Intelligent printer built-in network flow protection method and device

Abstract

The invention relates to the technical field of printer network information security, and provides an intelligent printer internal network flow protection method and device, and the method comprises the steps: receiving a data message header sent by user equipment; identifying a service type indicated by the data message header, and judging whether the service type meets an access blocking condition or not; if yes, storing the data message header into a cache queue; and detecting whether a real user approaches, if the real user approaches the printer, extracting the data message header from the cache queue for the user to select after the state of the printer is determined, and releasing the data message content corresponding to the data message header selected by the user for the printer to execute. According to the method, the security of the printer can be improved.

Description

Technical Field

[0001] This application relates to the field of printer network information security technology, and in particular to an intelligent method and device for protecting printer-inherent network traffic. Background Technology

[0002] With the widespread adoption of digitalization and networking, network printers have become indispensable products in office settings. However, reports indicate that many printers are exposed to the network, making them targets for attacks. This is especially true with the further expansion of the Internet of Things (IoT) and the development of IPv6, ushering in an era of ubiquitous connectivity. This increased exposure of printers to the network exacerbates the risks, making them frequent targets for attacks. Attackers can exploit exposed printers to launch denial-of-service attacks, leak user privacy data, and gain unauthorized access and control.

[0003] The root cause lies in the fact that printers, in order to respond to printing requests at any time, are usually exposed to the network 24 hours a day. This always-on working mode is convenient for users, but on the other hand, it creates the largest attack window. Its attack time is far longer than that of traditional PCs. In particular, when printer manufacturers save energy, they usually turn off the screen and other devices to make it appear to be in sleep mode, but in fact, it is always monitoring the network environment.

[0004] Traditional security measures, such as setting passwords, deploying firewalls, and updating firmware, can mitigate some risks, but they cannot fundamentally change the printer's passive and continuously exposed vulnerability, resulting in low printer security. Summary of the Invention

[0005] This application provides an intelligent method and device for protecting printer-embedded network traffic, which can solve the problem of low printer security.

[0006] In a first aspect, embodiments of this application provide an intelligent method for protecting printer-inherent network traffic, the method comprising:

[0007] Receive data packet headers sent to the printer by the user equipment;

[0008] Identify the service type indicated by the data packet header and determine whether the service type indicated by the data packet header meets the access blocking conditions;

[0009] If the access blocking condition is met, the data packet header is stored in the cache queue;

[0010] Detect whether a real user is approaching the printer; if so, determine the supported service type based on the printer's device status.

[0011] Extract the data header that matches the service type supported by the printer from the cache queue; provide the extracted data header information to the user for selection so that the printer can execute the data header selected by the user.

[0012] Optionally, if the service type indicated by the data packet header does not meet the access blocking conditions, the subsequent data packet content corresponding to the data packet header is allowed to be sent so that the printer can execute the data packet.

[0013] Optionally, when the service type indicated by the data packet header is a printer add request or a printer status query request, the service type indicated by the data packet header does not meet the access blocking condition.

[0014] Optionally, detect whether a real user is approaching the printer, including:

[0015] Obtain user status information, which includes printer button usage information, user infrared information, user action information, and user document placement information;

[0016] The acquired user status information is input into a pre-trained convolutional neural network to obtain the probability that a real user approaches the printer.

[0017] If the probability is greater than the preset threshold, it is confirmed that a real user has approached the printer; otherwise, it is confirmed that no real user has approached the printer.

[0018] Optionally, the method further includes:

[0019] Clear data packet headers from the cache queue that have been stored for a duration exceeding a threshold; the cache queue stores a maximum of N data packet headers, where N is a positive integer.

[0020] Secondly, embodiments of this application provide an intelligent printer-embedded network traffic protection device, comprising:

[0021] The receiving module is used to receive the data packet headers sent to the printer by the user equipment;

[0022] The type identification module is used to identify the service type indicated by the data packet header;

[0023] The condition judgment module is used to determine whether the service type indicated by the data packet header meets the access blocking condition based on the service type indicated by the data packet header.

[0024] The storage module is used to store the data packet header into a cache queue when the service type indicated by the data packet header meets the access blocking condition.

