Watermarking/job annotation
Watermarking is a feature that allows a small portion of text to be written to the bottom (or top) of every page. Watermarking is a powerful and flexible feature. Typical uses of watermarkingWatermarking is a feature that allows you to print a small portion of text to the top or bottom margin of every page. Typical uses of watermarking include adding a username to the bottom of every page to help identify the owner, writing job metadata in the footer such as print time, printer or document name, and applying a digital signature to help track and verify documents. include:
-
adding a username to the bottom of every page to help identify the owner
-
writing job metadata in the footer such as print time, printer or document name
-
applying a digital signatureDigital signatures allow you to include metadata, such as, the origin, author, time of print, and other details of print jobs, on print jobs (usually the footer). This helps organizations track documents and encourages employees to be responsible with sensitive information. Digital signatures use either a cryptographically secure HMAC or a Bates number. to help track and verify documents
You can apply watermark text to printers individually. Print scripting makes it possible to change watermarks dynamically (see Advanced scripting (print scripting)). Watermarks can contain substitution variables allowing the insertion of document metadata such as date/time, username, document name, etc.
A typical watermark is shown in the picture immediately below. This watermark uses the %user%, %date% and %signature% substitution variables described in the Substitution Variables section.
PaperCut NG watermarks print jobs by modifying the print stream as jobs spool via the print serverA print server is a system responsible for hosting print queues and sharing printer resources to desktops. Users submit print jobs to a print server rather then directly to the printer itself. A print server can be a dedicated server but on many networks this server also performs other tasks, such as, file serving. The watermark is injected into the job using advanced PDL methods, such as, macros and overlays. This is the reason why PaperCut supports only the following standards based print languages:
- PCL5
- PCL6
- PostScript.
PaperCut NG must understand the job and its data to perform this on-the-fly modification.
Watermarking is a new feature that uses advanced printer techniques that are implemented differently by each device manufacturer. Please report any problems that you experience to our support team for investigation.
Typical uses
-
Owner Identification. Add the username to each page so it is easy to find the owner (e.g. uncollected print jobs).
Suggested Watermark: Printed by %user%
-
Student Assignments. Add the username and time of printing to each page. This helps teachers match up student work and help students prove that assignments were delivered on time.
Suggested Watermark: Printed by %user% at %date% on printer %printer%
-
Tracking an Organization's Physical Documents. Add a sequentially allocated number to every document printed. This number is a document-level Bates number (http://en.wikipedia.org/wiki/Bates_numbering). It is recorded in the PaperCut NG database and is useful for organizing document trails.
Suggested Watermark: Document No.: %bates% composed of %pages% pages
-
Identification and Source Tracking. Add a unique and secure digital signature to each document. use this to verify the origin and generation details of a document. (Note: see Digital Signatures in Detail section below if security is required).
Suggested Watermark: %signature%
-
Protecting Value of Documents. Use the copy protection aspects of watermark signatures described above to protect valuable documents where royalties apply.
Suggested Watermark: Copyright ABC Corporation. All rights reserved. Document Signature: %signature%
-
Behavioral Change. The cost of each print job is added to the bottom of each page. This gives the user immediate feedback on the cost of their printing.
Suggested Watermark: The cost of this print job is: %cost%
To configure watermarking based on the user (e.g. a user's group membership) or job attributes, consider the Advanced Scripting feature. Advanced Scripting allows the watermarking to be enabled/disabled and the watermarking text to be adjusted to meet any need. See Advanced scripting (print scripting) for more details.
Requirements
Watermarking is currently available for printers using PostScript and PCL drivers. You should ensure that the printer driverA printer driver or a print processor is a piece of software that converts the data to be printed to the form specific to a printer. The purpose of printer drivers is to allow applications to do printing without being aware of the technical details of each printer model. uses the PostScript or PCL language rather than GDI or other languages. You can verify this by observing the word PostScript, PCL5 or PCL6 in the Job Log as shown in the screenshot below.
On Windows systems, if the language lists as EMF, then turn off Advanced Printing Features as described in Troubleshooting.
Enabling watermarking
To enable watermarking:
-
Click the Printers tab.
The Printer List page is displayed.
-
Select a printer.
The Printer Details - Summary page is displayed.
-
In the Advanced Configuration area, select the Apply watermarks to all pages check box.
-
Complete the following options as required:
- Text—the text to be printed on the watermark. You can use macro substitution variables, such as %user% and %date%. Substitution variables are described in the Substitution Variables/Macros section below.
- Gray level—determines how dark or light the text will be. Medium is the default. Light is just viewable.
- Font size—determines the watermark text size.
- Position—can be bottom left of page, top left of page, or custom. Custom is intended for advanced situations where some tweaking is required due to differences in page printable area. Custom positions are specified as the distance from the left of the page and distance from the bottom of the page in millimeters.
-
Click OK.
