and authenticity of data, but these mechanisms may also be at risk of being bypassed or cracked. For example, some printer models may have firmware vulnerabilities, enabling attackers to bypass digital signatures, or abnormal situations such as network interruptions or data packet loss may occur during printing, resulting in the receiving party being unable to fully verify the integrity and authenticity of the data. At this time, attackers may take advantage of loopholes in the protocol implementation or construct specific data packets to deceive the verification mechanism, thereby achieving tampering, forgery or theft of encrypted print data. Summary of the Invention

[0004] In a first aspect, an embodiment of the present application provides an encrypted print data analysis method based on the IPP protocol, including the following steps: S1. Pre-configure an access control list, the firmware of the print terminal device, and a firmware vulnerability list on the print server; S2. The user terminal device extracts key fields from the IPP protocol data, calculates a signature after performing a hash operation on the key fields, adds the signed data as an extended field to the IPP protocol data, and sends it to the print server; S3. The print server verifies whether the user terminal device is in the access control list. When it is in the access control list, it parses the key fields and the signed data from the received IPP protocol data, calculates a hash operation on the key fields, and verifies the signature of the signed data. If the signature verification fails, the print data is discarded; S4. The printing server regularly performs firmware integrity detection on the printing terminal device and sends the IPP protocol data that passes the signature verification to the printing terminal device that passes the firmware integrity detection.

[0005] Further, the specific steps of step S1 are as follows: S11. Obtain the access permissions configured by the administrator user for the user device, and add the IP addresses of the user devices allowed to access the printing server to the access control list; S12. When the printing server detects that there is a new version of the firmware of the printing terminal device, download the firmware of the new version of the printing terminal device; S13. Detect and identify whether there are vulnerabilities in the firmware of the new version of the printing terminal device through the firmware vulnerability list; If so, do not perform firmware update, and feedback the firmware vulnerabilities, and end; If not, perform firmware update on the printing terminal device; S14. After the firmware update of the printing terminal device is completed, the printing server calculates the hash value of the firmware of the printing terminal device using the SHA-3 algorithm, encrypts it using the public key of the first key to obtain the firmware ciphertext, and then deletes the downloaded firmware of the printing terminal device.

[0006] Further, the specific steps of step S2 are as follows: S21. The user terminal device obtains the IPP protocol data to be printed and extracts the key fields; the key fields include the printing task name, the number of printed pages, and the number of copies; S22. The user terminal device splices the key fields into a string, calculates the hash value using the SHA-3 algorithm, and signs it using the private key of the second key to obtain the extended field; S23. The user terminal device adds the extended field to the IPP protocol data to be printed and then sends it to the printing server.

[0007] Further, the specific steps of step S3 are as follows: S31. After the printing server receives the data of the user terminal device, parse the IP address of the user terminal device from the IPP protocol data to be printed; S32. The printing server verifies whether the IP address of the user terminal device is in the access control list; If so, go to step S33; If not, discard the IPP protocol data to be printed and return an access permission error, and end; S33. The printing server parses the key fields and the extended field from the IPP protocol data to be printed; S34. The printing server concatenates the keyword fields into a string, calculates the hash value using the SHA-3 algorithm, and then performs signature verification using the public key of the second key. It compares whether the signature verification result is consistent with the extended field; If they are consistent, proceed to step S35; If they are inconsistent, discard the IPP protocol data to be printed, return a data error, and end; S35. The printing server parses the target printing terminal device from the IPP protocol data to be printed.

[0008] Further, the specific steps of step S4 are as follows: S41. The printing server periodically performs firmware integrity detection on the printing terminal device; If the firmware integrity detection passes, no mark is made on the printing terminal device; If the firmware integrity detection fails, the printing terminal device is marked; S42. The printing server determines whether the target printing terminal device is marked; If it is, discard the IPP protocol data to be printed, return a printer error, and end; If not, proceed to step S43; S43. The printing server sends the IPP protocol data to be printed to the target printing terminal device to complete the printing.

[0009] Further, the specific steps of step S41 are as follows: S411. The printing server periodically sends a firmware detection request to the printing terminal device; S412. After receiving the firmware detection request, the printing terminal device calculates the hash value of the firmware of the printing terminal device using the SHA-3 algorithm, and then encrypts it using the private key of the first key to obtain the encrypted firmware, and returns it to the printing server; S413. The printing server compares whether the encrypted firmware is the same as the firmware ciphertext; If they are the same, it is determined that the firmware integrity detection of the printing terminal device passes; If they are different, it is determined that the firmware integrity detection of the printing terminal device fails.

[0010] Further, the following steps are also included in step S1: The printing terminal device generates the public key and private key of the first key, saves the private key of the first key, and sends the public key of the first key to the printing server through the HTTPS protocol; The user terminal device generates the public key and private key of the second key, saves the private key of the second key, and sends the public key of the second key to the printing server through the HTTPS protocol.

