1. Preface
The Xerox® Translate and Print app provides an easy path for users to provide instant machine translations via the user's Xerox multifunction device (MFD).
The Xerox® Translate and Print app can be installed on Xerox multifunction devices which support ConnectKey technology. The user scans the document and receives a translation print in one of 44 languages. Additionally, the user may specify an email address to receive a translation of the scanned document.
Purpose
The purpose of this Security Guide is to disclose information for the Xerox® Translate and Print app with respect to device security. Device security, in this context, is defined as how data is stored and transmitted, how the product behaves in a networked environment, and how the product may be accessed, both locally and remotely. This document describes the design, functions, and features of the Xerox® Translate and Print app relative to Information Assurance (IA) and the protection of customer sensitive information. It is important to note that the customer is responsible for the security of their network, and the Xerox® Translate and Print app does not establish security for any network environment.
This document does not provide tutorial-level information about security, connectivity, or Xerox® Translate and Print features and functions. This information is readily available elsewhere. It is assumed that the reader has a working knowledge of these types of topics.
Target Audience
The target audience for this document is Xerox field personnel and customers concerned with IT security. It is assumed that the reader is familiar with the Xerox® Translate and Print app; as such, some user actions are not described in detail.
Disclaimer
The content of this document is provided for information purposes only. Performance of the products referenced herein is exclusively subject to the applicable Xerox Corporation terms and conditions of sale and/or lease. Nothing stated in this document constitutes the establishment of any additional agreement or binding obligations between Xerox Corporation and any third party.
2. General Security Protection
Data Protection Overview
Use of the Xerox Translate and Print app is unauthenticated. Any person with access to a Xerox Multifunction Device on which the app is installed may launch the Xerox Translate and Print app and use its features. The device administrator has the option of requiring a person to authenticate with the Device before the device may be accessed.
The system maintains a record of translation orders executed on each Xerox Multifunction device. Each record stores the Source and Target language, the number of pages translated, and the date on which the translation was executed. Translation order records are anonymous and tie back to a specific Device rather than a particular person.
User Data Protection within the products
Document and File Security
File content is protected during transmission by standard secure network protocols at the channel level. Since document source content may contain Personally Identifiable Information (PII) or other sensitive content, it is the responsibility of the user to handle documents and digital information in accordance with information protection best practices.
Scanned document content is not reused for other parties' translations, nor is it disclosed to third parties.
Xerox® employees are not permitted to review client documents and translation results, except in exceptional circumstances where a document:
- causes a service failure.
- leads to the abnormal consumption of computing resources.
- leads to additional exceptional cases connected with the functionality of the service.
A limited number of authorized Xerox® personnel may review a customer image for the sole purpose of reproducing and fixing the issue this document has caused. In such cases, only a derivative document, without any personal/confidential data, is used to fix the issue.
The output of the system is strictly determined by the input. Only non-executable plain text data is returned by the translation sub-system. The system prevents the insertion of executable output as translation for non-executable content. Executable links in source documents are not translated.
Hosting - Microsoft Azure
The Xerox Translate web service is hosted on the Microsoft Azure Network. The Microsoft Azure Cloud Computing Platform operates within the Microsoft® Global Foundation Services (GFS) infrastructure, portions of which are ISO27001-certified. Microsoft has also adopted the new international cloud privacy standard, ISO 27018. Azure safeguards customer data in the cloud and provides support for companies that are bound by extensive regulations regarding the use, transmission, and storage of customer data.
The service is scalable, allowing multiple instances to be spun up/down as needed to handle user demand. The service is hosted in both the US and Europe. Users will be routed to the closest server geographically (based on network speed).
The Xerox Translate Web Service incorporates third-party Aspose file conversion and Mongo DB components. These components are configured to be accessible only from the local host, and not from the internet. The Mongo DB itself is not encrypted, but the disk the database resides on in the VM is encrypted. The Xerox Translate Web Service also invokes Xerox Services (hosted in the same Azure cloud) to initiate email. Xerox Services, in turn, invokes the external SendGrid email service to send the actual email to the recipient.
These security highlights are relevant to the Xerox Translate and Print system:
General Azure security
- Azure Security Center
- Azure Key Vault
- Log Analytics
Storage security
- Azure Storage Service Encryption
- Azure Storage Account Keys
- Azure Storage Analytics
Identity and access management
- Azure Role Based Access Control
- Azure Active Directory
- Azure Active Directory Domain Services
- Azure Multi-Factor Authentication
Networking
- Network Security Groups
- Azure Traffic Manager
For a full description of Azure security, please follow the link: https://docs.microsoft.com/en-us/azure/security/azure-network-security
ABBYY Cloud OCR
ABBYY Cloud OCR is a cloud-based document processing service that performs OCR conversion of scanned documents. The ABBYY Cloud OCR SDK service is hosted on Microsoft Azure. All data, including personal data and uploaded documents, is processed and stored on Azure servers. No information is stored outside of the Microsoft Azure environment. ABBYY Cloud OCR SDK service utilizes encrypted data transfer using HTTPS protocol. Within the Microsoft Azure environment, the data transfer between storage and processing nodes is encrypted. ABBYY Cloud OCR SDK is SOC 2 Type II certified – PwC (PricewaterhouseCoopers) has evaluated ABBYY's product, infrastructure, and policies, and certifies that the ABBYY service complies with SOC stringent requirements.
