An edge cloud and Fibonacci-Diffie-Hellman encryption scheme for secure printer data transmission

1.   Introduction

With the increasing demand for supporting mobile device printing, network printers that support mobile functions such as WiFi direct connection, NFC printing and cloud printing have gradually become indispensable electronic devices in people's daily life and office. Schools, government departments, hospitals and other units and institutions all use printers. From a security perspective, as printing devices are deployed on internal networks, they can directly access various sensitive information, so their security is more important. However, due to its unique functionality, people often overlook its security, resulting in many printer security issues and a gradual increase in security incidents ^[1,2]. For example, a high school hacker from the UK, Stackoverflow, claimed to have used printer vulnerabilities to control over 150,000 printers. He attempted to directly transmit RAW protocol print jobs through port 9100 using printer process daemon (LPD) and Internet Printing Protocol (IPP), bypassing identity authentication. He also revealed that he had discovered an 0Day remote execution vulnerability (RCE) on Xerox's printer web management page. Columbia University researchers have found that a feature called "Remote Firmware Update" on some HP laser printers allows hackers to fully control the printer after installing malicious software on the machine, transmit printed files back to the hacker's computer, stop the printer from working and even cause the fixing device on the printer that heats and pressurizes the toner to continue heating until it catches fire. Now, someone has successfully invaded a printer connected to a public network. Andrew Auernheimer (codenamed "Weev" and previously a well-known hacker who was a member of the Goatse security team) admitted on his blog that he had invaded thousands of network printers and made them print content containing racist and anti-Semitic information. These are all very serious printer security incidents ^[3,4].

There have been many achievements in research on the security of data during network printing and the prevention of printing data leakage. First, Li ^[5] conducted research on network printer security risk analysis and prevention technologies. Li et al. ^[6] proposed suggestions for network printer security research and protection. Yan et al. ^[7] designed a security enhanced printer based on Trusted Computing 3.0, Feng et al. ^[8] evaluated and improved the network printing protocol based on the HCPN model detection method, Sulaiman et al. ^[9] developed a signature based Suricata network printer for theft prevention on PfSense, Huang et al. ^[10] designed a cloud based portable IoT inkjet printer, Nguyen et al. ^[11] designed a deep learning based micro print source printer recognition and Kakade et al. ^[12] designed an open IoT based real-time online monitoring system for FDM printers, The above achievements have achieved certain results in achieving network printing security.

This article is different from previous studies. In order to achieve security in data transmission of network printers, a FIB-DH data encryption technology scheme based on edge cloud collaboration is proposed. Network security is achieved through edge cloud collaboration and cryptographic methods. There have also been studies related to this. Cai et al. ^[13] designed an industrial internet intrusion detection method based on Res-CNN SRU, and Xiang et al. ^[14] proposed an APT attack detection event extraction method based on BERT BiGRU-CRF, Kimi et al. ^[15] conducted digital forensics for electronic IoT devices in smart cities, while Almuflih et al. ^[16] used efficient key exchange using identity-based encryption in a multipath TCP environment. Here, we combine the characteristics of the third-order Fibonacci matrix with Diffie-Hellman to ultimately achieve secure data transmission for network printers.

The major contributions of this paper include three aspects:

● By combining the third-order Fibonacci matrix with Diffie-Hellman through edge cloud collaboration, a FIB-DH data encryption technology architecture is designed.

● The process of implementing FIB-DH data encryption technology solution is provided.

● The feasibility of the FIB-DH scheme was verified through simulation attack experiments using the PRET tool and compared with normal network printing.

The paper is organized as follows: The second section of this article introduces the preliminary knowledge for implementing the technical solution of this paper, including the information flow of the printer, the risk of printing data transmission leakage, IPP protocol, the characteristics of the third-order Fibonacci matrix, Diffie-Hellman encryption technology and MQTT protocol; in Section 2, an architecture of FIB-DH encryption technology based on edge cloud collaboration was designed, providing the implementation process of the FIB-DH scheme; Section 3 conducted experiments and comparative analysis on the scheme through simulation; Finally, we summarize the entire article and propose future work.

