Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Examiner respectfully withdraws the 112(f) interpretation, but a 35 USC 101 rejection can be found below for being directed to software per se.
Regarding applicants arguments directed at the 35 USC 112(b) rejection:
Applicant submits that the amendment to claim 19 provides antecedent basis for “the target domain message system” in claim 20 (Remarks, page 8). Agreed. The rejection of claim 20 under 35 U.S.C. 112(b) is withdrawn. The amendment, however, deleted the element “an account holder message system having an electronic message address associated with an account holder” from claims 1, 12, and 19 and did not amend claims 6, 11, and 16. As a result, “the electronic message address” (claims 1, 2, 12, 18, 19, and 20), “the account holder” (claims 2, 8, and 12), “the alias manager” (claims 6, 11, and 16), and “the sender,” “the sender’s account,” and “the electronic message system” (claim 19) now lack antecedent basis. The new rejections under 35 U.S.C. 112(b) set forth above are necessitated by the amendment.
Regarding applicant’s arguments directed at the 35 USC 102/103 rejections:
Claim 12:
Applicant argues that amended claim 12 requires associating “one or more affiliated domains with the target domain” and transmitting the inbound message “according to a determination that the alias address is associated with the target domain or the one or more affiliated domains,” and that Shiga does not teach these features because Shiga “is limited to a one-to-one pairing between an alias address and a single web service domain” (Remarks, pages 10-11).
As to “associate one or more affiliated domains with the target domain,” the argument is moot in view of the new ground of rejection. The rejection does not rely on Shiga for that limitation; it relies on Thirumavalavan, which teaches a dedicated address created for a target domain whose administrator “can add SAD record in example.com to allow emails from other domains” [0436], with the authorized domains being, for example, a parent company’s domain for a subsidiary’s domain [0308] or amazon.com and amazon.co.uk for amazon.in [0346]. An argument directed to a reference individually does not address a rejection based on a combination of references. In re Keller, 642 F.2d 413, 425 (CCPA 1981); MPEP 2145(IV).
As to the transmit limitation, the argument is not persuasive. The limitation is recited in the alternative: “according to a determination that the alias address is associated with the target domain or the one or more affiliated domains.” A limitation recited in the alternative is met by prior art that teaches either alternative. MPEP 2173.05(h). Shiga forwards the inbound email to the primary email address when the pair list shows the alias “paired with a domain name that matches the sender address of the email 260” (Column 4, lines 47-65), which is a determination that the alias address is associated with the target domain. That satisfies the limitation as claimed. Shiga is also not limited to the paired domain: Shiga forwards the email when “the domain name in the sender address of the email 260 has been whitelisted, i.e. the domain name is associated with a sender that has been approved by the user” (Column 4, lines 47-65). Thirumavalavan, cumulatively, delivers mail on a determination that the sender’s domain is the target domain or a domain authorized by it [0258].
Claims 13-15 are argued only on the basis of their dependency from claim 12 (Remarks, page 11) and are rejected with claim 12 for the reasons set forth above.
Claims 19:
Applicant argues that Morgenroth “does not teach or suggest detecting that an alias address is being improperly used to send unauthorized outbound messages, or taking remedial actions such as locking accounts, requiring password resets, requiring multifactor authentication, or initiating security scans” (Remarks, pages 11-12). The argument is moot in view of the new ground of rejection, which does not rely on Morgenroth for those features. Chechik teaches determining from an account’s outgoing emails that the account “may have been compromised” and preventing its outgoing emails from reaching their destination [0074], and teaches remediation by “resetting the password of the compromised email account,” “preventing the compromised email account from accessing resources on the enterprise network,” and “ending all active sessions of the compromised email account” [0079], by prompting the owner “to reset her password” [0030], and by requiring confirmation “via two-factor authentication” [0172]. The claim requires only one of the four listed remedial actions. Morgenroth is relied on, as before, for intercepting the outgoing message, retrieving the alias, substituting it for the sender’s address, and transmitting the message [0093]; Applicant does not dispute those teachings.
Claims 1:
Applicant repeats for claim 1 the argument that Shiga pairs each alias with a single web service, and adds that Howe “is silent regarding any mechanism for associating affiliated domains with a target domain or for deeming messages from such affiliated domains as appropriate” (Remarks, pages 12-14). The Shiga argument is addressed in section C above: the association limitation is supplied by Thirumavalavan, and the transmit limitation is met by Shiga under its alternative language. The Howe argument is moot. Howe is relied on only for transmitting the alias address to the target domain [0069-0070], a teaching Applicant does not dispute, and the rejection does not rely on Howe for the affiliated-domain limitation.
Claim Objections
Regarding claims 1-2, 7, 9-10, 12-14, and 17-20: The claims recite “set of an computer readable instructions” but should recite a/the “set of computer readable instructions.”