For more information about ABBYY security, see: https://www.abbyy.com/cloud-ocr-sdk/specifications/. For more information about ABBYY privacy, see: https://www.abbyy.com/privacy/.
Microsoft Translator
Microsoft Translator, part of the collection of Cognitive Services and an Azure service, is a cloud-based text translation API. The service uses modern neural machine translation technology and offers statistical machine translation technology. Translation is from a source language to a target language. The service is hosted in Azure Cloud.
Customer data submitted for translation to Azure Cognitive Services Translator is not written to persistent storage. There will be no record of the submitted text or any portion thereof, in any Microsoft data center. For more information on Microsoft Translator data confidentiality and compliance, see: https://www.microsoft.com/en-us/translator/business/notrace/.
SendGrid Service
The solution provides for an email service, hosted by SendGrid. The email service sends translated documents to the recipient.
For further details on SendGrid security, see: https://sendgrid.com/policies/security/. For more information about SendGrid privacy, see their parent company's privacy statement at: https://www.twilio.com/legal/privacy; and their Data Protection Addendum at: https://www.twilio.com/legal/data-protection-addendum.
User Data in transit
Device Webservice Calls
During standard usage of the Xerox® Translate and Print app, calls to the device web services are used to initiate and monitor scan functions and retrieve device information using the EIP interface. All communications to and from the Xerox® Translation Web Service are over HTTPS. Data is transmitted securely and is protected by TLS security for both upload and download. The default TLS version used is 1.2.
ABBYY Cloud OCR and Xerox Translation Web Services
All web communication between The ABBY Cloud OCR service and the Xerox Translate Web Service is encrypted using TLS 1.2. The Xerox Translate Web Service connects to ABBYY Cloud OCR via a secured connection, using an ApplicationID and a Password.
Microsoft Translator and Xerox Translation Web Services
Microsoft Translator is a multilingual machine translation cloud service provided by Microsoft. The Microsoft Translator endpoint (https://api.cognitive.microsofttranslator.com/) exposed over HTTP enforces TLS 1.2 communication with Xerox Translation web services. The Xerox Translate Web Service connects to Microsoft Translator via a secured connection, using a subscription key and a Secret key.
Xerox Translation Web Services and Xerox Services
The Xerox Translate web service communicates with Xerox Services within the same Azure cloud to initiate email. Communication between the services is secured by a secret key.
Xerox Services and SendGrid
The Xerox Services communicates with SendGrid to send emails using the SendGrid API defined at: https://sendgrid.com/docs/api-reference/. This communication is done via HTTPS and the data is transmitted securely and is protected by TLS security. The minimum TLS version used is 1.2. The Xerox Services connects to SendGrid via a secured connection, using an API key.
3. Translate and Print – ConnectKey App
Description
Overview
The Xerox® Translate and Print ConnectKey app supports translation of scanned documents at a Xerox Multifunction Device; and optionally emailing a recipient the translation.
ConnectKey App
The Xerox® Translate and Print app may be purchased from the Xerox App Gallery and then installed on Xerox devices from the Xerox® App Gallery. The purpose of the App is to provide translations of scanned documents.
The ConnectKey App allows any person with access to the Device to use the app's functionality. The app does not require any user credentials. Any device user may view records of the translation orders initiated at the Device. Since no credentials are involved, all translation order records are anonymous.
The ConnectKey App allows users to scan a document and have a translated version print at the device. The user may optionally specify an email recipient for the app to send the translation to.
App Hosting
The ConnectKey App depends heavily on cloud-hosted components. A brief description of each can be found below.
ConnectKey App
The ConnectKey App is implemented as a weblet installed on the Xerox MFD. The device weblet enables the following behavior on a Xerox device:
- Presents the user with an application UI and executes the business logic of the app.
- Interfaces with the EIP API to initiate operations at the Device.
- Interfaces with the Xerox Translate web service to translate supplied image documents.
Xerox Extensible Interface Platform® Web Services
During standard usage of the ConnectKey App, calls to the device web services are used to initiate scan and print operations on the device.
Components
MFD
The MFD is an EIP-capable device capable of running ConnectKey App weblets installed from the Xerox App Gallery. In this case, the MFD has the Xerox® Translate and Print app weblet installed.
Translate and Print – App weblet
The Xerox® Translate and Print app weblet is installed on the MFD via the Xerox® App Gallery. The weblet is responsible for hosting web pages, which are displayed on the UI of the MFD, and provide the basis for user interaction with the Xerox® Translate and Print app.
