Details
Claims 1-9 and 11-20 are pending.
Claims 1-9 and 11-20 are rejected.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-5 and 11, and 15-20 are rejected under 35 U.S.C. 103 as being unpatentable over Alston et al (Pub. No.: US 2022/0131692 A1) in view of Roth et al (Pub. No.: US 2018/0124056 A1).
As per claim 1, Alston discloses a computer-implemented method, comprising: - obtaining, by a computing system, data comprising erasure scope parameters, wherein the erasure scope parameters comprise a binding key and a scope timer (Alston, paragraph 0063, wherein “In block 410, data is received from a client. For example, the data may include a write to a database or any other information. The data may be information that the client would like to be temporarily available. According to some examples, along with a request providing the data, the client may also specify a duration for which the data should be accessible”, wherein the duration is the scope timer; Paragraph 0064, "For example, each of the plurality of keys may be added to a logical treadmill of available keys at predetermined intervals. The availability and expiration may be designated by one or more timestamps. According to the example where the client specifies a duration for which the data may be accessible, the expiration of the key may correspond to the specified duration. Moreover, each of the plurality of keys may have a predetermined expiration. The one of the keys used to encrypt the data may be any of the available keys on the treadmill", wherein the one of the used keys from the available keys on the treadmill is the obtained binding key), wherein the scope timer comprises a time to live (TTL) (Alston, paragraph 0004, wherein “The deletion timestamp may indicate a maximum time to live before expiration”); - obtaining, by the computing system, resource data (Alston, paragraph 0063, wherein “In block 410, data is received from a client”); - encrypting the resource data using the binding key (Alston, paragraph 0064, wherein “In block 420, the data is encrypted using one of a plurality of keys”).Alston does not explicitly disclose obtaining data indicative of a shred-now request, wherein the shred-now request is received before an expiration of the TTL; and deleting, in response to obtaining the shred-now request, the binding key before the expiration of the TTL.However, issuing a request to and deleting data/key before the expiration of the data/key has reached is well known in the art. For example, Roth discloses obtaining data indicative of a shred-now request (Roth, Fig 17 step 702, paragraph 0124, wherein “FIG. 17 provides an illustrative example of the process 1700 for updating policy in accordance with various embodiments. Process 1700 may be performed by any suitable system, such as by a cryptography service system, such as described above in connection with FIG. 16. In an embodiment, the process 1300 includes receiving 1302 a request to update policy for a KeyID”; wherein the request to update policy for keyID can be the shred-now request), wherein the shred-now request is received before an expiration of the TTL (Roth, paragraph 0159, wherein “In various embodiments, tokens may become invalid for various reasons. For example, in some embodiments, tokens are valid for a predetermined amount of time. The information from which the token's validity may be determined may, therefore, include a timestamp, which may encode a time at which the token was generated (for use as a basis for enforcing a token lifetime limit programmed into a system) and/or a time in which the token is to expire. Other information may be used instead of, or in addition to, a timestamp. For example, in an embodiment, a distributed system utilizes global sequence numbers for policy updates. Thus, each policy update that is made in the system may, for instance, include an updated sequence number. The sequence number may be encoded in the token to enable a distributed system to determine whether a subsequent policy has been propagated. For example, a component of the distributed system involved in access control that receives a token may look at a sequence number in the token and compare that sequence number to a sequence number of a policy update received through propagation. If the latest policy received through propagation is greater than the sequence number of the token, the component may therefore determine that any policy encoded in the token would have been reflected in policy changes received through propagation. In this manner, the policy updater of the token may be ignored and the policy may be enforced regardless of any information in the token”; Thus, a policy update request can be issued and the policy update is enforced before the timestamp information in the token/key); and deleting, in response to obtaining the shred-now request, the binding key before the expiration of the TTL (Roth, paragraph 0159, wherein “In various embodiments, tokens may become invalid for various reasons. For example, in some embodiments, tokens are valid for a predetermined amount of time. The information from which the token's validity may be determined may, therefore, include a timestamp, which may encode a time at which the token was generated (for use as a basis for enforcing a token lifetime limit programmed into a system) and/or a time in which the token is to expire. Other information may be used instead of, or in addition to, a timestamp. For example, in an embodiment, a distributed system utilizes global sequence numbers for policy updates. Thus, each policy update that is made in the system may, for instance, include an updated sequence number. The sequence number may be encoded in the token to enable a distributed system to determine whether a subsequent policy has been propagated. For example, a component of the distributed system involved in access control that receives a token may look at a sequence number in the token and compare that sequence number to a sequence number of a policy update received through propagation. If the latest policy received through propagation is greater than the sequence number of the token, the component may therefore determine that any policy encoded in the token would have been reflected in policy changes received through propagation. In this manner, the policy updater of the token may be ignored and the policy may be enforced regardless of any information in the token”; Thus, a policy update request can be issued and the policy update is enforced before the timestamp information in the token/key).
