DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant’s arguments are directed to the newly added limitations. In particular, the Applicant states “the EDK is not symmetrically encrypted using a device key previously generated on the client device, nor is the EDK decrypted using the device key that was used to symmetrically encrypt the EDK” (p. 14), the Examiner agrees with that statement. However, Guccione teaches the elements of the limitation in the two implementations. The bundle is asymmetrically encrypted with the public key of the public/private key pair generated by the device and sent to the device from the server. The device receives the encrypted bundle, retrieves the private key from local memory and decrypts the encrypted bundle to generate the data key. The other implementation uses symmetric key (device key) to encrypt the bundle. The symmetric key is sent to the device to enable the device to decrypt the symmetrically encrypted bundle. The device key is generated on the server side. There are only a limited number of variations presented by the limitations: encryption can be symmetric or asymmetric and the key can be generated on the device or outside of the device. The Guccione reference has all of these variations and even explicitly states, “The disclosure provided herein describes features in terms of the preferred and exemplary embodiments thereof. Numerous other embodiments, modifications and variations within the scope and spirit of the appended claims will to persons of ordinary skill in the art from a review of this disclosure” (Guccione, [0116]). The Examiner agrees that it would be obvious to one of ordinary skill to select the symmetric encryption option with the generation of the device key (secret key) on the device option in the rejection of the amended claims.
Response to Amendment
Claims 3, 12, and 20-38 have been cancelled.
Claims 1, 2, 5, and 6 have been amended.
Claims 1, 2, 4, 5-11, and 13-19 are pending.
Claim Rejections - 35 USC § 112
In light of Applicant’s amendment, the previous 35 USC §112(b) rejection of the claims has been withdrawn.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 1, 4, 9-11, 13, and 14 are rejected under 35 U.S.C. 103 as being unpatentable over US PG Pub. No. 2021/0266309 to Guccione et al. (hereinafter Guccione).
As to claim 1, Guccione teaches:
a. Receiving, on a client device, user input to access a cryptographically protected resource provided by a web service provider (logging in via a redirection to an identity provider) (Guccione, [0063 and 0071]).
b. Redirecting a user on the client device to perform a login to an identity provider (logging in via a redirection to an identity provider) (Guccione, [0063 and 0071]).
c. Receiving, from the identity provider, a response to the login to the identity provider (signed attestation returned to the user) (Guccione, [0071]).
d. Sending the response from the identity provider to the web service provider (identity provider signed attestation sent to vault) (Guccione, [0071]).
e. After the web service provider confirms validity of the identity of the user by the identity provider, receiving information conveying an encrypted credential bundle corresponding to the user and the client device, wherein the encrypted credential bundle is symmetrically encrypted using a device key previously generated on the client device and corresponding to the user and the client device, the encrypted credential bundle including at least an encrypted first key comprising a first key that is symmetrically encrypted using the device key (symmetrically encrypted data key (EDK) (encrypted credential bundle) sent to user by vault upon confirmation of user identity) (Guccione, [0029, 0036, and 0071]). While Guccione does not explicitly recite that the symmetric key used to encrypt the data key corresponds to the user and the device, it would be obvious to make that assumption as only the user has access to the encryption key. The encryption key is only known to the user and the user device (Guccione, [0029]).
Guccione as modified further teaches:
f. Retrieving, from local storage on the client device, the device key corresponding to the user and the client device (decryption key (device key) for the EDK is resident on the user device) (Guccione, [0029 and 0037]).
g. Decrypting the encrypted credential bundle using the device key to obtain the first key (EDK is decrypted to obtain the data key (DK) equivalent to the first key) (Guccione, [0057]).
h. Using the first key to access the cryptographically protected resource provided by the web service provider (DK is used to access encrypted data from the vault) (Guccione, [0057]).
As to claim 4, Guccione as modified teaches:
a. The encrypted credential bundle is symmetrically encrypted with a symmetric encryption key derived from the device key (symmetrically encrypted data key (EDK) (encrypted credential bundle) sent to user by vault upon confirmation of user identity) (Guccione, [0029, 0036, and 0071]). While Guccione does not explicitly recite that the symmetric key used to encrypt the data key corresponds to the user and the device, it would be obvious to make that assumption as only the user has access to the encryption key. The encryption key is only known to the user and the user device (Guccione, [0029]).
b. Deriving a symmetric decryption key using the device key (symmetric encryption key is used to encrypt device key) (Guccione, [0029]).
c. Decrypting the encrypted credential bundle with the symmetric decryption key (EDK is decrypted to obtain the data key (DK) equivalent to the first key) (Guccione, [0057]).
As to claim 9, Guccione as modified teaches before receiving the encrypted credential bundle from the web service provider, sending a key identifier (ID) to the web service provider for use in identifying the encrypted credential bundle corresponding to the user and the client device, wherein the key ID corresponds to the device key previously generated on the client device (registering client device) (Guccione, [0076]).
