DETAILED ACTION
This Office Action has been issued in response to Applicant's Amendments filed September 30, 2025.
Claims 1, 9, and 17 have been amended. Claims 1-20 have been examined and are pending.
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant's arguments filed September 30, 2025 have been fully considered but they are not persuasive.
Applicant argues the references do not disclose “store an identification of an administrator of the endpoint node in the storage”. Paragraph [0031] of applicant’s published specification recite “an identification of an administrator for the endpoint may be stored in a storage of the endpoint. The administrator may be identified in any suitable manner, such as by the associated public key being stored in endpoint 408.” Accordingly, storage of a public key is considered an identification of an administrator. Paragraph [0040] of Cannata discloses the key agent node 114b receives public keys from the key management service node 108b in order to validate and decrypt access tokens received as part of user access requests.
Applicants remaining arguments are moot in view of the new grounds of rejection.
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 1-20 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention. Independent claims recite receive a signed request certificate, wherein the signed request certificate is located within a payload of a message provided from the endpoint node. Paragraph [0021] of applicant’s published specification recites “in certain examples, certificates to authenticate a user request may be received or signed by authenticator 106 previously, such as a request generated long before a current request be assessed within endpoint node 104. For example, the previous user request may have been signed by authenticator 106 via a payload of a challenge provided from endpoint node 104 to authenticator 106. In an example, the validation of the signed certificate from authenticator 106 may be assessed by a component other than endpoint node 104 that generated the challenge based on the challenge being a payload of a message.” This appears to be the section that is closest to the amended subject matter but it does not appear to clearly tie the signed request certificate being in a payload of a message provided from the endpoint node.
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention. The claims recite “wherein the signed request certificate is located within a payload of a message provided from the endpoint node.” It is unclear how the signed request certificate is located within a payload of a message provided from the endpoint node when based on claim flow it presumably is coming from the authenticator.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over US Pub. No. 2023/0163967 to Cannata et al. (hereinafter “Cannata”) and further in view of US Pub. No. 2021/0365434 to Kim et al. (hereinafter “Kim”) and further in view of US Pub. No. 2022/0215384 to Livingston et al. (hereinafter “Livingston”).
As to Claim 1, Cannata discloses a control plane node of a multiple node environment, the control plane node comprising:
a storage configured to store a signed authorization certificate, wherein the signed authorization certificate grants permission to a user to perform an operation within an endpoint of the multiple node environment (Paragraph [0014] of Cannata discloses the authorization service node transmits the first security certificate comprising the first public key to the gateway node. Cannata does not explicitly disclose the certificate being signed however, paragraph [0040] of Cannata discloses the certificate being an x509 certificate. X.509 certificates are signed); and
a processor to communicate with the storage, the processor to:
[perform an onboard process for the endpoint node;
during the onboard process of the endpoint node],
store an identification of an administrator of the endpoint node in the storage (Paragraph [0040] of Cannata discloses the key agent node 114b receives public keys from the key management service node 108b in order to validate and decrypt access tokens received as part of user access requests); and
provide a public key to the endpoint node, wherein the public key is associated with an administrator of the endpoint node (Paragraph [0040] of Cannata discloses the key agent node 114b receives public keys from the key management service node 108b in order to validate and decrypt access tokens received as part of user access requests);
receive, from a client node, a request including a work order for the operation to be performed in the endpoint node (Paragraph [0040] of Cannata discloses upon receiving the user access request, the gateway node 106 generates (step 204) a signed and encrypted access token based upon the user access request); and
in response to reception of the request, the processor to:
provide a request certificate to an authenticator device associated with the administrator of the endpoint node, wherein the authenticator device is a [key fob] connected to the endpoint node (Paragraph [0040] of Cannata discloses upon receiving the user access request, the gateway node 106 generates (step 204) a signed and encrypted access token based upon the user access request. Transmits the unencrypted access token to the authorization service node);
receive a signed request certificate, wherein the signed request certificate is located within a payload of a message provided from the endpoint node (Paragraph [0041] of Cannata discloses the authorization service node 108a transmits the signed and encrypted access token to the gateway node 106); and
provide the signed request certificate to the endpoint node for verification base on the public key provided the endpoint node (Paragraph [0042] of Cannata discloses the gateway node 106 then transmits (step 206) the signed and encrypted access token and public key digital certificate received from node 108a, and the user access request as originally received from the remote computing device 102, to a security proxy node 114a of a microservice container 112 at server computing device 110. Paragraph [0040] of Cannata discloses the key agent node 114b receives public keys from the key management service node 108b in order to validate and decrypt access tokens received as part of user access requests).
