DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
The amendment filed 3/30/2026 has been placed of record in the file.
No claims have been amended.
Claim 29 has been added.
Claims 1-29 are now pending.
The applicant’s arguments with respect to claims 1-29 have been fully considered but they are not persuasive as discussed below.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-28 are rejected under 35 U.S.C. 103 as being unpatentable over Cha et al. (U.S. Patent Application Publication Number 2014/0230027), hereinafter referred to as Cha, in view of Novack et al. (U.S. Patent Application Publication Number 2011/0154452), hereinafter referred to as Novack, further in view of Smith (U.S. Patent Application Publication Number 2013/0047218).
Cha disclosed techniques for accessing services via SSO by utilizing local OpenID. In an analogous art, Novack disclosed techniques for provisioning authenticators to users for access to services. Also in an analogous art, Smith disclosed techniques for authenticating a device for access to multiple networks. All of these systems are directed to facilitating secure access for multiple systems.
Regarding claim 1, Cha discloses a system for enabling user access to secure resources in conjunction with authentication of the user on a client device executing a remote application, the system comprising: a database of authentication data (paragraph 30, OPSF); a database of authorization information (paragraph 31, aggregation OP); a client device comprising: i. a network interface (paragraph 34, transmits and receives wireless signals); ii. a computer processor for executing software instructions of a remote application (paragraph 46, processor); iii. an authorization-request handler, executable by the computer processor, configured to: a. electronically receive a request to authenticate the user from the remote application, the remote application being an application other than a token programmer (paragraph 111, user browses to target OPSF page), b. prompt the user for authentication information in a manner consistent with the request (paragraph 111, page displayed in browsing agent), c. communicate with a hardware device in electronic communication with the client device to obtain the authentication information (paragraph 111, user submits login information), and d. cause the authentication information to be compared to authentication data in the database of authentication data to verify that the user is authorized to use the remote application (paragraph 114, target OPSF verifies assertion); and iv. a token-generation module, executable by the computer processor, configured to, only after the user is authorized to use the remote application, and before any attempt to access by the user, or any access of by the user, one or more secure resources other than the remote application: A. automatically electronically receive, from the database of authorization information, authorization information for the user related to one or more secure resources other than the remote application (paragraph 116, database finalization associates source OID with target OPSF), and B. automatically cause a token programmer to program a token for the user consistent with the authorization information without requiring additional authentication of the user by the token programmer and without receiving additional authentication information from the user, the token being (i) usable by the user to access the one or more secure resources other than the remote application, wherein the token is usable by the user to access the one or more secure resources other than the remote application in a subsequent authorization, in conjunction with the one or more secure resources (paragraph 116, user may authenticate to associated relying parties in target domain).
Cha does not explicitly state the token being (i) providable by the user to access the one or more secure resources other than the remote application, (ii) distinct from the authentication information obtained by the authorization-request handler, and (iii) not based on authentication information received from the user. However, provisioning separate access tokens back to the user for later use in authentication was well known in the art as evidenced by Novack. Since the inventions encompass the same field of endeavor, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Cha by adding the ability for the token being (i) providable by the user to access the one or more secure resources other than the remote application, (ii) distinct from the authentication information obtained by the authorization-request handler, and (iii) not based on authentication information received from the user as provided by Novack (see paragraph 60, provisions one or more authenticators, and paragraph 61, authenticators are specific to referring organizations). One of ordinary skill in the art would have recognized the benefit that utilizing authenticators in such a way would assist authenticating users by allowing them to enroll in a secure access system only once to obtain access to multiple resources (see Novack, paragraph 30).
The combination of Cha and Novack does not explicitly state the one or more secure resources being any secure resources other than the remote application. However, generating tokens in such a fashion was well known in the art as evidenced by Smith. Since the inventions encompass the same field of endeavor, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the combination of Cha and Novack by adding the ability for the operation of the token-generation module to be before any attempt to access by the user, or any access of by the user, any secure resources other than the remote application as provided by Smith (see paragraphs 37 and 38, generates tokens for access to different networks before device associates with those networks). One of ordinary skill in the art would have recognized the benefit that providing tokens in such a way would assist in signing on to a second network without requiring re-authentication over that network (see Smith, paragraph 27).