[0025] The user monitoring module is used to detect whether a real user is approaching the printer;

[0026] The device status detection module is used to determine the supported service type based on the device status of the printer when a real user approaches the printer.

[0027] The extraction module is used to extract data headers that are consistent with the service types supported by the printer from the cache queue; and to provide the extracted data header information to the user for selection, so that the printer can execute the data header selected by the user.

[0028] Thirdly, embodiments of this application provide a terminal device, including a memory, a processor, and a computer program stored in the memory and executable on the processor. When the processor executes the computer program, it implements the aforementioned printer-inherent network traffic protection method.

[0029] Fourthly, embodiments of this application provide a computer-readable storage medium storing a computer program that, when executed by a processor, implements the aforementioned printer intrinsic network traffic protection method.

[0030] The above-mentioned solution in this application has the following beneficial effects:

[0031] In the embodiments of this application, the decision to allow a data packet is determined by the service type indicated in the header of the data packet sent by the user equipment. When the service type meets the blocking conditions, the data packet header is first buffered. If a real user is detected approaching and the printer status supports the normal operation of the service type, the buffered data packet header is then provided to the user to select the service to be executed, and then the data packet corresponding to the data packet header is allowed for the printer to execute. In this application, a "security gate" is added before the printer receives and executes the data packet. The printer does not directly face the network packets; the "security gate" only allows the data packet header to pass through. The decision to allow the data packet for the printer to execute is based on the service type indicated in the header. If it is a service such as printing or scanning, the data packet is blocked from being transmitted to the printer. Instead, it is further determined whether a real user is approaching the printer. If no real user is approaching the printer, the "security gate" blocks the data packet. Here, the user approaching the printer essentially means determining whether the user intends to use the printer.

[0032] In network attacks, attackers often send commands containing malicious operations to printers over long-distance networks. Based on the solution in this application, only the header of the message is received and processed before the actual user is detected; the actual data in the message does not affect the printer. Secondly, attackers do not actually operate the printer, meaning the commands sent by the attacker will not be selected for execution by the user. Based on the solution in this application, the time the printer is directly exposed to the network can be reduced, avoiding a continuously vulnerable state and effectively improving printer security. Attached Figure Description

[0033] To more clearly illustrate the technical solutions in the embodiments of this application, the drawings used in the description of the embodiments or the prior art will be briefly introduced below. Obviously, the drawings described below are only some embodiments of this application. For those skilled in the art, other drawings can be obtained based on these drawings without creative effort.

[0034] Figure 1 A flowchart of an embodiment of the intelligent printer native network traffic protection method provided in this application;

[0035] Figure 2 A flowchart of a second embodiment of an intelligent printer intrinsic network traffic protection method provided in this application;

[0036] Figure 3 A flowchart of Embodiment 3 of the intelligent printer intrinsic network traffic protection method provided in this application;

[0037] Figure 4 This is a schematic diagram of the structure of a printer native network traffic protection device provided in an embodiment of this application;

[0038] Figure 5 This is a schematic diagram of the structure of a terminal device provided in an embodiment of this application. Detailed Implementation

[0039] In the following description, specific details such as particular system architectures and techniques are set forth for illustrative purposes and not for limitation, in order to provide a thorough understanding of the embodiments of this application. However, those skilled in the art will understand that this application may also be implemented in other embodiments without these specific details. In other instances, detailed descriptions of well-known systems, apparatuses, circuits, and methods have been omitted so as not to obscure the description of this application with unnecessary detail.

[0040] It should be understood that, when used in this application specification and the appended claims, the term "comprising" indicates the presence of the described features, integrals, steps, operations, elements and / or components, but does not exclude the presence or addition of one or more other features, integrals, steps, operations, elements, components and / or a collection thereof.

[0041] It should also be understood that the term “and / or” as used in this application specification and the appended claims means any combination of one or more of the associated listed items and all possible combinations, and includes such combinations.

[0042] As used in this application specification and the appended claims, the term "if" may be interpreted, depending on the context, as "when," "once," "in response to determination," or "in response to detection." Similarly, the phrase "if determined" or "if detected [the described condition or event]" may be interpreted, depending on the context, as meaning "once determined," "in response to determination," "once detected [the described condition or event]," or "in response to detection [the described condition or event]."