Substitution variables/macros
| Field | Description |
|---|---|
| %user% | The name (username) of the user that printed the document. |
| %user_primary_card_id% | The user's primary ID code. |
| %user_secondary_card_id% | The user's secondary ID code. |
| %user_full_name% | The full name of the user that printed the document. |
| %user_email% | The email address of the user that printed the document. |
| %date% | The date/time that the document was printed. The date is formatted in according the locale of the server. An example of a %date% is 12/12/2010 3:12:37 PM. |
| %document% | The name of the document that printed. |
| %server% | The server name that is hosting the printer that printed the print job. |
| %printer% | The name of the printer where the print job was printed. |
| %client_ip% | The IP address of the workstation the job was sent from. |
| %client_machine% | The name of the workstation that sent the print job. |
| %job_id% | The PaperCut NG job id of the job. |
| %copies% | The number of copies of the document that was printed. |
| %cost% | The cost of the print job. |
| %pages% | The total number of pages in the print job. |
| %bates% | A sequentially incrementing number based on a Bates Numbering (http://en.wikipedia.org/wiki/Bates_numbering) scheme. All pages in the document are stamped with the same number. The number is recorded as a signature in the print log. |
| %signature% | A unique secure digital signature (in text form) generated via an MD5 HMAC. The signature is recorded in the print log. See Digital Signatures in Detail (Advanced) below for technical details. |
| %digest% | A unique digital signature (in text form) generated using an MD5 of various document attributes. |
| %sig_md5% | Same as %signature%. |
| %digest_md5% | Same as %digest%. |
| %sig_sha1% | Same as %signature% but based on the SHA1 message digest algorithm. |
| %digest_sha1% | Same as %digest% but based on the SHA1 message digest algorithm. |
Restrictions and limitations
To ensure a document that has a unique single signature, use only one digital signature macro in a watermark. The digital signature macros are:
-
%bates%
-
%signature%
-
%sig_md5%
-
%sig_sha1%
Digital signatures in detail (advanced)
Signature algorithm
PaperCut NG document digital signatures are generated using a cryptographic technique called an HMAC (http://en.wikipedia.org/wiki/HMAC). This works by taking various print job attributes, such as, print time, username, printer name, and document name, and combining them with a secret key. The result is then passed through a digest algorithm such as MD5. The resulting signature is unique to the document. The secret key portioning ensures that it is not possible to predict a signature. Two message digest algorithms are available:
- MD5— MD5 is secure enough for print job signature applications. Because the signatures are shorter, using MD5 makes it easier to enter keys to find matching print jobs.
- SHA1—provided as an option for cryptographic completeness.
The algorithm used is:
-
Digest = Hash(date time || username || server name || printer name || document name || job id)
-
Signature = Hash(Digest || Key)
where:
-
key is a random string generated on first use and stored in the config keyA config key stores information about a specific advanced setting in PaperCut. Config keys are editable by an administrator in the Config Editor. "print.signature.hmac-key" and hash is either MD5 or SHA1.
-
date time is formatted in ISO 8601 basic format from year to second ("yyyyMMddTHHmmss"). The time is local time (not UTC). E.g. "20100130T141059"
Verifying a signature
If a document is located, for example, due to an information leak, you can use the signature to track down the print event details such as the originating user, time of print, and other details. This is done as follows:
-
Click the Logs tab.
The Job Log page is displayed.
-
Click edit next to Filter on.
-
In Signature, enter the signature.
-
Click Apply Filter. The matching job should list.
For example, the following screenshot shows how to search for the print job with signature b608c7a39f08643768051217f2f5315a in the job logThe job log retains a history of all print jobs including the following details: the user who printed (ie. their network user ID), the time of the print event, the number of pages, document attributes such as color, duplex, grayscale, paper size, document area, paper length, where the print job originated from (the workstation name or IP address), and the document name and type (for example, a Word document’s file name)..
Troubleshooting
Watermarking requires print jobs to be printed in PostScript or PCL format. If your document is printed in EMF you might be able to print in PostScript or PCL by following the procedure listed in the EMF section below. For all other drivers, see Other Printer Languages.
EMF
On Windows systems, if the printer language for a job lists as EMF, then turn off Advanced Printing Features. Disabling this option causes print jobs to be rendered into their printer language on the client side. Enabling it can result in rendering on the server side, which is usually unwanted.
You can do this by following these steps:
-
On the print server, select Start > Control Panel > Printers > [right-click printer] > Properties > Advanced.
-
Turn off (disable) the Enable advanced printing features option.
-
Test printing and check the printer language to ensure that it is now PostScript or PCL.
You can read more about this setting on the Microsoft website at: http://support.microsoft.com/?kbid=268093.
Other printer languages
If the printer language for a job is listed as a non-supported language, such as, ESC/P2(Epson), then watermarking does not work. The manufacturer might also support other languages, such as, PostScript. Check the printer manufacturer's website download page for details.
Updating printer drivers
When updating printer drivers, it is important to update the printer drivers on both the client and the server.