DETAILED ACTION
This communication is in response to applicant’s amendments filed on April 6, 2026. Claims 1-20 are pending.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendment / Arguments
Objection to specification has been withdrawn in light of applicant’s amendment.
Applicants’ arguments with respect to amended claims have been fully considered but are moot in view of the new ground(s) of rejection.
Drawings
The replacement drawings were received on 04/06/2026. These drawings are acceptable.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claim 20 is rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 20 recites “the instructions, when executed by the computer system, further cause the computer device to.” Independent claim 17, from which claim 20 depends, introduces “a computer system of a remote device.” The term “computer device” lacks antecedent basis in claim 17 and the relationship between “computer device” and “computer system” is unclear. For purposes of examination, the Examiner interprets “computer device” as “computer system.”
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1, 9 and 17 are rejected under 35 U.S.C. 103 as being unpatentable over US 20250030679 A1 to Reddy et al. (hereinafter “Reddy”) in view of US 20040003190 A1 to Childs et al. (hereinafter “Childs”) and further in view of US 20070100768 A1 to Boccon-Gibod et al. (hereinafter “Boccon-Gibod”).
As per claim 1, Reddy discloses a method for accessing a remote device through the use of a break glass account (Reddy, ¶0022, “Examples described herein may provide an approach to create a one-time temporary break glass account with the required privileged access to the data center resource”) comprising:
prior to being disconnected from a network, the remote device: accessing a break glass synchronization (sync) account stored by a directory server (Reddy, ¶0021, “the data center manager may notify credentials associated with the temporary break glass account to the user and enable an operation on the data center resource via the temporary break glass account using the credentials”). Examiner Note: Reddy teaches a break glass account managed by a management node that functions as a directory of credentials. Access to the break glass account occurs while the device maintains connection to a network.
reading break glass user credentials stored in association with the break glass sync account, the break glass user credentials including a secure password mechanism (Reddy, ¶0004, “access to these services and other network resources requires that a user provide some type of credential, often a password, to authenticate the user’s identity and obtain authorization for that access through a user account”; Reddy, ¶0021, credentials associated with the temporary break glass account are notified to the user).
storing the break glass user credentials defined for the remote device on the remote device (Reddy, claim 3, “storing the credentials associated with the temporary break glass in a storage device associated with a management component”; Reddy, claim 4, “the data center resource comprises an on-premises resource of an on-premises computing system or a cloud resource of a cloud computing system”).
Reddy teaches the above limitations including receiving login credentials by a user. However, Reddy does not explicitly teach authentication after being disconnected from a network.
In an analogous art in network system security, Childs teaches:
after being disconnected from the network, the remote device: receiving login credentials by a user attempting to log in to the remote device, including a user-entered secure password mechanism (Childs, Figure 3, Elements 100, 120, 150, 200, 160, 170, 180; Childs, ¶0024, “If, when a user authentication request fails in a system including a gateway machine, no connectivity is available to an operative LDAP server or an operative gateway, the local client is searched 160 and a matching locally-stored authenticated credential used 180, if applicable”).
comparing the login credentials to the break glass user credentials (Childs, ¶0024, “the local client is searched 160 and a matching locally-stored authenticated credential used 180” -- searching for a matching credential inherently includes comparing the login credentials to stored credentials).
allowing access to protected information stored by the remote device or functionality provided by the remote device based on a result of the comparison (Reddy, ¶0033, “data center manager 134 may create the temporary break glass account to access the data center resource for a specific duration”; Reddy, claim 10, “enable an operation on the data center resource via the temporary break glass account using the credentials”; Childs, ¶0024, matching locally-stored credential used to grant access).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the break glass access method of Reddy to incorporate local authentication using cached credentials when a directory server is unavailable due to network disconnection, as taught by Childs, in order to allow access to secure resources when a server is unavailable and prevent productivity losses (Childs, ¶¶0005-0006).
Reddy-Childs does not explicitly teach: subsequent to the remote device reconnecting to the network, the remote device repeatedly updating the break glass user credentials stored on the remote device, wherein repeatedly updating the break glass user credentials includes the remote device repeatedly logging into the directory server as a break glass synchronization user to update the break glass user credentials stored on the remote device.
