Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
Response to Arguments
In communications filed on 4/27/2026, claims 22, 24-28, 33, 35-38, 43, 48, and 50 are presented for examination. Claims 22, 33, 43, and 50 are independent.
Amended claim(s): 22, 24, 33, 35, 36, 38, 43, and 50.
Applicants’ arguments, see Applicant Arguments/Remarks filed 4/27/2026, with respect to claim(s) rejected under prior art have been considered but are moot in view of new ground(s) of rejection necessitated by Applicants’ amendment to the claim(s).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claim(s) 22, 24-26, 33, 36, 37, 43, 50 is/are rejected under 35 U.S.C. 103 as being unpatentable over US 20220070151 A1 (hereinafter ‘Chauhan’) in view of US 20100077216 A1 (hereinafter ‘Kramer’).
As claim 22, Chauhan (US 20220070151 A1) discloses: A method, applied to a terminal, (Chauhan, ¶4-¶5, i.e., system/method of user and device authentication) the method comprising: sending an authentication request to a policy control apparatus, wherein the authentication request carries authentication information, and the authentication information is usable by the policy control apparatus to perform authentication on the terminal based on the authentication information; (Chauhan: Fig. 2, ¶53-¶55, i.e., the management of access/permission policies; Figs. 8-12, ¶168, i.e., interaction of user with an application for authentication with an application server wherein the request includes user’s credential)
receiving a trust identifier from the policy control apparatus, and saving the trust identifier, wherein the trust identifier is sent by the policy control apparatus after the terminal is authenticated; (Chauhan: Fig. 12, ¶168, i.e., receiving a token from the application server upon authentication)
However, Chauhan does not but in analogous art, Kramer (US 20100077216 A1) teaches: the trust identifier is generated based on dynamic information related to the terminal, the dynamic information related to the terminal comprising an internet protocol (IP) address and a session identifier of the terminal; and (Kramer: ¶22-¶23, ¶49-¶59, i.e., the security token generated based on client’s IP address, session ID etc)
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to modify Chauhan to include generating a token based on the IP address and session ID of the user device as taught by Kramer with the motivation to provide secure communication sessions between a client and a server (Kramer: ¶22-¶23, ¶49-¶59)
Chauhan et al combination further teaches: sending a first access request when the terminal accesses an application server, wherein the first access request carries the trust identifier, causing the policy control apparatus to determine that the terminal is a trusted terminal. (Chauhan: ¶170, i.e., accessing request to an application when the client accesses an application wherein the request includes the token)
Claims 33, 43, 50 recite substantially the same features recited in claim 22 above and are rejected based on the rationale discussed in the rejection.
As regards claim 26, Chauhan et la combination teaches the method according to claim 22, wherein the first access request further carries a user token, and the token is allocated by the policy control apparatus to the terminal after the terminal is authenticated. (Chauhan: Fig. 12, ¶168, i.e., receiving a token from the application server upon authentication)
Claim 37 recites substantially the same features recited in claim 26 above and is rejected based on the rationale discussed in the rejection.
As regards claim 24, Chauhan et al combination teaches the method according to claim 22, wherein the session identifier identifies a session established between the policy control apparatus and the terminal according to hypertext transfer protocol (H'ITP) after the terminal is authenticated. (Kramer: ¶22-¶23, ¶49-¶59, i.e., the security token generated based on client’s IP address, session ID etc)
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to modify Chauhan to include generating a token based on the IP address and session ID of the user device as taught by Kramer with the motivation to provide secure communication sessions between a client and a server (Kramer: ¶22-¶23, ¶49-¶59)
Claim 35 recites substantially the same features recited in claim 24 above and is rejected based on the rationale discussed in the rejection.
As regards claim 25, Chauhan et al combination teaches the method according to claim 22, wherein the trust identifier is saved by the terminal in a cookie of a browser of the terminal, and the method further comprises: when the terminal accesses the application server, obtaining the trust identifier from the cookie of the browser, and adding the trust identifier to the first access request. (Kramer: ¶9, ¶23, i.e., token saved in browser cookie)
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to modify Chauhan to include generating a token based on the IP address and session ID of the user device as taught by Kramer with the motivation to provide secure communication sessions between a client and a server (Kramer: ¶22-¶23, ¶49-¶59)
Claim 36 recites substantially the same features recited in claim 25 above and is rejected based on the rationale discussed in the rejection.
Claim(s) 27, 38 is/are rejected under 35 U.S.C. 103 as being unpatentable over Chauhan in view of Kramer in view of US 20230196357 A9 (hereinafter ‘Gallagher’).
As regards claim 27, Chauhan discloses the method according to claim 26. However, Chauhan does not but in analogous art, Gallagher (US 20230196357 A9) teaches: wherein before sending the authentication request to the policy control apparatus, the method further comprises: (Gallagher: Fig. 2, ¶101-102) sending a second access request, wherein the second access request does not carry the token, the policy control apparatus is triggered to send an authentication page to the terminal after the second access request is redirected by a policy execution apparatus to the policy control apparatus, and (Gallagher: Fig. 2, ¶101-102, i.e., the login request is redirected to an authentication server wherein the auth server writes a cookie to the browser and then the browser is redirected to the login page for authentication) the authentication request is sent after the terminal receives the authentication page. (Gallagher: Fig. 2, ¶101-102, i.e., the login request is redirected to an authentication server wherein the auth server writes a cookie to the browser and then the browser is redirected to the login page for authentication)
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to modify Chauhan to include an authentication redirection mechanism wherein request is redirected to an authentication server wherein the auth server writes a cookie to the browser and then the browser is redirected to the login page for authentication as taught by Gallagher with the motivation to provide a secure authentication and transaction process (Gallagher, ¶35-¶36)
Claim 38 recites substantially the same features recited in claim 27 above and is rejected based on the rationale discussed in the rejection.
Claim(s) 28, 48 is/are rejected under 35 U.S.C. 103 as being unpatentable over Chauhan in view of Kramer in view of US 20140207566 A1 (hereinafter ‘Kamran’).
As regards claim 28, Chauhan discloses the method according to claim 22. However, Chauhan does not but in analogous art, Kamran (US 20140207566 A1) teaches: wherein the first access request further comprises an identifier of the terminal, the identifier is used by a policy detection apparatus to compare the identifier with a registration identifier of the terminal, and when the identifier is the same as the registration identifier of the terminal, the policy detection apparatus sends the trust identifier carried in the first access request to the policy control apparatus. (Kamran, Figs. 1, 6, ¶10, ¶30-¶31, ¶38, i.e., the token is based on the network address (IP address) of the user device)
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to modify Chauhan to include generating a token based on the IP address of the user device as taught by Kamran with the motivation to identify devices in a communication session (Kamran, ¶3)
Claim 48 recites substantially the same features recited in claim 28 above and is rejected based on the rationale discussed in the rejection.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SYED A ZAIDI whose telephone number is (571)270-5995. The examiner can normally be reached Monday-Thursday: 5:30AM-5:30PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Nickerson can be reached at (469) 295-9235. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SYED A ZAIDI/Primary Examiner, Art Unit 2432
Prosecution Insights