The combination of Cha and Novack does not explicitly state wherein the token is providable by the user to access the one or more secure resources other than the remote application in a subsequent authorization, in conjunction with the one or more secure resources, after expiration of the user’s authorization to use the remote application. However, utilizing tokens in such a fashion was well known in the art as evidenced by Smith. Since the inventions encompass the same field of endeavor, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the combination of Cha and Novack by adding the ability that the token is providable by the user to access the one or more secure resources other than the remote application in a subsequent authorization, in conjunction with the one or more secure resources, after expiration of the user’s authorization to use the remote application as provided by Smith (see paragraph 37 and claim 2, tokens have different expiry times where second token used beyond expiry of first token). One of ordinary skill in the art would have recognized the benefit that providing tokens in such a way would assist in signing on to a second network without requiring re-authentication over that network (see Smith, paragraph 27).
Regarding claim 2, the combination of Cha, Novack, and Smith discloses a remote host for hosting the remote application and comparing the authentication information to the database of authentication data (Cha, paragraph 25, Relying Party).
Regarding claim 3, the combination of Cha, Novack, and Smith discloses an authorization server for comparing the authentication information to the database of authentication data, wherein the authorization server does not host the remote application (Cha, paragraph 30, OPSF reachable for the RP via internet).
Regarding claim 4, the combination of Cha, Novack, and Smith discloses wherein the token programmer is configured to program at least one of a smart card, RFID tag, or soft token (Cha, paragraph 61, smart card).
Regarding claim 5, the combination of Cha, Novack, and Smith discloses wherein the authorization information specifies physical access restrictions for the user (Cha, paragraph 61, physical access).
Regarding claim 6, the combination of Cha, Novack, and Smith discloses wherein the authorization information specifies electronic access restrictions for the user (Cha, paragraph 25, RP is application service provider of network).
Regarding claim 7, the combination of Cha, Novack, and Smith discloses an authorization server for managing the database of authorization information and returning user information therefrom in response to a request from the client (Cha, paragraph 31, aggregation OP).
Regarding claim 8, the combination of Cha, Novack, and Smith discloses wherein the token is providable by the user to access the one or more secure resources other than the remote application without use of the client device (Novack, paragraph 46, user logs into referring organization).
Regarding claim 9, the combination of Cha, Novack, and Smith discloses wherein the token-generation module is configured to cause the token generator to program the token for the user only after the user presents an unprogrammed or previously programmed token to the token generator (Novack, paragraph 42, hard token FOB device).
Regarding claim 10, the combination of Cha, Novack, and Smith discloses wherein the token-generation module is configured to cause the token generator to program the token for the user only after the user launches an application on a mobile device to wirelessly connect to the token generator for receipt of the token therefrom (Novack, paragraph 42, software loaded on mobile device).
Regarding claim 11, the combination of Cha, Novack, and Smith discloses wherein the mobile device is different from the client device (Novack, paragraph 42, software loaded on mobile device).
Regarding claim 12, the combination of Cha, Novack, and Smith discloses wherein the token-generation module is configured to cause the token generator to store the token on a mobile device of the user (Novack, paragraph 42, software loaded on mobile device).
Regarding claim 13, the combination of Cha, Novack, and Smith discloses wherein the mobile device is different from the client device (Novack, paragraph 42, software loaded on mobile device).
Regarding claim 14, the combination of Cha, Novack, and Smith discloses wherein the token is providable by the user to access the one or more secure resources other than the remote application only in conjunction with additional authentication information provided by the user (Novack, paragraph 48, more than one authenticator required).
Regarding claim 15, the combination of Cha, Novack, and Smith discloses wherein the additional authentication information comprises a password or biometric information (Novack, paragraph 40, password or biometrics).
Regarding claim 16, the combination of Cha, Novack, and Smith discloses wherein the token is a dedicated physical device configured to be carried by the user (Novack, paragraph 42, hard token FOB device).
Regarding claim 17, the combination of Cha, Novack, and Smith discloses a policy handler configured to, automatically, after the user is authorized to use the remote application and before any attempt to access and before any access by the user of any secure resources other than the remote application, determine the one or more secure resources for which the token programmer is caused to program the token (Cha, paragraph 119, store associations for Relying Parties).
