DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-20 are presented for examination.
Claim Interpretation
The following is a quotation of 35 U.S.C. 112(f):
(f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph:
An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The claims in this application are given their broadest reasonable interpretation using the plain meaning of the claim language in light of the specification as it would be understood by one of ordinary skill in the art. The broadest reasonable interpretation of a claim element (also commonly referred to as a claim limitation) is limited by the description in the specification when 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is invoked.
As explained in MPEP § 2181, subsection I, claim limitations that meet the following three-prong test will be interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph:
(A) the claim limitation uses the term “means” or “step” or a term used as a substitute for “means” that is a generic placeholder (also called a nonce term or a non-structural term having no specific structural meaning) for performing the claimed function;
(B) the term “means” or “step” or the generic placeholder is modified by functional language, typically, but not always linked by the transition word “for” (e.g., “means for”) or another linking word or phrase, such as “configured to” or “so that”; and
(C) the term “means” or “step” or the generic placeholder is not modified by sufficient structure, material, or acts for performing the claimed function.
Use of the word “means” (or “step”) in a claim with functional language creates a rebuttable presumption that the claim limitation is to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites sufficient structure, material, or acts to entirely perform the recited function.
Absence of the word “means” (or “step”) in a claim creates a rebuttable presumption that the claim limitation is not to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is not interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites function without reciting sufficient structure, material or acts to entirely perform the recited function.
Claim limitations in this application that use the word “means” (or “step”) are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action. Conversely, claim limitations in this application that do not use the word “means” (or “step”) are not being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action.
This application includes one or more claim limitations that do not use the word “means,” but are nonetheless being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because the claim limitations use a generic placeholder that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. Such claim limitations are “identity provider module” and “authentication provider module” in claim 19.
Because these claim limitations are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, they are being interpreted to cover the corresponding structure described in the specification as performing the claimed function, and equivalents thereof.
If applicant does not intend to have these limitations interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, applicant may: (1) amend the claim limitations to avoid them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph (e.g., by reciting sufficient structure to perform the claimed function); or (2) present a sufficient showing that the claim limitations recite sufficient structure to perform the claimed function so as to avoid them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Sprague et al. (U.S. Patent Application Publication Number 2015/0089568), hereinafter referred to as Sprague, in view of Fryer (U.S. Patent Application Publication Number 2022/0217124).
Sprague disclosed techniques for providing authentication via the use of device identification factors. In an analogous art, Fryer disclosed techniques for authenticating and authorizing a client device to access online resources. Both systems are directed toward authentication of client devices utilizing an identity provider separate from a service provider.
Regarding claim 1, Sprague discloses a computer-implemented method for providing an authentication provider module with authentication credentials, the method comprising: transmitting, by an authentication provider module that is configured to independently authenticate an identity of an individual, data, indicative of at least one attribute of the authentication provider module, to an identity provider module configured to issue authentication credentials (paragraph 80, context verification tests/factors communicated from user’s device to device identity server); and responsive to determining that the at least one attribute meets at least one predetermined authentication provider eligibility criterion, providing, by the identity provider module, the service provider with authentication credentials (paragraph 81, returns ID and trust score).
Sprague does not explicitly state providing, by the identity provider module, the authentication module with the authentication credentials. However, returning authentication data to the client device for use was well known in the art as evidenced by Fryer. Since the inventions encompass the same field of endeavor, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Sprague by adding the ability for providing, by the identity provider module, the authentication module with the authentication credentials as provided by Fryer (see paragraph 27, IDP returns authorization code to client device). One of ordinary skill in the art would have recognized the benefit that providing authentication in this was way would assist in protecting user confidential information (see Fryer, paragraph 3).
Regarding claim 2, the combination of Sprague and Fryer discloses responsive to said providing, transmitting, by the identity provider module, an authentication token to the authentication provider module (Fryer, paragraph 28, IDP sends access token to client device).
Regarding claim 3, the combination of Sprague and Fryer discloses transmitting the authentication token as a token comprising data indicative of the at least one attribute (Fryer, paragraph 14, encrypted access token, and Sprague, paragraph 81, trust score, which is based on device tests/factors).
Regarding claim 4, the combination of Sprague and Fryer discloses prior to transmitting the authentication token, sending, by the authentication provider module, a request for the authentication token; and authenticating, by the identity provide module, the authentication provider module using the authentication credentials (Fryer, paragraph 28, sends token request message to IDP and IDP validates authorization code).
Regarding claim 5, the combination of Sprague and Fryer discloses wherein said providing comprises: storing the authentication credentials in a memory associated with the identity provider module (Fryer, paragraph 27, IDP generates authorization code and stores for later validation).
Regarding claim 6, the combination of Sprague and Fryer discloses providing a trust level score for the authentication provider module based on the at least one attribute (Sprague, paragraph 88, trust score based on device ID tests).
Regarding claim 7, the combination of Sprague and Fryer discloses transmitting the authentication token as a token comprising data indicative of the trust level score (Fryer, paragraph 14, encrypted access token, and Sprague, paragraph 81, trust score).
Regarding claim 8, the combination of Sprague and Fryer discloses determining that the at least one attribute meets the at least one predetermined authentication provider eligibility criterion based on a first subset of at least one attribute of said at least one attribute (Sprague, paragraph 87, multiple context verification tests/factors).
