Details for Patent: 6,938,154

Title:	System, method and article of manufacture for a cryptographic key infrastructure for networked devices
Abstract:	A system, method and article of manufacture are provided for secure operation of a network device. A digital certificate is assigned to a network user. A command for operation of a network device and the digital certificate are received from the network user. A cryptographic key stored in the network device is utilized to authenticate the digital certificate of the network user. Operation of the network device is enabled if the digital certificate of the network user is authenticated. According to another aspect of the present invention, a system, method and article of manufacture are provided for secure identification of a network device. A digital certificate is assigned to a network device. A command for operation of the network device is received from a network user. The digital certificate is sent to the network user. The network user utilizes a cryptographic key to authenticate the digital certificate of the network device. Operation of the network device is enabled if the digital certificate of the network device is authenticated. In another embodiment of the present invention, a system, method and article of manufacture are provided for secure management of a network device. Policy information and/or a computational protocol are associated with a command for the network device. The policy information and/or computational protocols are encrypted, sent to the network device, and decrypted. The network device utilizing the policy information and/or computational protocols processes the command.
Inventor(s):	Berson; Thomas A. (Palo Alto, CA), Dean; R. Drews (Cupertino, CA), Franklin; Matthew K. (Palo Alto, CA), Lunt; Teresa F. (Palo Alto, CA), Smetters; Diana K. (Burlingame, CA)
Assignee:	Xerox Corporation (Stamford, CT)
Filing Date:	Jun 19, 2000
Application Number:	09/596,948
Claims:	1. A method for secure operation of a network device, comprising: (a) assigning a digital certificate to a network user; (b) receiving a command for operation of a network device and the digital certificate from the network user; (c) utilizing a cryptographic key stored in the network device to authenticate the digital certificate of the network user; (d) enabling operation of the network device if the digital certificate of the network user is authenticated and if the operation is permitted by a usage policy associated with the network user; and wherein the network device is at least one of a printer, a copier, a scanner, and a facsimile machine; and the usage policy associated with the printer, the copier or the facsimile machine is at least one of the policies: a policy to allow selection of special paper stock, a policy to allow the network device to decrypt and print a document only if the network user was identified by the network device as being physically near the network device, a policy to print a selected watermark when printing the document, a policy to enable the network device to accept digital cash associated with an operation on the document, a policy to enable a billing function, a routing policy, and a policy to escrow a document; wherein the usage policy associated with the scanner is at least one of the policies: a policy to enable the network device to accept digital cash associated with an operation on the document, a policy to enable a billing function, a routing policy, and a policy to escrow a document. 2. The method as recited in claim 1, wherein the network user is another network device. 3. The method as recited in claim 1, wherein the command for operation of the network device is encrypted, and wherein the cryptographic key is utilized to decrypt the command for operation. 4. The method as recited in claim 1, further comprising receiving electronic payment for paying for operation of the network device. 5. A computer program embodied on a computer readable medium for secure operation of a network device, comprising: (a) code segment embodied on the computer readable medium that assigns a digital certificate to a network user; (b) code segment embodied on the computer readable medium that receives a command for operation of a network device and the digital certificate from the network user; (c) code segment embodied on the computer readable medium that utilizes a cryptographic key stored in the network device to authenticate the digital certificate of the network user; (d) code segment embodied on the computer readable medium that enables operation of the network device if the digital certificate of the network user is authenticated and if the operation is permitted by a usage policy associated with the network user; and wherein the network device is at least one of a printer, a copier, a scanner, and a facsimile machine; and the usage policy associated with the printer, the copier or the facsimile machine is at least one of the policies: a policy to allow selection of special paper stock, a policy to allow the network device to decrypt and print a document only if the network user was identified by the network device as being physically near the network device, a policy to print a selected watermark when printing the document, a policy to enable the network device to accept digital cash associated with an operation on the document, a policy to enable a billing function, a routing policy, and a policy to escrow a document; wherein the usage policy associated with the scanner is at least one of the policies: a policy to enable the network device to accept digital cash associated with an operation on the document, a policy to enable a billing function, a routing policy, and a policy to escrow a document. 6. The computer program as recited in claim 5, wherein the network user is another network device. 