HP IMAGING AND PRINTING SECURITY CENTER 2.0 Instant-On Security CONTENTS Overview ............................................................................................................................. 2 What is Instant-On Security? ................................................................................................ 2 What is Instant-On Secure at Install? ..................................................................................... 2 What is Instant-On Stay Secure? ................
OVERVIEW What is Instant-On Security? The HP Imaging and Printing Security Center (HP IPSC) is the industry’s first policy-based security compliance solution for Hewlett Packard printing and imaging devices. Unique to HP IPSC, the Instant-On Security feature provides automatic device discovery and security compliance configuration when an HP supported device is first connected to the network.
What is Instant-On Stay Secure? After registering with HP IPSC, a device generates an announcement during a power cycle, cold reset, when assigned a different IP address, or for other device specific conditions while on the network. Upon receiving an announcement, HP IPSC assesses the device and immediately remediates any setting found to be out of compliance with the last security policy applied to that device. This activity is referred to as Stay Secure throughout the document.
PART 1 - DEVICE ANNOUNCEMENT AGENT General Discussion This section provides a general understanding of the Device Announcement Agent, why it was developed and the value it provides. The HP Device Announcement Agent (DAA) serves as the device-side component of the Instant-On Security solution and is an embedded function in most, but not all HP IPSC supported printers.
A device Secure at Install experience is the result of this two-step process. After the Secure at Install process is complete, Instant-On continues with the Stay Secure process via the DAA announcements that occur for device cold resets, IP address changes and other device specific conditions. The Stay Secure process ensures the device is remediated in accordance with the last security policy applied.
Figure 5 provides another example of how to determine if the device supports the DAA. Beginning with version 10.2 Service Release 7, HP Web Jetadmin provides fleet configuration of the Device Announcement Agent. You can set up a device layout in HP Web Jetadmin to include the Device Announcement Agent column. DAA presence is indicated by an Enabled, Disabled or Not Supported status in this column.
An enabled Device Announcement Agent announces when the device is powered up on the network for the first time. Announcements also occur during a device power cycle, cold reset, IP address change and link down/link up scenario. DAA Workflow Description The Device Announcement Agent is enabled by default. The device is capable of displaying four different DAA states; Disabled, In Progress, Success or Failed. Success indicates the device was able to discover an HP IPSC server and establish communication.
DAA Workflow Diagram FIGURE 7 8
Detailed Discussion This section presents the Device Announcement Agent in greater detail, including network configuration for default functionality, network activity, primary use cases, communication specifics, and authentication. Network Configuration DAA communication occurs via the HP device announcement protocol (HDAP).
FIGURE 9 Note: The DAA DNS resolve occurs on the local domain only, unless the device is configured to query additional domains or the DNS environment is configured to refer to other domains. The device can be automatically configured with a specific DHCP server option (option 119) that assigns additional domain suffixes or manually configured with the additional domain information via the device’s embedded web server. See Figure 10.
FIGURE 11 Note: When IPv6 is enabled on the device, you will notice at least one IPv6 (AAAA) and IPv4(A) DNS request per domain. 2. TCP Port 3329 is registered with the Internet Assigned Numbers Authority (IANA) and specifically assigned to HP IPSC. See Figure 12. This port is dedicated to Instant-On communication between the HP supported device and HP IPSC. Port 3329 is also referred to as the hp-device-disc port.
Network Activity Instant-On security operates with very little impact to the network. As mentioned earlier in this document, the Device Announcement process consists of resolving the HP IPSC server hostname or alias of hp-print-mgmt to an IP address. Once the address is resolved, a dedicated TCP port (3329) is opened for direct communication between the device and HP IPSC.
Successful DNS resolution of the hp-print-mgmt hostname or alias (IPv6 Enabled) Trace 1is an example of a successful DNS resolution of the default hostname of hp-printmgmt.domain.company.net. After an unsuccessful attempt at DNS resolve over IPv6, the device retried over IPv4. Once the hostname resolved to an IP address, the device then opened up a TCP connection on port 3329. This connection then serves as secure communication between HP IPSC and the device.
Initial Device Announcement Use Cases Setting up the network as explained above allows for an initial default out-of-the-box device security configuration experience. Below, is a list of the most common Secure at Install use cases. Use Case 1 – Auto Discovery and Policy Conformance A DAA enabled HP IPSC supported device is placed on the network for the first time without any staged configuration. The IPSC server Instant-On feature is configured to Accept Device Announcements and Allow Automatic Remediation.
Use Case 4 – Filtered Discovery and Policy Conformance A DAA enabled HP IPSC supported device is placed on the network without any staged configuration. The IPSC server Instant-On feature is configured to “Accept Device Announcements”, “Allow Automatic Remediation” and utilize device serial numbers as a method of filtering Instant-On activity. The device acquires a DHCP address and attempts to resolve the DNS hostname or alias of hp-print-mgmt.
back on the network generates a DAA announcement. The HP IPSC server processes this announcement , reconciles the device identity based on the serial number match and applies the last policy the device was assessed with. Through this process, the device is immediately placed back into its secure state. Use Case 3 – Device Acquires New IP address Device has moved physical locations and acquires a new IP address. The IP address change produces a DAA announcement, thus prompting communication with HP IPSC.
attempted. However, the DAA allows the SSL/TLS connection to proceed after authentication fails. HP IPSC might close the SSL/TLS connection as a result of failing to validate the device certificate. This decision is determined by the device announcement security policy on the HP IPSC server. For more information on use of certificates with the Instant-On Security feature, please refer to Mutual Authentication in Part 2 of this document.