As to claim 10, Guccione as modified teaches:
a. Receiving a communication from the web service provider confirming validation of the identity of the user by the identity provider (user authenticated) (Guccione, [0029, 0036, and 0071]).
b. Sending, to the web service provider, a request to provide the encrypted credential bundle corresponding to the user and the client device previously generated on the client device (upon authentication, vault service provider sends EDK to user) (Guccione, [0029, 0036, and 0071]).
As to claim 11, Guccione as modified teaches the encrypted credential bundle corresponds to the user, the client device and a specific account of the user, the method further comprising sending an account identifier to the web service provider for use in identifying the encrypted credential bundle corresponding to the user, the client device and the specific account of the user (user accounts are used to insure that proper authentication procedures are followed to allow the user to access their protected data) (Guccione, [0027-0029]).
As to claim 13, Guccione as modified teaches:
a. Receiving, on the client device, user input to access the cryptographically protected resource provided by the web service provider (logging in via a redirection to an identity provider) (Guccione, [0063 and 0071]).
b. Redirecting the user on the client device to perform a login to the identity provider (logging in via a redirection to an identity provider) (Guccione, [0063 and 0071]).
c. Receiving, from the identity provider, a response to the login to the identity provider (signed attestation returned to the user) (Guccione, [0071]).
d. Sending the response from the identity provider to the web service provider (identity provider signed attestation sent to vault) (Guccione, [0071]).
e. After the web service provider confirms validity of the identity of the user by the identity provider, generating the device key corresponding to the user and the client device (symmetrically encrypted data key (EDK) (encrypted credential bundle) sent to user by vault upon confirmation of user identity) (Guccione, [0029, 0036, and 0071]).
g. Generating the first key (data key) (Guccione, [0036]).
h. Encrypting the first key using the device key to generate the encrypted credential bundle (symmetrically encrypted data key (EDK) (encrypted credential bundle) sent to user by vault upon confirmation of user identity) (Guccione, [0029, 0036, and 0071]).
i. Sending the encrypted credential bundle to the web service provider for storage in association with the user and the client device (upon authentication, vault service provider sends EDK to user) (Guccione, [0029, 0036, and 0071]).
As to claim 14, Guccione as modified teaches:
a. Deriving a symmetric encryption key using the device key (symmetrically encrypted data key (EDK) (encrypted credential bundle) (Guccione, [0029, 0036, and 0071]).
b. Encrypting the first key with the symmetric encryption key to generate the encrypted credential bundle (symmetric encryption key is used to encrypt device key) (Guccione, [0029]).
Claims 2 and 15 are rejected under 35 U.S.C. 103 as being unpatentable over US PG Pub. No. 2021/0266309 to Guccione et al. (hereinafter Guccione) as applied to claim 1 above, and further in view of US PG Pub. No. 2007/0006231 to Barari et al. (hereinafter Barari).
As to claim 2, Guccione as modified teaches receiving multiple session tokens from the vault service provider to enable secure communication and connection to the vault service provider (Guccione, at least [0076]), but does not expressly mention a second key. However, in an analogous art, Barari teaches:
a. Decrypting the encrypted credential bundle using the device key to obtain a second key that is symmetrically encrypted using the device key (encrypted session key is sent to the user via a Ticket Granting Ticket (TGT) (encrypted credential bundle) to enable secure communication between the parties) (Barari, [0027]).
Therefore, one of ordinary skill in the art before the effective filing date of the instant application would have been motivated to implement the single sign on scheme of Guccione with the inclusion of an encrypted session key (second key) of Barari in order to perform a more secure single sign on scheme as suggested by Barari (Barari, [0011]).
Guccione as modified further teaches:
b. Using the second key to establish an authenticated session for communication between the web service provider and the client device (session key is decrypted and used to establish secure communication with the server) (Barari, [0005]).
As to claim 15, Guccione as modified teaches before redirecting the user on the client device to perform the login to the identity provider, performing an enrollment process to register the client device with the web service provider as a trusted device for SSO for the user, comprising:
a. Generating a verifier using the second key (session key is used as a verifier and identifier and is used in authenticating a communication session between the server and the user) (Barari, [0006]).
b. Sending the verifier to the web service provider for storage in associated with the user and the client device for use in establishing the authenticated session for communication between the web service provider and the client device (session key is used as a verifier and identifier and is used in authenticating a communication session between the server and the user) (Barari, [0006]).
Claims 5-8 and claims 16-19 are rejected under 35 U.S.C. 103 as being unpatentable over US PG Pub. No. 2021/0266309 to Guccione et al. (hereinafter Guccione) in view of US PG Pub. No. 2007/0006231 to Barari et al. (hereinafter Barari) as applied to claim 2 and claim 1 respectively above, and further in view of US Patent No. 10,382,413 to Friel et al. (hereinafter Friel).