[0043] Furthermore, in the description of this application and the appended claims, the terms "first," "second," "third," etc., are used only to distinguish descriptions and should not be construed as indicating or implying relative importance.

[0044] References to "one embodiment" or "some embodiments" as described in this specification mean that one or more embodiments of this application include a specific feature, structure, or characteristic described in connection with that embodiment. Therefore, the phrases "in one embodiment," "in some embodiments," "in other embodiments," "in still other embodiments," etc., appearing in different parts of this specification do not necessarily refer to the same embodiment, but rather mean "one or more, but not all, embodiments," unless otherwise specifically emphasized. The terms "comprising," "including," "having," and variations thereof mean "including but not limited to," unless otherwise specifically emphasized.

[0045] To address the issue of low security in existing printers, this application provides an intelligent method for protecting printer-embedded network traffic. (Refer to...) Figure 1 The flowchart shown includes the following steps:

[0046] Step 11: Receive the data packet header sent by the user equipment to the printer.

[0047] Step 12: Identify the service type indicated by the data packet header and determine whether the service type indicated by the data packet header meets the access blocking conditions.

[0048] Step 13: If the access blocking condition is met, the data packet header is stored in the cache queue.

[0049] Step 14: Detect if a real user is approaching the printer. If so, determine the supported service type based on the printer's device status.

[0050] Step 15: Extract the data header that matches the service type supported by the printer from the cache queue; provide the extracted data header information to the user for selection so that the printer can execute the data header selected by the user.

[0051] After successfully establishing communication by handshaking upon receiving a connection request from the user, the printer receives the header of the data packet sent by the user equipment, identifies the service type indicated by the header, and determines whether the service type meets the access blocking condition. If the service type meets the access blocking condition, the printer stores the data packet in the buffer queue.

[0052] The system then checks whether a real user is approaching the printer and the types of services the printer supports (printing, scanning, etc.). This detection essentially checks the user's intention to approach the printer. After obtaining the detection result, the system retrieves data packet headers from the cache queue for the user to choose from. Preferably, it selects a data packet header that matches the service type supported by the printer. The system then allows the data packet content corresponding to the selected header to be sent to the printer's service resolver so that the printer can execute the user's command. This reduces the time the printer is exposed to the network, preventing it from being in a continuously vulnerable state and effectively improving printer security.

[0053] The following is an exemplary description of the printer-inherent network traffic protection method provided in this application.

[0054] like Figure 2 As shown in the flowchart of Embodiment 2 of the intelligent printer intrinsic network traffic protection method provided in this application, the steps include:

[0055] Step 21: Receive the data packet header sent by the user equipment to the printer.

[0056] The user equipment and the printer establish a network communication connection through a handshake mechanism. After the connection is established, the user equipment sends data packets to the printer (the printer can also be understood as the printer's network service port or the printer itself). The data packets include a data packet header and a packet content. The data packet header contains the service type of the user task. For example, the service type can be a printer add request, a printer status query request, or other requests (such as connection requests for printing, scanning, etc.).

[0057] In some embodiments of this application, scripts, software, etc., based on Transmission Control Protocol / Internet Protocol (TCP / IP) can be built using tools such as MicroPython to receive data packets.

[0058] Step 22: Identify the service type indicated by the data packet header and determine whether the service type indicated by the data packet header meets the access blocking conditions.

[0059] Specifically, the printer's service resolver can analyze the message header to determine the service type. If the service type is a printer add request or printer status query request, then the service type of the data message does not meet the access blocking condition. In this case, the data message content after the header is allowed to proceed for the printer to execute. For operations performed by the printer, such as printing or scanning, the service type of the data message can be considered to meet the access blocking condition.

[0060] For example, a user's job service type is usually reflected in the fields of the header of the data packet. Different network connection types have different header formats. By analyzing the header, the user's job service type can be obtained.

[0061] Step 23: When the service type indicated by the data packet header meets the access blocking condition, the data packet header is stored in the cache queue.

[0062] The aforementioned cache queue includes multiple data packet headers, with a maximum number that can be set to an upper limit N, where N is a positive integer, such as 10. A threshold duration can be set for the cache time of data packet headers. Data packet headers whose cache time exceeds the threshold will be cleared so that the cache queue can cache new data packet headers. Data packet headers selected by the user will also be cleared from the cache queue.

