Notice of Pre-AIA or AIA Status
1. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
2. The response filed on 1/12/2026 was received and considered. Claims 1-5, 8-11, and 13-16, and 18-20 are pending for examination.
Information Disclosure Statement
3. The information disclosure statements (IDS) submitted on January 12, 2026 is in compliance with the provisions of 37 CFR 1.97 and have been considered by the examiner.
Response to Arguments
4. Applicant’s arguments in the amendment filed 1/12/2026 with respect to the 103 rejection have been fully considered but they are not persuasive. Applicant amends claim 1 by incorporating some of the claimed features of claim 17 into claim 1. Grajek discloses the limitations of canceled claim 17. A new ground of rejection is set forth below in view of Grajek.
Claim Objections
5. Claims 18 and 20 are objected to because of the following informalities: Claims 18 and 20 recite the private key instead of a private key. Appropriate correction is required.
Claim Rejections - 35 USC § 103
6. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
7. Claims 1-5, 9-11, 13 and 18-20 are rejected under 35 U.S.C. 103 as being unpatentable over Foreign Patent Application CN-108737331-A to Zhu in view of US Patent Publication US 2015/0188906 A1 to Minov et al hereafter Minov and in view of US Patent Publication US 2014/0082715 A1 to Grajek et al hereafter Grajek.
Regarding claim 1, Zhu teaches a method comprising:
Utilizing a trust mechanism to log the user out of a second one of the two systems wherein utilizing the trust mechanism to log the user out of the second one of the two systems comprises (See page 3, paragraph 5 disclosing a cross-domain application between the two systems to log the user out of the second system).
wherein utilizing the trust mechanisms to log the user out of the second one of the two systems comprises sending a JSON web token (JWT) from a user browser to the second one of the two systems… and sending the JWT to the first system as confirmation of completion of the logout from the second one of the two systems. (See page 9, paragraphs 2-3 disclosing an exit login request from the user browser to third party system B and an exit request submitted to third party system A. See also paragraphs 4-5 disclosing a JSON web token to be used for cross domain. The system also uses authentication with HTTPS suggesting that the JSON can be signed for added security).
Zhu does not explicitly disclose receiving a logout request from a user at a first one of two systems; logging the user out of the first one of the two systems;
sending a JSON web token (JWT) signed by a private key of the first one of the two systems from a user browser to the second one of the two systems wherein the JWT comprises a post logout redirect URL
redirecting the user browser to logout of the second one of the two systems, wherein the redirecting comprises, sending by the second one of the two systems, the JWT that was previously sent to the second one of the two systems to the user browser.
However, Minov in an analogous art discloses receiving a logout request from a user at a first one of two systems; logging the user out of the first one of the two systems (see para 42);
sending a JSON web token (JWT) signed by a private key of the first one of the two systems from a user browser to the second one of the two systems wherein the JWT comprises a post logout redirect URL (see paragraphs 41-42 Minov does not disclose a JSON which is disclosed by Zhu but discloses a signed token; the login module adding signed request parameters to the logout request which may be digitally signed with the IDP private keys (para 20), the MDS redirects the browser to the IDP).
MInov further discloses redirecting the user browser to logout of the second one of the two systems, wherein the redirecting comprises, sending by the second one of the two systems, the JWT that was previously sent to the second one of the two systems to the user browser (see paragraphs 43-44 disclosing the browser sends the logout request to the IDP the IDP encodes the assertion parameter, cookie name and returns the information to the browser).
Therefore, it would have been obvious to one having ordinary skill in the art before the effective filing date of the claimed invention to modify Zhu to redirect the browser to log out of the second one of the two systems wherein the redirecting comprises sending by the second one of the two systems, the JWT that was previously sent to the second one of the two systems to the user browser. One of ordinary skill in the art would have been motivated to do so because it allows verification of multiple domains as taught by Minov (see paragraph 44)
Zhu does not explicitly disclose responsive to the completion of the logout, identifying by the second one of the two systems, other applications of the second one of the two systems to which the user is logged in;
receiving by the second one of the two systems front channel logout URLs for the other applications of the second one of the two systems to which the user is logged in; and
directing by the second one of the two systems loading of the front channel logout URLs by the other applications of the second one of the two systems to which the user is logged in.
