DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 2/26/2026 has been entered.
Response to Arguments
Applicant's arguments filed 2/26/2026 have been fully considered but they are not persuasive.
Applicant argues that the combination of Caraccio and Dias do not teach “only a single network module that…processing system”. As can be seen in Dias, interface 1040 as described in, col. 3, lines 29-41 and col. 14, lines 32-43 serves as an ethernet enabled interface to communicate with other computer systems and also to communicate with secure erasure module 200. Hence, Dias teaches a module that both interacts with external systems and also internal systems with regards to erasure. Further, the management controller in the context of Dias is the storage interface 210, col. 6, lines 16 - 32.
With regards to claim 12, as previously stated, the network interface 1040 is capable of ethernet based communication, col. 14, lines 32-43
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1 – 20 are rejected under 35 U.S.C. 103 as being unpatentable over Caraccio, publication number: US 2022/0207193 in view of Dias, patent number: US 9 990 382.
As per claim 1, Caraccio teaches a method for managing operation of a data processing system, the method comprising:
obtaining, by a management controller of the data processing system and via an out-of-band communication channel, a removal instruction, (management unit 134 and out-of-band channels [0066], firmware update, [0084-0085]); and the management controller being a separate and independently operating computing device from the data processing system that is physically installed with a chassis of the data processing system (management unit 134 included in device 100, Fig. 1, management unit 134 including its own CPU, [0031],)
identifying, by the management controller, a portion of data indicated for removal by the removal instruction (update, [0085]);
selecting, by the management, a removal workflow based on the portion of the data (validating before updating, [0086-0087]);
performing, by the management controller and using at least a sideband channel between the management controller and hardware resources of the data processing system, the selected removal workflow to complete the removal instruction (using sideband [0060-0063], updating, [0089]); and
Caraccio does not teach the removal instruction being part of a deprovisioning process for the data processing system,
wherein the data processing system further comprises a single network module that is shared by both of the management controller and the hardware resources, and the single network module is adapted to separately advertise network endpoints for the management controller and the hardware resources such that first communications meant for the hardware resources never flow through the management controller and second communications meant for the management controller never flow through the hardware resources and
the single network module is a network interface device of the data processing system that comprises at least one of a wide area network card, a WiFi card, a wireless local area network card, a wired local area network card, an optical communication card, a radio access network (RAN) card, or a wide area network (WAN) card for establishing remote communications including the first communications and the second communications between the data processing system and other devices remote to the data processing system;
notifying, by the management controller and via the out-of-band communication channel, a requesting entity of completion of the removal instruction
In an analogous art, Dias teaches the removal instruction being part of a deprovisioning process for the data processing system (device end of life, col. 2, line 32-49),
wherein the data processing system further comprises a single network module that is shared by both of the management controller and the hardware resources, and the single network module is adapted to separately advertise network endpoints for the management controller and the hardware resources such that first communications meant for the hardware resources never flow through the management controller and second communications meant for the management controller never flow through the hardware resources (Network interface 1040 facilitating communication between the erasure module and external systems, col. 14, lines 32-43, col. 3, lines 29-41, erasure module being able to communicate through interface 210, Fig. 2, col. 5, lines 20-38, erasure module communicating directly with module 222 and device 220, col. 5, lines 39-60, user input, col. 8, line 45 – col. 9, line 6) and
the single network module is a network interface device of the data processing system that comprises at least one of a wide area network card, a WiFi card, a wireless local area network card, a wired local area network card, an optical communication card, a radio access network (RAN) card, or a wide area network (WAN) card for establishing remote communications including the first communications and the second communications between the data processing system and other devices remote to the data processing system (network module 1040 being suitable for ethernet network and communicating with other computer systems, col. 14, lines 32-43);
notifying, by the management controller and via the out-of-band communication channel, a requesting entity of completion of the removal instruction (notifying of erasure results, col. 8, line 45- col. 9, line 6).
Therefore, it would have been obvious to one of ordinary skill in the art, prior to the effective filing date of the claimed invention to modify Caraccio’s secure storage management system to include deprovisioning and a verification of implemented actions as discussed in Dias’ verifiable action system by including an action verification step as discussed in Dias for the advantage of reliably verifying actions, hence preserving system integrity.
As per claim 2, the combination teaches wherein in an instance of the identifying where the portion of the data is stored by a trusted platform module of the hardware resources:
performing the selected removal workflow comprises:
selectively powering, by the management controller, the trusted platform module;
forwarding, by the management controller and via the sideband channel, a request to initiate removal of the portion of the data from the trusted platform module (Carracio: using sideband [0060-0063], updating, [0089], Dias: controller module 222, col. 4, line 63- col. 5, line 19).