2.   Preliminary knowledge

2.1.   The information flow of the printer

The printer mostly consists of three parts: the host part (including driver program and PC storage), the control card part (including the main control chip CPU) and the printer core (including LSU, toner cartridge and mechanical structure) ^[17]. The laser printer is composed of a mechanical part and an electronic control part, which is a typical mechatronics product. The electronic control part is usually highly integrated on the printer control card. Used to control the mechanical part to complete the entire printing work. The composition structure of the printer is shown in Figure 1.

In response to the security risks of modules or components such as the printer's main control unit, data transmission unit, external interface, driver, printing protocol, etc., attackers usually use the built-in backdoor program of the printer, control of the printer port, plaintext transmission of printing information, printing business authentication and processing of printing information cache data to attack printer security vulnerabilities.

2.2.   Printing data transmission leakage risk

Although a printer is only one of the peripheral devices connected to a computer host, it has independent data processing capabilities and can interact with the host for data transmission, thus providing great security ^[18]. There are three main risks of printing data transmission leakage, as shown in Figure 2.

First, communication interface leaks. Modern printers are generally equipped with rich communication interfaces to meet diverse user needs. These interfaces can be divided into two categories: Wired communication interfaces such as USB, RJ45, RS232 and PCIExpress; the other type is wireless communication interfaces, such as Wi-Fi, GPRS, Bluetooth, infrared, etc. Although these interfaces extend the functionality of the printer, they also increase the avenues for unauthorized users to steal printing data.

Second, network access leaks. Currently, printers are developing towards comprehensive information management and output terminals, mostly integrating rich network functions. These functions not only improve work efficiency and enhance team collaboration capabilities, but also become a major channel for information leakage. When the printer is connected to an external network (such as the Internet), it will inevitably generate data exchange with the public network; in addition, some open ports can even be exploited by hackers, leading to illegal takeover of printers.

Third, data transmission leaks. During the process of sending print jobs to the printer, the computer needs to interact with the printer through data transmission media. During this process, if the printed data is not encrypted before transmission, once it is illegally hijacked by an intruder during transmission, the intruder can easily obtain the true printed data through protocol analysis tools.

2.3.   IPP Protocol

IPP is the latest industry standard network printing protocol that can be used for client to server communication and server to printer communication. This protocol provides a basic model that includes printers and jobs, standard attributes of these printers and jobs and a set of standard operations that can be performed on these printers and jobs. Due to the standardization of objects, attributes and operations, IPP is a method used for communication between client and server systems, allowing users to perform remote printing and manage printing work through the internet ^[19].

The IPP protocol is based on the client/server mode. Network printers are connected to the internet or intranet through IPP, and users can directly observe the working and physical status of the printers. However, BinaryEdge normal scanning shows that on average, about 80000 printers are discovered through the IPP port every day, and these printers are exposed to the internet every day, which will cause many problems ^[20].

Therefore, the IPP protocol is not completely secure and is often exploited by attackers, Conduct an attack.

2.4.   Characteristic analysis of third order Fibonacci matrix

People have been interested in studying Fibonacci sequences for hundreds of years. It was an interesting sequence, also known as the golden sequence, introduced by the Italian mathematician Fibonacci in the 13th century to solve the problem of rabbit reproduction, which is a second-order recursive sequence: F₀ = 0, F₁ = 1, F_{n + 1} = F_n + F_n-1, n = 1, 2, 3…. Fibonacci has many unique properties and is widely used in computational mathematics, mathematical statistics, geometry and other fields ^[21,22]. Previous research has shown that Fibonacci sequences can be represented by Fibonacci matrices, and second-order Fibonacci sequences can be represented by second-order Fibonacci matrix T₂ ^[23], as shown in formula (1).

Third order Fibonacci sequence: F₀ = 1, F₁ = 1, F₂ = 2, F_{n + 1} = F_n + F_n-1 + F_n-2, n = 2, 3, 4…, can be represented by the third-order Fibonacci matrix T₃ ^[24] as shown in formula (2).

Due to the determinant |T₃| = 1, T₃ is reversible, so T₃⁻¹ can be calculated, as shown in formula (3).

Calculate T₃ⁿ and (T₃ⁿ) ⁻¹ using formulas (4) and (5), as shown in formula (6).