Grajek discloses responsive to the completion of the logout, identifying by the second one of the two systems, other applications of the second one of the two systems to which the user is logged in (See paragraph 120 disclosing “the client app may automatically logout of any enterprise service server or network resource it was accessing, this may involve sending a message to its affiliated enterprise service server to instruct the server or network resource that it has logged out and its session is over. client app 111a may direct the browser back to the authentication appliance to query the appliance for more URL mappings that may be used to log out additional applications”.
receiving by the second one of the two systems front channel logout URLs for the other applications of the second one of the two systems to which the user is logged in (see paragraph 121 disclosing “the browser (and subsequently the client app) may receive a list of applications from the authentication appliance that should be logged out. The authentication appliance may track the applications that a user is logged into…”
directing by the second one of the two systems loading of the front channel logout URLs by the other applications of the second one of the two systems to which the user is logged in (see paragraph 121 disclsosing “this list may then be transferred to the browser 113a (3), and passed on to the client app 111a (4). The list may then be utilized to call the native client app URL to start a chain of calling each mobile app for the purpose of logging out of each mobile app. .”.
Therefore, it would have been obvious to a person having ordinary skill in the art before the effective filing date of the claimed invention, to modify Zhu, Minov, responsive to the completion of the logout, identifying by the second one of the two systems, other applications of the second one of the two systems to which the user is logged in; receiving by the second one of the two systems front channel logout URLs for the other applications of the second one of the two systems to which the user is logged in; and directing by the second one of the two systems loading of the front channel logout URLs by the other applications of the second one of the two systems to which the user is logged in as suggested by Grajek (see paragraphs [0120-121]).
Regarding claim 2, the references as combined above disclose the method of claim 1. Zhu further discloses: wherein the trust mechanism comprises at least one token (see page 9, paragraph 2).
Regarding claim 3, the references as combined above disclose the method of claim 1. Minov further discloses wherein the logout request directs the logging out of the user from the first one of the two systems ( See Minov para 42).
Regarding claim 4, the references as combined above disclose the method of claim 3. Minov further discloses wherein logging the user out of the first one of the two systems comprises expiring a session of the user on the first system. (See paragraph 62, session of the one or more domains are invalidated). Claim 4 is rejected on the same rationale as claim 1 above.
Regarding claim 5, the references as combined above disclose the method of claim 4 as outlined above. Minov further discloses
Wherein utilizing the trust mechanisms to log the user out of the second one of the two systems comprises redirecting the user to the second one of the two systems. (See paragraphs 43-44 disclosing the browser sends the logout request to the IDP the IDP encodes the assertion parameter, cookie name and returns the information to the browser). Claim 5 is rejected on the same rationale as claim 1 above.
Regarding claim 9, the references as combined above disclose the method of claim 1 as outlined above. Minov further discloses:
Wherein utilizing the trust mechanisms to log the user out of the second one of the two systems comprises clearing cookies and/or tokens of the second one of the two systems from the user browser (See Mivov paragraphs 39-40 disclosing cleaning and removing the session cookies). Claim 9 is rejected on the same rationale as claim 1 above.
Regarding claim 10, the references as combined above disclose the method of claim 9 as outlined above. Minov further discloses:
Wherein utilizing the trust mechanism to log the user out of the second one of the two systems comprises logging the user out of applications of the second one of the two systems. (See paragraphs 60-63 disclosing in a single logout request from the user the browser requests the SLO service to logout from all the domains). Claim 10 is rejected on the same rationale as claim 1 above.
Regarding claim 11, the references as combined above disclose the method of claim 10 as outlined above. Zhu further discloses:
Wherein utilizing the trust mechanisms to log the user out of the second one of the two systems comprises sending a confirmation of logout from the second one of the two systems to the user browser, the confirmation of logout comprising the JWT. (See page 9, paragraphs 2-3 disclosing an exit login request from the user browser to third party system B and an exit request submitted to third party system A. See also paragraphs 4-5 disclosing a JSON web token to be used for cross domain. The system also uses authentication with HTTPS suggesting that the JSON can be signed for added security).
Regarding claim 13, the references as combined above disclose the method of claim 9 as outlined above. Minov further discloses logging out other applications of the first system via communication of a front channel logout URL. (See paragraphs 60-63 disclosing in a single logout request from the user the browser requests the SLO service to logout from all the domains). Claim 10 is rejected on the same rationale as claim 1 above.
Regarding claim 18, Zhu discloses a system comprising: a first access control system having a first login protocol ,the first access control system comprising: at least one first processor (see page 5 last two paragraphs to page 6 first two paragraphs); and a memory comprising a plurality of instructions executable by the at least one first processor, (see abstract, and background the cross domain communication system comprises computers with memory and processor)
and a second access control system, wherein the second access control system has a second login protocol independent of the first login protocol, wherein the first access control system is configured to: (see page 5 last two paragraphs to page 6 first two paragraphs).
