DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application is being examined under the first inventor to file provisions of the AIA .
Applicant(s) Response to Office Action
The response filed on 12/5/2025 has been entered and made of record.
Examiner’s Note – Patentably Distinct Subject Matter
Application 17/713,987 now US Patent 11811775 and application 16/865,422 now US Patent 11297060 contain similar, yet patentably distinct subject matter.
Examiner’s Note – Allowable Subject Matter
Claims 25-28, 33-34, 36, and 39-40 overcome the prior art and would otherwise be allowable if incorporated into the independent claim along with any intermediate claims as well as made to overcome the double patenting rejection below.
Response to Amendment/Remarks
Claims 21-40 were submitted as previously presented and remain pending in the application.
Examiner thanks applicant for their thoughtful remarks which have been fully considered. Applicant attempts to overcome the double patenting rejection with a terminal disclaimer. However, a terminal disclaimer has not been filed in the weeks subsequent to filing a response. Hence, the double patenting rejection is maintained.
Applicant’s makes various remarks regarding 35 USC 103. Applicant’s remarks Pg. 9 Ln. 15 – Pg. 12 Ln. 2 demonstrate that Cavage does not teach, “compute a replay attack score associated with the login attempt based on the at least one pair of counters”. In this examiner and applicant are in agreement, since the Cavage reference was not used to teach this limitation. Applicant makes no remarks directed towards demonstrating that Cavage does not teach any limitation relied upon in the rejection.
Applicant makes no remarks to demonstrate that either Jakobsson or Charan do not teach the limitations relied upon for these references in the rejection.
Applicant’s remarks Pg. 12 Ln. 3 – Pg. 13 Ln. 10 assert that the motivation to combine is invalid. Applicant contends that the KSR rationale used is invalid since examiner did not provide evidence to support predictable results and in doing so, the examiner is engaging in hindsight reasoning. MPEP 2141 Section V Consideration of Applicant’s Rebuttal Evidence states that the applicant must provide arguments or evidence that the “results of the combination were unexpected”. Thus, the evidentiary burden in this case falls on the applicant. The applicant has not performed this task.
Applicant’s remarks Pg. 13 Ln. 11 – Pg. 15 Ln. 13 attempt to content the examiner’s obviousness claims stating the references are not analogous arts. As per MPEP 2141.01(a) Section 1, it has been held that a prior art reference must either be in the field of the inventor’s endeavor or, if not, then be “reasonably pertinent” to the particular problem with which the inventor was concerned, in order to be relied upon as a basis for rejection of the claimed invention. See In re Oetiker, 977 F.2d 1443, 24 USPQ2d 1443 (Fed. Cir. 1992). Examiner contends that the references are “reasonably pertinent” as required by the MPEP. Also as stated in the MPEP, “Common sense teaches, however, that familiar items may have obvious uses beyond their primary purposes, and in many cases a person of ordinary skill will be able to fit the teachings of multiple patents together like pieces of a puzzle.” KSR Int’l Co. v. Teleflex Inc., 550 U.S. 398, 420; 82 USPQ2d 1385, 1390; 127 S. Ct. 1727, 1742 (KSR).
Similarly, DyStar Textilfarben GmbH & Co. Deutschland KG v. C.H. Patrick Co., 80 USPQ2d 1641, 1651 (Fed. Cir. 2006) wherein the CAFC stated:
“Indeed, we have repeatedly held that an implicit motivation to combine exists not only when a suggestion may be gleaned from the prior art as a whole, but when the "improvement" is technology-independent and the combination of references results in a product or process that is more desirable, for example because it is stronger, cheaper, cleaner, faster, lighter, smaller, more durable, or more efficient. Because the desire to enhance commercial opportunities by improving a product or process is universal-and even common-sensical -we have held that there exists in these situations a motivation to combine prior art references even absent any hint of suggestion in the references themselves.”