[0011] In a second aspect, an encrypted print data analysis system based on the IPP protocol provided by an embodiment of the present application includes: A print security configuration module, configured to pre-configure an access control list, the firmware of a print terminal device, and a vulnerability detection model in a print server; A print data signature module, configured to extract key fields from IPP protocol data, calculate a signature after performing a hashing operation on the key fields, add the signed data as an extended field to the IPP protocol data, and send the data to the print server; A print data reception security verification module, configured to verify whether a user terminal device is in the access control list, and when it is in the access control list, parse the key fields and the signed data from the received IPP protocol data, perform a hashing operation on the key fields and then verify the signature of the signed data. If the signature verification fails, the print data is discarded; A print data transmission security verification module, configured to periodically perform firmware integrity detection and vulnerability scanning on a print terminal device, and send the IPP protocol data that passes the signature verification to the print terminal device that passes the firmware integrity detection and vulnerability scanning.

[0012] In a third aspect, an electronic device provided by an embodiment of the present application includes a memory, a processor, and a computer program stored on the memory and executable on the processor. When the processor executes the program, the steps of the encrypted print data analysis method based on the IPP protocol described in the first aspect are implemented.

[0013] In a fourth aspect, a storage medium provided by an embodiment of the present application stores a computer program, and when the computer program is executed by a processor, the steps of the encrypted print data analysis method based on the IPP protocol described in the first aspect are implemented.

[0014] From the above technical solutions, it can be seen that the present invention has the following advantages: In the method, system, device, and medium for encrypted print data analysis based on the IPP protocol provided by this application, by configuring an access control list, it precisely controls which user devices are authorized to access the print service, effectively blocking unauthorized access attempts, preventing the leakage of sensitive information and potential security threats. By performing signature processing on the print data, using hash operations and encryption algorithms to generate a unique and tamper-proof signature, it ensures the integrity and authenticity of the data. Moreover, the signature verification operation when the print server receives the data verifies whether the source of the data is legal and whether the content has been tampered with. Any data that fails the signature verification will be immediately discarded, effectively preventing data tampering and forgery. By regularly detecting the firmware integrity of the print terminal device, it ensures that the firmware version is correct and has not been maliciously modified, effectively preventing security vulnerabilities caused by firmware tampering. And by combining firmware vulnerability scanning technology, it timely discovers and fixes known security vulnerabilities, avoiding security threats caused by firmware defects and enhancing the overall security of the print terminal device. BRIEF DESCRIPTION OF THE DRAWINGS

[0015] To more clearly illustrate the technical solutions of the present invention, the accompanying drawings required for description will be briefly introduced below. Obviously, the accompanying drawings in the following description are only some embodiments of the present invention. For those of ordinary skill in the art, without creative efforts, other drawings can be obtained based on these drawings.

[0016] Figure 1 It is a schematic flowchart of an embodiment of the method for encrypted print data analysis based on the IPP protocol of the present invention.

[0017] Figure 2 It is a schematic flowchart of another embodiment of the method for encrypted print data analysis based on the IPP protocol of the present invention.

[0018] Figure 3 It is a schematic diagram of the system for encrypted print data analysis based on the IPP protocol of the present invention.

[0019] Figure 4 It is a schematic diagram of the electronic device storing the method for encrypted print data analysis based on the IPP protocol of the present invention. DETAILED DESCRIPTION OF THE EMBODIMENTS

[0020] In the following, the specific steps of the method for encrypted print data analysis based on the IPP protocol will be described in detail, and various embodiments of the present disclosure will be described more comprehensively. The present disclosure can have various embodiments, and adjustments and changes can be made therein. However, it should be understood that there is no intention to limit the various embodiments of the present disclosure to the specific embodiments disclosed herein, but the present disclosure should be understood to cover all adjustments, equivalents, and / or alternative solutions falling within the spirit and scope of the various embodiments of the present disclosure.

[0021] Exemplarily speaking, in the current network printing field, as a highly popular network printing protocol, the IPP protocol enables users to remotely manage and print files. However, it is worth noting that many printers supporting the IPP protocol have deficiencies in security protection, making them vulnerable to network attacks. Attackers can connect to these printers via the IPP protocol without authentication, then manipulate printing tasks and even illegally obtain sensitive information in the printers, which may be used for deeper network attacks or intelligence activities. At the same time, although the IPP protocol uses security means such as digital signatures and hash algorithms to ensure data integrity and authenticity, these protection measures also face the potential risks of being circumvented or cracked. For example, the firmware of some printer models may have vulnerabilities, enabling attackers to bypass the digital signature mechanism; in addition, during the printing process, if abnormal situations such as network failures or data loss occur, the receiving party will not be able to effectively verify the integrity and authenticity of the data. In this case, attackers may take advantage of security flaws in the protocol implementation or deceive the verification mechanism through carefully designed data packets to tamper with, forge, or steal encrypted printing data.