Therefore, it would have it would have been obvious to one ordinary skill in the art before the effective filing date of the invention to incorporate Roth teachings into Alston to achieve the claimed limitations because this would have provided a way to improve the security of the system so that policy changes can be treated as effective immediately when needed without having to wait for the changes to propagate through the system (see Roth abstract).
As per claim 2, claim 1 is incorporated and Alston further discloses wherein the binding key is stored across a plurality of devices by distributing a binding key secret share to each device of the plurality of devices (Alston, paragraph 0026, wherein “Fig. 2 illustrates an example system in which the encryption key treadmill is distributed across a plurality of node”, Paragraph 0031, “For example, the elected master node 212 pushes a definitive state to the distributed lock service 240, and pushes a description of what keys exist to the distributed lock service 240”).
As per claim 3, claim 1 is incorporated and Alston further discloses wherein the binding key comprises an ephemeral key that is specific to the erasure scope parameters (Alston, paragraph 0011, wherein “the key used to encrypt the data is selected from the treadmill based on an amount of time remaining between a current time and the deletion timestamp”; hence, the binding key is selected to match/fit the erasure scope parameters) and wherein the binding key is a unique encryption key associated with a logical treadmill (Alston , paragraph 0064, “For example, each of the plurality of keys may be added to a logical treadmill of available keys at predetermined intervals”), wherein the method comprises: - maintaining a logical treadmill of multiple unique encryption keys that are made available and destroyed according to a predetermined schedule, wherein each of the unique encryption has an associated deletion timestamp (Alston , paragraph 0009, “The system may include one or more processors configured to maintain a logical treadmill of multiple unique encryption keys that are made available and destroyed according to a predetermined schedule, and an interface that grants cryptographic oracle access to the encryption keys on the treadmill. Each encryption key has a deletion timestamp indicating when the key will be deleted from the treadmill”);- providing an interface that grants cryptographic oracle access to the encryption keys on the treadmill using a logical treadmill (Alston , paragraph 0009, “an interface that grants cryptographic oracle access to the encryption keys on the treadmill”); and - obtaining the scope timer, wherein the scope timer comprises an indication of a duration of time for which the resource data should be accessible (Alston, paragraph 0063, wherein “In block 410, data is received from a client. For example, the data may include a write to a database or any other information. The data may be information that the client would like to be temporarily available. According to some examples, along with a request providing the data, the client may also specify a duration for which the data should be accessible”, wherein the duration is the scope timer), wherein the binding key used to encrypt the data is selected from the logical treadmill based on an amount of time remaining between a current time and the deletion timestamp, the amount of time remaining corresponding to the scope timer (Alston, paragraph 0011, wherein “the key used to encrypt the data is selected from the treadmill based on an amount of time remaining between a current time and the deletion timestamp”).