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter. The claim(s) does/do not fall within at least one of the four categories of patent eligible subject matter because:
Regarding claims 1, 12, and 19. The claims are directed at a system, yet recite instructions as the only component of the system. Normally, an apparatus or system claim would be statutory. However, the claims merely recite instruction which can be implemented alone. Since, the claimed systems may be software, then the apparatus or system as a whole can be considered to be only software which is not a “process”, “machine” or “article of manufacture”.
Claims 2-11 and 13-18, and 20 inherit the same rejections as claims 1, 12, and 19 in light of their dependency.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-20 rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Regarding claim 1, the claim recites “transmit the inbound message to the electronic message address” where the electronic message address lacks antecedent basis.
Regarding claim 2, the claim recites “the account holder … the electronic message address” both lack antecedent basis in the claims.
Regarding claim 6, the claim recites “the alias manager” which lacks antecedent basis in the claims.
Regarding claim 8, the claim recites “the account holder” which lacks antecedent basis in the claims.
Regarding claim 11, the claim recites “the alias manager” which lacks antecedent basis in the claims.
Regarding claim 12, the claim recites “the account holder … the electronic message address” both lack antecedent basis in the claims.
Regarding claim 16, the claim recites “the alias manager” which lacks antecedent basis in the claims.
Regarding claim 18, the claim recites “the electronic message address” which lacks antecedent basis in the claims.
Regarding claim 19, the claim recites “the electronic message address … the account of the sender … the senders account … the electronic message system” all of which lack antecedent basis.
Regarding claim 20, the claim recites “the electronic message address” which lacks antecedent basis in the claims.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claim(s) 1, 5, 7-8, and 11 is/are rejected under 35 U.S.C. 103 as being unpatentable over Shiga et al. (US 11316894 B1) in view of Howe (US 20160255040 A1) and further in view of Thirumavalavan (US 20220086158 A1) hereinafter Thiru.
Regarding claim 1, Shiga teaches a computerized system for creating and managing alias electronic addresses comprising: (Fig. 1; Column 1, lines 29-40; Column 2, lines 14-18; email security system 160 generates alias email addresses 164)
a set of an computer readable instructions (Fig. 6; software modules 110 comprising instructions stored on main memory 108 for execution by processor 101) in communication with an account holder message system (Fig. 1, 170; email system 170 holding the primary email address 171) and adapted to:
receive a request for an alias address, (Column 2, lines 47-53; request to generate an alias address) create an alias address, (Column 2, lines 53-67 and Column 3, lines 1-17) receive a target domain, (Column 2, lines 53-56; domain name of the web service, facebook.com) associate the target domain with the alias address, (Column 3, lines 1-17; the alias address and the domain name are stored as an entry in the pair list 162)
receive an inbound message from a target domain message system (paired domain service like Facebook, see mapping above) addressed to the alias address, (Column 4, lines 44-47; Fig. 3, 260; receive an email addressed to the alias address from the paired service (see mapping above)) transmit the inbound message to the electronic message address according to a determination that the alias address is associated with the target domain (Column 4, lines 44-65; the email is forwarded to the primary email address 171 when the pair list shows the alias paired with a domain name matching the sender address, or when the sender’s domain name is in the whitelist 163, “i.e. the domain name is associated with a sender that has been approved by the user”) or the one or more affiliated domains (Examiner notes this is part of an “or” limitation, and since target domain is already mapped, this element of the “or” limitations is not being elected); and,
take remedial action (Col 5 Lines 18-33; alert to the user; block) against the inbound message according to a determination that the alias address is not associated with the target domain. (Column 5, lines 18-33; Fig. 4, 303 and 305; the spam email 310 “has a sender address that does not have the domain name of the web service 180-3,” so the email security system 160 “detects, e.g., by consulting the pair list 162, that the spam email 310 is not from a web service that has been paired with the alias email address 164-3, and is thus suspicious,” and “sends an alert to the user” and blocks the email (305))
Shiga does not explicitly teach associate one or more affiliated domains with the target domain and transmit the alias address to the target domain.
Howe teaches receive a request for an alias address, (0068; the processing unit determines that an e-mail field is included in a web form) identify an alias address, (0069) receive a target domain, (0070; merchant 110 associated with the web page or URL) associate the target domain with the alias address, (0070) and transmit the alias address to the target domain. (0069-0070; submission of the web form transmits the alias e-mail address to the entity associated with the form)
It would have been obvious to one of ordinary skill in the art prior to the effective filing date of the application to modify the teachings of Shiga to include transmitting the alias address to the target domain as is taught by Howe.
The suggestion/motivation is to give the user the benefits of alias e-mail addresses [Background].