In an analogous art in the field of access control and credential management for distributed systems, Boccon-Gibod teaches: subsequent to the remote device reconnecting to the network, the remote device repeatedly updating the break glass user credentials stored on the remote device (Boccon-Gibod, ¶0202, “The next time her DRM plugin refreshes her memberships, it will detect this new group, and download a Link Object that links her User Node to the Special Projects Team Node” -- the device periodically refreshes its locally stored credentials and memberships from a central directory server; Boccon-Gibod, ¶0195, “the client can be required to have an up-to-date time value or notion of time (based on whatever freshness value the company chooses to define (e.g., 1 week, 1 day, 1 hour, every 5 minutes, etc.)) in order to use DRM licenses” -- periodic, repeated credential refresh; Boccon-Gibod, ¶0861, “Effective use of expiration may require renewal mechanisms whereby the credential or object can be refreshed to enable continued access” -- repeated credential updating as a renewal mechanism; Boccon-Gibod, ¶0204, “when network connectivity is re-established the relevant content can be reported via services previously described” -- actions taken specifically upon reconnection to the network).
wherein repeatedly updating the break glass user credentials includes the remote device repeatedly logging into the directory server as a break glass synchronization user to update the break glass user credentials stored on the remote device (Boccon-Gibod, ¶0193, “a directory server (e.g., an Active Directory server) 1806” -- directory server; Boccon-Gibod, ¶0195, “the directory server 1806 may comprise an Active Directory server running web services… If membership changes in the group, then new tokens may be issued” -- directory server issues updated credentials; Boccon-Gibod, ¶0202, the DRM plugin on the device initiates the refresh by contacting the directory server - the device is the active agent logging into the directory server; Boccon-Gibod, ¶¶1000-1001, “Octopus Personality nodes, which are the root nodes of a given DRM engine (e.g., Device Node or PC Software Node)” - devices have dedicated identity nodes under which they interact with the directory server, analogous to logging in as a synchronization user; Boccon-Gibod, ¶0634, “the secure database is implemented in non-volatile memory, such as flash memory on a portable device” - updated credentials stored locally on the device). Examiner Note: Boccon-Gibod teaches that devices autonomously and periodically contact a directory server (Active Directory) to refresh their locally stored credentials, memberships, and access-related objects. The device initiates this contact using its device personality node identity, which functions analogously to the claimed “break glass synchronization user” -- it is a device-specific identity used to access credential information stored on the directory server. The periodic nature of the refresh (¶0195, freshness values from every 5 minutes to 1 week) corresponds to the “repeatedly” limitation. The device stores the refreshed credentials in non-volatile memory (¶0634), corresponding to updating the break glass user credentials stored on the remote device.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the break glass access method of Reddy–Childs to incorporate device-initiated periodic credential synchronization with the directory server as taught by Boccon-Gibod, in order to ensure the device maintains up-to-date access credentials and security metadata, thereby enabling continued secure operation after reconnection and timely synchronization of credential changes (Boccon-Gibod, ¶¶0195, 0202, 0861).
Claim 9 recites substantially the same limitations as claim 1 in the form of a remote device comprising a memory and a processing device. The remote device structure is taught by Boccon-Gibod (¶0060, system 200 includes processor 202 and memory 204 including non-volatile memory; ¶0061, memory includes DRM engine 232 and state database 224). Therefore, claim 9 is rejected under the same rationale as claim 1.
Claim 17 recites substantially the same limitations as claim 1 in the form of a non-transitory computer readable storage medium with embedded computer programs. The non-transitory computer readable storage medium is taught by Boccon-Gibod (¶0060, memory 204 includes non-volatile memory such as magnetic disk and/or flash EEPROM storing programs that control the operation of the device). Therefore, claim 17 is rejected under the same rationale as claim 1.
Claim(s) 2-6, 10-14, and 18-20 are rejected under 35 U.S.C. 103 as being unpatentable over Reddy in view of Childs and Boccon-Gibod as applied to claims 1, 9 and 17 above, and further in view of US 20210279325 A1 to Harris (hereinafter “Harris”).
As per claim 2, Reddy-Childs-Boccon-Gibod teaches the method of claim 1, including subsequent to reconnecting to the network, repeatedly updating the break glass user credentials (as established in the rejection of claim 1 -- Boccon-Gibod, ¶¶0195, 0202, 0861);
Reddy-Childs-Boccon-Gibod does not explicitly teach wherein the break glass user credentials were changed responsive to a determination that the remote device had been logged into using the break glass user credentials beyond a limit established by the break glass user credentials.
