Encryption in PrinterOn Enterprise - c06381289

There are 2 areas of encryption within PrinterOn: job data (AES & RSA) & communication (SSL/TLS).

When it comes to TLS/SSL, the keys would be handled by the customer in an On-Premise or private cloud deployment. Most of our software is Java-based so a Java keystore containing the root chain and private/public keys is required. When using the Managed Cloud service, Amazon fully manages the TLS/SSL keys.

Job data encryption is available as below, but is an optional configuration. It relies on PDS having encryption enabled. If PDS encryption is disabled, there is no print job encryption aside from TLS. There can only be 1 active encrypted PDS within a single PrinterOn implementation, we do not support encrypted active-active clustering of PDS.

The RSA & AES keypairs are managed by PrinterOn. Job data is encrypted using a 2-phase encryption: every single print job has a unique 128-bit AES encryption key that is generated by PrintWhere. We don’t use the same AES key for all jobs. First, the data is encrypted using the AES encryption key. From here, the AES key is encrypted using a 1024-bit RSA public key, and appended to the print file. Then, the whole thing is sent to PDS for decryption and distribution. In other words, we encrypt our own encryption keys. These keys are managed by PrinterOn and PrintWhere will generate a new 128-bit AES key for each print job. This key is used once, and then discarded. This is more secure than using the same key for all print jobs. PDS will generate its own 1024-bit RSA key sets and can be recreated as often as you like, but it is a manual process.

Data is considered to be “in transit” as it passes through the various components of the PrinterOn infrastructure, since it never remains in any one place for more than a few seconds. The only exceptions to this are the PDH and PDS, where print jobs have the potential to sit and wait to be pulled/released and are therefore considered at rest. Of course, ideally, the jobs flow through these components quickly as well. The entire workflow takes place over TLS.

Once jobs are downloaded from PDH to PDS (over a TLS channel), PDS will use its RSA private key to decrypt the document’s AES encryption key and output it to the print queue defined. This process occurs at time of job release request, depending on your configuration that might be immediately or after being prompted by a user. This means when a job is rendered, it contains an RSA public key.