Using n as a parameter and formula (6), taking n = 4, calculate T₃⁴ and (T₃⁴)⁻¹, as shown in formula (7).

Using formula (6), take n = 5 and calculate T₃⁵and (T₃⁵)⁻¹, as shown in formula (8).

Similarly, we can easily calculate T₃ⁿ and (T₃ⁿ)⁻¹ by taking n = 6, 7, 8, 9, 10.

Finally, Fn is defined by formula (6), as shown in formula (9). By changing n, a third-order recursive sequence can be calculated.

In this study, we utilized the unique feature of third-order Fibonacci matrices being reversible and easy to calculate. Using n as a parameter and applying F_n and F_n⁻¹ to the printing data transmission process, we achieved anti tampering and encryption effects. The sender sends data to the receiver, and the process is shown in Figure 3.

The specific data communication process is as follows:

First, the sender and receiver have agreed on n, which is actually the agreement F_n and F_n^-1.

1) Sender: Transform the original text M through a third-order Fibonacci matrix. M is defined as a matrix with the same three columns, M3 = (M, M, M), Calculate G3 = M3 × F_n = (M, M, M) × F_n = (G₁, G₂, G₃) and send G3 to the intermediary.

2) Middle-party: There are three Middle-partys who receive G₁, G₂ and G₃ and forward them to the receiver.

3) Receiver: The receiver receives (G₁, G₂, G₃) and transforms G3 through the third-order Fibonacci inverse matrix to generate G3 × F_n⁻¹ = (M₁, M₂, M₃).

If there is no tampering during the transmission process, it should be: G3 × F_n⁻¹ = (G₁, G₂, G₃) × F_n⁻¹ = (M, M, M) × F_n × F_n⁻¹ = (M₁, M₂, M₃), M₁, M₂ and M₃ should all be equal. Therefore, the receiver can prevent data tampering by comparing whether M₁, M₂ and M₃ are equal, Moreover, due to the change in n, the intermediary receives three different data sets G₁, G₂ and G₃ from the original text, thus serving the purpose of encryption.

2.5.   Diffie-Hellman encryption algorithm

Diffie-Hellman is a key consistency algorithm published by Whitfield Diffie and Martin Hellman in 1976. It is a method of establishing key exchange, aimed at enabling two users to securely exchange a secret key for future message encryption. Its effectiveness depends on the difficulty of calculating discrete logarithms. Diffie-Hellman is an asymmetric encryption algorithm commonly used in blockchain encryption schemes and also a public key algorithm ^[25,26]. Its working principle is that each communication party generates a private key and a public key, and the private key is not public. After the public key is publicly exchanged, the communication parties can calculate the shared key, which is shared. Therefore, both parties can encrypt and decrypt messages through the shared key, thus achieving encrypted transmission of messages ^[27,28,29]. Diffie-Hellman can negotiate a shared key through unreliable channels and is widely used in PKI key distribution in many industrial level security protocols.

Sender sends plaintext M to Receiver for encrypted transmission, as shown in Figure 4.

1) Sender and receiver first agree on two parameters g and N, and randomly generate their own private keys x and y, and calculate their respective public keys X and Y using formula (10).

2) Sender and Receiver exchange X and Y

3) Sender calculates key K through x and Y, while Receiver calculates key G through y and X, as shown in formula (11).

From formula (11), it can be seen that K and G are equal, and therefore can be used as dual shared keys.

4) Sender encrypts plaintext M through K, with Cm = E_k(M); The receiver decrypts D_G(Cm) through G, and since K and G are equal, the receiver can obtain plaintext M = D_G(E_K(M)).

Diffie-Hellman is the foundation of authentication key exchange (AKE) schemes in the post quantum computing era ^[30]. It combines the third-order Fibonacci matrix with Diffie-Hellman encryption algorithm to form a new FIB-DH encryption technology scheme, which is a specific application of Diffie-Hellman in network printer encryption schemes.