In an analogous art in the field of password management, Harris teaches wherein the break glass user credentials were changed responsive to a determination that the remote device had been logged into using the break glass user credentials beyond a limit established by the break glass user credentials (Harris, ¶0066, “The update of a device password may be carried out for example in response to a particular time occurring, a time interval passing, or an event taking place (for example, the number of times the active password has been used to gain access, an incorrect login attempt wherein a wrong password is used, etc.)”). Examiner Note: Harris teaches that credentials are changed in response to the number of times a password has been used to gain access, which corresponds to the claimed determination that the device had been logged into beyond a limit established by the credentials.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of Reddy-Childs-Boccon-Gibod to incorporate credential changes triggered by login count thresholds as taught by Harris, in order to keep the devices secure on the network by ensuring that credentials are updated when their permitted usage has been exhausted (Harris, ¶¶0006, 0066).
As per claim 3, Reddy-Childs-Boccon-Gibod-Harris teaches the method of claim 2. Reddy-Childs-Boccon-Gibod further teaches wherein updating the break glass user credentials stored on the remote device includes the remote device:
accessing the break glass user credentials stored in association with the break glass sync account (Boccon-Gibod, ¶0202, “The next time her DRM plugin refreshes her memberships, it will detect this new group, and download a Link Object” -- the device accesses the updated credential and membership objects associated with the account on the directory server; Boccon-Gibod, ¶0195, security metadata evaluated to determine current memberships); and
replacing previously stored break glass user credentials with the accessed break glass user credentials (Boccon-Gibod, ¶0202, the device downloads and stores the new Link Object, replacing prior membership and credential state; Boccon-Gibod, ¶0634, updated state stored in secure database in nonvolatile memory; Harris, ¶0067, “If a reserve password successfully gains access to the password protected device, the PMS 200 may update its active password to be this reserve password, and update the password database to remove this password from among the reserve passwords” -- replacement of previously stored credentials with newly accessed credentials).
The reasons of obviousness have been stated in the rejection of claim 2 above and are applicable herein.
As per claim 4, Reddy-Childs-Boccon-Gibod-Harris teaches the method of claim 3, wherein the determination that the remote device had been logged onto using the break glass user credentials beyond the limit established by the break glass user credentials is determined locally at the remote device: Boccon-Gibod teaches that a device locally determines whether access constraints have been exceeded using a local secure state database (Boccon-Gibod, ¶0085, “the DRM engine includes, or has access to, a secure, persistent object store that can be used to provide a secure state storage mechanism… Such a state database can be used to store state objects such as play-counts, date of first use, accumulated rendering times”; Boccon-Gibod, ¶0095, “State-based conditions: Checking information in the state database… thereby enabling evaluation of conditions involving counters (e.g., number of plays, number of exports, elapsed time limits, etc.)”; Boccon-Gibod, ¶0531, COUNTER_CONSTRAINT defined as a locally evaluated constraint parameter type). Examiner Note: Boccon-Gibod teaches that the device itself locally tracks access counts in its persistent state database and evaluates counter-based constraints to determine whether a usage limit has been exceeded, corresponding to the determination being performed “locally at the remote device.” Harris further supports local determination (Harris, ¶0066, “the number of times the active password has been used to gain access” -- tracking login count at the device level).
Reddy-Childs-Boccon-Gibod-Harris does not explicitly teach that the remote device is an industrial asset used in an industrial automation system. However, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to apply the break glass access method of Reddy-Childs-Boccon-Gibod-Harris to an industrial asset used in an industrial automation system because: (1) Industrial automation systems, such as SCADA systems communicating with remote terminal units (RTUs), programmable logic controllers (PLCs), and multivariable transmitters (MVTs), are well-known to face the same access control challenges addressed by the prior art combination --specifically, the need to provide emergency access to remote devices when they are disconnected from a host network and unable to authenticate users through a central directory server; (2) The need for emergency “break glass” access is particularly acute in industrial automation, where field technicians must access disconnected devices to diagnose problems and prevent operational disruptions; and (3) The application of known access control and credential management techniques (break glass accounts, local credential caching, periodic credential synchronization) to a known type of remote device (industrial automation asset) yields predictable results. See KSR Int’l Co. v. Teleflex Inc., 550 U.S. 398, 416 (2007).