Utilize a trust mechanism to log the user out of a second one of the two systems wherein utilizing the trust mechanism to log the user out of the second one of the two systems comprises (See page 3, paragraph 5 disclosing a cross-domain application between the two systems to log the user out of the second system).
wherein utilizing the trust mechanisms to log the user out of the second one of the two systems comprises sending a JSON web token (JWT) from a user browser to the second one of the two systems… and sending the JWT to the first system as confirmation of completion of the logout from the second one of the two systems. (See page 9, paragraphs 2-3 disclosing an exit login request from the user browser to third party system B and an exit request submitted to third party system A. See also paragraphs 4-5 disclosing a JSON web token to be used for cross domain. The system also uses authentication with HTTPS suggesting that the JSON can be signed for added security).
Zhu does not explicitly disclose receiving a logout request from a user at the first access control system; log the user out of the first access control system;
sending a JSON web token (JWT) signed by a private key of the first one of the two systems from a user browser to the second one of the two systems wherein the JWT comprises a post logout redirect URL
redirecting the user browser to logout of the second one of the two systems, wherein the redirecting comprises, sending by the second one of the two systems, the JWT that was previously sent to the second one of the two systems to the user browser.
However, Minov in an analogous art discloses receiving a logout request from the first access control system; logging the user out of the first access control system (see para 42);
sending a JSON web token (JWT) signed by a private key of the first one of the two systems from a user browser to the second one of the two systems wherein the JWT comprises a post logout redirect URL (see paragraphs 41-42 Minov does not disclose a JSON which is disclosed by Zhu but discloses a signed token; the login module adding signed request parameters to the logout request which may be digitally signed with the IDP private keys (para 20), the MDS redirects the browser to the IDP).
MInov further discloses redirecting the user browser to logout of the second one of the two systems, wherein the redirecting comprises, sending by the second one of the two systems, the JWT that was previously sent to the second one of the two systems to the user browser (see paragraphs 43-44 disclosing the browser sends the logout request to the IDP the IDP encodes the assertion parameter, cookie name and returns the information to the browser).
Therefore, it would have been obvious to one having ordinary skill in the art before the effective filing date of the claimed invention to modify Zhu to redirect the browser to log out of the second one of the two systems wherein the redirecting comprises sending by the second one of the two systems, the JWT that was previously sent to the second one of the two systems to the user browser. One of ordinary skill in the art would have been motivated to do so because it allows verification of multiple domains as taught by Minov (see paragraph 44).
Zhu does not explicitly disclose responsive to the completion of the logout, identifying by the second one of the two systems, other applications of the second one of the two systems to which the user is logged in;
receiving by the second one of the two systems front channel logout URLs for the other applications of the second one of the two systems to which the user is logged in; and
directing by the second one of the two systems loading of the front channel logout URLs by the other applications of the second one of the two systems to which the user is logged in.
Grajek discloses responsive to the completion of the logout, identifying by the second one of the two systems, other applications of the second one of the two systems to which the user is logged in (See paragraph 120 disclosing “the client app may automatically logout of any enterprise service server or network resource it was accessing, this may involve sending a message to its affiliated enterprise service server to instruct the server or network resource that it has logged out and its session is over. client app 111a may direct the browser back to the authentication appliance to query the appliance for more URL mappings that may be used to log out additional applications”.
receiving by the second one of the two systems front channel logout URLs for the other applications of the second one of the two systems to which the user is logged in (see paragraph 121 disclosing “the browser (and subsequently the client app) may receive a list of applications from the authentication appliance that should be logged out. The authentication appliance may track the applications that a user is logged into…”
directing by the second one of the two systems loading of the front channel logout URLs by the other applications of the second one of the two systems to which the user is logged in (see paragraph 121 disclsosing “this list may then be transferred to the browser 113a (3), and passed on to the client app 111a (4). The list may then be utilized to call the native client app URL to start a chain of calling each mobile app for the purpose of logging out of each mobile app. .”.
Therefore, it would have been obvious to a person having ordinary skill in the art before the effective filing date of the claimed invention, to modify Zhu, Minov, responsive to the completion of the logout, identifying by the second one of the two systems, other applications of the second one of the two systems to which the user is logged in; receiving by the second one of the two systems front channel logout URLs for the other applications of the second one of the two systems to which the user is logged in; and directing by the second one of the two systems loading of the front channel logout URLs by the other applications of the second one of the two systems to which the user is logged in as suggested by Grajek (see paragraphs [0120-121]).