Xerox Translate Web Service
The Xerox® Translate Web Service is hosted on the Microsoft Azure Cloud System.
The web service interacts with the ABBYY platform using the ABBYY Cloud OCR API to perform Optical Character Recognition on the scanned document. The web service interacts with Microsoft Translator to convert the document to the target language. The web service incorporates Aspose to format the translated document into PDF that can be printed or emailed. The webservice interacts with Xerox Services to initiate optional email of a translated document. The web service incorporates a Mongo DB to store input documents, translated documents, and records for each translation order.
Abbyy Cloud OCR
The solution provides for an OCR capability hosted by ABBYY in the Microsoft Azure cloud. The OCR capability performs Optical Character Recognition on a scanned document as described in https://www.abbyy.com/cloud-ocr-sdk/specifications/. The Xerox Translate Web Service connects to ABBYY Cloud OCR via a secured connection, using an ApplicationID and a Password.
Microsoft Translator
The solution provides for a translation capability hosted by Microsoft in the Microsoft Azure cloud at https://api.cognitive.microsofttranslator.com/. Translation is from a source language to a target language. The Translate Web Service connects to Microsoft Translator via a secured connection, using a subscription key and a Secret key.
Xerox Services
Xerox Services invokes SendGrid via the SendGrid API to email the recipient the translated document. Xerox Services connects to SendGrid via a secured connection, using an API key.
SendGrid Service
The solution provides for an email service hosted by SendGrid. The email service sends a recipient a translated document.
Architecture and Workflows
Architecture Diagram
The architecture diagram illustrates the flow of data and services. It shows ABBYY Cloud OCR, Microsoft Translator, and SendGrid interacting with the Xerox Translate Web Service. The Xerox Translate Web Service connects to Azure Cloud Service, Mongo DB, and Aspose. It also interacts with Xerox Services, which in turn connects to SendGrid. The Xerox Device, running the Xerox Translate & Print weblet, interacts with the Xerox Translate Web Service. The Xerox App Gallery, hosted on Azure (Azure SQL Server, Azure App Service, Azure Storage), is the source for installing the weblet on the Xerox Device. Web Browser and Browser Extensions (like Chrome ActiveX) are also shown as interfaces.
Workflows – ConnectKey App
Scan, translate, and Print Workflow
- User launches the Translate and Print app weblet at the Device.
- User specifies the source language of the document to be scanned.
- User selects the target language of the document to be printed.
- User modifies the scanning options (e.g., single sided, original size, etc.).
- User selects the Scan button, and the document is scanned.
- The Xerox Translate web service translates the scanned document.
- The translated document is printed to the Device.
View "My Orders" Workflow
- User launches the Translate and Print app weblet at the Device.
- User selects the view orders option.
- The Xerox Translate web service provides the Translate and Print app weblet with records of translation orders initiated at the Device.
- The Translate and Print app weblet displays the content of the translate order records in the device browser for the user to view.
Scan, translate, and Print with optional email Workflow
- User launches the Translate and Print app weblet at the Device.
- User specifies the source language of the document to be scanned.
- User selects the target language of the document to be printed.
- User specifies the email address of the recipient.
- User modifies the scanning options (e.g., single sided, original size, etc.).
- User selects the Scan button, and the document is scanned.
- The Xerox Translate web service translates the scanned document.
- The translated document is printed to the Device.
- The translated document is emailed to the recipient.
User Data Protection
Application Data Stored in the Xerox Cloud
User data related to the categories below are stored in the Mongo DB hosted by the Xerox cloud translation service:
- Anonymous records for each translation order.
- Document data
A delete occurs of all document data files 72 hours after the output file was created.
Local Environment
Application Data Transmitted
Application data is protected during transmission by standard secure network protocols at the channel level. Since document content may contain Personally Identifiable Information or other sensitive content, it is the responsibility of the user to handle the scanned and printed documents in accordance with information protection best practices.
Application Data Stored on the Xerox Device
The following app data is stored on the device, in persistent storage, until the App is uninstalled from the device:
- The Translate and Print app weblet
- Scratchpad data storage
No user-specific data is stored locally on the device.
4. Additional Information & Resources
Security @ Xerox
Xerox maintains an evergreen public web page that contains the latest security information pertaining to its products. Please see https://www.xerox.com/security.
Responses to Known Vulnerabilities
Xerox has created a document which details the Xerox Vulnerability Management and Disclosure Policy used in discovery and remediation of vulnerabilities in Xerox software and hardware. It can be downloaded from this page: https://www.xerox.com/information-security/information-security-articles-whitepapers/enus.html.
Additional Resources
| Security Resource | URL |
|---|---|
| Frequently Asked Security Questions | https://www.xerox.com/en-us/information-security/frequently-asked-questions |
| Bulletins, Advisories, and Security Updates | https://www.xerox.com/security |
| Security News Archive | https://security.business.xerox.com/en-us/news/ |