As per claim 4, claim 3 is incorporated and Alston in view of Roth further discloses wherein the binding key is stored across a plurality of devices by distributing a binding key secret share to each device of the plurality of devices (Alston, paragraph 0007, wherein “"maintaining the logical treadmill may include deploying a plurality of distributed server processes, each of the server processes maintaining key material and executing a loop for removal of the key material from memory at the deletion timestamp”), (Roth, paragraph 0159, wherein “In various embodiments, tokens may become invalid for various reasons. For example, in some embodiments, tokens are valid for a predetermined amount of time. The information from which the token's validity may be determined may, therefore, include a timestamp, which may encode a time at which the token was generated (for use as a basis for enforcing a token lifetime limit programmed into a system) and/or a time in which the token is to expire. Other information may be used instead of, or in addition to, a timestamp. For example, in an embodiment, a distributed system utilizes global sequence numbers for policy updates. Thus, each policy update that is made in the system may, for instance, include an updated sequence number. The sequence number may be encoded in the token to enable a distributed system to determine whether a subsequent policy has been propagated. For example, a component of the distributed system involved in access control that receives a token may look at a sequence number in the token and compare that sequence number to a sequence number of a policy update received through propagation. If the latest policy received through propagation is greater than the sequence number of the token, the component may therefore determine that any policy encoded in the token would have been reflected in policy changes received through propagation. In this manner, the policy updater of the token may be ignored and the policy may be enforced regardless of any information in the token”; Thus, a policy update request can be issued and the policy update is enforced before the timestamp information in the token/key).
As per claim 5, claim 4 is incorporated and Alston in view of Roth further discloses wherein deleting the binding key comprises executing a loop for removal of the key material from the memory at the time of receipt of the shred-now request (Alston, paragraph 0007, wherein “maintaining the logical treadmill may include deploying a plurality of distributed server processes, each of the server processes maintaining key material and executing a loop for removal of the key material from memory at the deletion timestamp”), (Roth, paragraph 0159, wherein “In various embodiments, tokens may become invalid for various reasons. For example, in some embodiments, tokens are valid for a predetermined amount of time. The information from which the token's validity may be determined may, therefore, include a timestamp, which may encode a time at which the token was generated (for use as a basis for enforcing a token lifetime limit programmed into a system) and/or a time in which the token is to expire. Other information may be used instead of, or in addition to, a timestamp. For example, in an embodiment, a distributed system utilizes global sequence numbers for policy updates. Thus, each policy update that is made in the system may, for instance, include an updated sequence number. The sequence number may be encoded in the token to enable a distributed system to determine whether a subsequent policy has been propagated. For example, a component of the distributed system involved in access control that receives a token may look at a sequence number in the token and compare that sequence number to a sequence number of a policy update received through propagation. If the latest policy received through propagation is greater than the sequence number of the token, the component may therefore determine that any policy encoded in the token would have been reflected in policy changes received through propagation. In this manner, the policy updater of the token may be ignored and the policy may be enforced regardless of any information in the token”; Thus, a policy update request can be issued and the policy update is enforced before the timestamp information in the token/key).
As per claim 11, claim 1 is incorporated and Alston further discloses wherein the binding key is stored across n number of devices, and wherein to unwrap data associated with the binding key, n/2+1 of the n number of devices must be accessible (Alston, paragraph 0007, wherein “"maintaining the logical treadmill may include deploying a plurality of distributed server processes, each of the server processes maintaining key material and executing a loop for removal of the key material from memory at the deletion timestamp”. Paragraph 0037, wherein “Public treadmill state will be definitively replicated across cells A-C in the distributed lock service 240. While three cells are shown in FIG. 2, it should be understood that the distributed lock service 240 may include any number of cells. For each cell, a serializable data structure containing a treadmill timer will be written to a file. The serializable data structure indicates an availability timestamp and a deletion timestamp. Definitive state is determined using majority rule, such as wherein a treadmill timer entry is considered to be present if written to a majority of the cells”).
Claims 15-20 are rejected under the same rationale as claims 1-5 and 11.
Claim 6 is rejected under 35 U.S.C. 103 as being unpatentable over Alston et al (Pub. No.: US 2022/0131692 A1) in view of Roth et al (Pub. No.: US 2018/0124056 A1) and Solow et al (Pub. No.: US 2014/0195809 A1).
As per claim 6, claim 4 is incorporated and Alston and Roth do not explicitly disclose wherein encrypting the resource data using the binding key comprises: locating one or more binding key secret shares; reconstructing the binding key; and encrypting the resource data using the binding key. However, reconstructing a key based on (previously) distributed key shares is well known in the art. For example, Solow discloses wherein encrypting the resource data using the binding key comprises: locating one or more binding key secret shares; reconstructing the binding key; and encrypting the resource data using the binding key (Solow, paragraph 0002, 0046, wherein “In secret sharing schemes, a secret (such as a cryptographic key) is shared among a group of participants, each of whom is allocated a share of the secret. The secret can be reconstructed only when a sufficient number of secret-shares are combined together, while individual shares are of no use on their own”).
