New Print Delivery Options for PaperCut Hive

Overview

Are you an IT admin struggling to enable Find-Me Printing in a Zero Trust or segmented network environment, and using Kyocera or Lexmark devices in your fleet? Our new Print Delivery Options in PaperCut Hive are designed just for you!

This feature is perfect for organizations that one or more of the following apply to:

• Use Network Client Isolation (often referred to as a Zero Trust network), meaning client machines cannot communicate with printers directly.
• Have moved printers onto a separate network segment (VLAN), removing client communication, and want to avoid requiring a print server or appliance.
• Require secure HTTPS (Port 443) delivery from local client machines to the printer with the added option of maintaining data sovereignty.
• Operate in hybrid environments where no user devices may be online at the time of print release.

If any of these sound familiar, keep reading to learn how you can participate in testing our new print delivery methods. Then, sign up below for access.

The basics

Traditional printing workflows rely on the end user’s computer to process and push print jobs directly to the printer. This is commonly done over protocols like RAW 9100 or IPP, both of which come with inherent challenges:

• RAW 9100 transmits print jobs in plain text.
• Client machines need to have a line of sight to the printer, which can be a problem in segmented or Zero Trust networks.
• Reliance on an always-on client or print server to handle job delivery where client availability is uncertain adds an infrastructure burden.

PaperCut Hive’s new Print Delivery Options eliminate these inefficiencies by shifting from a push-based model to a pull-based approach, where MFDs retrieve print jobs on demand directly from the configured source. This enables additional security by adhering to modern network security protocols such as Zero trust and operational resilience by allowing print jobs to be pulled from:

• The Cloud Node – Ideal for Zero Trust environments or where clients do not have a network route to the printers.
• A Local Client – Ensuring print jobs remain within the internal network, enhancing both security and performance

How it works

In PaperCut Hive, we have added two new options to the print delivery protocol selection, which can be made on a per-printer basis.

The print job flow when using these features is as follows:

1. A user sends a print job from their device.
2. The job is replicated within the Edge Mesh, and a copy is sent to the Cloud Node.
3. At the time of release, the MFD securely downloads the print job, over a 443 connection, from the Cloud Node or a local client.
4. The job is processed and printed by the MFD.

Diagram showing the flow after a user has released a print job where the Printer pulls job from cloud is selected:

Diagram showing the flow after a user has released a print job where the Printer pulls job from local client is selected:

Example use case

Zero Trust Printing

An IT team implementing network client isolation as part of its Zero Trust strategy faces a challenge: how to enable printing without opening ports between clients and printers.

Solution: Configure Printer Pulls Jobs from Cloud mode, ensuring the MFD retrieves jobs securely from the PaperCut Hive Cloud Node.

Printing in a Segmented Network

A school has moved its printers to a separate VLAN, making traditional client-to-printer connections impossible, and it doesn’t want to introduce a server or appliance to send print jobs to the printer.

Solution: Allow the MFD to retrieve print jobs from the PaperCut Hive Cloud Node by configuring Printer Pulls Jobs from Cloud mode, removing the need for a print server while maintaining network segmentation.

Printing with extensive privacy and data sovereignty policies

A hospital or government office with extensive privacy and data sovereignty policies.They have internal networks to keep all data local. They do not want to adopt cloud storage and cloud job processing.

Solution: Configure Printer Pulls Jobs from Local client mode, ensuring the data sovereignty and that print data remains in the local network.

The result

1. For the first scenario above, we eliminated the need for direct communication between devices, including printers. The communication takes place via the cloud node securely, which means no additional ports need to be opened to communicate with printers that may pose risk.

2. For the second scenario above, Students no longer have access to printers on the same network and can’t print directly to Port 9100, etc. This setup works with the school’s pre-existing network client isolation providing a print delivery configuration that fits their requirements.
This minimizes the risk of a printer or port being accessible to outsiders for network attacks.

3. For the third scenario above, the customer can get the optimum print performance. This approach also respects the preferred client settings in the custom print delivery profile associated with the printers following the strict privacy and data sovereignty policies.