7. The computer program as recited in claim 5, wherein the command for operation of the network device is encrypted, and wherein the cryptographic key is utilized to decrypt the command for operation. 8. The computer program as recited in claim 5, further comprising a code segment embodied on the computer readable medium that receives electronic payment for paying for operation of the network device. 9. A system for secure operation of a network device, comprising: (a) logic that assigns a digital certificate to a network user; and (b) a network device capable of receiving a command for operation thereof and the digital certificate from the network user, wherein the network device utilizes a cryptographic key to authenticate the digital certificate of the network user; (c) wherein operation of the network device is enabled if the digital certificate of the network user is authenticated and if the operation is permitted by usage policy associated with the network user; and wherein the network device is at least one of a printer, a copier, a scanner, and a facsimile machine; and the usage policy associated with the printer, the copier or the facsimile machine is at least one of the policies: a policy to allow selection of special paper stock, a policy to allow the network device to decrypt and print a document only if the network user was identified by the network device as being physically near the network device, a policy to print a selected watermark when printing the document, a policy to enable the network device to accept digital cash associated with an operation on the document, a policy to enable a billing function, a routing policy, and a policy to escrow a document; wherein the usage policy associated with the scanner is at least one of the policies: a policy to enable the network device to accept digital cash associated with an operation on the document, a policy to enable a billing function, a routing policy, and a policy to escrow a document. 10. The system as recited in claim 9, wherein the network user is another network device. 11. The system as recited in claim 9, wherein the command for operation of the network device is encrypted, and wherein the cryptographic key is utilized to decrypt the command for operation. 12. The system as recited in claim 9, further comprising logic that receives electronic payment for paying for operation of the network device. 13. A method for secure identification of a network device, comprising: (a) assigning a digital certificate to a network user; (b) receiving a command for operation of a network device and the digital certificate from the network user; (c) utilizing a cryptographic key stored in the network device to authenticate the digital certificate of the network user; (d) enabling operation of the network device if the digital certificate of the network user is authenticated and if the operation is permitted by a usage policy associated with the network user; and wherein the network device is at least one of a printer, a copier, a scanner, and a facsimile machine; and the usage policy associated with the printer, the copier or the facsimile machine is at least one of the policies: a policy to allow selection of special paper stock, a policy to allow the network device to decrypt and print a document only if the network user was identified by the network device as being physically near the network device; a policy to print a selected watermark when printing the document, a policy to enable the network device to accept digital cash associated with an operation on the document, a policy to enable a billing function, a routing policy, and a policy to escrow a document; wherein the usage policy associated with the scanner is at least one of the policies: a policy to enable the network device to accept digital cash associated with an operation on the document, a policy to enable a billing function, a routing policy, and a policy to escrow a document. 14. The method as recited in claim 13, wherein the network user is another network device. 15. The method as recited in claim 13, and further comprising assigning a unique digital certificate to a second network device, wherein the command for operation of the network device is re-routed to the second network device based on at least one of attributes of the network devices and the routing policy. 16. A method for secure management of a network device, comprising: (a) associating at least on of policy information and a computation protocol with a command for the network device; (b) encrypting at least one of policy information and computation protocols; (c) sending at least one of policy information and computation protocols to the network device; (d) decrypting at least one of policy information and computation, protocols; (e) processing the command with the network device utilizing at least one of policy information and computation protocols; and wherein the network device is at least one of a printer, a copier, a scanner, and a facsimile machine; and the usage policy associated with the printer, the copier or the facsimile machine is at least one of the policies: a policy to allow selection of special paper stock, a policy to allow the network device to decrypt and print a document only if the network user was identified by the network device as being physically near the network device, a policy to print a selected watermark when printing the document, a policy to enable the network device to accept digital cash associated with an operation on the document, a policy to enable a billing function, a routing policy, and a policy to escrow a document; wherein the usage policy associated with the scanner is at least one of the policies: a policy to enable the network device to accept digital cash associated with an operation on the document, a policy to enable a billing function, a routing policy, and a policy to escrow a document.