Regarding claim 18, the combination of Cha, Novack, and Smith discloses wherein the policy handler is configured to implement (i) a rule base specifying the secure resources and privilege levels and permissions associated therewith, and (ii) a database associating the privilege levels associated with a plurality of users, the policy handler being configured to determine the one or more secure resources for which the token programmer is caused to program the token based at least on the rule base and the database (Cha, paragraphs 158-161, access to services governed by permission policies for UE).
Regarding claim 19, the combination of Cha, Novack, and Smith discloses wherein the token is not usable to access the remote application (Novack, paragraph 61, authenticators are specific to referring organizations).
Regarding claim 20, Cha discloses a method for authenticating a user of a client device executing a remote application, and, in conjunction therewith, enabling access for the user to secure resources, the method comprising: electronically receiving, from the remote application, with an authentication-request handler local to the client device, an HTTP or HTTPS request to authenticate the user, the remote application being an application other than a token programmer (paragraph 111, user browses to target OPSF page, and paragraph 145, HTTP(S)); prompting the user for authentication information (paragraph 111, page displayed in browsing agent); with the handler, communicating with a hardware device in electronic communication with the client device to obtain the authentication information (paragraph 111, user submits login information); verifying, using a computer processor and the authentication information, that the user is authorized to use the remote application (paragraph 114, target OPSF verifies assertion); and only after the user is authorized to use the remote application, and before any attempt to access by the user, or any access of by the user, one or more secure resources other than the remote application, (A) automatically receiving authorization information for the user related to one or more secure resources other than the remote application from a database of authorization information (paragraph 116, database finalization associates source OID with target OPSF), and (B) thereafter, automatically causing a token to be programmed for the user consistent with the authorization information without requiring additional authentication of the user and without receiving additional authentication information from the user, the token being (i) usable by the user to access the one or more secure resources other than the remote application, wherein the token is usable by the user to access the one or more secure resources other than the remote application in a subsequent authorization, in conjunction with the one or more secure resources (paragraph 116, user may authenticate to associated relying parties in target domain).
Cha does not explicitly state the token being (i) providable by the user to access the one or more secure resources other than the remote application, (ii) distinct from the authentication information obtained by the authorization-request handler, and (iii) not based on authentication information received from the user. However, provisioning separate access tokens back to the user for later use in authentication was well known in the art as evidenced by Novack. Since the inventions encompass the same field of endeavor, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Cha by adding the ability for the token being (i) providable by the user to access the one or more secure resources other than the remote application, (ii) distinct from the authentication information obtained by the authorization-request handler, and (iii) not based on authentication information received from the user as provided by Novack (see paragraph 60, provisions one or more authenticators, and paragraph 61, authenticators are specific to referring organizations). One of ordinary skill in the art would have recognized the benefit that utilizing authenticators in such a way would assist authenticating users by allowing them to enroll in a secure access system only once to obtain access to multiple resources (see Novack, paragraph 30).
The combination of Cha and Novack does not explicitly state the one or more secure resources being any secure resources other than the remote application. However, generating tokens in such a fashion was well known in the art as evidenced by Smith. Since the inventions encompass the same field of endeavor, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the combination of Cha and Novack by adding the ability for the operation of programming the token to be before any attempt to access by the user, or any access of by the user, any secure resources other than the remote application as provided by Smith (see paragraphs 37 and 38, generates tokens for access to different networks before device associates with those networks). One of ordinary skill in the art would have recognized the benefit that providing tokens in such a way would assist in signing on to a second network without requiring re-authentication over that network (see Smith, paragraph 27).
The combination of Cha and Novack does not explicitly state wherein the token is providable by the user to access the one or more secure resources other than the remote application in a subsequent authorization, in conjunction with the one or more secure resources, after expiration of the user’s authorization to use the remote application. However, utilizing tokens in such a fashion was well known in the art as evidenced by Smith. Since the inventions encompass the same field of endeavor, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the combination of Cha and Novack by adding the ability that the token is providable by the user to access the one or more secure resources other than the remote application in a subsequent authorization, in conjunction with the one or more secure resources, after expiration of the user’s authorization to use the remote application as provided by Smith (see paragraph 37 and claim 2, tokens have different expiry times where second token used beyond expiry of first token). One of ordinary skill in the art would have recognized the benefit that providing tokens in such a way would assist in signing on to a second network without requiring re-authentication over that network (see Smith, paragraph 27).