Accordingly, applicant has not demonstrated that the claimed invention has unexpected results are non-analogous art beyond reasonably pertinent. The standard applied by the applicant appears to be higher than that of the MPEP on these issues. Applicant has not demonstrate that any of the references do not teach anything they were relied upon. Applicant’s remarks are respectfully unpersuasive. Applicant’s remarks Pg. 15 Ln. 14 – Pg. 16 Ln. 8 broadly apply applicants remarks to the remaining claims and make no specific additions. Examiner thanks the applicant for their thoughtful remarks. Accordingly, the rejection under 35 USC 103 is maintained.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the claims at issue are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); and In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on a nonstatutory double patenting ground provided the reference application or patent either is shown to be commonly owned with this application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The USPTO internet Web site contains terminal disclaimer forms which may be used. Please visit http://www.uspto.gov/forms/. The filing date of the application will determine what form should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to:
http://www.uspto.gov/patents/process/file/efs/guidance/eTD-info-I.jsp.
Claim(s) 21-40 is/are rejected on the grounds of nonstatutory double patenting as being unpatentable over claims 1-20 of U.S. Patent No. 10,645,086. Although the claims at issue are not identical in form, they are not patentably distinct from each other. In particular, the patented claims anticipate their respective instant claims.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 21-23, 29-31, 35, and 37-38 is/are rejected under 35 U.S.C. 103 as being unpatentable over Cavage (US 8,776,190 B1), in view of Jakobsson (US 2014/0130126 A1) in view of Eldar (US 2007/0005985 A1).
Regarding claims 21, 29 and 37, Cavage teaches:
“A computing device, comprising: memory storing computer readable instructions (Cavage, Col. 14, Ln. 25-61 teaches processor, memory and medium to implement method steps); and at least one processor configured to execute the computer readable instructions to cause the computing device (Cavage, Col. 14, Ln. 25-61 teaches processor, memory and medium to implement method steps) to, receive a login attempt associated with at least one user (Cavage, Fig. 4, step 402, Col. 7 Ln. 1-22 teaches user login into service), determine at least one pair of counters based on the login attempt, each pair of counters of the at least one pair of counters including a first counter corresponding to successful login attempts associated with the at least one user (Cavage, Fig. 4, step 418, Col. 9 Ln. 44-56 teaches incrementing successful login counter when the login is successful), and a second counter corresponding to unsuccessful login attempts associated with the at least one user (Cavage, Fig. 4 step 410 Col. 8 Ln. 16-24 teaches increasing unsuccessful login counter when failed login attempts occur), and allow access to the at least one user (Cavage, Col. 9 Ln. 44- Col. 10 Ln. 10 teaches providing access to the requested resource based on the successful authentication)”.
Cavage does not, but in related art, Jakobsson teaches:
“compute a replay attack score associated with the login attempt based on the at least one pair of counters (Jakobsson, Fig. 4, ¶ 38 Ln. 25 - ¶ 39 Ln. 23 teaches process where counters in an authentication process reflect successful and unsuccessful actions. Further, the ratio of these counters are used to create a value which is then compared to a threshold to determine if a session should be ended or not)”.
Before applicant’s earliest effective filing it would have been obvious to one of ordinary skill in the art, having the teachings of Cavage and Jakobsson, to modify the login counter system of Cavage to include the method to use the ratio of counters in an authentication environment to make threat mitigation decisions. The motivation to do so constitutes applying a known technique to known devices and/or methods ready for improvement to yield predictable results. Further, as disclosed by Charan (US 2016/0057116 A1) ¶ 191, various metrics compared to threshold can be utilized to detect replay attacks.
Cavage and Jakobsson do not, but in related art, Eldar teaches:
“allow access to the at least one user based on the computed replay attack score (Eldar, Fig. 5, ¶ 47-51 teaches using a metric to determine if the system is under attack and further making login access decisions)”.
Before applicant’s earliest effective filing it would have been obvious to one of ordinary skill in the art, having the teachings of Cavage, Jakobsson and Eldar, to modify the login counter system of Cavage and Jakobsson to include the method to use attack metrics to factor into authentication and validation decisions. The motivation to do so constitutes applying a known technique to known devices and/or methods ready for improvement to yield predictable results.