Shiga in view of Howe does not explicitly teach associate one or more affiliated domains with the target domain;
In an analogous art Thiru teaches associate one or more affiliated domains (0308; buyfruits.com, “the parent company” of the subsidiary domains buyoranges.com, buyapples.com, and buygrapes.com; 0346; amazon.com and amazon.co.uk for amazon.in) with the target domain, (0308; the Sender Alias Domains (SAD) record “v=sad1 buyfruits.com -all” placed in the DNS of the target domain buyapples.com “would allow mails from @buyfruits.com to the Dombox buyapples.com@giri123.domboxmail.com,” so that “although the box created only for buyapples.com, it can receive mails from buyfruits.com”; 0266; “A SAD record can have multiple domains”; 0316; Fig. 8F, 852; the system pulls “the SAD record from the ‘dombox domain’ and store[s] it in our session cache”; 0436; the dedicated address example.com@giri123.domboxmail.com is created for the domain the user entered, and “By default only mails from example.com are allowed in that dombox. However example.com domain admin can add SAD record in example.com to allow emails from other domains”)
It would have been obvious to one of ordinary skill in the art prior to the effective filing date of the application to modify the teachings of Shiga to include transmitting the alias address to the target domain through the processing server as is taught by Howe.
The suggestion/motivation is to protect users, improve privacy, reduce spam [Background].
Regarding claim 5, Shiga in view of Howe in view of Thiru teach the system of claim 1, and is disclosed above, Shiga further teaches wherein remedial action is taken from the group consisting of quarantining, deleting, blacklisting, sending a reply message, generating a notification and any combination thereof. (Column 5, lines 18-33; Fig. 4, 303; the email security system 160 “sends an alert to the user,” which “may be in the form of an email (e.g., addressed to the primary email address 171 of the user), text message to the user’s registered mobile phone number, or other messaging means”)
Regarding claim 7, Shiga in view of Howe in view of Thiru teach the system of claim 5, and is disclosed above, Shiga further teaches wherein the set of an computer readable instructions are adapted to transmit the notification to a user of the account holder messages system. (Column 5, lines 18-33; Fig. 4, 303; the alert is sent to the user as “an email (e.g., addressed to the primary email address 171 of the user),” i.e., to the user of the email system 170)
Regarding claim 8, Shiga in view of Howe in view of Thiru teach the system of claim 1, and is disclosed above, Shiga further teaches wherein the alias address is unique to the account holder and the target domain. (Column 3, lines 4-16; “the local-part ‘12345’ and the subdomain ‘abc’ are unique to the combination of the user and ‘facebook.com’”)
Regarding claim 11, Shiga in view of Howe in view of Thiru teach the system of claim 1, and is disclosed above, Shiga further teaches wherein the account holder message system is a first account holder message system, (Fig. 1, 170; the email system 170 holding the primary email address 171) and the alias manager (set of computer readable instructions; email security system 160) is adapted to notify a second account holder message system (Column 5, lines 26-33; the alert may be sent as a “text message to the user’s registered mobile phone number, or other messaging means,” i.e., through a messaging service of the user other than the email system 170) that the target domain message system potentially is being accessed without authorization. (Column 5, lines 18-33; Fig. 4, 301-303; the alert indicates “reception of the spam email 310 that is addressed to the alias email address 164-3 but is not from the web service 180-3,” the alias having “been leaked out of the web service 180-3 (see arrow 301)” by sale or by “a cybercriminal [who] hacks the web service 180-3”)
Claim(s) 2-4 is/are rejected under 35 U.S.C. 103 as being unpatentable over Shiga et al (US 11316894 B1) in view of Howe (US 20160255040 A1) in view of Thirumavalavan (US 20220086158 A1) hereinafter Thiru, in view of Morgenroth (US 20140373106 A1).
Regarding claim 2, Shiga in view of Howe in view of Thiru teach the system of claim 1, and is disclosed above, Shiga in view of Howe in view of Thiru do not explicitly teach wherein the set of an computer readable instructions are adapted to modify an outbound message from the account holder to remove the electronic message address from a message sent by the account holder and insert the alias address in its place.
In an analogous art Morgenroth teaches wherein the set of an computer readable instructions (Fig. 12, 208; the enhanced mail transfer agent 208) are adapted to modify an outbound message from the account holder (0093; the email message 502 dispatched by the mail user agent 204 of the protected entity 410 with “the protected entity’s 410 delivery address 501 as the envelope sender and From: header address”) to remove the electronic message address from a message sent by the account holder and insert the alias address in its place. (0093; “The envelope sender and From: header of the email message 502 is replaced with the receiving alias 104. All instances of the protected entity delivery address 501 in the email message 502 may be replaced with the receiving alias 104 to maintain the secrecy of the protected entity delivery address”)
It would have been obvious to one of ordinary skill in the art prior to the effective filing date of the application to modify the teachings of Shiga in view of Howe in view of Thiru to include replacing the account holder’s electronic message address in outbound messages with the alias address as is taught by Morgenroth.
The suggestion/motivation is to improve email handling regarding identity management and email addressing [0001-0007].