[0063] Step 24: Detect if a real user is approaching the printer.

[0064] This step is used to detect whether a legitimate user is approaching the printer, preventing malicious attacks on the printer by remote users over the network. Detecting the presence of a legitimate user can also be understood as detecting the intent of a legitimate user, that is, the probability that a legitimate user intends to use the printer to perform a legitimate operation.

[0065] The following example illustrates this. The presence of a real user can be determined through user interaction with the printer. If a user enters a certain range of the printer and interacts with it, but does not actually enter the printer's range or interact with it, then it is not considered that a real user intends to approach and use the printer. This can be determined by detecting the user's infrared information using infrared devices, or by detecting specific actions the user performs within a certain range of the printer, such as in a scanning scenario. Alternatively, it can be determined by detecting corresponding actions the user takes when placing the scanned document, such as in glass-stage scanning where the user needs to open the glass stage cover to place the original document.

[0066] The methods described above can initially determine whether a real user is present, but false positives are possible. For example, a user who is not intending to print or scan may approach the printer without demonstrating any intention to use it. Therefore, sensors and other devices can be used to acquire user state information. Convolutional neural networks can be pre-trained using this sample user state information, with the probability of whether a user is a genuine user intending to use the printer as the output. First, a dataset is created using actual user actions that demonstrate an intention to use the printer, serving as a training sample database. This database is then used to train a relatively coarse AI model. This coarse AI model can then be deployed in practice, and further fine-tuning can be performed based on actual user states and actions during real-world use.

[0067] The aforementioned user status information may include user key usage information (used to describe the interaction information between the user and the keys on the printer), user infrared information (used to describe whether the user is close to the printer), user action information (used to describe the actions the user performs within a certain range of the printer), and user document placement information (used to describe whether the user has placed a document on the printer).

[0068] Step 25: When a real user is detected approaching the printer, determine the supported service type based on the printer's device status.

[0069] The printer's device status determines the types of services it can support. Printers contain numerous sensors that work together to maintain normal operation. Therefore, based on parameters from these sensors, it's possible to determine if the printer can perform certain operations (i.e., which service types it supports), such as printing or scanning. Printing requires certain conditions, such as the availability of toner, paper in the paper feed, suitable temperature, and no printer malfunctions. Different jobs require different conditions. Therefore, initial device status data (which could be operating parameters of various printer components) can be collected by performing different user jobs on different printer models for training. In practical applications, the various device status data are input into the trained model, which then determines the types of services supported by the device status.

[0070] Step 26: Extract the data header that matches the service type supported by the printer from the cache queue; provide the extracted data header information to the user for selection so that the printer can execute the data header selected by the user.

[0071] If a real user is detected approaching the printer, the data packet header is retrieved from the buffer queue. The service type indicated in the retrieved data packet header belongs to the service types that the printer can support. Specifically, the user is shown relevant information from the data packet header, such as the IP address of the user device sending the data packet and the file name. The user then selects the job corresponding to the data packet header to execute. To avoid excessive printing memory usage, for example, if 10,000 jobs are simultaneously entered into the printer's buffer queue requesting printing, only the five most recent jobs (for example) are retrieved when a user approaches the printer, while the others are discarded.

[0072] It should be noted that if the printer only supports printing and not scanning, it is preferable to display only the print type data header to the user. If the printer only supports scanning and not printing, it is preferable to display only the scan type data header to the user. If the printer supports both scanning and printing, it is preferable to display both scan and print type data headers to the user.

[0073] For example, if a data packet header enters the cache queue and no related file (such as a file that needs to be printed) is received within a preset time period, the data packet header will be deleted from the cache queue.

[0074] It should be noted that the specific steps for sending the data packet header corresponding to the data packet header to the printer's parsing server are as follows: based on the business type of the data packet header in the cache queue, an "opening" strategy is executed: if there is a real user and the printer's device status meets the requirements (such as being able to print or scan normally), the user is allowed to specify the task to be performed (selecting the data packet header) through the interaction module, and then the printer receives the task and responds to it; if the printer's device status does not meet the preset requirements, the user is asked whether to abandon the task.