As per claim 3, the combination teaches wherein performing the selected removal workflow further comprises:
receiving, by the trusted platform module, a payload, signed using a private key of a public private key pair, indicating instruction to remove the portion of the data from the trusted platform module;
performing, by the trusted platform module and using a public key of the public private key pair, a verification process to determine whether the payload is trustworthy; and
based on performing the verification process, removing, by the trusted platform module, cryptographic data from the data processing system, the cryptographic data being based on the portion of the data; and
after the cryptographic data is removed, providing, by the trusted platform module to the management controller via the sideband channel, a notification indicating the removal of the portion of data is complete (Caraccio: verifying, Fig. 6, Dias: notifying of erasure results, col. 8, line 45- col. 9, line 6).
As per claim 4, the combination teaches wherein in an instance of the identifying where the portion of the data correspond to an application hosted by the hardware resources:
performing the selected removal workflow comprises:
selectively powering, by the management controller, a storage device of the hardware resources; and
storing, by the management controller and via the sideband channel, a data structure based on the request to initiate removal of the portion of the data from the storage device, the data structure being stored in a predetermined location known to a startup management entity that manages starts ups of the data processing system (Caraccio: not relying on system resources, [0066], startup, [0077]).
As per claim 5, the combination teaches wherein performing the selected removal workflow further comprises:
initiating, by the management controller, a startup of the data processing system; and identifying, by the startup management entity and during the startup, the data structure;
removing, by the data startup management entity and based on the identification of the data structure, an application from the data processing system;
after the application is removed, handing off, by the startup management entity, management of the data processing system to an operation management entity (Caraccio: updating at power on, Fig. 4, [0077], UART, [0066]).
As per claim 6, the combination teaches wherein the deprovisioning process is initiated by a remote cloud server, the deprovisioning process comprising managing entitlements for the data processing system that defined, at least in part, by an entitlement certificate obtained from an ownership voucher for the data processing system, the ownership voucher comprising the entitlement certificate and at least one delegation of authority over the data processing system (Dias: device end of life, col. 2, line 32-49).
As per claim 7, the combination teaches wherein the removal instruction indicates that at least a portion of the entitlement certificate has expired, the entitlement certificate comprising:
a payload indicating at least one entitlement for the data processing system; and a signature generated using a private key of a public private key pair maintained by an entity granting the at least one entitlement (Caraccio: verification and update, Fig. 5, [0080-0081], validating, [0079]).
As per claim 8, the combination teaches further comprising:
identifying, by a remote server, that a deprovisioning event for the data processing system has occurred;
based on identifying the deprovisioning event:
identifying, by the remote server, a deprovisioning policy for the data processing system;
applying, by the remote server, the deprovisioning policy to obtain the removal instruction; and
providing, by the remote server, the removal instruction to, at least in part, deprovision the data processing system (Dias: device end of life, col. 2, line 32-49).
As per claim 9, the combination teaches wherein, the network endpoints are used being usable by a server to address the first communications to the hardware resources using an in-band communication channel and he second communication to the management controller using the out-of-band communication channel (Dias: erasure module being able to communicate through interface 210, Fig. 2, col. 5, lines 20-38, erasure module communicating directly with module 222 and device 220, col. 5, lines 39-60,).
As per claim 10, the combination teaches wherein the management controller and the single network module are on separate power domains from the hardware resources so that the management controller and the single network module are operable while the hardware resources are inoperable (Caraccio: not relying on system resources, [0066]).
As per claim 11, the combination teaches wherein the out-of-band communication channel runs through the single network module, and an in-band communication channel that services the hardware resources also runs through the single network module (Dias: erasure module being able to communicate through interface 210, Fig. 2, col. 5, lines 20-38, erasure module communicating directly with module 222 and device 220, col. 5, lines 39-60).
As per claim 12, the combination teaches wherein the network module hosts a transmission control protocol/internet protocol (TCP/IP) stack to facilitate network communications via the out-of- band communication channel (Dias: network module 1040 being suitable for ethernet, col. 14, lines 32-43).
Claims 13 – 16 and 17-20 are rejected based on claims 1-4.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to OLUGBENGA O IDOWU whose telephone number is (571)270-1450. The examiner can normally be reached Monday-Friday 8am - 5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jung Kim can be reached at 5712723804. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/OLUGBENGA O IDOWU/Primary Examiner, Art Unit 2494