Cannata does not explicitly disclose perform an onboard process for the endpoint node and during the onboard process of the endpoint node.
However, Kim discloses this. Paragraph [0103] of Kim discloses the owner server 130 performs device onboarding and provides an owner public key to the sensor device 110. Paragraph [0062] of Kim discloses may allow only a qualified consumer terminal 150 to access the data in units of records provided from the sensor device 110.
It would have been obvious to one of ordinary skill in the art before the effective filing of the invention to combine the authorization system as disclosed by Cannata, with onboarding endpoints as disclosed by Kim. One of ordinary skill in the art would have been motivated to combine to apply a known technique to a known device ready for improvement to yield predictable results. Cannata and Kim are directed toward authorization systems and as such it would be obvious to use the techniques of one in the other. Cannata discloses a distributed service architecture that connects service endpoints to clients. Creating such a network requires onboarding endpoints and clients. Accordingly, Cannata would be improved by the onboarding of Kim to create the network.
Cannata does not explicitly disclose a key fob.
However, Livingston discloses this. Paragraph [0029] of Livingston discloses the authenticator 116 may include a roaming authenticator that is a standalone device, such as a key fob style token device that communicates with the agent 112.
It would have been obvious to one of ordinary skill in the art before the effective filing of the invention to combine the authorization system as disclosed by Cannata, with using a key fob as disclosed by Livingston. One of ordinary skill in the art would have been motivated to combine to apply a known technique to a known device ready for improvement to yield predictable results. Cannata and Livingston are directed toward authorization systems and as such it would be obvious to use the techniques of one in the other. Paragraph [0029] of Livingston discloses the authenticator 116 may include hardware and/or software to authenticate an identity of a user of the user device 110. Accordingly, using a key fob is a well known alternative to authenticate a user.
As to Claim 2, Cannata-Kim-Livingston discloses the control plane node of claim 1, wherein the processor further to: provide the signed authorization certificate with the signed request certificate to the endpoint node for verification (Paragraph [0042] of Cannata discloses the gateway node 106 then transmits (step 206) the signed and encrypted access token and public key digital certificate received from node 108a, and the user access request as originally received from the remote computing device 102, to a security proxy node 114a of a microservice container 112 at server computing device 110).
As to Claim 3, Cannata-Kim-Livingston discloses the control plane node of claim 1, wherein the processor further to:
provide an authorization certificate to an administrator node of the multiple node environment; receive the signed authorization certificate from the administrator node; and store the signed authorization certificate in the storage (Paragraph [0040] of Cannata discloses the authorization service node 108a requests a private key or a private-public key pair from the key management service node 108b. Paragraph [0054] of Cannata discloses the authorization service node 108a can store a digital certificate (e.g., x509 certificate) that contains a public key paired to the private key received from node 108b. Paragraph [0014] of Cannata discloses the authorization service node transmits the first security certificate comprising the first public key to the gateway node).
As to Claim 4, Cannata-Kim-Livingston discloses the control plane node of claim 1, wherein the signed authorization certificate is signed with a private key of the administrator (Paragraph [0054] of Cannata discloses the authorization service node 108a can store a digital certificate (e.g., x509 certificate) that contains a public key paired to the private key received from node 108b).
