Transcription
Software Version 4.0.2xxVersion 1.2702P04728Xerox Print Management andMobility ServiceInformation Assurance Disclosure
Xerox Print Management and Mobility Service Copyright 2016-2017 XeroxCorporation. All rights reserved. Xerox , Xerox and Design , Xerox Extensible InterfacePlatform are trademarks of Xerox Corporation in the United States and/or othercounties.Microsoft , SQL Server , Microsoft .NET, Windows , Windows Server , WindowsAzure and Windows 7 are either registered trademarks or trademarks of MicrosoftCorporation in the United States and/or other countries.IOS is a trademark or registered trademark of Cisco in the U.S. and other countries.This product includes software developed by Aspose (http://www.aspose.com)BR14700Xerox Print Management and Mobility Service Information Assurance Disclosure
Contents1.Introduction . 51.1. Purpose . 51.2. Target Audience . 51.3. Disclaimer . 52.Product Description . 62.1. Overview . 62.1.1. Submission methods: . 62.1.2. Release methods:. 62.1.3. Combined Submission / Release methods . 62.1.4. Printer Authentication Methods . 62.1.5. @PrintByXerox Solution . 72.1.6. Xerox Print Management and Mobility Service . 82.2. Description of System Components . 93.System Architecture . 103.1. Sub-Systems. 103.1.1. Xerox Print Management and Mobility Service . 103.1.2. Xerox Print Management and Mobility Agent . 113.1.3. Desktop Print Client . 123.1.4. Print Portal Application . 133.2. Open Source Components . 144.System Interaction . 154.1. System Components . 154.1.1. Xerox Mobile Print Portal Application . 154.1.2. Xerox Print Management and Mobility Service . 154.1.3. LDAP/ADS Server . 184.1.4. Azure AD . 194.1.5. Third Party Public Print Provider . 204.1.6. Xerox Print Management and Mobility Agent . 214.1.7. Server-Based Print Queues . 224.1.8. Printer . 224.1.9. Xerox Print Management and Mobility EIP App . 244.1.10. Customer Email Server . 244.1.11. User Workstation . 244.1.12. Xerox Email Service . 254.1.13. Network Appliance . 254.1.14. XSM (Xerox Services Manager) . 254.2. System Component Interfaces . 264.2.1. Communication between Xerox Mobile Print Portal and Xerox PrintManagement and Mobility Service . 26ivXerox Print Management and Mobility Service Information Assurance Disclosure
4.2.2. Communication between Xerox Mobile Print Portal and the CustomerEmail Server . 264.2.3. Communication between the Customer Email Server and Xerox PrintManagement and Mobility Service . 264.2.4. Communication between Xerox Print Management and MobilityService and the Xerox Print Management and Mobility Agent . 274.2.5. Communication between the Xerox Print Management and MobilityAgent and the Printer . 274.2.6. Communication between the Xerox Print Management and MobilityAgent and a 3rd Part Print Queue. 284.2.7. Communication between the Mobility Service Desktop Client andXerox Print Management and Mobility Service . 284.2.8. Communication between the Mobility Service Desktop Client and thePrinter . 284.2.9. Communication between the Xerox Print Management and MobilityAgent and the Customer ADS (LDAP) Server . 294.2.10. Communication between the Xerox Print Management and MobilityService and XSM . 295.Logical access, network protocol information. . 305.1. Protocols and Ports . 306.System access. 346.1.6.2.6.3.6.4.6.5.7.Xerox Print Management and Mobility Service (Web Portal) . 34Xerox Print Management and Mobility Service Agent . 34Xerox Mobile Print Portal Application . 34Desktop Client . 35Print@PrintByXerox EIP App . 35Additional Security Items . 367.1. Xerox Print Management and Mobility Service Endpoint Table . 367.2. Certificate Validation . 367.2.1. Connection Details . 377.3. Auto Release via Network Appliance Workflow . 387.3.1. Models . 397.4. Audit Log . 39ivXerox Print Management and Mobility Service Information Assurance Disclosure
1. IntroductionA Xerox Workflow Solution that connects a mobile workforce to new productive ways of printing.Printing is easy and convenient from a mobile device or by sending an email with attachments toprint@printbyxerox.com, without needing drivers and cables.1.1. PurposeThe purpose of the IAD is to disclose information for the Xerox Print Management and Mobility Servicewith respect to device security. Device security, in this context, is defined as how data is stored andtransmitted, how the product behaves in a networked environment, and how the product may beaccessed, both locally and remotely. This document describes design, functions, and features of theXerox Print Management and Mobility Service relative to Information Assurance (IA) and theprotection of customer sensitive information. Please note that the customer is responsible for thesecurity of their network and the Xerox Print Management and Mobility Service does not establishsecurity for any network environment.The purpose of this document is to inform Xerox customers of the design, functions, and features of theXerox Print Management and Mobility Service relative to Information Assurance (IA).This document does not provide tutorial level information about security, connectivity or Xerox PrintManagement and Mobility Service features and functions. This information is readily availableelsewhere. We assume that the reader has a working knowledge of these types of topics.1.2. Target AudienceThe target audience for this document is Xerox field personnel and customers concerned with ITsecurity.It is assumed that the reader is familiar with the Xerox Print Management and Mobility Serviceworkflow; as such, some user actions are not described in detail.1.3. DisclaimerThe content of this document is provided for information purposes only. Performance of the productsreferenced herein is exclusively subject to the applicable Xerox Corporation terms and conditions ofsale and/or lease. Nothing stated in this document constitutes the establishment of any additionalagreement or binding obligations between Xerox Corporation and any third party.5Xerox Print Management and Mobility Service Information Assurance Disclosure