2.6.   MQTT protocol

The full name of the MQTT protocol is Message Queuing Telemetry Transport, which means Message Queuing Transport Detection. It is a client server-based message publish/subscribe transport protocol under the ISO standard, based on the TCP/IP protocol cluster, published by IBM in 1999. The biggest advantage of MQTT is that it is lightweight, simple, open and easy to implement. It can provide real-time and reliable messaging services for remote connected devices with minimal code and limited bandwidth. As a low-cost, low bandwidth instant messaging protocol, it has a wide range of applications in the Internet of Things, small devices, mobile applications and other fields ^[31,32].

Implementing the MQTT protocol requires communication between the client and server. During the communication process, there are three identities in the MOTT protocol: Publisher, Broker (server) and Subscriber. Both the publisher and subscriber of the message are the client, while the message broker is the server. The message publisher can simultaneously send messages to the subscriber ^[33,34], as shown in Figure 5.

From Figure 5, it can be seen that the subscriber has subscribed to topic data1 or data2. As long as the publisher publishes topic data1 or data2, the subscriber can receive it. Therefore, broadcasting transmission and reception can be achieved, which can be one-to-many or many-to-one.

The messages transmitted by MQTT are mostly divided into two parts: Topic and payload:

1) Topic: It can be understood as the type of message (the type of data command transmitted). After subscribing to (Subscribe), the subscriber will receive the message content (payload) of the topic.

2) Payload: Can be understood as the content of the message (transmitted data body content), referring to the specific content that the subscriber needs to use. Payload can contain printed data content.

3.   FIB-DH encryption technology scheme based on edge cloud collaboration

3.1.   System scheme architecture

The FIB-DH encryption technology scheme based on edge cloud collaboration mostly includes five parts: Client computer (CC), MQTT cloud server (MCS), edge computer (EC), printing computer (PC) and printer (PT). 1) Customer computer is a customer computer that allows users to operate network printing, which can be printed locally on a local area network or remotely on the internet; 2) MQTT cloud server, remote communication management between customers and printing computers, and FIB-DH edge cloud collaboration; 3) Edge computer, at the edge of local area network, mainly realizes FIB-DH edge cloud collaboration; 4) The printing computer is connected to the printer USB in the local LAN to achieve FIB-DH edge cloud collaboration and transmit the verified printing data to the printer; 5) Printer, responsible for printing document data. The scheme architecture is shown in Figure 6.

In the FIB-DH encryption technology scheme, users send printed data through the client's computer. When the system is implemented, the major tasks include two types: 1) User connection authentication, and 2) printing document data, as shown in Figure 7.

In the connection authentication stage, users use FIB-DH data encryption technology scheme to perform connection authentication. During the document printing phase, users encrypt, transmit and verify printed data through edge cloud collaboration and FIB-DH scheme to avoid man in the middle attacks and prevent leaked printed documents

3.2.   FIB-DH encryption scheme

By utilizing the characteristics of the third-order Fibonacci matrix and combining it with the Diffie-Hellman encryption algorithm, a new FIB-DH encryption algorithm is formed. In the FIB-DH encryption algorithm, first, due to the fact that each encryption key is random and undergoes Fibonacci transformation, the generated ciphertext is different each time. If the intermediary obtains the ciphertext, it is ambiguous to analyze. Second, due to the use of key vectors, it is necessary to compare and vote on the results to achieve verification purposes. The FIB-DH encryption process in which the user sends plaintext M to the terminal is shown in Figure 8.

1) Sender and Receiver first agree on three parameters g, N, n (n is the n in F_n in formula 9) and randomly generate their own private key vectors x = (x1, x2, x3) and y = (y1, y2, y3), and calculate their respective public key vectors X and Y through formula (12).

2) Sender and Receiver exchange X and Y.

3) Sender calculates the key vector K through x and Y, while Receiver calculates the key vector G through y and X, as shown in formula (13).

From formula (13), it can be seen that K and G are equal and can therefore serve as shared keys for both parties.

4) Sender encrypts plaintext M through K, with Cm = E_k(M), as shown in formulas (14) and (15); Calculate Em through F_n transformation, as shown in formulas (16) and (17); Then the sender sends {E1, E2, E3} to the intermediate party (Party A, Party B, Party C).