Regarding claim 3, Shiga in view of Howe in view of Thiru in view of Morgenroth teach the system of claim 2, and is disclosed above, Shiga in view of Howe in view of Thiru do not explicitly teach but Morgenroth further teaches wherein the alias address inserted is dependent upon the domain of a recipient. (Fig. 3, 303 and 304; 0040; the contacts database holds “one receiving alias 303” for each combination of a protected entity delivery address 301 and a contact entity delivery address 304; 0093; the receiving alias to insert is found “by looking up the contact in the database … by the contact entity delivery address 506,” the recipient’s address, whose domain (email.com, Fig. 10b, 1004) identifies the recipient)
It would have been obvious to one of ordinary skill in the art prior to the effective filing date of the application to modify the teachings of Shiga in view of Howe in view of Thiru to include selecting the alias to insert according to the recipient’s address and domain as is taught by Morgenroth.
The suggestion/motivation is to improve email handling regarding identity management and email addressing [0001-0007].
Regarding claim 4, Shiga in view of Howe in view of Thiru in view of Morgenroth teach the system of claim 3, and is disclosed above, Shiga in view of Howe in view of Thiru do not explicitly teach but Morgenroth teaches wherein the domain of the recipient is the target domain. (Fig. 12, 506; the recipient of the outbound message is the unprotected contact entity delivery address 506, the entity for which the receiving alias 104 was created (Fig. 3, 303-304); 0044, lines 28-36; the modified message “is delivered to a mail transfer agent 202 specified from the domain of the email message 501 envelope recipient address (the unprotected contact entity delivery address 402)”)
It would have been obvious to one of ordinary skill in the art prior to the effective filing date of the application to modify the teachings of Shiga in view of Howe in view of Thiru to include delivering the aliased outbound message to the domain of the recipient for which the alias was created as is taught by Morgenroth.
The suggestion/motivation is to improve email handling regarding identity management and email addressing [0001-0007].
Claim(s) 6 and 10 is/are rejected under 35 U.S.C. 103 as being unpatentable over Shiga et al (US 11316894 B1) in view of Howe (US 20160255040 A1) in view of Thirumavalavan (US 20220086158 A1) hereinafter Thiru, in view of Yoskowitz et al (US 11627106 B1).
Regarding claim 6, Shiga in view of Howe in view of Thiru teach the system of claim 5, and is disclosed above, Shiga in view of Howe in view of Thiru do not explicitly teach wherein the notification is a notification representing that the target domain potentially has been accessed without authorization and the alias manager is adapted to transmit the notification to the target domain.
In an analogous art Yoskowitz teaches wherein the notification (alert) is a notification representing that the target domain (Fig. 1, 161; Column 10, lines 55-67; the resource host server 161, the service or website that requested the alias from the aliasing server) potentially has been accessed without authorization (Column 4, line 66 – Column 5, line 13; a message directed to an alias from a sender who is not on the whitelist for that alias is an unauthorized communication indicating the alias held by the host has been exposed) and the alias manager (Fig. 1, 131; Column 7, lines 36-63; the aliasing server 131, which generates the aliases, maps them to the real addresses, and forwards messages to the real addresses) is adapted to transmit the notification to the target domain. (Column 22, line 37 – Column 23, line 11; Column 22, lines 14-34; Column 15, lines 34-49; the aliasing server 131 generates and transmits an alert to the resource host server 161 when an email addressed to an alias associated with that host is received from a sender who is not on the whitelist 134 for that alias)
It would have been obvious to one of ordinary skill in the art prior to the effective filing date of the application to modify the teachings of Shiga in view of Howe in view of Thiru to include sending the notification to the target domain to report that the alias registered with it is being used by an unauthorized sender as is taught by Yoskowitz.
The suggestion/motivation is to reduce the impact of data breaches by using email aliases [Background].
Regarding claim 10, Shiga in view of Howe in view of Thiru teach the system of claim 1, and is disclosed above, Shiga in view of Howe in view of Thiru do not explicitly teach wherein the set of an computer readable instructions are adapted to determine a geographic location of the target domain and take remedial action when an electronic message addressed to the alias address originates from a geographic area differing from the geographic area of the target domain.
In an analogous art Yoskowitz teaches wherein the set of an computer readable instructions (Fig. 1, 131; Column 7, lines 36-63; the aliasing server 131) are adapted to determine a geographic location (Column 22, line 37 – Column 23, line 17; the aliasing server 131 “may analyze messages to determine that 95% of received messages originate from the US”) of the target domain (Fig. 1, 161; Column 10, lines 55-67; the resource host server 161 whose messages to the alias are the messages received) and take remedial action (Column 22, line 37 – Column 23, line 17; “this may trigger a low level alert”) when an electronic message addressed to the alias address originates from a geographic area differing from the geographic area of the target domain. (Column 22, line 37 – Column 23, line 17; “If the aliasing server 131 suddenly starts receiving messages from China, this may trigger a low level alert”)
It would have been obvious to one of ordinary skill in the art prior to the effective filing date of the application to modify the teachings of Shiga in view of Howe in view of Thiru to include comparing the geographic origin of a message to the alias against the geographic area the target domain’s messages normally come from and raising an alert on a mismatch as is taught by Yoskowitz.