[0022] To address the above problems, this embodiment provides an encrypted print data analysis method based on the IPP protocol. By configuring access control lists, signing and verifying print data, detecting firmware integrity and scanning for vulnerabilities of print terminal devices, etc., this method effectively improves the security and reliability of the printing system, can prevent unauthorized access, data tampering, and security threats caused by firmware vulnerabilities, and provides strong security guarantees for enterprise printing services.

[0023] Next, the technical solutions in the embodiments of the present invention will be clearly and completely described in conjunction with the accompanying drawings in the embodiments of the present invention. Obviously, the described embodiments are only a part of the embodiments of the present invention, rather than all of the embodiments. Based on the embodiments of the present invention, all other embodiments obtained by those of ordinary skill in the art without creative efforts shall fall within the protection scope of the present invention.

[0024] Please refer to Figure 1 The following is a flowchart of an encrypted print data analysis method based on the IPP protocol in a specific embodiment. The method includes the following steps: S1. Pre-configure an access control list, the firmware of the print terminal device, and a firmware vulnerability list on the print server; It should be noted that pre-configuring the access control list on the print server can determine which user devices can access the printing service), configuring the firmware of the print terminal device can ensure that the print terminal device uses the correct software version, and configuring the firmware vulnerability list can identify and prevent known security vulnerabilities in the firmware; S2. The user terminal device extracts key fields from the IPP protocol data, calculates a signature after performing a hash operation on the key fields, adds the signed data as an extended field to the IPP protocol data, and sends it to the print server; It should be noted that before sending the print data, the user terminal device extracts key fields such as print task information from the IPP protocol data, generates a signature after performing a hash operation on these key fields, adds this signature as an extended field to the IPP protocol data, and then sends it to the print server, ensuring the reliable source and integrity of the data; S3. The print server verifies whether the user terminal device is in the access control list. When it is in the access control list, it parses the key fields and the signed data from the received IPP protocol data, calculates a hash operation on the key fields, and then verifies the signature of the signed data. If the signature verification fails, the print data is discarded; It should be noted that after receiving the data, the print server first verifies whether the user terminal device sending the data is in the access control list. If it is in the list, it parses the key fields and the signature, and re - calculates the hash operation on the key fields to verify the validity of the signature. If the signature verification fails, the print data is discarded to prevent unauthorized or tampered data from being printed; S4. The print server periodically performs firmware integrity detection on the print terminal device, and sends the IPP protocol data that passes the signature verification to the print terminal device that passes the firmware integrity detection; It should be noted that after confirming the validity of the data, the print server also periodically performs firmware integrity detection on the print terminal device to ensure that it has not been maliciously tampered with or has security vulnerabilities. Only the print terminal device that passes the firmware integrity detection will receive the IPP protocol data that passes the signature verification and perform the printing operation.

[0025] An encrypted print data analysis method based on the IPP protocol provided by the present invention precisely controls which user devices have the right to access the print service by configuring an access control list, effectively blocking unauthorized access attempts, preventing the leakage of sensitive information and potential security threats, signing the print data, generating a unique and tamper-proof signature using hash operations and encryption algorithms, ensuring the integrity and authenticity of the data, and the print server performs a signature verification operation when receiving the data to verify whether the data source is legal and whether the content has been tampered with. Any data that fails the signature verification will be immediately discarded, effectively preventing data tampering and forgery behaviors; regularly detecting the firmware integrity of the print terminal device to ensure that the firmware version is correct and not maliciously modified, effectively preventing security vulnerabilities caused by firmware tampering, and combining firmware vulnerability scanning technology to timely discover and repair known security vulnerabilities, avoiding security threats caused by firmware defects, and improving the overall security of the print terminal device.