Therefore, it would have it would have been obvious to one ordinary skill in the art before the effective filing date of the invention to incorporate Solow teachings into Alston and Roth to achieve the claimed limitations because this would have provided a way to improve the security of the system so that only qualified users will be able to decrypt it.
Claims 7 and 9 are rejected under 35 U.S.C. 103 as being unpatentable over Alston et al (Pub. No.: US 2022/0131692 A1) in view of Roth et al (Pub. No.: US 2018/0124056 A1) and Sahni et al (Pub. No.: US 2021/0377308 A1).
As per claim 7, claim 1 is incorporated and Alston and Roth do not explicitly disclose wherein the deleting the binding key comprises: locating one or more binding key secret shares; and writing over the one or more binding key secret shares storage location with random data. However, writing over key secret shares is well known in the art. For example, Sahni discloses wherein the deleting the binding key comprises: locating one or more binding key secret shares; and writing over the one or more binding key secret shares storage location with random data (Sahni, paragraph 0026, wherein “the transport layer process cleans and releases the first memory block. Even if the memory pool is serviced by a garbage collector or similar process to sanitize released or returned memory blocks, the transport layer process at least cleans the first memory block of the cryptographic keys and shared secret. For instance, the transport layer process writes over the blocks of the first memory block corresponding to the keys and shared secret with Os. Or the transport layer process writes over the entire first memory block with Os”).
Therefore, it would have it would have been obvious to one ordinary skill in the art before the effective filing date of the invention to incorporate Sahni teachings into Alston and Roth to achieve the claimed limitations because this would have provided a way to improve the security of the system so that the destroyed keys cannot be reconstructed after deleting.
As per claim 9, claim 1 is incorporated and Alston and Roth do not explicitly disclose wherein deleting the binding key results in the binding key being computationally unrecoverable. However, deleting a key in a way that make it computationally unrecoverable is well known in the art. For example, Sahni discloses wherein deleting the binding key results in the binding key being computationally unrecoverable (Sahni, paragraph 0026, wherein “the transport layer process cleans and releases the first memory block. Even if the memory pool is serviced by a garbage collector or similar process to sanitize released or returned memory blocks, the transport layer process at least cleans the first memory block of the cryptographic keys and shared secret. For instance, the transport layer process writes over the blocks of the first memory block corresponding to the keys and shared secret with Os. Or the transport layer process writes over the entire first memory block with Os”).
Therefore, it would have it would have been obvious to one ordinary skill in the art before the effective filing date of the invention to incorporate Sahni teachings into Alston abd Roth to achieve the claimed limitations because this would have provided a way to improve the security of the system so that the destroyed keys cannot be reconstructed after deleting.
Claim 8 is rejected under 35 U.S.C. 103 as being unpatentable over Alston et al (Pub. No.: US 2022/0131692 A1) in view of Roth et al (Pub. No.: US 2018/0124056 A1) and Beck (Pub. No.: US 2021/0019436 A1).
As per claim 8, claim 1 is incorporated and Alston and Roth does not explicitly disclose wherein the erasure scope parameters are associated with an erasure scope namespace that comprises the binding key, the scope timer, an identification of one or more authorized user devices to transmit shred-now requests, and a storage policy associated with one or more storage locations associated with secret sharing of the binding key. However, having a namespace comprising the binding key, the scope timer, an identification of one or more authorized user devices to transmit shred-now requests, and a storage policy associated with one or more storage locations associated with secret sharing of the binding key is matter of implementation choices and thus it would have been obvious to one ordinary skill in the art before the effective filing date of the invention to implement such choices because this would have provided a way to encapsulate all of the data related to the erasure scope parameters in one place/namespace which simplifies the access and management of the data. Alternatively, Beck discloses wherein the erasure scope parameters are associated with an erasure scope namespace that comprises the binding key, the scope timer, an identification of one or more authorized user devices to transmit shred-now requests, and a storage policy associated with one or more storage locations associated with secret sharing of the binding key (Beck, paragraph 0072, wherein “The first terms and conditions can be packaged with the content and can include duration of access, location of access, trusted issuing root public key certificate, and/or actions authorized to be performed. The metadata can include an index of the first secure holding, non-sensitive biographical information, short descriptions of the first secure holding including non-sensitive diagnosis and/or procedure codes, and/or a data content subject identifier. The rights management specification can include information identifying a clearing server, a specification of roles eligible for requesting access to the content, and/or a specification of credentials eligible for requesting access to the content”).