The suggestion/motivation is to reduce the impact of data breaches by using email aliases [Background].
Claim(s) 9 is/are rejected under 35 U.S.C. 103 as being unpatentable over Shiga et al (US 11316894 B1) in view of Howe (US 20160255040 A1) in view of Thirumavalavan (US 20220086158 A1) hereinafter Thiru in view of Esfahani et al (US 20140047043 A1).
Regarding claim 9, Shiga in view of Howe in view of Thiru teach the system of claim 1, and is disclosed above, Shiga in view of Howe in view of Thiru do not explicitly teach wherein the set of an computer readable instructions are adapted to expire the alias address and send a reply that the alias address is undeliverable to a sender upon such expiration.
In an analogous art Esfahani teaches wherein the set of an computer readable instructions (email server) are adapted to expire the alias address (0033; “The expiration information indicates the conditions that will cause the disposable email address to expire automatically, invalidating the email address,” e.g., “after a predetermined number of uses” or “after a predetermined amount of time”; 0042; “the email server determines whether the disposable email address is an expired address”) and send a reply that the alias address is undeliverable to a sender upon such expiration. (0044; when the disposable email address is expired, “the disposable email address is no longer a valid address, and the email is refused (generally referred to as bouncing the message), just as if the sender had attempted to send to an unknown addressee,” with a “refusal message … returned to the sender”)
It would have been obvious to one of ordinary skill in the art prior to the effective filing date of the application to modify the teachings of Shiga in view of Howe in view of Thiru to include expiring the alias address and bouncing messages sent to it after expiration as is taught by Esfahani.
The suggestion/motivation is to track and mitigate span or junk mail [Background].
Claim(s) 12-15 is/are rejected under 35 U.S.C. 103 as being unpatentable over Shiga et al (US 11316894 B1) in view of Thirumavalavan (US 20220086158 A1) hereinafter Thiru.
Regarding claim 12, Shiga teaches a computerized system for creating and managing alias electronic addresses comprising: (Fig. 1; Column 1, lines 29-40; “a system for detecting leakage of email addresses generates an alias email address that will be used by a user to register with a web service”; Column 2, lines 14-18; the email security system 160 is “configured to generate an alias email address for a primary email address”)
a set of an computer readable instructions (Fig. 1, 160; the email security system 160 “may comprise computer hardware and software”; Fig. 6, 110; software modules 110 “comprising instructions stored non-transitory on the main memory 108 for execution by the processor 101”) in communication with an account holder message system (Fig. 1, 170; the email system 170 “may comprise an email server,” with which the user “maintains … an email account having a primary email address 171”; Column 2, lines 19-26; the email security system 160 forwards emails to the email system 170 (Fig. 3, 252)) adapted to:
receive a request for an alias address associated with the account holder, (Column 2, lines 47-53; the user requests the email security system 160 “to generate an alias email address 164 … that the user will use to register with a web service 180,” the alias being “an alias for a primary email address 171, which the user maintains with the email system 170”)
create an alias address according to the request (Column 2, lines 53-67 and Column 3, lines 1-17; the email security system 160 “generates each alias email address 164 with a unique local-part … and/or a unique subdomain for each combination of user and web service,” e.g., “12345@abc.tmantil.com”) wherein the alias address is adapted to be used to open or access an account associated with a target domain, (Column 1, lines 14-25; “A web service may require a user to register by providing an email address”; Column 2, lines 47-53; the alias is the address “that the user will use to register with a web service 180,” e.g., facebook.com)
associate the target domain with the alias address, (Column 3, lines 1-17; the alias and the domain name of the web service are stored together as an entry in the pair list 162: “12345@abc.tmantil.com, facebook.com, trend_taro@gmail.com”)
receive an inbound message from a target domain message system addressed to the alias address, (Column 4, lines 9-37; Fig. 2, 204; the web service 180-1 “sends a confirmation email 210 to the alias email address 164-1,” “which is received by the email security system 160”; Column 4, lines 44-47; Fig. 3, 251; the web service 180-1 “sends an email 260 that is addressed to the alias email address 164-1”) and,
transmit the inbound message to the electronic message address according to a determination that the alias address is associated with the target domain (Column 4, lines 47-65; Fig. 3, 252; the email security system 160 “may consult the pair list 162 to find that the alias email address 164-1 has been paired with a domain name that matches the sender address of the email 260,” and “forwards the email 260 to the primary email address 171”)
Shiga does not explicitly teach associate one or more affiliated domains with the target domain; and transmit the inbound message to the electronic message address according to a determination that the alias address is associated with the target domain or the one or more affiliated domains.