[0026] Further, as a refinement and extension of the specific implementation manner of the above embodiment, in order to completely illustrate the specific implementation process in this embodiment, another encrypted print data analysis method based on the IPP protocol is provided, as Figure 2 shown. This method includes the following steps: S1. Pre-configure an access control list, the firmware of the print terminal device, and a firmware vulnerability list in the print server; the specific steps of step S1 are as follows: S11. Obtain the access rights configured by the administrator user for the user device, and add the IP addresses of the user devices allowed to access the print server to the access control list. S12. When the print server detects that there is a new version of the firmware of the print terminal device, download the new version of the firmware of the print terminal device. S13. Detect and identify whether there are vulnerabilities in the new version of the firmware of the print terminal device through the firmware vulnerability list. If so, do not perform firmware update, and feedback the firmware vulnerabilities, and end. If not, perform firmware update on the print terminal device. S14. After the firmware update of the print terminal device is completed, the print server calculates the hash value of the firmware of the print terminal device using the SHA-3 algorithm, encrypts it using the public key of the first key to obtain the firmware ciphertext, and then deletes the downloaded firmware of the print terminal device. It should be noted that through the configuration process of the access control list, and how to maintain the security of the print terminal device through firmware update and vulnerability detection, prevent security threats caused by firmware vulnerabilities, and improve the overall security of the print system. S2. The user terminal device extracts key fields from the IPP protocol data, calculates a signature after performing a hash operation on the key fields, adds the signed data as an extended field to the IPP protocol data, and sends it to the print server. The specific steps of step S2 are as follows: S21. The user terminal device obtains the IPP protocol data to be printed and extracts the key fields. The key fields include the print job name, the number of printed pages, and the number of copies. S22. The user terminal device concatenates the key fields into a string, calculates the hash value using the SHA-3 algorithm, and then signs it using the private key of the second key to obtain the extended field. S23. The user terminal device adds the extended field to the IPP protocol data to be printed and then sends it to the print server. It should be noted that the specific process of signing the IPP protocol data to be printed by the user terminal device ensures the reliability and integrity of the data source, and through the hash operation and private key signature, the anti-tampering ability of the data is increased. S3. The print server verifies whether the user terminal device is in the access control list. When it is in the access control list, it parses the key fields and the signed data from the received IPP protocol data, calculates the hash operation on the key fields, and then verifies the signature of the signed data. If the signature verification fails, the print data is discarded. The specific steps of step S3 are as follows: S31. After receiving the data from the user terminal device, the print server parses the IP address of the user terminal device from the IPP protocol data to be printed. S32. The print server verifies whether the IP address of the user terminal device is in the access control list. If it is, go to step S33. If not, discard the IPP protocol data to be printed, return an access permission error, and end. S33. The print server parses the key fields and the extended field from the IPP protocol data to be printed. S34. The print server concatenates the key fields into a string, calculates the hash value using the SHA-3 algorithm, and then verifies the signature using the public key of the second key, and compares whether the verification result is consistent with the extended field. If they are consistent, go to step S35. If they are not consistent, discard the IPP protocol data to be printed, return a data error, and end. S35. The print server parses the target print terminal device from the IPP protocol data to be printed. It should be noted that by verifying the access rights and data integrity of the user terminal device through the print server and by comparing the hash value and signature verification result, the occurrence of forged data and unauthorized access is effectively prevented; Specifically, the second key adopts an ECDSA key pair. The hash value of the string of the key field is signed through the ECDSA signature algorithm, and the SECP256R1 elliptic curve is used to obtain a 64-byte signature result. The signature result is added to the extended field in the IPP protocol data and transmitted together with other data. After the print server receives the data, it first extracts the signature result, then extracts the key field used during signing from the IPP protocol data, concatenates them into a string in the same format and performs SHA-3-256 hashing operation, and then uses the same ECDSA public key as the user terminal device to verify the hash value and the signature result through the ECDSA signature verification algorithm. If the verification passes, it indicates that the integrity and authenticity of the IPP protocol data have not been damaged and can be safely accepted and processed; if the verification fails, it is possible that the data has been tampered with during transmission. According to the security requirements of the application scenario, the data can be selected to be discarded or other processing can be performed. Here, the security features of the ECDSA algorithm and the SHA-3 key hash function are utilized, which can effectively prevent the IPP protocol data from being tampered with and forged, and improve the security of protocol communication.

[0027] Similarly, the first key also adopts an ECDSA key pair, which can effectively prevent the firmware of the printing terminal device from being tampered with, ensure the integrity of the printing terminal device, and prevent vulnerability attacks; S4. The print server regularly performs firmware integrity detection on the printing terminal device and sends the IPP protocol data that passes the signature verification to the printing terminal device that passes the firmware integrity detection; The specific steps of step S4 are as follows: S41. The print server regularly performs firmware integrity detection on the printing terminal device; If the firmware integrity detection passes, the printing terminal device is not marked; If the firmware integrity detection fails, the printing terminal device is marked; S42. The print server determines whether the target printing terminal device is marked; If so, the IPP protocol data to be printed is discarded, and a printer error is returned, and the process ends; If not, go to step S43; S43. The print server sends the IPP protocol data to be printed to the target printing terminal device to complete the printing; It should be noted that by regularly detecting the firmware integrity of the printing terminal device, the normal operation and security of the printing terminal device are ensured. By marking the printing terminal device with unqualified firmware integrity, potential security risks are avoided.