Therefore, it would have it would have been obvious to one ordinary skill in the art before the effective filing date of the invention to incorporate Beck teachings into Alston and Roth to achieve the claimed limitations because this would have provided a way to encapsulate all of the data related to the erasure scope parameters in one place/namespace which simplifies the access and management of the data.
Claims 12-14 are rejected under 35 U.S.C. 103 as being unpatentable over Alston et al (Pub. No.: US 2022/0131692 A1) in view of Roth et al (Pub. No.: US 2018/0124056 A1).
As per claim 12, claim 1 is incorporated and Alston and Roth do not explicitly disclose the erasure scope parameters are stored in a bit layout comprising the scope timer and an encrypted binding key share. However, having using bit layout to store data is well known in the art and thus it would have been obvious to one ordinary skill in the art before the effective filing date of the invention to store the erasure scope parameters including the scope timer and an encrypted binding key share in a bot layout as a matter of design choice because this would have provided one way to store data.
As per claim 13, claim 12 is incorporated and Alston and Roth do not explicitly disclose wherein the scope timer comprises an origin deadline, a reconstruction deadline, a share expiration, and a tentative reclamation time. However, the claim does not define these elements or show how they are used when destroying the keys. Thus, these elements (an origin deadline, a reconstruction deadline, a share expiration, and a tentative reclamation time) are viewed as any data within the scope timer (Alston, paragraph 0063, wherein “In block 410, data is received from a client. For example, the data may include a write to a database or any other information. The data may be information that the client would like to be temporarily available. According to some examples, along with a request providing the data, the client may also specify a duration for which the data should be accessible”, wherein the duration is the scope timer; Paragraph 0064, "For example, each of the plurality of keys may be added to a logical treadmill of available keys at predetermined intervals. The availability and expiration may be designated by one or more timestamps. According to the example where the client specifies a duration for which the data may be accessible, the expiration of the key may correspond to the specified duration. Moreover, each of the plurality of keys may have a predetermined expiration. The one of the keys used to encrypt the data may be any of the available keys on the treadmill", wherein the one of the used keys from the available keys on the treadmill is the obtained binding key).
As per claim 14, claim 12 is incorporated and Alston and Roth do not explicitly disclose wherein the encrypted binding key share comprises a key identifier and an expiration time. (Alston, paragraph 0026, wherein “Fig. 2 illustrates an example system in which the encryption key treadmill is distributed across a plurality of node”, Paragraph 0029, “The encryption key treadmill state consists of (i) a public treadmill timer which times events on the encryption key treadmill and (ii) private key material for each key on the treadmill. The public treadmill timer is replicated using the distributed lock service 240”, Paragraph 0031, “For example, the elected master node 212 pushes a definitive state to the distributed lock service 240, and pushes a description of what keys exist to the distributed lock service 240”).
Alternative rejection.
Claims 1-5 and 11, and 15-20 are rejected under 35 U.S.C. 103 as being unpatentable over Alston et al (Pub. No.: US 2022/0131692 A1) in view of Myman et al (Pub. No.: US 2009/0248751 A1).
