Canon Kabushiki Kaisha

Canon U.s.a., Inc.

Canon Information and Imaging Solutions, Inc.

Craig Mazzagatte

Royce Earle Slick

Neil Y Iwamoto

Don Hideyasu Matsubayashi

Dariusz T Dusberger

Wei-Jhy Chern

Yeongtau Louis Tsao

Eliza Khosrova

Harishankar Karantothu

Manuel Pearson Ferreira

Kazuyuki Saito

Martin Martinez

Don Francis Purpura

Jiuyuan Ge

Nigel Patrick Brady

Edward A Smith

Kevin F Piazza

Allison Bajo

Jiayin Peng

William Zhang

Quentin Dietz

Anthony Louis DeMartini

Ahmad Abiri

Hari Rathod

Jeremy Serfling

Devices, systems, and methods receive a token and a request to create a joint tenant, wherein at least one of the token and the request identifies a first user of a first tenant of a first service; receive one or more administrator credentials for a second service; send the one or more administrator credentials and a request to create a service account to the second service; and create a joint tenant that includes a tenant of the first service and a tenant of the second service, wherein the first user is included in the tenant of the first service, and wherein the service account is included in the tenant of the second service.

Devices, systems, and methods for zero-trust single sign-on

Systems, devices, and methods for contextual management extract context information and content information from a collection of stored digital content items; generate an index of the extracted context information and content information; store the indexed context information and content information; receive a query from a computing device, wherein the query is associated with a user; determine a context of the user; determine a context of a user activity; determine contents of the query; generate a recommendation in response to the query based on the context of the user, the context of the user activity, and the contents of the query; and return the recommendation to the computing device.

Devices, systems, and methods for context management

A mobile data processing method, in which a request for performing a data processing job by a data processing device is initiated from a user of a mobile device. A device code of the mobile device in association with the user is transmitted to the data processing device. The user is authenticated by the data processing device. Whether the device code of the mobile device is identifiable by the data processing device is determined. An entry of the data processing job in association with the user and the device code of the mobile device is created in the data processing device if the device code of the mobile device is identified by the data processing device. The data processing job is executed if the entry of the data processing job is created and stored in association with the user and the device in the data processing device.

Mobile data processing having secured association with multifunction device

Systems, methods, and devices for associating an image forming device and a mobile device receive, at a first device, a request to establish a connection with a second device; generating an optically-readable code that encodes a first set of data, wherein the first set of data includes first key-derivation data; display the optically-readable code of the first set of data; establish a communication channel with the second device; receiving a second set of data from the second device via the established communication channel, wherein the second set of data includes second key-derivation data, and wherein the second key-derivation data is generated in response to receiving the first key-derivation data at the second device; and determine the common key from the first key-derivation data and the second key-derivation data.

Method for associating an image-forming device, a mobile device, and a user

Systems and methods for providing a login context operate a virtual machine, wherein the virtual machine includes an open services platform and an authentication service, wherein the authentication service includes a classloader, and an initial classloader is designated as the classloader of the authentication service, register a login module, receive an authentication request from a first application, and responsive to receiving the authentication request designate a classloader associated with the login module as the classloader of the authentication service, generate a login context of the login module, and provide the login context of the login module to the first application, whereby the first application uses the login context to perform an authentication.

Systems and methods for implementing security services

The present disclosure is directed to network communication between a sender and a receiver. Network communication is established between the sender and the receiver using a first acknowledgment mechanism for signifying receipt of data by the receiver. The first acknowledgment mechanism is selected from one of a receiver positive acknowledgment mechanism (RPA) and a receiver negative acknowledgment mechanism (RNA). Communication information is monitored, wherein the communication information indicates at least a current state of performance for network communication. Based on the communication information, a message is exchanged between the sender and the receiver to negotiate a switchover to a second acknowledgment mechanism for signifying receipt of data by the receiver. The second acknowledgment mechanism is selected from the other of the receiver positive acknowledgment mechanism (RPA) and the receiver negative acknowledgment mechanism (RNA). Network communication is then established between the sender and the receiver using the second acknowledgment mechanism.

Adaptive acknowledgment mechanism for network communication

A method and system for registering a card that is used to enable configurations of an application and/or a device. The method and system includes initializing into an administrative card setup mode, providing information for at least one card to be registered, storing the information for the at least one card to be registered, and exiting the administrative card setup mode.