[0028] In an embodiment of the present invention, based on step S41, the following will give a possible embodiment to non-restrictively elaborate on its specific implementation.

[0029] The specific steps of step S41 are as follows: S411. The printing server regularly sends a firmware detection request to the printing terminal device; After receiving the firmware detection request, the printing terminal device calculates the hash value of the firmware of the printing terminal device using the SHA-3 algorithm, and then encrypts it using the private key of the first key to obtain the encrypted firmware, and returns it to the printing server; S413. The printing server compares whether the encrypted firmware is the same as the firmware ciphertext; If they are the same, it is determined that the firmware integrity detection of the printing terminal device passes; If they are different, it is determined that the firmware integrity detection of the printing terminal device fails; It should be noted that through the firmware integrity detection process including the comparison of encrypted hash values, it is possible to accurately determine whether the firmware of the printing terminal device has been tampered with, improving the accuracy and efficiency of the detection.

[0030] Another method for encrypting and analyzing printing data based on the IPP protocol provided in this embodiment may further include in step S1: The printing terminal device generates the public key and private key of the first key, saves the private key of the first key, and sends the public key of the first key to the printing server through the HTTPS protocol; The user terminal device generates the public key and private key of the second key, saves the private key of the second key, and sends the public key of the second key to the printing server through the HTTPS protocol.

[0031] Specifically, the private key for encrypting IPP protocol data by the user terminal device is generated by the printing terminal device, and the public key is transmitted to the printing server. The private key for encrypting the firmware by the printing terminal device is generated by the printing terminal device, and the public key is transmitted to the printing server, thus avoiding the transmission of the private key and ensuring the security of the private key. By securely transmitting the public key of the key through the HTTPS protocol, the security of the key exchange is ensured, which provides a reliable basis for the subsequent signature and verification processes; In addition, the public keys of the printing terminal device and the user terminal device saved by the printing server need to be regularly verified for validity; For example, the print server calculates the hash value of the public key of the printing terminal device and saves it. It regularly requests the printing terminal device to provide the public key, calculates the hash value of the newly provided public key, and then compares it with the saved hash value. If they are inconsistent, it means that the public key has been tampered with or replaced, and the print server refuses to send IPP protocol data to this printing terminal device anymore.

[0032] Similarly, the print server calculates the hash value of the public key of the user terminal device and saves it. It regularly requests the user terminal device to provide the public key, calculates the hash value of the newly provided public key, and then compares it with the saved hash value. If they are inconsistent, it means that the public key has been tampered with or replaced, and the print server refuses to receive the IPP protocol data sent by this user terminal device anymore.

[0033] Taking an enterprise that decides to adopt an encrypted print data analysis method based on the IPP protocol to improve the security of the print system as an example, this enterprise has multiple printers supporting the IPP protocol and hopes to prevent unauthorized access, data tampering, and security threats caused by firmware vulnerabilities by implementing the present invention.

[0034] The specific implementation is as follows: I. Pre-configuration Access control list: The administrator configures access permissions for the user devices allowed to access the print server and adds the IP addresses of these devices to the access control list. Firmware and vulnerability management: The print server detects that there is a new version of the firmware for a certain printing terminal device, so it downloads the new version of the firmware. It detects the new version of the firmware through the firmware vulnerability list and finds that there are no vulnerabilities, so it updates the firmware of this printing terminal device. After the update is completed, the print server calculates the hash value of the new firmware using the SHA-3 algorithm and encrypts it using the public key of the first key to obtain the firmware ciphertext. Subsequently, it deletes the downloaded firmware file.

[0035] II. Data signature Extract key fields: The user terminal device is about to print a file and extracts the key fields from the IPP protocol data, including the print task name "Report", the number of printed pages "10", and the number of copies "2". Calculate hash value and signature: Concatenate these key fields into a string "Report102", calculate the hash value using the SHA-3 algorithm, and sign the hash value using the private key of the second key to obtain the extended field. Send data: The user terminal device adds the extended field to the IPP protocol data to be printed and sends it to the print server. III. Data verification Parse the IP address and verify access rights. After receiving the data, the print server parses the IP address of the user terminal device and verifies whether the IP address is in the access control list. Since the device is in the list, it proceeds to the next step of verification. Parse the key field and verify the signature. The print server parses the key field and the extended field from the data, concatenates the key field into a string, and calculates the hash value using the SHA-3 algorithm. It uses the public key of the second key to verify the signature of the extended field and compares the signature verification result with the calculated hash value. Since the two are consistent, the verification passes. Parsing the target printing terminal device, the print server parses the identifier of the target printing terminal device from the data.