As to Claim 5, Cannata-Kim-Livingston discloses the control plane node of claim 1, wherein signed request certificate is signed with a private key of an owner of the endpoint node (Paragraph [0054] of Cannata discloses the authorization service node 108a can store a digital certificate (e.g., x509 certificate) that contains a public key paired to the private key received from node 108b).
As to Claim 6, Cannata-Kim-Livingston discloses the control plane node of claim 5, wherein the private key of the owner is part of a private/public key combination with an owner public key stored in the endpoint node (Paragraph [0054] of Cannata discloses the authorization service node 108a can store a digital certificate (e.g., x509 certificate) that contains a public key paired to the private key received from node 108b. Paragraph [0040] of Cannata discloses the key agent node 114b receives public keys from the key management service node 108b in order to validate and decrypt access tokens received as part of user access requests).
As to Claim 7, Cannata-Kim-Livingston discloses the control plane node of claim 1, wherein the authorization certificate is a long-lived attestation of permission for the user to perform the operation in the endpoint node (Paragraph [0040] of Cannata discloses the certificate being an x509 certificate. X.509 certificates have varied validity periods).
As to Claim 8, Cannata-Kim-Livingston discloses the control plane node of claim 1, wherein the work order is a long-lived request for the operation to be performed in the endpoint node (Paragraph [0040] of Cannata discloses the certificate being an x509 certificate. X.509 certificates have varied validity periods).
As to Claim 9, Cannata discloses a method comprising:
[performing, by a control plane node of a multiple node environment, an onboard process of an endpoint node;
during the onboard process of the endpoint node],
storing an identification of an administrator of the endpoint node in the storage (Paragraph [0040] of Cannata discloses the key agent node 114b receives public keys from the key management service node 108b in order to validate and decrypt access tokens received as part of user access requests); and
providing a public key to the endpoint node, wherein the public key is associated with the administrator of the endpoint node (Paragraph [0040] of Cannata discloses the key agent node 114b receives public keys from the key management service node 108b in order to validate and decrypt access tokens received as part of user access requests);
receiving, by a processor of a control plane node, a request including a work order for the operation to be performed in the endpoint node, wherein the work order is received from a client node (Paragraph [0040] of Cannata discloses upon receiving the user access request, the gateway node 106 generates (step 204) a signed and encrypted access token based upon the user access request); and
in response to reception of the request:
providing a request certificate to an authenticator device associated with the administrator of the endpoint node, wherein the authenticator device is a [key fob] connected to the endpoint node (Paragraph [0040] of Cannata discloses upon receiving the user access request, the gateway node 106 generates (step 204) a signed and encrypted access token based upon the user access request. Transmits the unencrypted access token to the authorization service node);
receiving a signed request certificate, wherein the signed request certificate is located within a payload of a message provided from the endpoint node (Paragraph [0041] of Cannata discloses the authorization service node 108a transmits the signed and encrypted access token to the gateway node 106); and
providing the signed request certificate to the endpoint node for verification base on the public key provided to the endpoint node (Paragraph [0042] of Cannata discloses the gateway node 106 then transmits (step 206) the signed and encrypted access token and public key digital certificate received from node 108a, and the user access request as originally received from the remote computing device 102, to a security proxy node 114a of a microservice container 112 at server computing device 110. Paragraph [0040] of Cannata discloses the key agent node 114b receives public keys from the key management service node 108b in order to validate and decrypt access tokens received as part of user access requests).
Cannata does not explicitly disclose performing, by a control plane node of a multiple node environment, an onboard process of an endpoint node, wherein the onboard process adds the endpoint node to the multiple node environment and during the onboard process of the endpoint node.
However, Kim discloses this. Paragraph [0103] of Kim discloses the owner server 130 performs device onboarding and provides an owner public key to the sensor device 110. Paragraph [0062] of Kim discloses may allow only a qualified consumer terminal 150 to access the data in units of records provided from the sensor device 110.
Examiner recites the same rationale to combine used for claim 1.
Cannata does not explicitly disclose a key fob.
