Watermarking/job annotation

Watermarking is a feature that allows text to be written to every page in a print job. You can write the text to the top (or bottom) of a page, in a custom location (such as the middle of the page), or over the entire page. Watermarking is a powerful and flexible feature. Typical uses of watermarkingWatermarking is a feature that allows you to print a small portion of text to the top or bottom margin of every page. Typical uses of watermarking include adding a username to the bottom of every page to help identify the owner, writing job metadata in the footer such as print time, printer or document name, and applying a digital signature to help track and verify documents. include:

adding a username to the bottom of every page to help identify the owner
writing job metadata in the footer, such as print time, printer or document name
applying a digital signatureDigital signatures allow you to include metadata, such as the origin, author, time of print, and other details of print jobs, on print jobs (usually the footer). This helps organizations track documents and encourages employees to be responsible with sensitive information. Digital signatures use either a cryptographically secure HMAC or a Bates number. to help track and verify documents
applying a copyright notice across proprietary content to prevent plagiarism

You can apply watermark text to printers individually. Print scripting makes it possible to change watermarks dynamically (see Print scripting). Watermarks can contain substitution variables allowing the insertion of document metadata such as date/time, username, document name, etc.

A typical watermark is shown in the picture immediately below. This watermark uses the %user%, %date% and %signature% substitution variables described in the Substitution Variables section.

NOTE

PaperCut NG/MF watermarks print jobs by modifying the print stream as jobs spool via the print serverA print server is a system responsible for hosting print queues and sharing printer resources to desktops. Users submit print jobs to a print server rather then directly to the printer itself. A print server can be a dedicated server but on many networks this server also performs other tasks, such as file serving. The watermark is injected into the job using advanced PDL methods, such as macros and overlays. This is the reason why PaperCut NG/MF supports only the following standards based print languages:

PCL5 (Full page watermarking is not supported)
PCL6
PostScript.

PCL6 and PostScript drivers are recommended for devices that support these drivers, as they provide better quality and consistent prints with watermarks.

Typical uses

Owner Identification. Add the username to each page so it is easy to find the owner (e.g. uncollected print jobs).

Suggested Watermark: Printed by %user%
Student Assignments. Add the username and time of printing to each page. This helps teachers match up student work and help students prove that assignments were delivered on time.

Suggested Watermark: Printed by %user% at %date% on printer %printer%
Tracking an Organization's Physical Documents. Add a sequentially allocated number to every document printed. This number is a document-level Bates number (http://en.wikipedia.org/wiki/Bates_numbering). It is recorded in the PaperCut NG/MF database and is useful for organizing document trails.

Suggested Watermark: Document No.: %bates% composed of %pages% pages
Identification and Source Tracking. Add a unique and secure digital signature to each document. Use this to verify the origin and generation details of a document. (Note: see Digital Signatures in Detail section below if security is required).

Suggested Watermark: %signature%
Content ownership and copyright. Add a repeated pattern stating the copyright notice or company name across the entire page to protect valuable documents where royalties apply. .

Suggested Watermark: Copyright ABC Corporation. All rights reserved. Document Signature: %signature%
Behavioral Change. The cost of each print job is added to the bottom of each page. This gives the user immediate feedback on the cost of their printing.

Suggested Watermark: The cost of this print job is: %cost%

TIP

To configure watermarking based on the user (e.g. a user's group membership) or job attributes, consider the Advanced Scripting feature. Advanced Scripting allows the watermarking to be enabled/disabled and the watermarking text to be adjusted to meet any need. See Print scripting for more details.

Requirements

Watermarking is currently available for printers using PostScript and PCL drivers. You should ensure that the printer driverA printer driver or a print processor is a piece of software that converts the data to be printed to the form specific to a printer. The purpose of printer drivers is to allow applications to do printing without being aware of the technical details of each printer model. uses the PostScript or PCL language rather than GDI or other languages. You can verify this by observing the word PostScript, PCL5 or PCL6 in the Job Log as shown in the screenshot below.

On Windows systems, if the language lists as EMF, then turn off Advanced Printing Features as described in Troubleshooting.

Enabling watermarking

To enable watermarking:

Click the Printers tab.

The Printer List page is displayed.
Select a printer.

The Printer Details page is displayed showing the Summary tab contents.
In the Advanced Configuration area, select the Apply watermark / digital signature to all pages check box.
In Text, enter the text to be printed in the watermark. You can use macro substitution variables, such as %user% and %date%. For a complete list of the variables, see Substitution variables/macros.
In Position, select the location on the page where you want watermark to be displayed. This can be Bottom of page, Top of page, Full page, or Custom. Custom is intended for advanced situations where some tweaking is required due to differences in the page printable area. Custom positions are specified as the distance, in millimeters, from the top or bottom of the page (Longitude), and from the left or right of the page (Latitude).
For Bottom of page and Top of page, complete the following options:
- In Text, enter the text to be printed in the watermark. You can use macro substitution variables, such as %user% and %date%. For a complete list of the variables, see Substitution variables/macros.
- Gray level—determines how dark or light the text will be. Medium is the default. Light is just viewable.
- Font size (points)—determines the watermark text size.
For Full page, complete the following options:
- In Text, enter the text to be printed in the watermark. You can use macro substitution variables, such as %user% and %date%. For a complete list of the variables, see Substitution variables/macros.
NOTE
For Full page:
- you cannot select any options. By default, the watermark will print in 14pt with Medium gray scale.
- Only PCL6 and postscript drivers are supported.
For Custom, complete the following options:
- In Text, enter the text to be printed in the watermark. You can use macro substitution variables, such as %user% and %date%. For a complete list of the variables, see Substitution variables/macros.
- Gray level—determines how dark or light the text will be. Medium is the default. Light is just viewable.
- Font size (points)—determines the watermark text size.
- Horizontal Position—the distance, in millimeters, from the top or bottom of the page. Select one of the following, then enter the number of millimeters:
  - Distance from top of page
  - Distance from bottom of page
- Vertical Position—the distance, in millimeters, from the left or right of the page. Select one of the following, then enter the number of millimeters:
  - Distance from top of page
  - Distance from bottom of page
Click OK.

