# US 10,872,161 B2 · Printer identity and security

> Agents: this data is available as JSON from the patentgrep API and MCP server — see https://patentgrep.com/llms.txt

- Number: US 10,872,161 B2
- Document ID: US10872161B2
- Status: Granted
- Kind: B2
- Application number: 15/821,162
- Filed: 2017-11-22
- Published: 2018-05-24
- Granted: 2020-12-22
- Earliest claimed: 2016-11-23
- Assignees: Entrust Corporation
- Applicants: Entrust Corporation
- Inventors: Rajesh K. Juriasingani
- Web page: https://patentgrep.com/patent/US10872161B2

## CPC

- G06F 21/608: {Secure printing}
- G06F 3/1222: {Increasing security of the print job}
- G06F 3/1238: {Secure printing, e.g. user identification, user rights for device usage, unallowed content, blanking portions or fields of a page, releasing held jobs}
- G06F 21/575: {Secure boot}
- G06F 21/602: {Providing cryptographic facilities or services}
- H04L 9/006: {involving public key infrastructure [PKI] trust models (network architecture or network communication protocol for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04L 9/0894: {Escrow, recovery or storing of secret information, e.g. secret key escrow or cryptographic key storage}
- H04L 9/14: using a plurality of keys or algorithms
- H04L 9/30: Public key, i.e. encryption algorithm being computationally infeasible to invert or user's encryption keys not requiring secrecy
- H04L 9/321: {involving a third party or a trusted authority}
- H04L 9/3263: {involving certificates, e.g. public key certificate [PKC] or attribute certificate [AC]; Public key infrastructure [PKI] arrangements (network architectures or network communication protocols for supporting authentication of entities using certificates in a packet data network H04L63/0823)}
- H04N 1/00339: {with an electronic or magnetic storage medium I/O device (RFID or the like H04N1/00342)}
- H04N 1/4433: {to an apparatus, part of an apparatus or an apparatus function}
- G06F 2221/032: Protect output to user by software means
- H04N 2201/0082: Image hardcopy reproducer (H04N2201/0091 - H04N2201/0094 take precedence)
- G06F: ELECTRIC DIGITAL DATA PROCESSING (computer systems based on specific computational models G06N)
- H04L: TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION (arrangements common to telegraphic and telephonic communication H04M)
- H04N: PICTORIAL COMMUNICATION, e.g. TELEVISION

## Abstract

A system and method for establishing a secure identity for a printing device at the time of manufacturing is provided. The method includes obtaining a first private key for use with a first operation of the printing device and obtaining a second private key for use with a second operation of the printing device. The method also includes loading the first private key into a secure memory portion of the printing device during manufacturing of the printing device, and loading the second private key into the secure memory portion of the printing device during manufacturing of the printing device.

## Claims

### Claim 1

A printing device comprising:
a housing;
a card input in the housing;
a card travel path that extends through the housing from the card input;
a print engine disposed along the card travel path;
a non-secure memory portion; and
a secure memory portion that is an isolated memory portion and is distinct and/or separate from the non-secure memory portion, wherein the secure memory portion includes a crypto processor, wherein the secure memory portion stores a unique and secure identity of the printing device,
wherein the secure memory portion has access to at least one private key, each of the at least one private key associated with an operation performed by the printing device,
wherein the crypto processor validates an authorization request associated with a requested operation to be performed by the printing device using the at least one private key associated with the requested operation, and
wherein the printing device performs the requested operation upon validation by the crypto processor of the authorization request,
wherein the printing device stores at least one public key or cryptographic hash associated with a secure boot operation.

### Claim 2 (depends on 1)

The printing device of claim 1, wherein the secure memory portion includes at least one factory established private key.

### Claim 3 (depends on 1)

The printing device of claim 1, wherein the print engine performs at least one of retransfer printing, direct to card printing, ink jet printing, laser marking, and laser engraving on a card.

### Claim 4 (depends on 1)

The printing device of claim 1, wherein the crypto processor identifies the at least one private key associated with the requested operation to be performed by the printing device.

### Claim 5 (depends on 1)

The printing device of claim 1, wherein the crypto processor validates the authorization request by decrypting the requested operation using the authorization request and the at least one private key.

### Claim 6 (depends on 1)

The printing device of claim 1, wherein the at least one private key stored in the secure memory portion is not accessible on a bus of the printing device.

### Claim 7 (depends on 1)

The printing device of claim 1, wherein the non-secure memory portion and the secure memory portion are part of a single memory device with the secure memory portion isolated from the non-secure memory portion.

### Claim 8 (depends on 1)

The printing device of claim 1, wherein the secure memory portion stores a storage root key that protects the at least one private key stored outside of the secure memory portion.

### Claim 9 (depends on 1)

The printing device of claim 1, wherein the secure memory portion stores the at least one private key.

### Claim 10 (depends on 1)

The printing device of claim 1, wherein the requested operation to be performed by the printing device includes at least one of: authentication of the printing device by a cloud server/service; authentication of supplies for use by the printing device; authentication of the printing device by a printer client using a printer protocol; authentication of signed firmware for modification; authentication of a print manager; authentication of a modular device security; authentication of a configuration setting of the printing device; authentication of a source of a print job and/or a configuration data; authentication of a secure and/or measured boot of the printing device; a Secure Sockets Layer/Transport Layer Security (SSL/TLS) authentication; authentication of a modular device security; a dual authentication; authentication of a private key storage; authentication of a file system encryption; and a payload encryption.

### Claim 11 (depends on 1)

The printing device of claim 1, further comprising a printer functionality component that performs a physical action on a customized personalization document.

### Claim 12 (depends on 11)

The printing device of claim 11, wherein the printer functionality component is at least one of:
a magnetic stripe station that reads and/or writes data on a magnetic stripe of a card; and
a chip programming station that reads and/or writes data on a chip of a card.

### Claim 13 (depends on 9)

The printing device of claim 9, wherein the card is a financial or identification card and the printer functionality component includes a print engine that prints custom specific information onto the financial or identification card.

### Claim 14 (depends on 11)

The printing device of claim 11, further comprising a second printer functionality component that performs a second physical action on the customized personalization document, wherein the second physical action is different than the first physical action.

### Claim 15 (depends on 1)

The printing device of claim 1, further comprising:
a network input/output receives the authorization request from an external secondary device,
wherein the secure memory portion retrieves a particular private key of the at least one private key associated with the requested operation,
wherein the printing device determines whether the requested operation is validated using the authorization request and the retrieved particular private key, and
wherein the printing device performs the requested operation when the requested operation is validated.

### Claim 16 (depends on 15)

The printing device of claim 15, wherein the authorization request is a public key.

### Claim 17 (depends on 15)

The printing device of claim 15, wherein the crypto processor validates the authorization request using the authorization request and the at least one private key associated with the requested operation.