[0075] For example, the method flow of this application is as follows: Figure 3 As shown, there may be multiple print initiators ( Figure 3 (Only one example is shown in the text). The door opening interface controls the communication between the printer server and the print initiator (PC or other host computer) (i.e., controls the opening and closing of the "door," and this communication must follow the printer communication protocol). After successfully handshaking with the printer, each print initiator first sends a data packet header to the printer. The rule processor determines whether the business type of the data packet header meets the access blocking conditions. If the rule processor determines that it does not meet the access blocking conditions, it directly opens the door opening interface, allowing subsequent data packet content to be passed, and the printer can directly execute the user command; if the rule processor determines that it meets the access blocking conditions, it puts the corresponding data packet header into the buffer for processing. Data from button presses, infrared sensing, millimeter-wave radar, and scanned document detection are input into the real user detection module. The data output by the real user detection module (calculating the probability of a real user) and the data output by the device status sensing modules (such as paper sensors, task status sensors, temperature sensors, and fault status sensors) are input into the decision-making module for calculation to determine whether the door opening strategy is met. If the door opening strategy is met, a query command is sent to the query interface according to the door opening strategy. The query interface can display the most recently reserved data packets received by the buffer on the display screen. The user selects their own task, and the result of the user's selection is input into the decision-making module. The decision-making module sends a door opening command to the door opening interface, and then the door opening interface releases the content of the data packet to the corresponding print initiator. The corresponding data packet is finally sent to the printer service.

[0076] The door opening strategy can be configured based on the specific printer or printing scenario. For example, the probability that a user is a genuine user can be set to meet a preset threshold (e.g., not less than 80%), and the device status must meet the requirements for the user to perform the task. For example, for a printing task, the device needs to be fault-free, have paper in the paper feed, sufficient toner, and be in an idle state. For a scanning task, the original document needs to be present. The user detection module determines whether a genuine user is present based on button operation, infrared detection results, and millimeter-wave radar detection results. If a button is operated, it is determined that the user is a genuine user who intends to use the printer. Infrared and millimeter-wave radar use training data to determine the proportion of genuine users intending to use the printer. Scanned document detection determines whether a genuine user intends to use the printer based on the user's actions on the scanner. For example, if a user uses the glass platform to scan an original document, the glass platform cover will definitely be opened to place the original document. By detecting whether the glass platform cover is open, it can be determined whether a genuine user intends to use the printer.

[0077] It is worth mentioning that when receiving data packets, only the data packet header is analyzed. When it is determined that a real user is using the printer and the printer status meets the usage conditions, the user's relevant job request is executed. This can reduce the time the printer is exposed to the network, avoid the printer being in a vulnerable state of continuous exposure, and effectively improve the printer's security.

[0078] Furthermore, the advantages of the method described in this application are as follows:

[0079] 1. The network-physical convergence security model: This model strongly binds control over network data flows to the physical presence of users. It breaks through the limitations of traditional network security, which only focuses on attack and defense within the digital domain, and innovatively introduces the physical dimension as a core variable in security strategies.

[0080] 2. Innovative Application of the "Zero Trust" Concept: This method is an innovative practice of the "Zero Trust" security architecture at the IoT device interaction layer. It does not trust any network connection by default, and only grants minimal data transmission permissions after obtaining strong authentication signals from the physical environment, thus achieving "never trust, always authenticate".

[0081] 3. Dynamic Attack Surface Minimization: Compared to statically closing ports or configuring firewall rules, this method achieves dynamic, real-time minimization of the attack surface. The attack surface is only open for a brief moment (on the order of minutes) when the user picks up the package, and is virtually nonexistent for the rest of the time.

[0082] By combining "two-phase TCP reception," "physical sensor triggering," and "printer security," this solution addresses the persistent risks of network printers. It cleverly leverages the underlying characteristics of the TCP protocol and integrates them with external physical events to create a novel, proactive, and intrinsic security mechanism. Its implementation cost is relatively controllable (software modification + low-cost radar module), making it easy to integrate into newly manufactured printers or apply to existing equipment via firmware upgrades.

[0083] The printer-inherent network traffic protection device provided in this application is described below as an example.