Regarding claim 21, the combination of Cha, Novack, and Smith discloses wherein the step of verifying is performed by the remote application (Cha, paragraph 25, Relying Party).
Regarding claim 22, the combination of Cha, Novack, and Smith discloses wherein the step of verifying is performed by an authorization server and further comprising electronically sending, to the remote application, an HTTP or HTTPS message confirming authentication of the user (Cha, paragraph 30, OPSF reachable for the RP via internet).
Regarding claim 23, the combination of Cha, Novack, and Smith discloses wherein the token is a smart card, RFID tag, or soft token (Cha, paragraph 61, smart card).
Regarding claim 24, the combination of Cha, Novack, and Smith discloses wherein the authorization information specifies physical access restrictions for the user (Cha, paragraph 61, physical access).
Regarding claim 25, the combination of Cha, Novack, and Smith discloses wherein the authorization information specifies electronic access restrictions for the user (Cha, paragraph 25, RP is application service provider of network).
Regarding claim 26, the combination of Cha, Novack, and Smith discloses without any attempt to access and without any access of any secure resources other than the remote application by the user, and before the authorization information is received and before the token is programmed, automatically determining, with a policy handler, the one or more secure resources for which the token programmer is automatically caused to program the token (Cha, paragraph 119, store associations for Relying Parties).
Regarding claim 27, the combination of Cha, Novack, and Smith discloses wherein the policy handler is configured to implement (i) a rule base specifying the secure resources and privilege levels and permissions associated therewith, and (ii) a database associating the privilege levels associated with a plurality of users, the policy handler being configured to determine the one or more secure resources for which the token programmer is caused to program the token based at least on the rule base and the database (Cha, paragraphs 158-161, access to services governed by permission policies for UE).
Regarding claim 28, the combination of Cha, Novack, and Smith discloses wherein the token is not usable to access the remote application (Novack, paragraph 61, authenticators are specific to referring organizations).
Claim 29 is rejected under 35 U.S.C. 103 as being unpatentable over Cha in view of Novack, in view of Smith, further in view of Ong et al. (U.S. Patent Application Publication Number 2016/0050280), hereinafter referred to as Ong.
The combination of Cha, Novack, and Smith disclosed techniques for accessing services via SSO by utilizing local OpenID. In an analogous art, Ong disclosed techniques for facilitating application-layer communication among computing devices. Both systems are directed to facilitating access to resources across a computer network.
Regarding claim 29, the combination of Cha, Novack, and Smith does not explicitly state wherein expiration of the user’s authorization to use the remote application is triggered by a user’s inactivity with respect to the remote application. However, managing network communication in such a fashion was well known in the art as evidenced by Ong. Since the inventions encompass the same field of endeavor, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the combination of Cha, Novack, and Smith by adding the ability that expiration of the user’s authorization to use the remote application is triggered by a user’s inactivity with respect to the remote application as provided by Ong (see paragraph 27, authorization expires after period of inactivity). One of ordinary skill in the art would have recognized the benefit that managing connections in such a way would assist in delineating sessions across the network communication (see Ong, paragraph 27).
Response to Arguments
In the remarks, the applicant has argued that the combination of Cha, Novack, and Smith does not disclose limitations of the independent claims, namely “a token-generation module, executable by the computer processor…only after the user is authorized to use the remote application, and before any attempt to access by the user, or any access of by the user, any secure resources other than the remote application” and the like. However, it is maintained that the combination of Cha, Novack, and Smith teaches these limitations. The rejection cites Cha, paragraph 116, which shows that the OID is enrolled and associated with the target OPSF and that this allows the user to authenticate to associated relying parties in the target domain. This is seen to meet the limitations at hand as the enrollment must occur before the user is enabled to access other relying parties. The OID is used to authenticate the user in the target domain and, as such, there can be no attempted access in the target domain before enrollment. It is noted that, as a general concept, any type of token generation and/or enrollment would require a previous authorization in order to generate and/or enroll the token. Likewise, access and/or attempted access to the resources governed by the token can only occur after the token exists and/or is enrolled. Such functionality is commonplace in the field of the present invention.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Victor Lesniewski whose telephone number is (571)272-2812. The examiner can normally be reached Monday thru Friday, 9am to 5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Carl Colin can be reached at 571-272-3862. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Victor Lesniewski/Primary Examiner, Art Unit 2493
Prosecution Insights