However, Livingston discloses this. Paragraph [0029] of Livingston discloses the authenticator 116 may include a roaming authenticator that is a standalone device, such as a key fob style token device that communicates with the agent 112.
Examiner recites the same rationale to combine used for claim 1.
As to Claim 10, Cannata-Kim-Livingston discloses the method of claim 9, further comprising: providing the signed authorization certificate with the signed request certificate to the endpoint node for verification (Paragraph [0042] of Cannata discloses the gateway node 106 then transmits (step 206) the signed and encrypted access token and public key digital certificate received from node 108a, and the user access request as originally received from the remote computing device 102, to a security proxy node 114a of a microservice container 112 at server computing device 110).
As to Claim 11, Cannata-Kim-Livingston discloses the method of claim 9, further comprising: providing an authorization certificate to an administrator node of the multiple node environment; receiving the signed authorization certificate from the administrator node; and storing the signed authorization certificate in the storage (Paragraph [0040] of Cannata discloses the authorization service node 108a requests a private key or a private-public key pair from the key management service node 108b. Paragraph [0054] of Cannata discloses the authorization service node 108a can store a digital certificate (e.g., x509 certificate) that contains a public key paired to the private key received from node 108b. Paragraph [0014] of Cannata discloses the authorization service node transmits the first security certificate comprising the first public key to the gateway node).
As to Claim 12, Cannata-Kim-Livingston discloses the method of claim 9, wherein the signed authorization certificate is signed with a private key of the administrator (Paragraph [0054] of Cannata discloses the authorization service node 108a can store a digital certificate (e.g., x509 certificate) that contains a public key paired to the private key received from node 108b).
As to Claim 13, Cannata-Kim-Livingston discloses the method of claim 9, wherein signed request certificate is signed with a private key of an owner of the endpoint node (Paragraph [0054] of Cannata discloses the authorization service node 108a can store a digital certificate (e.g., x509 certificate) that contains a public key paired to the private key received from node 108b).
As to Claim 14, Cannata-Kim-Livingston discloses the method of claim 13, wherein the private key of the owner is part of a private/public key combination with an owner public key stored in the endpoint node (Paragraph [0054] of Cannata discloses the authorization service node 108a can store a digital certificate (e.g., x509 certificate) that contains a public key paired to the private key received from node 108b. Paragraph [0040] of Cannata discloses the key agent node 114b receives public keys from the key management service node 108b in order to validate and decrypt access tokens received as part of user access requests).
As to Claim 15, Cannata-Kim-Livingston discloses the method of claim 9, wherein the authorization certificate is a long-lived attestation of permission for the user to perform the operation in the endpoint node (Paragraph [0040] of Cannata discloses the certificate being an x509 certificate. X.509 certificates have varied validity periods).
As to Claim 16, Cannata-Kim-Livingston discloses the method of claim 9, wherein the work order is a long-lived request for the operation to be performed in the endpoint node (Paragraph [0040] of Cannata discloses the certificate being an x509 certificate. X.509 certificates have varied validity periods).