Substitution variables/macros

Substitution variables / macros
Field	Description
%user%	The name (username) of the user that printed the document.
%user_primary_card_id%	The user's primary ID code.
%user_secondary_card_id%	The user's secondary ID code.
%user_full_name%	The full name of the user that printed the document.
%user_email%	The email address of the user that printed the document.
%date%	The date/time that the document was printed. The date is formatted in according the locale of the server. An example of a %date% is 12/12/2010 3:12:37 PM.
%document%	The name of the document that printed.
%server%	The server name that is hosting the printer that printed the print job.
%printer%	The name of the printer where the print job was printed.
%client_ip%	The IP address of the workstation the job was sent from.
%client_machine%	The name of the workstation that sent the print job.
%job_id%	The PaperCut NG/MF job id of the job.
%copies%	The number of copies of the document that was printed.
%cost%	The cost of the print job.
%pages%	The total number of pages in the print job.
%bates%	A sequentially incrementing number based on a Bates Numbering (http://en.wikipedia.org/wiki/Bates_numbering) scheme. All pages in the document are stamped with the same number. The number is recorded as a signature in the print log.
%signature%	A unique secure digital signature (in text form) generated via an MD5 HMAC. The signature is recorded in the print log. See Digital Signatures in Detail (Advanced) below for technical details.
%digest%	A unique digital signature (in text form) generated using an MD5 of various document attributes.
%sig_md5%	Same as %signature%.
%digest_md5%	Same as %digest%.
%sig_sha1%	Same as %signature% but based on the SHA1 message digest algorithm.
%digest_sha1%	Same as %digest% but based on the SHA1 message digest algorithm.

Restrictions and limitations

To ensure a document that has a unique single signature, use only one digital signature macro in a watermark. The digital signature macros are:

%bates%
%signature%
%sig_md5%
%sig_sha1%

Digital signatures in detail (advanced)

Signature algorithm

PaperCut NG/MF document digital signatures are generated using a cryptographic technique called an HMAC (http://en.wikipedia.org/wiki/HMAC). This works by taking various print job attributes, such as print time, username, printer name, and document name, and combining them with a secret key. The result is then passed through a digest algorithm such as MD5. The resulting signature is unique to the document. The secret key portioning ensures that it is not possible to predict a signature. Two message digest algorithms are available:

MD5— MD5 is secure enough for print job signature applications. Because the signatures are shorter, using MD5 makes it easier to enter keys to find matching print jobs.
SHA1—provided as an option for cryptographic completeness.

NOTE

The algorithm used is:

Digest = Hash(date time || username || server name || printer name || document name || job id)
Signature = Hash(Digest || Key)

where:

key is a random string generated on first use and stored in the config keyA config key stores information about a specific advanced setting in PaperCut. Config keys are editable by an administrator in the Config Editor. "print.signature.hmac-key" and hash is either MD5 or SHA1.
date time is formatted in ISO 8601 basic format from year to second ("yyyyMMddTHHmmss"). The time is local time (not UTC). E.g. "20100130T141059"

Verifying a signature

If a document is located, for example, due to an information leak, you can use the signature to track down the print event details such as the originating user, time of print, and other details. This is done as follows:

Click the Logs tab.

The Job Log page is displayed.
Click edit next to Filter on.
In Signature, enter the signature.
Click Apply Filter. The matching job should list.

For example, the following screenshot shows how to search for the print job with signature b608c7a39f08643768051217f2f5315a in the job logThe job log retains a history of all print jobs including the following details: the user who printed (ie. their network user ID), the time of the print event, the number of pages, document attributes such as color, duplex, grayscale, paper size, document area, paper length, where the print job originated from (the workstation name or IP address), and the document name and type (for example, a Word document’s file name)..

Troubleshooting

Watermarking requires print jobs to be printed in PostScript or PCL format. If your document is printed in EMF you might be able to print in PostScript or PCL by following the procedure listed in the EMF section below. For all other drivers, see Other Printer Languages.

EMF

On Windows systems, if the printer language for a job lists as EMF, then turn off Advanced Printing Features. Disabling this option causes print jobs to be rendered into their printer language on the client side. Enabling it can result in rendering on the server side, which is usually unwanted.

You can do this by following these steps:

On the print server, select Start > Control Panel > Printers > [right-click printer] > Properties > Advanced.
Turn off (disable) the Enable advanced printing features option.
Test printing and check the printer language to ensure that it is now PostScript or PCL.

You can read more about this setting on the Microsoft website at: http://support.microsoft.com/?kbid=268093.

Other printer languages

If the printer language for a job is listed as a non-supported language, such as ESC/P2(Epson), then watermarking does not work. The manufacturer might also support other languages, such as PostScript. Check the printer manufacturer's website download page for details.

Updating printer drivers

When updating printer drivers, it is important to update the printer drivers on both the client and the server.