As per claim 1, Alston discloses a computer-implemented method, comprising: - obtaining, by a computing system, data comprising erasure scope parameters, wherein the erasure scope parameters comprise a binding key and a scope timer (Alston, paragraph 0063, wherein “In block 410, data is received from a client. For example, the data may include a write to a database or any other information. The data may be information that the client would like to be temporarily available. According to some examples, along with a request providing the data, the client may also specify a duration for which the data should be accessible”, wherein the duration is the scope timer; Paragraph 0064, "For example, each of the plurality of keys may be added to a logical treadmill of available keys at predetermined intervals. The availability and expiration may be designated by one or more timestamps. According to the example where the client specifies a duration for which the data may be accessible, the expiration of the key may correspond to the specified duration. Moreover, each of the plurality of keys may have a predetermined expiration. The one of the keys used to encrypt the data may be any of the available keys on the treadmill", wherein the one of the used keys from the available keys on the treadmill is the obtained binding key), wherein the scope timer comprises a time to live (TTL) (Alston, paragraph 0004, wherein “The deletion timestamp may indicate a maximum time to live before expiration”); - obtaining, by the computing system, resource data (Alston, paragraph 0063, wherein “In block 410, data is received from a client”); - encrypting the resource data using the binding key (Alston, paragraph 0064, wherein “In block 420, the data is encrypted using one of a plurality of keys”).Alston does not explicitly disclose obtaining data indicative of a shred-now request, wherein the shred-now request is received before an expiration of the TTL; and deleting, in response to obtaining the shred-now request, the binding key before the expiration of the TTL.However, issuing a request to and deleting data/key before the expiration of the data/key has reached is well known in the art. For example, Myman discloses obtaining data indicative of a shred-now request (Myman, paragraph 0049, wherein “In accordance with a further aspect of the present invention, the sender can also destroy a message that has a time limit in an instruction before that time limit has expired. A sender may provide, for instance, an instruction to destroy the message by clicking in the user interface on the sender client on a field, or icon or any other designated destruction mark, for instance, next to a message that has been already sent. This will generate a message from the sender to the recipient that will instruct the client of the recipient to destroy the relevant message immediately, even before the initial time to destroy has expired”), wherein the shred-now request is received before an expiration of the TTL (Myman, paragraph 0049, wherein “In accordance with a further aspect of the present invention, the sender can also destroy a message that has a time limit in an instruction before that time limit has expired. A sender may provide, for instance, an instruction to destroy the message by clicking in the user interface on the sender client on a field, or icon or any other designated destruction mark, for instance, next to a message that has been already sent. This will generate a message from the sender to the recipient that will instruct the client of the recipient to destroy the relevant message immediately, even before the initial time to destroy has expired”); and deleting, in response to obtaining the shred-now request, the binding key before the expiration of the TTL (Myman, paragraph 0049, wherein “In accordance with a further aspect of the present invention, the sender can also destroy a message that has a time limit in an instruction before that time limit has expired. A sender may provide, for instance, an instruction to destroy the message by clicking in the user interface on the sender client on a field, or icon or any other designated destruction mark, for instance, next to a message that has been already sent. This will generate a message from the sender to the recipient that will instruct the client of the recipient to destroy the relevant message immediately, even before the initial time to destroy has expired).
Therefore, it would have it would have been obvious to one ordinary skill in the art before the effective filing date of the invention to incorporate Myman teachings into Alston to achieve the claimed limitations because this would have provided a way to improve the security of the system so that immediate deleting of the keys can be performed when the keys are compromised even before the key are expired.
As per claim 2, claim 1 is incorporated and Alston further discloses wherein the binding key is stored across a plurality of devices by distributing a binding key secret share to each device of the plurality of devices (Alston, paragraph 0026, wherein “Fig. 2 illustrates an example system in which the encryption key treadmill is distributed across a plurality of node”, Paragraph 0031, “For example, the elected master node 212 pushes a definitive state to the distributed lock service 240, and pushes a description of what keys exist to the distributed lock service 240”).