In an analogous art Thiru teaches associate one or more affiliated domains (0308; buyfruits.com, “the parent company” of the subsidiary domains buyoranges.com, buyapples.com, and buygrapes.com; 0346; amazon.com and amazon.co.uk for amazon.in) with the target domain, (0308; the Sender Alias Domains (SAD) record “v=sad1 buyfruits.com -all” placed in the DNS of the target domain buyapples.com “would allow mails from @buyfruits.com to the Dombox buyapples.com@giri123.domboxmail.com,” so that “although the box created only for buyapples.com, it can receive mails from buyfruits.com”; 0266; “A SAD record can have multiple domains”; 0316; Fig. 8F, 852; the system pulls “the SAD record from the ‘dombox domain’ and store[s] it in our session cache”; 0436; the dedicated address example.com@giri123.domboxmail.com is created for the domain the user entered, and “By default only mails from example.com are allowed in that dombox. However example.com domain admin can add SAD record in example.com to allow emails from other domains”)
and transmit the inbound message to the electronic message address (0258; the only possible result of the Alias Layer is “Pass,” after which the mail proceeds to delivery; 0317; Fig. 8G, 868; “proceed to next layer check”) according to a determination that the alias address is associated with the target domain (0258; “DirectPass—When the ‘Envelope and Message Domain’ are the same as ‘Dombox Domain’”; 0316; Fig. 8F, 853 and 855; “Is the ‘Dombox Domain’ matches with ‘MAIL FROM’ domain? 853. If yes, we mark the ‘Alias—Envelope Layer’ as Direct Pass 855”) or the one or more affiliated domains. (0258; “IndirectPass—When the ‘Envelope and/or Message Domain’ are not the same as ‘Dombox Domain’, but passed via SAD record”; 0237; the Alias Layer “Checks whether the ‘Envelope Domain and/or Message Domain’ is an alias for the ‘Dombox Domain’”; 0317; Fig. 8G, 862-868; the system fetches the SAD record of the target domain, checks “whether the ‘Envelope Domain’ present in the SAD Record 864,” marks the mail “Envelope SAD Indirect Pass 867” when it is, and rejects the mail (863, 866) when it is not; 0346; “from the ‘Dombox mail address’ perspective, authorized domains are ‘amazon.in, amazon.com, amazon.co.uk’”)
It would have been obvious to one of ordinary skill in the art prior to the effective filing date of the application to modify the teachings of Shiga to include associating one or more affiliated domains with the target domain and forwarding the inbound message to the user when it comes from the target domain or one of its affiliated domains as is taught by Thiru.
The suggestion/motivation is to protect users, improve privacy, reduce spam [Background]
Regarding claim 13, Shiga in view of Thiru teach the system of claim 12, and is disclosed above, Shiga further teaches wherein the set of an computer readable instructions are adapted to transmit the inbound message to the electronic message address according to a determination that the alias address is associated with the target domain. (Column 4, lines 47-65; Fig. 3, 252; the email security system 160 “may consult the pair list 162 to find that the alias email address 164-1 has been paired with a domain name that matches the sender address of the email 260,” and “forwards the email 260 to the primary email address 171”)
Regarding claim 14, Shiga in view of Thiru teach the system of claim 12, and is disclosed above, Shiga further teaches wherein the set of an computer readable instructions are adapted to take remedial action (alert to the user; blocking the email) against the inbound message according to a determination that the alias address is not associated with the target domain. (Column 5, lines 18-33; Fig. 4, 303 and 305; the spam email 310 “has a sender address that does not have the domain name of the web service 180-3,” so the email security system 160 “detects, e.g., by consulting the pair list 162, that the spam email 310 is not from a web service that has been paired with the alias email address 164-3, and is thus suspicious,” and “sends an alert to the user” and blocks the email (305))
Regarding claim 15, Shiga in view of Thiru teach the system of claim 14, and is disclosed above, Shiga further teaches wherein the remedial action is taken from the group consisting of quarantining, deleting, blacklisting, sending a reply message, generating a notification and any combination thereof. (Column 5, lines 18-33; Fig. 4, 303; the email security system 160 “sends an alert to the user,” which “may be in the form of an email (e.g., addressed to the primary email address 171 of the user), text message to the user’s registered mobile phone number, or other messaging means”)
Claim(s) 16 is/are rejected under 35 U.S.C. 103 as being unpatentable over Shiga et al (US 11316894 B1) in view of Thirumavalavan (US 20220086158 A1) hereinafter Thiru in view of Velayudham (US 20050204011 A1).
Regarding claim 16, Shiga in view of Thiru teach the system of claim 14, and is disclosed above, Shiga in view of Thiru do not explicitly teach wherein the alias address includes an MX record pointing to the alias manager.
In an analogous art Velayudham teaches wherein the alias address (0049; the email alias “Alias-4mg-6Oct20031231-10@hp.com”; 0056; “hp.com: the FQDN (a fully qualified domain name)”) includes an MX record pointing to the alias manager. (0011; the alias’s domain “is preferably a fully qualified domain name having an MX record which resolves to a mail server having suitably modified software running thereon”; 0066-0068; that mail server (33) stores the alias and forwards email sent to the alias to the real email addresses “defined in the one-to-many mapping {dyn_alias→real_email_addr} held in the server database,” i.e., the mail server is the alias manager)
It would have been obvious to one of ordinary skill in the art prior to the effective filing date of the application to modify the teachings of Shiga in view of Thiru to include an MX record for the alias’s domain that resolves to the server running the alias software as is taught by Velayudham.