Regarding claims 22, 30, and 38, Cavage, Jakobsson and Eldar teaches:
“The computing device of claim 21 (Cavage, Jakobsson and Eldar teaches the limitations of the parent claims as discussed above), wherein the at least one processor is further configured to execute the computer readable instructions to cause the computing device to determine the at least one counter by: identifying the at least one pair of counters associated with at least one attribute of the login attempt (Cavage, Fig. 4, step 418, Col. 9 Ln. 44-56 teaches incrementing successful login counter when the login is successful. The attribute being successful login attempts); determining whether the login attempt was valid (Cavage, Fig. 4, step 408, Col. 8 Ln. 5-15 teaches determining if the credentials are valid); and incrementing one or more of the identified counters of the at least one pair of identified counters based on results of the determining (Cavage, Fig. 4, step 418, Col. 9 Ln. 44-56 teaches incrementing successful login counter when the login is successful)”.
Regarding claims 23 and 31, Cavage, Jakobsson and Eldar teaches:
“The computing device of claim 22 (Cavage, Jakobsson and Eldar teaches the limitations of the parent claims as discussed above), wherein the at least one processor is further configured to execute the computer readable instructions to cause the computing device to: increment the first counter of the identified at least one pair of counters in response to the login attempt being valid (Cavage, Fig. 4, step 418, Col. 9 Ln. 44-56 teaches incrementing successful login counter when the login is successful); and increment the second counter of the identified at least one pair of counters in response to the login attempt being invalid (Cavage, Fig. 4 step 410 Col. 8 Ln. 16-24 teaches increasing unsuccessful login counter when failed login attempts occur)”.
Regarding claims 35, Cavage, Jakobsson and Eldar teaches:
“The non-transitory computer readable medium of claim 33 (Cavage, Jakobsson and Eldar teaches the limitations of the parent claims as discussed above), wherein the execution of the computer readable instructions causes the computing device to allow the access to the at least one user based on the computed replay attack score by: comparing the computed replay attack score associated with the login attempt with a desired threshold value (Jakobsson, Fig. 4, ¶ 38 Ln. 25 - ¶ 39 Ln. 23 teaches process where counters in an authentication process reflect successful and unsuccessful actions. Further, the ratio of these counters are used to create a value which is then compared to a threshold to determine if a session should be ended or not); and allowing the access to the at least one user based on results of the comparing (Jakobsson, Fig. 4, ¶ 38 Ln. 25 - ¶ 39 Ln. 23 teaches process where counters in an authentication process reflect successful and unsuccessful actions. Further, the ratio of these counters are used to create a value which is then compared to a threshold to determine if a session should be ended or not. Eldar, Fig. 5, ¶ 47-51 teaches using a metric to determine if the system is under attack and further making login access decisions including a threshold)”.
Claim(s) 24 and 32 is/are rejected under 35 U.S.C. 103 as being unpatentable over Cavage in view of Jakobsson in view of Eldar in view of Maxwell (US 2020/0137033 A1).
Regarding claims 24 and 32, Cavage, Jakobsson and Eldar teaches:
“The computing device of claim 22 (Cavage, Jakobsson and Eldar teaches the limitations of the parent claims as discussed above)”.
Cavage, Jakobsson and Eldar does not, but in related art, Maxwell teaches:
“wherein the at least one attribute of the login attempt includes at least one of: an IP address corresponding to the login attempt, at least one browser attribute, or any combination thereof (Maxwell Fig. 3 step 310 ¶ 34 teaches that intrinsic information in the request is received including the browser type and IP address with the browser)”.
Before applicant’s earliest effective filing it would have been obvious to one of ordinary skill in the art, having the teachings of Cavage, Jakobsson, Eldar, and Maxwell to modify the login counter system of Cavage, Jakobsson and Eldar to include the method to collect and evaluate attributes of the user logging in including browser and IP address. The motivation to do so constitutes applying a known technique to known devices and/or methods ready for improvement to yield predictable results.
Conclusion
THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to STEPHEN T GUNDRY whose telephone number is (571)270-0507. The examiner can normally be reached Monday-Friday 8:30AM-5PM (EST).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Joseph Hirl can be reached on (571)272-3685. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/STEPHEN T GUNDRY/ Primary Examiner, Art Unit 2435