[0084] like Figure 4 As shown in the figure, this application embodiment provides an intelligent printer-embedded network traffic protection device, which includes:

[0085] The receiving module 401 is used to receive the data packet header sent by the user equipment to the printer;

[0086] The type identification module 402 is used to identify the service type indicated by the data packet header;

[0087] The condition judgment module 403 is used to determine whether the service type indicated by the data packet header meets the access blocking condition based on the service type indicated by the data packet header.

[0088] Storage module 404 is used to store the data packet header into a cache queue when the service type indicated by the data packet header meets the access blocking condition;

[0089] User monitoring module 405 is used to detect whether a real user is approaching the printer;

[0090] Device status detection module 406 is used to determine the supported service type based on the device status of the printer when a real user approaches the printer.

[0091] The extraction module 407 is used to extract data headers that are consistent with the service types supported by the printer from the cache queue; and to provide the extracted data header information to the user for selection so that the printer can execute the data header selected by the user.

[0092] It should be noted that the information interaction and execution process between the above-mentioned devices / units are based on the same concept as the method embodiments of this application. For details on their specific functions and technical effects, please refer to the method embodiments section, and they will not be repeated here.

[0093] Those skilled in the art will clearly understand that, for the sake of convenience and brevity, the above-described division of functional units and modules is merely an example. In practical applications, the above functions can be assigned to different functional units and modules as needed, that is, the internal structure of the device can be divided into different functional units or modules to complete all or part of the functions described above. The functional units and modules in the embodiments can be integrated into one processing unit, or each unit can exist physically separately, or two or more units can be integrated into one unit. The integrated unit can be implemented in hardware or as a software functional unit. Furthermore, the specific names of the functional units and modules are only for easy differentiation and are not intended to limit the scope of protection of this application. The specific working process of the units and modules in the above system can be referred to the corresponding process in the foregoing method embodiments, and will not be repeated here.

[0094] like Figure 5 As shown, an embodiment of this application provides a terminal device, wherein the terminal device D10 of this embodiment includes: at least one processor D100 ( Figure 5 The diagram shows only one processor, a memory D101, and a computer program D102 stored in the memory D101 and executable on the at least one processor D100, wherein the processor D100 executes the computer program D102 to implement the steps in any of the above method embodiments.

[0095] Specifically, when the processor D100 executes the computer program D102, it receives connection requests sent to the printer by the user equipment, identifies the request type, and determines whether the request type meets the access blocking condition. If the request type meets the access blocking condition, the connection request is stored in a cache queue. Then, it checks whether the connection request is a genuine user request, obtains the detection result, and finally determines whether the connection request meets the connection conditions based on the detection result and the cache queue. If it does, the connection request is connected to the printer's network server. By analyzing the connection request after receiving it, based on its request type and whether it is a genuine user request, and only executing the connection request when the connection conditions are met, the time the printer is exposed to the network is reduced, preventing the printer from being in a continuously exposed and vulnerable state, and effectively improving printer security.

[0096] The processor D100 can be a central processing unit (CPU), or it can be other general-purpose processors, digital signal processors (DSPs), application-specific integrated circuits (ASICs), field-programmable gate arrays (FPGAs), or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components, etc. A general-purpose processor can be a microprocessor or any conventional processor.

[0097] In some embodiments, the memory D101 may be an internal storage unit of the terminal device D10, such as a hard disk or memory of the terminal device D10. In other embodiments, the memory D101 may be an external storage device of the terminal device D10, such as a plug-in hard disk, smart media card (SMC), secure digital card (SD), flash card, etc., equipped on the terminal device D10. Furthermore, the memory D101 may include both internal and external storage units of the terminal device D10. The memory D101 is used to store the operating system, applications, bootloader, data, and other programs, such as the program code of the computer program. The memory D101 can also be used to temporarily store data that has been output or will be output.

[0098] This application also provides a computer-readable storage medium storing a computer program that, when executed by a processor, implements the steps described in the various method embodiments above.

[0099] This application provides a computer program product that, when run on a terminal device, enables the terminal device to implement the steps described in the various method embodiments above.