Regarding claim 19, the references as combined above disclose the method of claim 9 as outlined above. Minov further discloses wherein the logout request directs the logging out of the user from the first access control system, wherein logging the user out of the first access control system comprises expiring a session of the user on the first access control system, (See paragraph 62, session of the one or more domains are invalidated) wherein utilizing the trust mechanism to log the user out of the second access control system comprises redirecting the user to the second access control system (see paragraphs 43-44 disclosing the browser sends the logout request to the IDP the IDP encodes the assertion parameter, cookie name and returns the information to the browser). Claim 19 is rejected on the same rationale as the rejection of claim 1 above.
Regarding claim 20, Zhu discloses a non-transitory computer-readable storage medium storing a plurality of instructions executable by one or more processors, the plurality of instructions when executed by the one or more processors cause the one or more processors to:
wherein utilizing the trust mechanisms to log the user out of the second one of the two systems comprises sending a JSON web token (JWT) from a user browser to the second one of the two systems… and sending the JWT to the first system as confirmation of completion of the logout from the second one of the two systems. (See page 9, paragraphs 2-3 disclosing an exit login request from the user browser to third party system B and an exit request submitted to third party system A. See also paragraphs 4-5 disclosing a JSON web token to be used for cross domain. The system also uses authentication with HTTPS suggesting that the JSON can be signed for added security).
Zhu does not explicitly disclose receive a logout request from a user at a first one of two systems; logging the user out of the first one of the two systems;
sending a JSON web token (JWT) signed by a private key of the first one of the two systems from a user browser to the second one of the two systems wherein the JWT comprises a post logout redirect URL
redirecting the user browser to logout of the second one of the two systems, wherein the redirecting comprises, sending by the second one of the two systems, the JWT that was previously sent to the second one of the two systems to the user browser.
However, Minov in an analogous art discloses receive a logout request from a user at a first one of two systems; log the user out of the first one of the two systems (see para 42);
sending a JSON web token (JWT) signed by a private key of the first one of the two systems from a user browser to the second one of the two systems wherein the JWT comprises a post logout redirect URL (see paragraphs 41-42 Minov does not disclose a JSON which is disclosed by Zhu but discloses a signed token; the login module adding signed request parameters to the logout request which may be digitally signed with the IDP private keys (para 20), the MDS redirects the browser to the IDP).
Minov further discloses redirecting the user browser to logout of the second one of the two systems, wherein the redirecting comprises, sending by the second one of the two systems, the JWT that was previously sent to the second one of the two systems to the user browser (see paragraphs 43-44 disclosing the browser sends the logout request to the IDP the IDP encodes the assertion parameter, cookie name and returns the information to the browser).
Therefore, it would have been obvious to one having ordinary skill in the art before the effective filing date of the claimed invention to modify Zhu to redirect the browser to log out of the second one of the two systems wherein the redirecting comprises sending by the second one of the two systems, the JWT that was previously sent to the second one of the two systems to the user browser. One of ordinary skill in the art would have been motivated to do so because it allows verification of multiple domains as taught by Minov (see paragraph 44).
Zhu does not explicitly disclose responsive to the completion of the logout, identifying by the second one of the two systems, other applications of the second one of the two systems to which the user is logged in;
receiving by the second one of the two systems front channel logout URLs for the other applications of the second one of the two systems to which the user is logged in; and
directing by the second one of the two systems loading of the front channel logout URLs by the other applications of the second one of the two systems to which the user is logged in.
Grajek discloses responsive to the completion of the logout, identifying by the second one of the two systems, other applications of the second one of the two systems to which the user is logged in (See paragraph 120 disclosing “the client app may automatically logout of any enterprise service server or network resource it was accessing, this may involve sending a message to its affiliated enterprise service server to instruct the server or network resource that it has logged out and its session is over. client app 111a may direct the browser back to the authentication appliance to query the appliance for more URL mappings that may be used to log out additional applications”.
receiving by the second one of the two systems front channel logout URLs for the other applications of the second one of the two systems to which the user is logged in (see paragraph 121 disclosing “the browser (and subsequently the client app) may receive a list of applications from the authentication appliance that should be logged out. The authentication appliance may track the applications that a user is logged into…”
directing by the second one of the two systems loading of the front channel logout URLs by the other applications of the second one of the two systems to which the user is logged in (see paragraph 121 disclsosing “this list may then be transferred to the browser 113a (3), and passed on to the client app 111a (4). The list may then be utilized to call the native client app URL to start a chain of calling each mobile app for the purpose of logging out of each mobile app. .”.