[0036] 4. Firmware integrity detection and data transmission Firmware integrity detection: The print server periodically performs firmware integrity detection on the print terminal device. For the target print terminal device, the print server initiates a firmware detection request to it. After receiving the request, the print terminal device calculates the hash value of the firmware, encrypts it with the private key of the first key, and then returns it to the print server. The print server compares the encrypted firmware with the firmware ciphertext and finds that the two are the same, so it determines that the firmware integrity detection has passed. Data is sent. Since the firmware integrity test of the target printing terminal device passes and the data verification also passes, the print server sends the IPP protocol data to be printed to the target printing terminal device, completing the printing task.

[0037] Ultimately, through the above-mentioned encrypted printing data analysis method based on the IPP protocol, the company successfully provided the security of the printing system. Unauthorized devices could not access the print server, the data was effectively protected during transmission, and the firmware of the printing terminal device was also regularly tested and updated, which ultimately provided a strong guarantee for the company's printing security.

[0038] It should be understood that the order of execution of the steps in the above embodiment does not necessarily mean the order of execution. The execution order of each process should be determined by its function and internal logic, and should not constitute any limitation on the implementation process of the embodiment of the present invention.

[0039] like Figure 3 As shown, the following is an embodiment of the encrypted printing data analysis system based on the IPP protocol provided by the embodiment of the present disclosure. The system and the encrypted printing data analysis method based on the IPP protocol in the above-mentioned embodiments belong to the same inventive concept. For details not described in detail in the embodiment of the encrypted printing data analysis system based on the IPP protocol, please refer to the embodiment of the encrypted printing data analysis method based on the IPP protocol.

[0040] The system includes: A print security configuration module, which is used to pre-configure an access control list, the firmware of the print terminal device, and a vulnerability detection model on the print server; A print data signature module, which is used to extract key fields from IPP protocol data, calculate a signature after performing a hash operation on the key fields, add the signed data as an extended field to the IPP protocol data, and send it to the print server; A print data reception security verification module, which is used to verify whether the user terminal device is in the access control list. When it is in the access control list, it parses the key fields and the signed data from the received IPP protocol data, performs a hash operation on the key fields, and then verifies the signature of the signed data. If the signature verification fails, the print data is discarded; A print data transmission security verification module, which is used to periodically perform firmware integrity detection and vulnerability scanning on the print terminal device, and send the IPP protocol data that passes the signature verification to the print terminal device that passes the firmware integrity detection and vulnerability scanning.

[0041] An encrypted print data analysis system based on the IPP protocol provided by the present invention precisely controls which user devices have the right to access the print service by configuring an access control list, effectively blocking unauthorized access attempts, preventing the leakage of sensitive information and potential security threats. By signing the print data, a unique and tamper-proof signature is generated using a hash operation and an encryption algorithm, ensuring the integrity and authenticity of the data. Moreover, the signature verification operation when the print server receives the data verifies whether the source of the data is legal and whether the content has been tampered with. Any data that fails the signature verification will be immediately discarded, effectively preventing data tampering and forgery behaviors. By periodically performing firmware integrity detection on the print terminal device, it ensures that the firmware version is correct and has not been maliciously modified, effectively preventing security vulnerabilities caused by firmware tampering. And combined with the firmware vulnerability scanning technology, known security vulnerabilities are discovered and repaired in a timely manner, avoiding security threats caused by firmware defects, and improving the overall security of the print terminal device.

[0042] Figure 4 A schematic diagram of the hardware structure of an electronic device for implementing various embodiments of the present invention.

[0043] The encryption print data analysis method based on the IPP protocol provided by the embodiments of the present application can be applied to an electronic device. Those skilled in the art can understand that the structure of the electronic device involved in the embodiments of the present invention does not constitute a limitation on the electronic device. The electronic device may include more or fewer components than shown in the figure, or combine certain components, or have different component arrangements. In the embodiments of the present invention, the electronic device includes, but is not limited to, a laptop computer, a desktop computer, a workbench, a personal digital assistant, a server, a blade server, a mainframe computer, and other suitable computers. The electronic device may also represent various forms of mobile devices, such as, a personal digital processor, a cellular phone, a smart phone, a wearable device, and other similar computing devices. The components shown herein, their connections and relationships, and their functions are merely examples and are not intended to limit the implementation of the embodiments of the present application described herein and / or claimed.

[0044] The electronic device may include a processor, an external memory interface, an internal memory, a universal serial bus (USB) interface, a charging management module, a power management module, a battery, a wireless communication module, an audio module, a speaker, a microphone, a sensor module, a key, a camera, a display screen, and a SIM card interface, etc.

[0045] It can be understood that the structure schematically shown in the embodiments of the present application does not constitute a specific limitation on the electronic device. In other embodiments of the present application, the electronic device may include more or fewer components than shown in the figure, or combine certain components, or split certain components, or have different component arrangements. The components shown in the figure may be implemented in hardware, software, or a combination of software and hardware.