As to Claim 17, Cannata discloses a method comprising:
[performing, by a control plane node of a multiple node environment, an onboard process of an endpoint node;
during the onboard process of the endpoint node],
storing an identification of an administrator of the endpoint node in the storage (Paragraph [0040] of Cannata discloses the key agent node 114b receives public keys from the key management service node 108b in order to validate and decrypt access tokens received as part of user access requests); and
providing a public key to the endpoint node, wherein the public key is associated with an administrator of the endpoint node (Paragraph [0040] of Cannata discloses the key agent node 114b receives public keys from the key management service node 108b in order to validate and decrypt access tokens received as part of user access requests);
providing, by the control plane node, an authorization certificate to an administrator node of the multiple node environment; receiving a signed authorization certificate from the administrator node; storing the signed authorization certificate in the storage (Paragraph [0040] of Cannata discloses the authorization service node 108a requests a private key or a private-public key pair from the key management service node 108b. Paragraph [0054] of Cannata discloses the authorization service node 108a can store a digital certificate (e.g., x509 certificate) that contains a public key paired to the private key received from node 108b. Paragraph [0014] of Cannata discloses the authorization service node transmits the first security certificate comprising the first public key to the gateway node);
receiving, by a processor of the control plane node, a request including a work order for the operation to be performed in the endpoint node, wherein the work order is received from a client node (Paragraph [0040] of Cannata discloses upon receiving the user access request, the gateway node 106 generates (step 204) a signed and encrypted access token based upon the user access request); and
in response to reception of the request:
providing a request certificate to an authenticator device associated with an administrator of the endpoint node, wherein the authenticator device is a [key fob] connected to the endpoint node (Paragraph [0040] of Cannata discloses upon receiving the user access request, the gateway node 106 generates (step 204) a signed and encrypted access token based upon the user access request. Transmits the unencrypted access token to the authorization service node);
receiving a signed request certificate, wherein the signed request certificate is located within a payload of a message provided from the endpoint node (Paragraph [0041] of Cannata discloses the authorization service node 108a transmits the signed and encrypted access token to the gateway node 106);
providing the signed request certificate to the endpoint node for verification (Paragraph [0042] of Cannata discloses the gateway node 106 then transmits (step 206) the signed and encrypted access token and public key digital certificate received from node 108a, and the user access request as originally received from the remote computing device 102, to a security proxy node 114a of a microservice container 112 at server computing device 110); and
providing the signed authorization certificate with the signed request certificate to the endpoint node for verification base on the public key provided to the endpoint node (Paragraph [0042] of Cannata discloses the gateway node 106 then transmits (step 206) the signed and encrypted access token and public key digital certificate received from node 108a, and the user access request as originally received from the remote computing device 102, to a security proxy node 114a of a microservice container 112 at server computing device 110. Paragraph [0040] of Cannata discloses the key agent node 114b receives public keys from the key management service node 108b in order to validate and decrypt access tokens received as part of user access requests).
Cannata does not explicitly disclose performing, by a control plane node of a multiple node environment, an onboard process of an endpoint node, wherein the onboard process adds the endpoint node to the multiple node environment and during the onboard process of the endpoint node.
However, Kim discloses this. Paragraph [0103] of Kim discloses the owner server 130 performs device onboarding and provides an owner public key to the sensor device 110. Paragraph [0062] of Kim discloses may allow only a qualified consumer terminal 150 to access the data in units of records provided from the sensor device 110.
Examiner recites the same rationale to combine used for claim 1.
Cannata does not explicitly disclose a key fob.
However, Livingston discloses this. Paragraph [0029] of Livingston discloses the authenticator 116 may include a roaming authenticator that is a standalone device, such as a key fob style token device that communicates with the agent 112.
Examiner recites the same rationale to combine used for claim 1.
As to Claim 18, Cannata-Kim-Livingston discloses the method of claim 17, wherein the signed authorization certificate is signed with a private key of the administrator (Paragraph [0054] of Cannata discloses the authorization service node 108a can store a digital certificate (e.g., x509 certificate) that contains a public key paired to the private key received from node 108b).
As to Claim 19, Cannata-Kim-Livingston discloses the method of claim 17, wherein the authorization certificate is a long-lived attestation of permission for the user to perform the operation in the endpoint node (Paragraph [0040] of Cannata discloses the certificate being an x509 certificate. X.509 certificates have varied validity periods).
As to Claim 20, Cannata-Kim-Livingston discloses the method of claim 17, wherein the work order is a long-lived request for the operation to be performed in the endpoint node (Paragraph [0040] of Cannata discloses the certificate being an x509 certificate. X.509 certificates have varied validity periods).
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Kevin S Mai whose telephone number is (571)270-5001. The examiner can normally be reached Monday to Friday 9AM to 5PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Philip Chea can be reached on 5712723951. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/KEVIN S MAI/Primary Examiner, Art Unit 2499
Prosecution Insights