The suggestion/motivation is protecting user information when it needs to remain hidden [0001-0004].
Claim(s) 17 is/are rejected under 35 U.S.C. 103 as being unpatentable over Shiga et al (US 11316894 B1) in view of Thirumavalavan (US 20220086158 A1) hereinafter Thiru, in view of Levosky (US 20020087641 A1).
Regarding claim 17, Shiga in view of Thiru teach the system of claim 14, and is disclosed above, Shiga in view of Thiru do not explicitly teach wherein the set of computer readable instructions is adapted to transmit a reply to the target domain address in response to the inbound message.
In an analogous art Levosky teaches wherein the set of computer readable instructions (Fig. 2, 100; the Alias Email server) is adapted to transmit a reply to the target domain address (0054; the sender’s address is recorded “by taking the recipient’s original Email, as it first comes through the Alias Email server, and recording the recipient’s Email address in the Alias Email server”) in response to the inbound message. (0053; “The invention allows for the user to reply to Emails, while still keeping his or her physical Email address from the sender”; 0057-0058; when the user replies, “the reply is sent to the Alias Email server instead of going directly back to the recipient,” the server “strips all information which could identify the user’s physical Email address,” uses “the user’s Alias Email address originally given to the recipient” as the sender, and sends the reply to the recipient; 0060; the server sends the reply “back to the recipient”)
It would have been obvious to one of ordinary skill in the art prior to the effective filing date of the application to modify the teachings of Shiga in view of Thiru to include transmitting the user’s reply to the web service through the alias server under the alias address as is taught by Levosky.
The suggestion/motivation is to improve control of unwanted email and organization [0002-0014].
Claim(s) 18 is/are rejected under 35 U.S.C. 103 as being unpatentable over Shiga et al (US 11316894 B1) in view of Thirumavalavan (US 20220086158 A1) hereinafter Thiru in view of Morgenroth (US 20140373106 A1).
Regarding claim 18, Shiga in view of Thiru teach the system of claim 14, and is disclosed above, Shiga in view of Thiru do not explicitly teach wherein the set of an computer readable instructions are adapted to intercept an outgoing message from the account holder message system that is addressed to the target domain and to substitute the alias address for the electronic message address.
In an analogous art Morgenroth teaches wherein the set of an computer readable instructions (Fig. 12, 208; the enhanced mail transfer agent 208) are adapted to intercept an outgoing message from the account holder message system (Fig. 12, 204; 0093; “the email is dispatched via a mail user agent 204 directly to the enhanced MTA 208”) that is addressed to the target domain (Fig. 12, 506; Fig. 10b, 1004; 0093; the protected entity addresses the message to “the unprotected contact entity delivery address 506,” e.g., in the domain email.com/company.com) and to substitute the alias address for the electronic message address. (0093; “The envelope sender and From: header of the email message 502 is replaced with the receiving alias 104. All instances of the protected entity delivery address 501 in the email message 502 may be replaced with the receiving alias 104”)
It would have been obvious to one of ordinary skill in the art prior to the effective filing date of the application to modify the teachings of Shiga in view of Thiru to include intercepting the user’s outgoing message to the web service and substituting the alias for the user’s electronic message address as is taught by Morgenroth.
The suggestion/motivation is to improve email handling regarding identity management and email addressing [0001-0007].
Claim(s) 19 and 20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Morgenroth (US 20140373106 A1) in view of Chechik et al (US 20210266294 A1).
Regarding claim 19, Morgenroth teaches a computerized system for creating and managing alias electronic addresses comprising: (Fig. 2; 0006-0007; “a system for delivering communications to a protected entity without the sender knowing the communication delivery address of the protected entity” and “a system for sending communications from the protected entity to specific entities without disclosing the true identity of the protected entity,” using alias identities)
a set of an computer readable instructions (Fig. 2, 208; 0035; the enhanced mail transfer agent 208 is implemented in “software code written, for example in the Ruby language” running on the server host 207) in communication with an account holder message system (Fig. 2 and Fig. 12, 204; the mail user agent 204 of the protected entity 410, which dispatches email “directly to the enhanced MTA 208” (0093)) adapted to:
intercept an outgoing message from the account holder message system addressed to a target domain message system, (0093; “In step 1200 the email is dispatched via a mail user agent 204 directly to the enhanced MTA 208,” carrying “the protected entity’s 410 delivery address 501 as the envelope sender and From: header address” and addressed to “the unprotected contact entity delivery address 506 as the original recipient of the message”; Fig. 12, 506; Fig. 10b, 1004; the recipient’s domain email.com/company.com)
retrieve an alias address associated with the target domain, (0093; the contact is looked up “by the contact entity delivery address 506 in database column 304, row 1,” and “The receiving alias 104 is retrieved from column 303, row 1 from the matching contact entry in the database”; Fig. 3, 303 and 304; Fig. 12, 502)
substitute the alias address for the electronic message address in the outgoing message, (0093; “The envelope sender and From: header of the email message 502 is replaced with the receiving alias 104. All instances of the protected entity delivery address 501 in the email message 502 may be replaced with the receiving alias 104”)
transmit the outgoing message to the target domain message system, (Fig. 12; 0044, lines 28-36; the modified message “is delivered to a mail transfer agent 202 specified from the domain of the email message 501 envelope recipient address (the unprotected contact entity delivery address 402)”) and,
Morgenroth does not explicitly teach determine that the alias address is being used to send an unauthorized outbound message, and take remedial action in response to the determination, wherein the remedial action comprises at least one of: locking the account of the sender, requiring a password reset for the sender’s account, requiring multifactor authentication for the sender’s account, or initiating a scan of the electronic message system.