After receiving the data from the intermediary, the receiver calculates Cm through F_n^-1 transformation, as shown in formula (18). Due to formula (19), formula (20) can be derived, and then D_G(Cm) can be decrypted through G, as shown in formula (21). Due to the equality of K and G, the three data {M1, M2, M3} in formula (22) should be equal. Therefore, the original M can be obtained through a voting algorithm.

For example, if the original file M has 5 bytes (if the multi byte principle is the same), M = (m1, m2, m3, m4, m5), (if n bytes, the principle is the same).

Finally, perform a time complexity analysis of the algorithm:

In the FIB-DH encryption scheme, due to Em = Cm × F_n and Cm = E × F_n⁻¹, based on the characteristics of the Fibonacci matrix, F_n and F_n⁻¹ can be calculated in advance. Therefore, its time complexity is O(n). The Elliptic Encryption Algorithm (ECC) is a public key encryption system based on Diffie-Hellman and is commonly used on mobile devices to ensure data security. ECC defines (x, y) at a point on G using the elliptic curve ^[35] equation G: y² + gxy + hy = x³ + ix² + jx + k, using key X × G and Y × G transformations for encryption and decryption. Based on this feature, its time complexity is O(n3). Therefore, the FIB-DH encryption method has lower time and complexity compared to the Elliptic Encryption Algorithm (ECC).

3.3.   Implementation process of FIB-DH scheme

Corresponding to Figure 8 of the FIB-DH scheme, the sender is Client Computer (CC), the receiver is Printer Computer (PC) and the intermediaries (Party A, Party B and Party C) are Edge Computer (EC), MQTT cloud server (MCS) and Printer Computer (PC). According to the FIB-DH encryption scheme in Section 3.1, the specific flowchart for implementing network printing is shown in Figure 9.

The implementation process is as follows:

Step1. CC set three parameters g, N and n, to randomly generate the private key x, and calculate X = mod N, F_n.

Step2. CC send three parameters g, N and n, and public key X to PC through the MQTT protocol.

CC = > PC:{ X, g, N, n}

Step3. PC randomly generates its own private key y and calculates Y = gen (g, y, N) based on the g, N transmitted by CC, Y serves as the public key of the PC; Simultaneously calculating encryption key G.

Step4. PC passes the public key Y to CC through the MQTT protocol. PC = > CC:{Y}

Step5. CC calculates the encryption key based on the Y transmitted from the PC.

K = mod N = mod N

Step6. CC input printing data, calculate Em = E_k(M) × F_n through key K and F_n, then send {E1, E2, E3} to PC, EC and MCS respectively.

CC- > PC:{E1}, CC- > EC:{E2}, CC- > MCS:{E3}

Step7. PC receives E2 and E3, merges them into Em and calculates Mn = D_G (Em × F_n⁻¹) through keys G and F_n, as shown in formula (22), compare M1, M2, M3 and vote for M.

Step8. Finally, the PC outputs to the PT via USB for printing.

4.   Experimental analysis

4.1.   Experimental tool

In order to simulate attacks on network printers, during the testing process, we used the printer intrusion tool kit PRET. PRET is an automated program based on Python language that can simulate various attack tests on the target printer. In actual use, it is necessary to install the PRET third-party components as follows:

# pip install colorama pysnmp

# pip install win_unicode_console

# apt-get install imagemagick ghostscript

The format of the PRET command is as follows:

usage: pret.py [-h] [-s] [-q] [-d] [-i file] [-o file] target {ps, pjl, pcl}

Among them, the PRET command position arguments are shown in Table 1.

The PRET command optional arguments are shown in Table 2.

The PRET command can be used to conduct various attacks on network printers, including DoS attacks, authorization, print task control, remote code operation, information leakage, information tampering, etc. These attacks can be used to test the anti-attack ability of remote network printing on network printers.

4.2.   Experiment and comparative analysis

Experimental comparison subjects: 1) Group 1: Local Network Printing (LN-PT), 2) Group 2: Remote Network Printing (RN-PT) and Group 3: FIB-DH Scheme Network Printing (FD-PT). Experimental address: In the IoT laboratory of the School of Artificial Intelligence. The system sets two parameters: 1) Set the number of network printing attacks using the PRET tool to simulate six network types of attacks: DoS attacks, authorization, print task control, remote code operation, information leakage and information tampering. The number of attacks for each type is shown in Table 3, with a total of 100 attacks. 2) Number of printing tasks, each task requires printing 10 2-page documents. In the experimental comparison, the number of printing tasks varies, and the accuracy of printing tasks is evaluated as the task burden increases.