2. Product Description2.1. OverviewThe workflow of mobile printing is quite simple. A user using a mobile device such as a smart phone,tablet, or laptop sends a document to the Xerox Print Management and Mobility Service. Dependingon the submission method, the job is either printed without any further user action or the user manuallyreleases the job to print.There are several methods for a mobile user to submit or release a job to print. The Submissionmethod is technically decoupled from the release method. However, certain submission/release pairsmake more sense than other pairs.2.1.1. Submission methods: E-mailPrint Portal Application (i.e., an App on a mobile device)Desktop Print Client (upload)2.1.2. Release methods: Printing device UI (via EIP)Print Portal Application (i.e., an App on a mobile device)Auto Release via AuthenticationAuto Release via Network Appliance2.1.3. Combined Submission / Release methods(Note: job will print without any explicit user action after submission): E-mail Print Portal App (i.e., an App on a mobile device) Web Portal (web browser interface to Xerox Print Management and Mobility Service) Desktop Print Client (upload and print) Desktop Print Client (direct print)2.1.4. Printer Authentication Methods Card Access (Proximity Cards, Magnetic Stripe Cards, NFC on Android)Alternate LoginPrint Portal UnlockThe common link between all submission and release methods is the Xerox Print Management andMobility Solution. Documents are stored in the cloud until they are deleted or until an administrativetime-out has passed.6Xerox Print Management and Mobility Service Information Assurance Disclosure
2.1.5. @PrintByXerox SolutionThe @PrintByXerox ConnectKey App, available via the Xerox App Gallery and included as an “In-Box”App on some devices is designed to give customers an introduction to the Xerox Print Managementand Mobility Service system. Users are able to submit jobs via Email, by sending them toprint@printbyxerox.com, and then release them using the @PrintByXerox App. Below is a diagramoutlining the different components used as part of this workflow.@PrintByXeroxUserVPNEmail eonsRespInternetXeroxEmail ServerEmailResponseEmail withAttachmentsCorporate EthernetEmail withAttachmentsCorporate FirewallailE m o n sespReAzure CloudHosted ServicesEmail withAttachmentsCorporateEmail ServerUserReview, Releaseand Pull Print JobsFigure 2.2.1-1: @PrintByXerox7Xerox Print Management and Mobility Service Information Assurance DisclosurePrinter Running@PrintByXerox
2.1.6. Xerox Print Management and Mobility ServiceThe below diagram shows the system components used for the full Xerox Print Management andMobility Service.Azure CloudCellularNetworkXerox Managed CloudBased Routing ServiceLoginPrintPortalAppAzureActive Directory (AD)Azure Service BusXeroxMobility rvice BusMobileAPPEIP Browser Web Pages,Job Management,Print Job RetrievalEmailGatewayEmail ResponseMessagesLoginJob Management,Print Job RetrievalEmail Submission toPrint@PrintByXeroxNotificationsPrint Mgmt &Mobility AgentCustomerEmail ServerFunctionsConfiguration,EIP Registration,Convenience AuthCardlessAuth- Printer Discovery- Cardless Authentication- Print job submissionTransactionsWeb PortalEIP CommunicationUserWorkstationPrint SubmissionAuthentication,User LookupNetwork Applianceand Card ReaderPrint Submission,Cardless Auth,Printer DiscoveryGeneral PrinterCommunicationADS (LDAP)ServerFigure 2.2.2-1: Xerox Print Management and Mobility Service8Xerox Print Management and Mobility Service Information Assurance DisclosurePrinterCardData
2.2. Description of System ComponentsComponentDescriptionUserA user of the Xerox Print Management and MobilityService.Xerox Mobile Print PortalApplicationMobile Phone application that allows the user to findprinters and upload / send print jobs to Xerox PrintManagement and Mobility Service.Xerox Print Management andMobility ServiceThe Azure hosted cloud service that provides the Xerox Print Management and Mobility Service functionality.Customer ADS/LDAP ServerUsed for user authentication.Azure AD[Optional] May be used for user authentication.Microsoft’s Azure AD may in turn forward authenticationrequests to the customer’s hosted AD system.Third Party Public Print ProviderAllows print jobs to be submitted to 3rd Party Providers.Xerox Print Management andMobility AgentOn premise application that runs on customer providedhardware, which supports Printer Discovery, Printtransmission, and Convenience Authentication.Server Based Print