Regarding claim 9, the combination of Sprague and Fryer discloses determining a trust level score based on a second subset of at least one attribute of said at least one attribute (Sprague, paragraph 87, multiple context verification tests/factors).
Regarding claim 10, the combination of Sprague and Fryer discloses determining the trust level score by: providing a respective weighting for each attribute of the second subset; and providing the trust level score as a summation of each respective weighting (Sprague, paragraph 87, aggregated weighting score).
Regarding claim 11, the combination of Sprague and Fryer discloses providing a high weighting category from a first weighting to a second weighting, less than the first weighting; providing a medium weighting category from a third weighting, less than the second weighting, to a fourth weighting, less than the third weighting; and providing a low weighting category from a fifth weighting, less than the fourth weighting, to a sixth weighting, less than the fifth weighting (Sprague, paragraph 87, each context verification test/factor has respective weight).
Regarding claim 12, the combination of Sprague and Fryer discloses categorising each attribute of the second subset into one of the high, medium or low weighting category (Sprague, paragraph 87, each context verification test/factor has respective weight).
Regarding claim 13, the combination of Sprague and Fryer discloses categorising into the high weighting category at least one attribute of: the authentication provider module and a trusted computing system comprising the identity provider module are provided by a common entity; or the authentication provider module is able to perform multi-factor authentication of an individual using biometric information from the individual (Sprague, paragraph 128, each device identity factor test has assigned trust score weight, and paragraph 80, biometric fingerprint).
Regarding claim 14, the combination of Sprague and Fryer discloses categorising into the medium weighting category at least one attribute of: the authentication provider module is able to provide geolocation information for the individual (Sprague, paragraph 128, each device identity factor test has assigned trust score weight, and paragraph 96, trusted geographic locations).
Regarding claim 15, the combination of Sprague and Fryer discloses categorising into the low weighting category at least one attribute of: the authentication provider module is able to perform multi-factor authentication of an individual using one time passcodes sent to a mobile device of the individual; or the authentication provider module requires re-authentication after a preconfigured time period has elapsed (Sprague, paragraph 128, each device identity factor test has assigned trust score weight, and paragraph 80, one-time-password).
Regarding claim 16, the combination of Sprague and Fryer discloses wherein the at least one attribute is one or more of: whether the authentication provider module and a trusted computing system comprising the identity provider module are provided by a common entity; whether the authentication provider module requires a minimum password difficulty for authentication of an individual; whether the authentication provider module is able to perform multi-factor authentication of an individual; whether the authentication provider module is able to provide geolocation information for the individual; whether the authentication provider module requires re-authentication after a preconfigured time period has elapsed (Sprague, paragraph 96, trusted geographic locations).
Regarding claim 17, the combination of Sprague and Fryer discloses wherein the at least one predetermined authentication provider eligibility criterion is one or more of: the authentication provider module and a trusted computing system comprising the identity provider module are provided by a common entity; the authentication provider module requires a minimum password difficulty for authentication of an individual; the authentication provider module is able to perform multi-factor authentication of an individual; the authentication provider module is able to provide geolocation information for the individual; the authentication provider module requires re-authentication after a preconfigured time period has elapsed (Sprague, paragraph 96, trusted geographic locations).
Regarding claim 18, the combination of Sprague and Fryer discloses wherein the at least one predetermined authentication provider eligibility criterion is only that the authentication provider module requires a minimum password difficulty for authentication of an individual (Sprague, paragraph 99, first and/or second passwords).
Regarding claim 19, Sprague discloses a communication network, comprising: a trusted computing system comprising an identity provider module configured to issue authentication credentials (paragraph 80, device identity server); a non-trusted computing system comprising an authentication provider module that is configured to authenticate an identity of an individual independently of the trusted computing system (paragraph 79, user’s device); wherein the authentication provider module is configured to transmit data, indicative of at least one attribute of the authentication provider module, to the identity provider module (paragraph 80, context verification tests/factors communicated from user’s device to device identity server); and wherein the identity provider module is configured to provide the service provider with authentication credentials responsive to determining that the at least one attribute meets at least one predetermined authentication provider eligibility criterion (paragraph 81, returns ID and trust score).
Sprague does not explicitly state wherein the identity provider module is configured to provide the authentication module with the authentication credentials. However, returning authentication data to the client device for use was well known in the art as evidenced by Fryer. Since the inventions encompass the same field of endeavor, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Sprague by adding the ability that the identity provider module is configured to provide the authentication module with the authentication credentials as provided by Fryer (see paragraph 27, IDP returns authorization code to client device). One of ordinary skill in the art would have recognized the benefit that providing authentication in this was way would assist in protecting user confidential information (see Fryer, paragraph 3).
Regarding claim 20, the combination of Sprague and Fryer discloses wherein the authentication provider module executes on a computing device of the non-trusted computing system and the identity provider module executes on a computing device of the trusted
computing system (Sprague, paragraph 79, user’s device, and paragraph 80, device identity server).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Shiralkar et al. (U.S. Patent Application Publication Number 2022/0124098) disclosed techniques for providing access to services based on a device trust score for a client device.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Victor Lesniewski whose telephone number is (571)272-2812. The examiner can normally be reached Monday thru Friday, 9am to 5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Carl Colin can be reached at 571-272-3862. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Victor Lesniewski/Primary Examiner, Art Unit 2493