As per claim 3, claim 1 is incorporated and Alston further discloses wherein the binding key comprises an ephemeral key that is specific to the erasure scope parameters (Alston, paragraph 0011, wherein “the key used to encrypt the data is selected from the treadmill based on an amount of time remaining between a current time and the deletion timestamp”; hence, the binding key is selected to match/fit the erasure scope parameters) and wherein the binding key is a unique encryption key associated with a logical treadmill (Alston , paragraph 0064, “For example, each of the plurality of keys may be added to a logical treadmill of available keys at predetermined intervals”), wherein the method comprises: - maintaining a logical treadmill of multiple unique encryption keys that are made available and destroyed according to a predetermined schedule, wherein each of the unique encryption has an associated deletion timestamp (Alston , paragraph 0009, “The system may include one or more processors configured to maintain a logical treadmill of multiple unique encryption keys that are made available and destroyed according to a predetermined schedule, and an interface that grants cryptographic oracle access to the encryption keys on the treadmill. Each encryption key has a deletion timestamp indicating when the key will be deleted from the treadmill”);- providing an interface that grants cryptographic oracle access to the encryption keys on the treadmill using a logical treadmill (Alston , paragraph 0009, “an interface that grants cryptographic oracle access to the encryption keys on the treadmill”); and - obtaining the scope timer, wherein the scope timer comprises an indication of a duration of time for which the resource data should be accessible (Alston, paragraph 0063, wherein “In block 410, data is received from a client. For example, the data may include a write to a database or any other information. The data may be information that the client would like to be temporarily available. According to some examples, along with a request providing the data, the client may also specify a duration for which the data should be accessible”, wherein the duration is the scope timer), wherein the binding key used to encrypt the data is selected from the logical treadmill based on an amount of time remaining between a current time and the deletion timestamp, the amount of time remaining corresponding to the scope timer (Alston, paragraph 0011, wherein “the key used to encrypt the data is selected from the treadmill based on an amount of time remaining between a current time and the deletion timestamp”).
As per claim 4, claim 3 is incorporated and Alston in view of Myman further discloses wherein the binding key is stored across a plurality of devices by distributing a binding key secret share to each device of the plurality of devices (Alston, paragraph 0007, wherein “"maintaining the logical treadmill may include deploying a plurality of distributed server processes, each of the server processes maintaining key material and executing a loop for removal of the key material from memory at the deletion timestamp”), (Myman, paragraph 0049, wherein “In accordance with a further aspect of the present invention, the sender can also destroy a message that has a time limit in an instruction before that time limit has expired. A sender may provide, for instance, an instruction to destroy the message by clicking in the user interface on the sender client on a field, or icon or any other designated destruction mark, for instance, next to a message that has been already sent. This will generate a message from the sender to the recipient that will instruct the client of the recipient to destroy the relevant message immediately, even before the initial time to destroy has expired).
As per claim 5, claim 4 is incorporated and Alston in view of Myman further discloses wherein deleting the binding key comprises executing a loop for removal of the key material from the memory at the time of receipt of the shred-now request (Alston, paragraph 0007, wherein “maintaining the logical treadmill may include deploying a plurality of distributed server processes, each of the server processes maintaining key material and executing a loop for removal of the key material from memory at the deletion timestamp”), (Myman, paragraph 0049, wherein “In accordance with a further aspect of the present invention, the sender can also destroy a message that has a time limit in an instruction before that time limit has expired. A sender may provide, for instance, an instruction to destroy the message by clicking in the user interface on the sender client on a field, or icon or any other designated destruction mark, for instance, next to a message that has been already sent. This will generate a message from the sender to the recipient that will instruct the client of the recipient to destroy the relevant message immediately, even before the initial time to destroy has expired).
As per claim 11, claim 1 is incorporated and Alston further discloses wherein the binding key is stored across n number of devices, and wherein to unwrap data associated with the binding key, n/2+1 of the n number of devices must be accessible (Alston, paragraph 0007, wherein “"maintaining the logical treadmill may include deploying a plurality of distributed server processes, each of the server processes maintaining key material and executing a loop for removal of the key material from memory at the deletion timestamp”. Paragraph 0037, wherein “Public treadmill state will be definitively replicated across cells A-C in the distributed lock service 240. While three cells are shown in FIG. 2, it should be understood that the distributed lock service 240 may include any number of cells. For each cell, a serializable data structure containing a treadmill timer will be written to a file. The serializable data structure indicates an availability timestamp and a deletion timestamp. Definitive state is determined using majority rule, such as wherein a treadmill timer entry is considered to be present if written to a majority of the cells”).
Claims 15-20 are rejected under the same rationale as claims 1-5 and 11.
Response to Arguments
Applicant’s arguments filed on 11/25/2025 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to HAMZA N ALGIBHAH whose telephone number is (571)270-7212. The examiner can normally be reached 7:30 am - 3:30 pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Wing Chan can be reached at (571) 272-7493. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/HAMZA N ALGIBHAH/Primary Examiner, Art Unit 2441