Default Configuration To enable the Instant-On Security feature, the Accept Device Announcements box must be selected. After selecting Accept Device Announcements, a pop-up notification provides a reminder to ensure TCP port 3329 is not blocked at the firewall. See Figure 16. FIGURE 16 When the Accept Device Announcements box is selected, two Instant-On Security options exist.
Option 2 is the selection of Accept Device Announcements and Allow Automatic Remediation. This combined selection will discover the DAA enabled device and apply the security policy that appears in the Initial Assessment Policy field. See Figure 18. FIGURE 18 The default Instant-On Security configuration accepts and processes discovery and policy requests from every device capable of announcing itself through the HP Device Announcement Agent.
FIGURE 19 Instant-On Filtering Instant-On Security configuration options are available to filter device “Instant-On” participation. Selecting Mutual Authentication leverages installed trusted certificates to establish a higher level of Instant-On connection and communication security. When selected and configured, only the devices that complete device identity certificate validation can participate in the Instant-On process.
Detailed Discussion This section explains the Instant-On configuration server in greater detail, including device discovery specifics, serial number filtering, database entry, mutual authentication and initial assessment policy use. Automatic Device Discovery As discussed in Part 1, HP supported devices now have the capability of announcing their presence on the network. This device capability is enabled by default.
The device’s Announcement Message request includes device identity information, such as; the MAC address, the IP address, model and the serial number. Upon initial authenticated communication between the device and server, IPSC inserts this gathered identity information into the database. See Figure 21. This identity information, specifically the serial number, can now be used if the serial number filtering option is selected.
FIGURE 23 As devices announce, are discovered and placed into the Device Table, the serial number entry is removed from the device serial number list. From the devices tab, status will show device as being Auto Discovered. See Figure 24. As long as Use Device Serial Number List remains selected in the Instant-On settings window, only the serial numbers in the Serial Numbers Filter Table will participate in the Instant-On Security process.
Mutual Authentication Overview Instant-On Security can be configured for mutual authentication; an announcement option that relies upon device and IPSC identity assurance through a combined action of client-toserver and server-to-client SSL/TLS (Secure Socket Layer/Transport Layer Security) authentication. Mutual authentication can also be informally referred to as 2-way SSL/TLS authentication. Deploying trusted certificates for mutual authentication provides the most secure method of Instant-On Security.
Authentication Authenticating the server consists of checks that include: • • • • Has the server certificate expired or been revoked? Can the Certificate Authority (CA) that issued the certificate, be trusted? Does the CA’s public key validate the digital signature? Does the domain name in the certificate match the domain name of the server? Authenticating the client consists of checks that include: • • • • Does the client public key validate the client digital signature? Has the client certificate expir
FIGURE 26 Note: During the Instant-On mutual authentication process, the device and IPSC toggle between roles of client and server. When creating (ID) certificates for the printer and IPSC, ensure the certificates are configured for Server and Client Authentication under Enhanced Key Usage. See Figure 27.
To participate in a Mutual Authentication announcement, each device must be set to Require Mutual Authentication via Certificates. From IPSC, select Mutual Authentication and choose the Certificate to use from the list of security certificates found on the server. See Figure 28. The IPSC list of available certificates is derived from entries found in the Local Computer Personal Store. See Figure 29.
Note: When generating the identity certificate for IPSC, it is a best practice to assign a friendly name to the certificate for easy identification in the IPSC certificate list. In the example above, “ipsctestcert” was used. Mutual Authentication Configuration To assist with certificate deployment, a basic understanding of mutual authentication and a simplified deployment process is presented in Figures 30 through 38. Figure 30 shows the usual out-of-the box configuration and the expected behavior.
In Figure 32, a JetDirect certificate request has been generated and provided to the Certificate Authority (CA) for signing. The (CA) generates a signed identity certificate based upon this request. The newly signed JetDirect certificate is installed, replacing the default self-signed certificate. However, the connection remains untrusted because the client has no knowledge of the (CA) that generated the JetDirect certificate.
FIGURE 33 FIGURE 34 For Instant-On mutual authentication, Figure 35 shows the required role reversal between the printer and the pc. With IPSC installed and the Instant-On Security feature enabled, the printer becomes the client requesting to establish secure communication with IPSC, the server.
FIGURE 35 IPSC now installed on PC Mutual Authentication selected in DAA With the printer now in the role of client, it requires knowledge of the CA that will be generating the identity certificate for the pc, now the server. See Figure 36. The (CA) certificate is exported and installed on the printer. To install the CA certificate on the device, see Figure 37.
FIGURE 37 At this point, the only missing component needed to achieve mutual authentication is the identity certificate of the server. As was the case when the printer was the server, a certificate request is generated from the IPSC server and submitted to the CA server for signing. Once signed and installed in the Local Computer Personal Store, trusted client-toserver communication and thus mutual authentication now exists.
Announcement Message Summary The device Announcement Message is always sent using the most secure authentication method the device is configured for. When the Device Announcement Agent is set for Require Mutual Authentication via Certificates, only trusted SSL/TLS authentication is allowed. When set, the Announcement Message requires valid identity and CA certificates be installed on the device. If this requirement is not met, the announcement is not sent.
Trademark Credits Microsoft®, Windows®, Windows Vista®, Windows Server®, and Windows Server System® are U.S. registered trademarks of Microsoft Corporation. © February 2014 Hewlett-Packard Development Company, L.P. The information contained herein is subject to change without notice. The only warranties for HP products and services are set forth in the express warranty statements accompanying such products and services. Nothing herein should be construed as constituting an additional warranty.