QueuesAllows print jobs to be forwarded to other 3rd PartySolutions for added job tracking, accounting, etc.PrinterAny printing device (Xerox or Non-Xerox) that is enabledto support Xerox Print Management and MobilityService.Customer Email ServerThe Customer Email Server is used to get print jobs tothe Xerox Print Management and Mobility Service.User WorkstationUser’s system on which the Desktop Print Client can beinstalled, which allows print jobs to be submitted toXerox Mobility Service Printers from the PC.Xerox Email ServiceUsed to send email responses back to users of Xerox Print Management and Mobility Service.Network ApplianceExternal hardware device that supports card baseddocument release at Non-Xerox or Non-EIP Devices.XSM (Xerox Services Manager)External Xerox application used in managed serviceaccounts.Table 2.3-1: System Components9Xerox Print Management and Mobility Service Information Assurance Disclosure
3. System Architecture3.1. Sub-Systems3.1.1. Xerox Print Management and Mobility ServiceThe Xerox Print Management and Mobility Service consists of number of different services that run asan Azure role (Web Role or Worker Role). The type of role used depends upon the function of theservice. If the service is interfacing externally via some type of API or interface, it’s typically a WebRole and if the service performs internal processing, then it’s typically a Worker Role. Each role runson its own Azure VM instance, and the number of such instances will vary based on the system load.Each service is assigned a fixed size set of RAM and HDD for the given VM, which varies based on theservice and its needs.Volatile MemoryType (SRAM,DRAM, etc.)SizeAzure storage– )Function or UseContainsCustomerDataProcess to ClearNExecutable code,temporary storage formessages processingrelated data, variables,state information, etc.YPower Off or Exitof the ServiceTable 3.1.1-1: Xerox Print Management and Mobility Service Volatile MemoryNon-Volatile Solid State MemoryType Modifiable(Y/N)Function or UseContainsCustomerDataProcess to ClearNStorage of binaries,libraries, graphic images,HTML pages, JavaScriptpages, certs,configuration, logs, userdocuments, print drivers,installers, templates, jobmetadataYRequires removalof Xerox rolesTable 3.1.1-2: Xerox Print Management and Mobility Service Non-Volatile Memory10Xerox Print Management and Mobility Service Information Assurance Disclosure
3.1.2. Xerox Print Management and Mobility AgentVolatile MemoryType (SRAM,DRAM, ction or UseContainsCustomerDataProcess to ClearNExecutable code,temporary storage forprocessing related data,variables, stateinformation, etc.YPower Off or Exitof the ServiceTable 3.1.2-1: Xerox Print Management and Mobility Agent Volatile MemoryNon-Volatile Solid State MemoryType (Flash,EEPROM,etc.)SizeUserModifiable(Y/N)Function or UseContainsCustomerDataProcess to ClearRemoval / Un-install ofthe Agent. Data maybe manually deleted byStorage of binaries,users with access rightsCustomerlibraries,logs, printerHDDNNto the PC on which theProvidedinformationAgent is running.Periodic removal ofsome data based ontime.Table 3.1.2-2: Xerox Print Management and Mobility Agent Non-Volatile Memory11Xerox Print Management and Mobility Service Information Assurance Disclosure
3.1.3. Desktop Print ClientVolatile MemoryType(SRAM,DRAM, ction or UseContainsCustomerDataProcess toClearNExecutable code,temporary storage forprocessing related data,variables, state information,etc.YPower Off or Exitof the ServiceTable 3.1.3-1: Desktop Print Client Volatile MemoryNon-Volatile Solid State MemoryType ction or UseContainsCustomerDataProcess to ClearRemoval / Un-install ofthe Client. Data maybemanually deleted byStorage of binaries,userswith access rightslibraries, logs, printerCustomerNYtothePC on which theinformation, print jobProvidedClient is running.dataPeriodic removal ofsome data based ontime.Table 3.1.3-2: Desktop Print Client Non-Volatile MemoryXerox Print Management and Mobility Service Information Assurance Disclosure
3.1.4. Print Portal ApplicationVolatile MemoryType(SRAM,DRAM, ction or UseContainsCustomerDataProcess toClearNExecutable code,temporary storage forprocessing related data,variables, state information,etc.YPower OffTable 3.1.4-1: Print Portal Application Volatile MemoryNon-Volatile Solid State MemoryType (Flash,EEPROM,etc.)SizeUserModifiable(Y/N)Function or UseContainsCustomerDataProcess to ClearROMCustomerProvidedNStorage of binaries,libraries, printerinformation, print job dataYRemoval / Uninstall of the App.Table 3.1.4-2: Print Portal Application Non-Volatile Memory13Xerox Print Management and Mobility Service Information Assurance Disclosure
3.2. Open Source ComponentsXerox Print Management and Mobility Service does make use of Open Source software modules in itsdifferent components (e.g. the Cloud hosted Xerox Mobility Service, the Desktop Client, etc.). An up todate bill of materials for this solution is available upon request from Xerox.14Xerox Print Managem
7 Xerox Print Management and Mobility Service Information Assurance Disclosure 2.1.5. @PrintByXerox Solution The @PrintByXerox ConnectKey App, available via the Xerox App Gallery and included as an “In-Box” App on some devices is designed to give customers an introduction to the Xero