As to claim 5, Guccione as modified does not expressly mention using PAKE. However, in an analogous art, Friel teaches after the web service provider confirms validity of the identity of the user by the identity provider, receiving information from the web service provider conveying a session identifier corresponding to an unverified session between the web service provider and the client device, wherein using the second key to establish an authenticated session for communication with the web service provider comprises using the second key in a password authenticated key exchange (PAKE) to authenticate the unverified session corresponding to the session identifier received from the web service provider ((session key is the identifier and is used in authenticating a communication session between the server and the user) (Barari, [0006]) and (PAKE handshake used to establish secure session) (Friel, 4:28-45)).
Therefore, one of ordinary skill in the art before the effective filing date of the instant application would have been motivated to implement the single sign on scheme of Guccione as modified with the use of the PAKE protocol of Friel in order to “establish an ephemeral, secure, encrypted channel” as suggested by Friel (Friel, 4:28-45).
As to claim 6, Guccione as modified does not expressly mention using PAKE. However, in an analogous art, Friel teaches using the second key to establish an authenticated session for communication with the web service provider comprises using the second key in a password authenticated key exchange (PAKE) to establish the authenticated session for communication with the web service provider without revealing the second key to the web service provider (PAKE handshake used to establish secure session) (Friel, 4:28-45) and (vault has no access to data key) (Guccione, [0023]).
Therefore, one of ordinary skill in the art before the effective filing date of the instant application would have been motivated to implement the single sign on scheme of Guccione as modified with the use of the PAKE protocol of Friel in order to “establish an ephemeral, secure, encrypted channel” as suggested by Friel (Friel, 4:28-45).
As to claim 7, Guccione as modified teaches using the second key in the PAKE to establish the authenticated session for communication with the web service provider comprises establishing a shared session key for the end-to-end encrypted communication with the web service provider (PAKE handshake used to establish secure session) (Friel, 4:28-45).
As to claim 8, Guccione as modified teaches the PAKE is based on a secure remote password (SRP) protocol utilizing a verifier previously generated using the second key, wherein the verifier is stored on the web service provider (SRP) (Friel, 4:28-45).
As to claim 16, Guccione as modified teaches:
a. Receiving a notification from the web service provider indicating a second client device has requested to be registered with the web service provider as a trusted device for the user (approval/registration of additional devices) (Guccione, [0034-0045 and 0103]).
b. Establishing a shared secret with the second client device (Guccione, [0036]).
Guccione as modified does not expressly mention using PAKE. However, in an analogous art, Friel teaches:
c. Using the shared secret in a password authenticated key exchange (PAKE) with the second client device to establish a session key for end-to-end encrypted communication with the second client device via the web service provider, wherein neither the shared secret nor the session key is revealed to the web service provider (PAKE handshake used to establish secure session) (Friel, 4:28-45).
Therefore, one of ordinary skill in the art before the effective filing date of the instant application would have been motivated to implement the single sign on scheme of Guccione as modified with the use of the PAKE protocol of Friel in order to “establish an ephemeral, secure, encrypted channel” as suggested by Friel (Friel, 4:28-45).
d. Encrypting a copy of the credential bundle using the session key (Guccione, [0029, 0036, and 0071]).
e. Sending the encrypted copy of the credential bundle to the web service provider for retrieval by the second client device (Guccione, [0029, 0036, and 0071]).
As to claim 17, Guccione as modified teaches:
a. Deriving a symmetric encryption key using the session key (symmetrically encrypted data key (EDK) (encrypted credential bundle) (Guccione, [0029, 0036, and 0071]) (using the session to encrypt communication between the two entities) (Barari, [0005]).
b. Encrypting the copy of the credential bundle with the symmetric encryption key derived using the session key (symmetrically encrypted data key (EDK) (encrypted credential bundle) (Guccione, [0029, 0036, and 0071]) (using the session to encrypt communication between the two entities) (Barari, [0005]).
As to claim 18, Guccione as modified teaches:
a. The shared secret comprises a code generated on the first client device (code is used as an additional authentication factor (out of band authentication) (Guccione, [0027]).
b. Establishing the shared secret with the second client device comprises displaying the code on a display of the first client device with a prompt to enter the code on the second client device (code is used as an additional authentication factor (out of band authentication) code is displayed in an email for example) (Guccione, [0027]).
c. Using the shared secret in the PAKE with the second client device comprises performing a PAKE handshake process with the second device via the web service provider using the code to establish the session key (code is used as an additional authentication factor (out of band authentication) code is displayed in an email for example) (Guccione, [0027]).
As to claim 19, Guccione as modified teaches the PAKE is based on a balanced composable PAKE protocol (using a particular old and well known commercially available protocol is not considered patentably distinct) (PAKE handshake used to establish secure session) (Friel, 4:28-45).
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to WILLIAM S POWERS whose telephone number is (571)272-8573. The examiner can normally be reached M-F 7:30-17:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jorge L Ortiz-Criado can be reached at (571) 272-7624. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/WILLIAM S POWERS/Primary Examiner, Art Unit 2496
Prosecution Insights