[0100] If the integrated unit is implemented as a software functional unit and sold or used as an independent product, it can be stored in a computer-readable storage medium. Based on this understanding, all or part of the processes in the methods of the above embodiments of this application can be implemented by a computer program instructing related hardware. The computer program can be stored in a computer-readable storage medium, and when executed by a processor, it can implement the steps of the various method embodiments described above. The computer program includes computer program code, which can be in the form of source code, object code, executable files, or certain intermediate forms. The computer-readable medium can include at least: any entity or device capable of carrying the computer program code to the printer network traffic protection method device / terminal device, a recording medium, a computer memory, a read-only memory (ROM), a random access memory (RAM), an electrical carrier signal, a telecommunication signal, and a software distribution medium, such as a USB flash drive, a portable hard drive, a magnetic disk, or an optical disk.

[0101] In the above embodiments, the descriptions of each embodiment have different focuses. For parts that are not described in detail or recorded in a certain embodiment, please refer to the relevant descriptions of other embodiments.

[0102] Those skilled in the art will recognize that the units and algorithm steps of the various examples described in conjunction with the embodiments disclosed herein can be implemented in electronic hardware or a combination of computer software and electronic hardware. Whether these functions are implemented in hardware or software depends on the specific application and design constraints of the technical solution. Those skilled in the art can use different methods to implement the described functions for each specific application, but such implementation should not be considered beyond the scope of this application.

[0103] The above description is the preferred embodiment of this application. It should be noted that for those skilled in the art, several improvements and modifications can be made without departing from the principle of this invention, and these improvements and modifications should also be considered within the scope of protection of this invention.

Claims

1. A smart method for protecting printer-inherent network traffic, characterized in that, include: Receive data packet headers sent to the printer by the user equipment; Identify the service type indicated by the data packet header and determine whether the service type indicated by the data packet header meets the access blocking conditions; If the access blocking condition is met, the data packet header is stored in the cache queue; Detect whether a real user is approaching the printer; if so, determine the supported service type based on the printer's device status. Retrieve the data packet header from the cache queue that matches the service type supported by the printer; The extracted data header information is provided to the user for selection, so that the printer can execute the data header selected by the user.

2. The method according to claim 1, characterized in that, When the service type indicated by the data packet header does not meet the access blocking conditions, the subsequent data packet content corresponding to the data packet header is allowed to be sent so that the printer can execute the data packet.

3. The method according to claim 2, characterized in that, When the service type indicated by the data packet header is a printer add request or a printer status query request, the service type indicated by the data packet header does not meet the access blocking condition.

4. The method according to claim 1, characterized in that, Detecting whether a real user is approaching the printer includes: Obtain user status information, which includes printer button usage information, user infrared information, user action information, and user document placement information; The acquired user status information is input into a pre-trained convolutional neural network to obtain the probability that a real user approaches the printer. If the probability is greater than the preset threshold, it is confirmed that a real user has approached the printer; otherwise, it is confirmed that no real user has approached the printer.

5. The method according to claim 1, characterized in that, Also includes: Clear data packet headers from the cache queue that have been stored for a duration exceeding a threshold; the cache queue stores a maximum of N data packet headers, where N is a positive integer.

6. An intelligent printer-embedded network traffic protection device, characterized in that, include: The receiving module is used to receive the data packet headers sent to the printer by the user equipment; The type identification module is used to identify the service type indicated by the data packet header; The condition judgment module is used to determine whether the service type indicated by the data packet header meets the access blocking condition based on the service type indicated by the data packet header. The storage module is used to store the data packet header into a cache queue when the service type indicated by the data packet header meets the access blocking condition. The user monitoring module is used to detect whether a real user is approaching the printer; The device status detection module is used to determine the supported service type based on the device status of the printer when a real user approaches the printer. The extraction module is used to extract data packet headers that are consistent with the service types supported by the printer from the cache queue; The extracted data header information is provided to the user for selection, so that the printer can execute the data header selected by the user.

7. A terminal device, comprising a memory, a processor, and a computer program stored in the memory and executable on the processor, characterized in that, When the processor executes the computer program, it implements the printer-inherent network traffic protection method as described in any one of claims 1 to 5.

8. A computer-readable storage medium storing a computer program, characterized in that, When the computer program is executed by the processor, it implements the printer-inherent network traffic protection method as described in any one of claims 1 to 5.

Images