[0046] The processor may include one or more processing units. For example, the processor may include a central processing unit (CPU), etc., an application processor (AP), a modem processor, a graphics processing unit (GPU), an image signal processor (ISP), a controller, a memory, a video codec, a digital signal processor (DSP), a baseband processor, and / or a neural-network processing unit (NPU), etc. Among them, different processing units may be independent devices or integrated in one or more processors.

[0047] Among them, the processor can be the nerve center and command center of the electronic device. The controller can generate operation control signals according to the instruction operation code and timing signal to complete the control of fetching and executing instructions.

[0048] A memory can also be set in the processor for storing instructions and data. In some embodiments, the memory in the processor is a cache memory. This memory can save the instructions or data that the processor has just used or recycled. If the processor needs to use the instruction or data again, it can directly call it from this memory. This avoids repeated accesses, reduces the waiting time of the processor, and thus improves the system efficiency.

[0049] The above-mentioned electronic device implements the technical solutions of the encrypted print data analysis method based on the IPP protocol of the present application by configuring an access control list, signing and verifying the print data, and performing firmware integrity detection and vulnerability scanning on the print terminal device, achieving the beneficial effects of improving the security and reliability of the print system, being able to prevent unauthorized access, data tampering, and security threats caused by firmware vulnerabilities, and providing a strong security guarantee for the enterprise's print service.

[0050] In the storage medium provided by the present application, there is a program product capable of implementing the encrypted print data analysis method based on the IPP protocol.

[0051] The encrypted print data analysis method based on the IPP protocol includes: pre-configuring an access control list, the firmware of the print terminal device, and a firmware vulnerability list in the print server; the user terminal device extracts key fields from the IPP protocol data, calculates a signature after performing a hash operation on the key fields, adds the signed data as an extended field to the IPP protocol data, and sends it to the print server; the print server verifies whether the user terminal device is in the access control list, and when it is in the access control list, parses the key fields and the signed data from the received IPP protocol data, calculates a hash operation on the key fields, and verifies the signed data. If the verification fails, the print data is discarded; the print server regularly performs firmware integrity detection on the print terminal device and sends the IPP protocol data that passes the verification to the print terminal device that passes the firmware integrity detection.

[0052] In some possible implementation manners, the encrypted print data analysis method based on the IPP protocol of the present disclosure can be implemented in the form of a program product, which includes program code. When the program product runs on the terminal device, the program code is used to cause the terminal device to execute the steps according to various exemplary embodiments of the present disclosure described in the "Exemplary Method" section above of this specification.

[0053] The storage medium of the present disclosure may employ any combination of one or more readable media. The readable media may be a readable signal medium or a readable storage medium. The readable storage medium may be, for example, but not limited to, an electrical, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or any combination of the foregoing. More specific examples (a non-exhaustive list) of the readable storage medium include: an electrical connection with one or more wires, a portable disk, a hard disk, a random access memory (RAM), a read-only memory (ROM), an erasable programmable read-only memory (EPROM or flash memory), an optical fiber, a portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

[0054] The foregoing description of the disclosed embodiments enables those skilled in the art to practice or use the present invention. Various modifications to these embodiments will be readily apparent to those skilled in the art, and the general principles defined herein may be implemented in other embodiments without departing from the spirit or scope of the present invention. Thus, the present invention is not intended to be limited to the embodiments shown herein but is to be accorded the widest scope consistent with the principles and novel features disclosed herein.

Claims

1. A method for analyzing encrypted print data based on the IPP protocol, characterized in that It includes the following steps: S1. Pre-configure an access control list, the firmware of the printing terminal device, and a firmware vulnerability list in the print server; S2. The user terminal device extracts key fields from the IPP protocol data, calculates a signature after performing a hash operation on the key fields, adds the signed data as an extended field to the IPP protocol data, and sends it to the print server; S3. The print server verifies whether the user terminal device is in the access control list. When it is in the access control list, it parses the key fields and the signed data from the received IPP protocol data, calculates a hash operation on the key fields, and verifies the signature of the signed data. If the signature verification fails, the print data is discarded; S4. The print server periodically performs firmware integrity detection on the printing terminal device and sends the IPP protocol data that passes the signature verification to the printing terminal device that passes the firmware integrity detection.

2. The encrypted print data analysis method based on the IPP protocol according to claim 1, characterized in that The specific steps of step S1 are as follows: S11. Obtain the access permissions configured by the administrator user for the user device, and add the IP addresses of the user devices allowed to access the print server to the access control list; S12. When the print server detects that there is a new version of the firmware of the printing terminal device, it downloads the firmware of the new version of the printing terminal device; S13. Detect and identify whether there are vulnerabilities in the firmware of the new version of the printing terminal device through the firmware vulnerability list; If so, do not perform firmware update, and feedback the firmware vulnerability, and end; If not, perform firmware update on the printing terminal device; S14. After the firmware update of the printing terminal device is completed, the print server calculates the hash value of the firmware of the printing terminal device using the SHA-3 algorithm, encrypts it using the public key of the first key to obtain the firmware ciphertext, and then deletes the downloaded firmware of the printing terminal device.

