Xeretec Scan to OneDrive Secure and Convenient

Transcription

1 Xeretec Scan to OneDrive Secure and Convenient Seb Coles Senior Software Developer Xeretec April, 2017 Version Copyright 2017 by Xeretec Ltd. All rights reserved.

2 Document Preface The purpose of this document is to serve as a technical specification of the Xeretec Scan to OneDrive printer application. The document will cover the hosting infrastructure and the security measures put in place to achieve a convenience authentication solution. The audience of this document is for our customer s IT authority and endeavours to provide all the information required to decide on whether the Xeretec Scan to OneDrive app will comply with our customer s policies and practises. Contents 1. Executive Summary 2. Scan to OneDrive 3. Architecture 4. Architecture a. Xeretec Scan to OneDrive b. EIP Hosting c. Authentication Mechanism 5. Technology Details 6. Environment Requirements 7. Conclusion

3 Executive Summary Xeretec Scan to OneDrive is a printer based application that works alongside a secure print solution to enable users to authenticate with OneDrive through their identification card. Using the Xerox EIP (Extensible Interface Platform) API we can programmatically ask the device who is currently authenticated. We can then take that authentication and retrieve credentials stored securely in a password safe, which can then be based onto to OneDrive to authenticate scanning. For the end user, this provides a quick and easy way to scan directly into personal or team SharePoint sites just using their card. The Xeretec Scan to OneDrive is a unique offering in that it is the only solution providing a convenience authentication approach for scanning into OneDrive. Our competitor product, Xerox Scan to OneDrive, requires an end user to provide credentials with every scan. This is cumbersome with the touch screen on the device which is why we believe the uptake of this solution is minimal. The purpose of this document is to provide assurance that the Xeretec Scan to OneDrive has taken the necessary security precautions for the secure, encrypted, storage of credentials for the use of convenience authentication. Security is a top concern when it comes to the IT Infrastructure and we ensure secure coding practises into our development process. We want to be transparent with what technologies and services are used to achieve this.

4 Scan to OneDrive Scanning directly into OneDrive can have several benefits. Whether its preventing a print and reducing your volume, ensuring secure storage of a document throughout a workflow, or even cutting out some steps in a workflow and saving time. The current Xerox offering for scanning to OneDrive requires credentials for every request at the multi-functional device. The touch screen panel on a Xerox MFD can be quite cumbersome at times and we feel therefore the uptake of this app has been poor. We wanted to solve that. Xeretec Scan to OneDrive is a web based application that is hosted on a client s network. This gets registered to your multi-functional devices and will present a user with a credentials input page on first use. A SQL database is attached to the web application which enables us to then take those credentials, encrypt them with AES (Advanced Encryption Standard) and store them securely for future usage of the app. When a client next authenticates with your secure print solution (Safecom, Equitrac etc) we will recognise that we have credentials available for that user. When the scan job is initiated we will retrieve these credentials and pass them onto OneDrive on the user s behalf. This allows us to provide a convenience authentication solution in conjunction with your secure print system. We ve added a few other security measures to ensure appropriate use of the Xeretec Scan to OneDrive app. Firstly we have built an administration portal that accompanies the application that is hosted your network. This allows you to control a whitelist of registered devices for the app ensuring only authenticated machines can view the app. We also check requests to ensure they come from a Xerox device. We also log all access requests to the device that is provided back to you through the administrator client. For ease of reporting the only data that is taken outside of your network into the Xeretec cloud infrastructure is your scan usage information. This data is taken for accurate billing automatically and doesn t contain any personally identifiable information. For customers that we provide user analytics for, we can also optionally take usage along with filenames and usernames automatically.

5 Architecture Xeretec Scan to OneDrive Customer Network Password Safe Customer Firewall Directory Listing File Upload Scan to OneDrive Application Server SharePoint / OneDrive Network Equipment Billing Data Customer Xerox MFD Xeretec Cloud The Xeretec Scan to OneDrive software is installed on a customer site on a windows server with IIS 8.5+ and SQL Express The app is registered to all licensed Xerox MFD devices and the administration portal URL and credentials are provided to IT to manage the IP whitelist. Once a user is registered with the application and they access the Xeretec Scan to OneDrive app we will query the customers personal and business share point sites to find all top level available repositories. When the customer selects a site, we go back to share point and request the next available directories. The user is also presented with a scan option which will take the user to the scan settings page. The user can select their scan settings (DPI, File format etc) and then initiate a scan request. Once completed the Scan to OneDrive application will pick up the raw completed scan job data from the Xerox device. It will then upload this file using the client s credentials into the selected directory. Usage data will periodically be sent to Xeretec for billing purposes only. There are no inbound connection requirements for the Scan to OneDrive application to work. All data transmission is sent using the encrypted HTTPS protocol and no other transport protocols are involved.

6 EIP Hosting WebPage AJAX (Asynchronous JavaScript & XML) Session API Device Management API SNMP API EIP EIP is hosted via web services on all Xerox Multi-functional devices. Websites using AJAX can query the EIP using localhost libraries available when a HTML page is displayed on the device.

7 Scan Workflow and Authentication Phase Users User Swipes Card Device Access not Granted User Selects Scan To OneDrive App Access Denied Present Registration Screen Select Directory and Initiate Scan Xerox MFD Devices Passes Card Information to Secure print Solution Secure Print Solution Session Information Sent to Scan To OneDrive App Secure Print Solution Is Valid User? Xeretec Scan to OneDrive Xerox Device? Valid IP? Do we have credentials for this user? Pick up scan job and send to OneDrive SharePoint/ OneDrive Personal Drive Available? What Team Sites? Upload

8 Technology Details Hosting IIS 8.5+ Xeretec Scan to OneDrive Programming Languages and Technologies ORM Libraries Additional Tools C# ASP MVC HTML5 CSS Javascript LLBLGen Unity, MSTest, Bootstrap, Log4Net, JQuery, Xerox Libraries Raygun Exception Handling Ports & Protocols Port Number Protocol Usage Flow 80 HTTP Internal API calls to MFD device Internal Only 443 HTTPS Accessing Printer Support App and External calls made from app to Xeretec API Internal & External (Outbound)

9 Environment Requirements Multi-Functional Device Requirements EIP Version 3.5 (Upgrade from 2.6 at Xerox.com) WC 3655, WC 58xx, WC 59xx, WC 6655, WC 72xx, WC 78xx, WC 7970 Network connected Extensible Services Available Remote TWAIN configured on the Xerox devices Recommended Web Server Requirements Microsoft Windows Server IIS 8.5+ Microsoft SQL Server Express Network requirements Port 443 Open to allow SSL HTTPS connections Conclusion At Xeretec were very excited to be able to provide this services to our customers. Combining SharePoint, scanning and convenience authentication we believe we can provide a solution that will assist with lower your print volume as well as saving time and improving compliance with using your cloud based document management system. Xeretec is the largest Xerox partner in Europe and I set to being a world leader in the Xerox printer application scene. Our Agile software team follows best practises and is committed to providing a continuous delivery environment. All support and feedback requests are welcomed to: Pulse Support Pulse.Support@Xeretec.co.uk Xeretec Office Systems Ltd Greenwell Base, Greenwell Road Aberdeen, Scotland, AB12 3AX.