The first group (Group1): Local Network Printing (LN-PT), under the same experimental conditions, achieves document printing through user computers on a local area network. The number of printing tasks is constantly changing, and it also simulates attacks on printers through PRET, ultimately comparing the accuracy of printing.

The second group (Group2): Remote Network System (RN-PT), under the same experimental conditions, remotely prints documents through user computers on the Internet. The number of printing tasks is constantly changing, and while printing, PRET is also used to simulate attacks on printers, ultimately comparing the accuracy of printing.

The third group (Group3): FIB-DH scheme network printing (FD-PT), under the same experimental conditions, remotely printing documents through user computers on the Internet. The number of printing tasks is constantly changing, and while printing, PRET simulation is also used to attack the printer, ultimately comparing the accuracy of printing.

1) Comparison of printing accuracy

By conducting network printing comparative experiments on three groups of systems, the task size varied from 100 to 300 with an increment level of 20. Finally, the comparative results were obtained as shown in Table 4. From the table, it can be seen that the FIB-DH network printing has the best printing accuracy under the same task.

When we set the number of printing tasks to 100,200 and 300, we compared the three groups of network printing. The bar chart is shown in Figure 10, which shows that FIB-DH network printing has more advantages.

The comparison of the printing accuracy of three sets of networks under different tasks is shown in Figure 11. From this line breaking chart, it can be clearly seen that the FIB-DH scheme has the best network printing accuracy under different tasks, with an improvement of about 6%.

2) Comparison of printing time cost

Similarly, we set the number of printing tasks to 100,200 and 300, and compare the time cost of three sets of network printing, the comparison results are shown in Table 5. Due to the fact that LN-RT is printed on a local network, the printing time cost is obviously lower than RN-PT and FD-PT. Therefore, we focus on comparing FD-PT and RN-PT. From the table, it can be seen that the printing time cost of FD-PT is slightly higher than that of FD-PT, and the difference is not significant, about 3%.

Summary of the experiment: 1) Compared the important indicator of network printing accuracy under three schemes, the FIB-DH scheme improved the network printing accuracy by about 6% under network attacks, making it more secure. 2) The FIB-DH scheme also has certain shortcomings in network printing. From the perspective of printing time cost, the FIB-DH scheme does not have an advantage in network printing, increasing by about 3% compared to others, but improving the printing accuracy by about 6%. In order to improve the security of network printing, it is inevitable to increase system complexity, and adding some printing time cost is not considered.

5.   Conclusions and future works

Network printers are a combination of traditional printers and internet applications, which perfectly solves the interconnection and sharing problems in office work and meets the office needs of government agencies. However, network printing poses security risks, and information leakage and network attacks may occur through network printing. In this article, we propose a FIB-DH data encryption technology scheme based on edge cloud collaboration to address the security of network printing, especially the risk of leakage during data transmission. By mining the characteristics of third-order Fibonacci matrices and combining Diffie-Hellman encryption technology, edge cloud collaboration is used to achieve the security of printed data. Through PRET tool simulation experiments, compared with conventional network printing, the accuracy of network printing data has been improved, effectively improving the security of network printing and preventing the leakage and tampering of printing information.

However, its technical scheme also has certain limitations. While improving network printing security, the complexity of its implementation has also increased. In future work, we will continue to compare and analyze privacy-protecting algorithms to improve their security while reducing the complexity of system implementation. This article can provide some reference for future research on network printing security models.

Use of AI tools declaration

The authors declare that they have not used Artificial Intelligence (AI) tools in the creation of this article.

Acknowledgments

This study was supported by the Natural Science Foundation Project of China (61976118), the Natural Science Foundation Project of Jiangsu Province (BK20180142), and the key topics of the "13th five-year plan" for Education Science in Jiangsu Province (B-b /2020/01/18).

Conflict of Interest

All authors declare no conflicts of interest in this paper.