In an analogous art Chechik teaches determine that the alias address (the sender address carried by every outbound message of the account; in Morgenroth that sender address is the receiving alias 104 (0093)) is being used to send an unauthorized outbound message, (0074; the monitoring module 406 monitors “outgoing emails … transmitted by those email accounts” and “discovers that outgoing emails generated by an email account indicate that the email account may have been compromised”; 0003; a compromised account is one in which an attacker “gains access to the email account of an employee … and then imitates the employee,” so its outgoing emails are not authorized by the account owner; 0030; the likelihood of compromise “may be determined based on the volume, nature, or type of digital activities performed with the email account”)
and take remedial action in response to the determination, (0079; “The remediation engine 412 may perform one or more remediation actions in response to the analysis module 410 determining that an email account may be compromised”; 0074; the remediation engine 412 “may temporarily prevent all outgoing emails transmitted by the email account from reaching their intended destination”)
wherein the remedial action comprises at least one of:
locking the account of the sender, (0079; “preventing the compromised email account from accessing resources on the enterprise network 414” and “ending all active sessions of the compromised email account”; 0030; “terminate all active sessions of the email account”; 0242; “prohibiting the email account from performing digital activities”)
requiring a password reset for the sender’s account, (0079; “resetting the password of the compromised email account”; 0030; “prompt the true owner to reset her password”)
requiring multifactor authentication for the sender’s account, (0172; “prompt the true owner of the email account to create new credentials and/or confirm that the sign-in event was legitimate (e.g., via two-factor authentication)”)
or initiating a scan of the electronic message system. (0079; “moving emails generated by the compromised email account into a hidden folder (also referred to as a ‘quarantine folder’) for further analysis”; 0074; the monitoring module 406 monitors “incoming emails and/or outgoing emails in near real time”; Examiner further notes the claim requires only one of the four listed actions)
It would have been obvious to one of ordinary skill in the art prior to the effective filing date of the application to modify the teachings of Morgenroth to include determining from the outgoing messages of the protected entity’s account that the account has been compromised and is sending unauthorized messages under the alias and, in response, locking the account, resetting its password, or requiring two-factor authentication as is taught by Chechik.
The suggestion/motivation is to stop an attacker and improve email security [0002-0004].
Regarding claim 20, Morgenroth in view of Chechik teach the system of claim 19, and is disclosed above, Morgenroth further teaches wherein the set of an computer readable instructions (Fig. 11, 208; the enhanced MTA 208) are adapted to receive an inbound message from a target domain message system (Fig. 11, 214; 0092; the mail transfer agent 214 of the unprotected contact entity 400 in “sending a message from a non-system user referred to as an unprotected contact entity 400 to a system user, referred to as a protected entity 410”) addressed to the alias address (Fig. 11, 104; 0092; the contact is looked up “by the receiving alias 104 in database column 303, row 1”) and transmit the inbound message to the electronic message address (Fig. 11, 407; 0092; “The envelope recipient of the email message 403 is replaced with the protected entity delivery address 407”) according to the association of the alias address with the electronic message address. (0092; the protected entity delivery address 407 “is retrieved from the matching contact record in the database (row 1) from database column 301, row 1,” the record found by the receiving alias 104; Fig. 3, 301 and 303; one receiving alias 303 is stored for each protected entity delivery address 301)
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ABDERRAHMEN H CHOUAT whose telephone number is (571)431-0695. The examiner can normally be reached on Mon-Fri from 9AM to 5PM PST.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Christopher Parry, can be reached at telephone number 571-272-8328. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from Patent Center. Status information for published applications may be obtained from Patent Center. Status information for unpublished applications is available through Patent Center to authorized users only. Should you have questions about access to the USPTO patent electronic filing system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
Examiner interviews are available via a variety of formats. See MPEP § 713.01. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) Form at https://www.uspto.gov/InterviewPractice.
Abderrahmen Chouat
Examiner
Art Unit 2451
/Chris Parry/Supervisory Patent Examiner, Art Unit 2451