3. The encrypted print data analysis method based on the IPP protocol according to claim 2, wherein, The specific steps of step S2 are as follows: S21. The user terminal device obtains the IPP protocol data to be printed and extracts the key fields; the key fields include the print job name, the number of printed pages, and the number of print copies; S22. The user terminal device concatenates the key fields into a string, calculates the hash value using the SHA-3 algorithm, and signs it using the private key of the second key to obtain the extended field; S23. The user terminal device adds the extended field to the IPP protocol data to be printed and then sends it to the print server.

4. The encrypted print data analysis method based on the IPP protocol according to claim 3, wherein The specific steps of step S3 are as follows: S31. After the print server receives the data of the user terminal device, it parses the IP address of the user terminal device from the IPP protocol data to be printed; S32. The print server verifies whether the IP address of the user terminal device is in the access control list; If so, go to step S33; If not, discard the IPP protocol data to be printed and return an access permission error, and end; S33. The print server parses the key fields and the extended field from the IPP protocol data to be printed; S34. The print server concatenates the key fields into a string, calculates the hash value using the SHA-3 algorithm, and verifies the signature using the public key of the second key, and compares whether the signature verification result is consistent with the extended field; If they are consistent, go to step S35; If they are inconsistent, discard the IPP protocol data to be printed, return a data error, and end; S35. The printing server parses the target printing terminal device from the IPP protocol data to be printed.

5. The encryption print data analysis method based on the IPP protocol according to claim 4, wherein, The specific steps of step S4 are as follows: S41. The printing server periodically performs firmware integrity detection on the printing terminal device; If the firmware integrity detection passes, do not mark the printing terminal device; If the firmware integrity detection fails, mark the printing terminal device; S42. The printing server determines whether the target printing terminal device is marked; If so, discard the IPP protocol data to be printed, return a printer error, and end; If not, proceed to step S43; S43. The printing server sends the IPP protocol data to be printed to the target printing terminal device to complete the printing.

6. The method for analyzing encrypted print data based on the IPP protocol according to claim 5, wherein The specific steps of step S41 are as follows: S411. The printing server periodically sends a firmware detection request to the printing terminal device; After receiving the firmware detection request, the printing terminal device calculates the hash value of the firmware of the printing terminal device using the SHA-3 algorithm, and then encrypts it using the private key of the first key to obtain the encrypted firmware, and returns it to the printing server; S413. The printing server compares whether the encrypted firmware is the same as the firmware ciphertext; If they are the same, it is determined that the firmware integrity detection of the printing terminal device passes; If they are different, it is determined that the firmware integrity detection of the printing terminal device fails.

7. The method for analyzing encrypted print data based on the IPP protocol according to claim 6, characterized in that, The following steps are also included in step S1: The printing terminal device generates the public key and private key of the first key, saves the private key of the first key, and sends the public key of the first key to the printing server through the HTTPS protocol; The user terminal device generates the public key and private key of the second key, saves the private key of the second key, and sends the public key of the second key to the printing server through the HTTPS protocol.

8. An encrypted print data analysis system based on the IPP protocol, characterized in that, It includes: A printing security configuration module for pre-configuring an access control list, the firmware of the printing terminal device, and a vulnerability detection model in the printing server; A printing data signature module for extracting key fields from the IPP protocol data, calculating a signature after performing a hash operation on the key fields, adding the signed data as an extended field to the IPP protocol data, and sending it to the printing server; A printing data reception security verification module for verifying whether the user terminal device is in the access control list, and when it is in the access control list, parsing the key fields and the signed data from the received IPP protocol data, performing a hash operation on the key fields, and verifying the signature of the signed data. If the signature verification fails, discard the printing data; A printing data sending security verification module for periodically performing firmware integrity detection and vulnerability scanning on the printing terminal device, and sending the IPP protocol data that passes the signature verification to the printing terminal device that passes the firmware integrity detection and vulnerability scanning.

9. An electronic device, comprising a memory, a processor, and a computer program stored on the memory and executable on the processor, characterized in that, When the processor executes the program, it implements the steps of the encrypted print data analysis method based on the IPP protocol according to any one of claims 1 to 7.

10. A storage medium having a computer program stored thereon, characterized in that, When the computer program is executed by a processor, it implements the steps of the IPP protocol-based encrypted print data analysis method according to any one of claims 1 to 7.

Images