HP Imaging and Printing Security Center 2.0 - Instant-On Security

PART 1 - DEVICE ANNOUNCEMENT AGENT

General Discussion

This section provides a general understanding of the Device Announcement Agent, why it

was developed and the value it provides.

The HP Device Announcement Agent (DAA) serves as the device-side component of the

Instant-On Security solution and is an embedded function in most, but not all HP IPSC

supported printers. The DAA is also found in recently released HP JetDirect network

interface cards, which provide Instant-On compatibility with legacy HP printers missing the

embedded DAA functionality. Please refer to the HP IPSC Supported Devices document

found at www.hp.com/go/ipsc for the most current list of Instant-On Security supported

devices.

Developed strictly for use with the HP IPSC Instant-On feature, the DAA combined with HP

IPSC addresses three primary customer desires: First, an automatic printing device discovery

solution that does not require additional network configuration, additional protocol

enabling, exhaustive searches or chatty broadcasts. Second, a solution that provides a true

out-of-the-box device security compliance experience or what is referred to as Secure at

Install. Third, a solution that can maintain security settings when the installed device is cold

reset or changes IP addresses, referred to as the Stay Secure experience.

Due to limitations in fully automatic discovery methods, networked printer discovery is

generally a manual process requiring device or network specific input. For example,

automatic device discovery methods such as Service Location Protocol (SLP) and Bonjour

(mDNS) can provide some automation to the discovery process. Both methods commonly

possess limitations that prevent them from being a complete solution in most corporate

environments. SLP adoption typically faces packet filtering restrictions and Bonjour is limited

to a single broadcast domain, without special DNS configuration. In addition, automatic

discovery methods such as exhaustive subnet scanning are not feasible for IPv6 networks

due to the size of the address space. These and other automatic methods typically involve

some manual intervention, lack efficiency, and do not scale well for large enterprises.

To overcome such limitations, the innovative Device Announcement Agent (DAA) was

developed and provides a supported HP printing device the capability of announcing its

presence directly to the HP IPSC server. This announcement process is handled through

common DNS address resolve and dedicated TCP port communication (port 3329). The

DAA model alleviates the need for manual intervention, is not chatty and serves as a more

efficient device discovery mechanism. After the initial device discovery process is complete,

HP IPSC applies the established security policy to the device over a secure TCP connection.