Therefore, it would have been obvious to a person having ordinary skill in the art before the effective filing date of the claimed invention, to modify Zhu, Minov, responsive to the completion of the logout, identifying by the second one of the two systems, other applications of the second one of the two systems to which the user is logged in; receiving by the second one of the two systems front channel logout URLs for the other applications of the second one of the two systems to which the user is logged in; and directing by the second one of the two systems loading of the front channel logout URLs by the other applications of the second one of the two systems to which the user is logged in as suggested by Grajek (see paragraphs [0120-121]).
8. Claim 8 is rejected under 35 U.S.C. 103 as being unpatentable over Foreign Patent Application CN-108737331-A to Zhu in view of US Patent Publication US 2015/0188906 A1 to Minov et al hereafter Minov, in view of US Patent Publication US 2014/0082715 A1 to Grajek et al hereafter Grajek as applied to claim 1 above and further in view of US Patent Publication US 2017/0331802 to Keshava et al hereafter Keshava.
Regarding claim 8, the references as combined above disclose the method of claim 1. Zhu does not explicitly disclose wherein the JWT further comprises an Identity and Access Management (“IAM”) login private key. However, Keshava discloses wherein the JWT further comprises an Identity and Access Management (“IAM”) login private key (see paragraph 238 disclosing signing JWT using a private key and paragraph 229 disclosing a client application requests the key or credential from the IAM platform. Therefore, it would have been obvious to one having ordinary skill in the art before the effective filing date of the claimed invention to modify the combination of Zhu and Minov to use an IAM login private key. One of ordinary skill in the art would have been motivated to do so because the key can be requested from the IAM platform for added security as taught by Keshava (see paragraph 229).
9. Claims 14-16 are rejected under 35 U.S.C. 103 as being unpatentable over Foreign Patent Application CN-108737331-A to Zhu in view of US Patent Publication US 2015/0188906 A1 to Minov et al hereafter Minov in view of US Patent Publication US 2014/0082715 A1 to Grajek et al hereafter Grajek as applied to claim 1 above, and further in view of Lander et al. (Pub No.: US 2017/0331832 A1), hereafter Lander.
Regarding claim 14, the references as combined above disclose the method of claim 1. Minov does not explicitly disclose
wherein the second one of the two systems comprises a role-based access control (RBAC) system, and wherein the first one of the two systems comprises an attribute-based access control (ABAC) system. However, Lander discloses:
wherein the first one of the two systems comprises an attribute-based access control (ABAC) system, and wherein the second one of the two systems comprises a role-based access control (RBAC) system. (Lander [0218] teaches "One embodiment provides fine-grained authorization policies for protecting the IDCS service resources described herein that are based on role-based access control ('RBAC') and attribute-based access control ('ABAC')." Here Lander teaches providing not only RBAC services but ABAC services to systems using Lander's IDCS.)
Therefore, it would have been obvious to a person having ordinary skill in the art before the effective filing date of the claimed invention, to modify Zhu and Minov, to use resources that comprise RBAC and ABAC. One would have been motivated to make such a combination to more efficiently provide fine-grained authorization policies for protecting system resources as taught by Lander (see Lander [0218]).
Regarding claim 15, the references as combined above disclose the method of claim 1. Lander further discloses wherein the first one of the two systems comprises a role-based access control (RBAC) system, and wherein the second one of the two systems comprises an attribute-based access control (ABAC) system. (Previously stated above, Lander [0218] teaches providing not only RBAC services but ABAC services as well to systems/applications using Lander's IDCS). Claim 15 is rejected on the same rationale as the rejection of claim 14 above.
Regarding claim 16, the references as combined above disclose the method of claim 15. Grajek discloses wherein the first one of the two systems identifies other applications of the first system to which the user is logged in; and logs the user out of those other applications (See paragraphs 120-121 disclosing identifying application through the mapping to log out the user of those applications). Claim 16 is rejected on the same rationale as the rejection of claims 1 and 14 above.
Conclusion
10. The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
US patent 9699171 to Sokolov discloses in response to identifying the attempt to log the user out of a set of identified applications, determining whether the user has been successfully logout from all other applications.
11. Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
12. Any inquiry concerning this communication or earlier communications from the examiner should be directed to Carl G Colin whose telephone number is (571)272-3862. The examiner can normally be reached Monday-Thursday 8:00-5:00 PM, Friday 8-12 PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Amy Cohen Johnson can be reached at 571-272-2238. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/CARL G COLIN/Supervisory Patent Examiner, Art Unit 2493
Prosecution Insights