System for registering and using administrative cards to enable configuration of an application and device

A method for establishing and maintaining a connection by a client to a server within a network includes creating a socket for connecting to the server, based on authentication information associated with the client, and connecting to the server using the socket. In addition, the method includes saving the authentication information associated the client. The method further includes in a case where subsequent connection to the server is requested by the client, reconnecting to the server via the socket, based on the saved authentication information. An apparatus for establishing and maintaining a connection by a client to a server within a network is also provided.

Establishing and maintaining a connection by a client to a server within a network

The invention provides for installing encryption keys on a device not having any previous security credentials. An installation authority generates a security token to be used by the device for secure communications, and an installation credential for the device, and stores them in association with one another. A user of the device is provided with the installation credential, whereby the user inputs the installation credential into the device. The device utilizes the installation credential as a temporary security key, establishes a secure communication channel with the installation authority and requests provision of the security token. The installation authority provides the security token associated with the installation credential to the device over the established secure communication channel, and the device installs the security token, after which the device erases the installation credential from the device. The installation authority may also certify the security token and provide a certified token and a root verification certificate to the device.

Establishing mutual authentication and secure channels in devices without previous credentials

Obtaining exclusive control of a printing device by deferring printing of print data in a print queue. To obtain control, the recipient performs a process which may include authentication of the recipient. Control may be obtained either before the recipient is authenticated or after a successful authentication process. After the recipient has obtained control, print data in the print queue is temporarily deferred from being printed. The recipient may then select a print job to print, including selecting a print job from among the print jobs deferred in the print queue, or selecting a file to print over a network, including the Internet or an intranet. Further, printing device resources utilized in printing data during the period of exclusive control may be tracked and correlated to the recipient who has control.

Obtaining temporary exclusive control of a printing device

Securely storing a public key for encryption of data in a computing device by using a user-specific key pair which is securely stored in the computing device, including receiving a target public key corresponding to a target device, obtaining a user-specific key pair from a secure registry, using a user-specific private key from the user-specific key pair to create a target key verifier based on the target public key, storing the target key verifier and the target public key in a storage area, retrieving the target key verifier and the target public key from the storage area, applying a user-specific public key from the user-specific key pair to the target key verifier for verifying the authenticity of the target public key, and encrypting data with the target public key, if authenticity of the target public key is verified, thereby creating encrypted data for transmission to the target device.

Secure printing with authenticated printer key

Remotely obtaining exclusive control of a device by remotely establishing communication with the device over a network, requesting to obtain remote exclusive control of the device's capabilities, and determining whether remote exclusive control of the device's capabilities can be obtained based on whether or not another user already has exclusive control of the device's capabilities. In a first case where it is determined that remote exclusive control can be obtained, authenticating a user requesting to obtain remote exclusive control of the device's capabilities, providing the user remote exclusive control of the device's capabilities after the user has been authenticated, and temporarily deferring requests by users other than the user who has obtained remote exclusive control to perform operations utilizing the device's capabilities during a period in which the user maintains remote exclusive control of the device's capabilities. In a second case where it is determined that remote exclusive control cannot be obtained, denying the user's request to obtain remote exclusive control, adding the user to a reservation queue of user's requesting to obtain exclusive control of the device, and when the user ascends in the reservation queue to be the next user to obtain exclusive control, the user is notified that he can now obtain remote exclusive control of the device.

Obtaining temporary exclusive control of a device

Secure transmission of data to an intended image output device, wherein the data can be used to generate an image at the intended image output device in the presence of an intended recipient. The data is encrypted using a first key. The first key is then encrypted using a second key and a third key. The second key is a public key of a first private key/public key pair, a private key of the first private key/public key pair being primarily in the sole possession of the intended image output device. The third key is a public key of a second private key/public key pair, a private key of the second private key/public key pair being primarily in the sole possession of the intended recipient of the image. The encrypted data and the twice-encrypted first key are transmitted to the intended image output device. The twice-encrypted first key is then decrypted by using the private keys of the second and first key pairs, respectively, which are primarily in the sole possession of the intended recipient device and the intended image output device, respectively. The data is then decrypted and printed at an image output device.

Targeted secure printing

Authorized printout of an image corresponding to print data received at a print node from a network. The authorized printout comprises encrypting print data by a print node and storing the encrypted print data without printout, receiving authentication of an intended recipient to print the print data, and decrypting the encrypted print data by the print node and printing the decrypted print data by an image forming device, responsive to receipt of authentication in the receiving step. The print node may be the image forming device itself or a gateway to multiple image forming devices. The print node encrypts the print data with either a symmetric key or an asymmetric key.

Growing community of inventors

Aliso Viejo, CA, United States of America

Craig Mazzagatte