As per claim 5, Reddy-Childs-Boccon-Gibod teaches the method of claim 1, wherein the remote device is included in a plurality of remote devices (Reddy, ¶0030, “computing environment 100 may include multiple user devices (e.g., a user device 122) for accessing different data center resources”; Reddy, ¶0038, “a typical computing environment would include many more remote servers… which may be distributed over multiple data centers”; Boccon-Gibod, ¶0067, multiple devices 300a, 300b, 300c, 300d each including a similar DRM engine); and wherein the method further comprises individual remote devices of the plurality of remote devices, when connected to the network, repeatedly:
logging into directory services hosted by the directory server as the break glass synchronization user (Boccon-Gibod, ¶0195, directory server is Active Directory server running web services; ¶0202, each device’s DRM plugin individually refreshes memberships by contacting the directory server; ¶¶1000–1001, each device uses its personality node to interact with the directory server);
accessing the break glass user credentials stored in association with the break glass sync account (Boccon-Gibod, ¶0202, each device downloads Link Objects and updated credentials from the directory server upon refresh); and
replacing previously stored break glass user credentials with the accessed break glass user credentials (Boccon-Gibod, ¶0202, each device stores the new credentials, replacing prior state; ¶0634, secure database in nonvolatile memory updated). Examiner Note: Boccon-Gibod teaches that multiple devices in a distributed system each independently and periodically contact the same directory server to refresh their locally stored credentials and memberships. Each device, when connected to the network, repeatedly performs this synchronization cycle using its device personality node identity, corresponding to the claimed plurality of remote devices individually and repeatedly logging in, accessing credentials, and replacing previously stored credentials.
Reddy-Childs-Boccon-Gibod does not explicitly teach that the credential update occurs as a result of the break glass user credentials having been changed responsive to a login exceeding a limit. However, Harris teaches credential changes responsive to usage events (Harris, ¶0066). It would have been obvious to one of ordinary skill in the art before the effective filing date to incorporate this feature for the reasons stated in the rejection of claim 2 above.
As per claim 6, Reddy-Childs-Boccon-Gibod-Harris teaches the method of claim 5, wherein the repeated logging into the directory services is periodic with a predetermined wait period between sequential login attempts into the directory services (Boccon-Gibod, ¶0195, “the client can be required to have an up-to-date time value or notion of time (based on whatever freshness value the company chooses to define (e.g., 1 week, 1 day, 1 hour, every 5 minutes, etc.)) in order to use DRM licenses” -- periodic synchronization with predetermined wait periods between sequential contacts with the directory server).
wherein the predetermined wait period is dynamically determined based on network bandwidth such that a duration of the predetermined wait period is lengthened or shortened when a bandwidth of the network becomes lower or higher, respectively:
Reddy-Childs-Boccon-Gibod-Harris does not explicitly teach that the wait period is dynamically determined based on network bandwidth. Boccon-Gibod teaches configurable freshness periods (¶0195) and that the freshness value can be “chosen” by the company, suggesting the period is configurable. It is well-known in the networking art that polling intervals for communication with remote servers are adjusted based on available network bandwidth to avoid congestion and optimize resource usage. It would have been obvious to one of ordinary skill in the art before the effective filing date to dynamically adjust the predetermined wait period based on network bandwidth, such that the wait period is lengthened when bandwidth decreases and shortened when bandwidth increases, as a matter of routine optimization of network resource usage in a system that periodically synchronizes credentials over a bandwidth-constrained network. See In re Aller, 220 F.2d 454, 456 (CCPA 1955) (where the general conditions of a claim are disclosed in the prior art, discovering the optimum or workable ranges involves only routine skill in the art).
wherein the break glass user credentials stored in association with the break glass sync account are changed responsive to a determination that one of the individual remote devices has been logged into using the break glass user credentials beyond a limit established by the break glass user credentials (Harris, ¶0066, “The update of a device password may be carried out for example in response to a particular time occurring, a time interval passing, or an event taking place (for example, the number of times the active password has been used to gain access, an incorrect login attempt wherein a wrong password is used, etc.)”). The reasons of obviousness for incorporating Harris have been stated in the rejection of claim 2 above, and are applicable herein.
Claim 10 recites substantially the same limitations as claim 2, in which the credentials were changed responsive to a determination that the device had been logged into beyond a limit, in the form of a remote device. Therefore, claim 10 is rejected under the same rationale as claim 2.
Claim 11 recites substantially the same limitations as claim 3, in which the break glass user credentials stored in association with the break glass sync account are accessed and previously stored credentials are replaced, in the form of a remote device. Therefore, claim 11 is rejected under the same rationale as claim 3.
Claim 12 recites the limitations of claim 11 and further recites: wherein the determination that the remote device had been logged onto using the break glass user credentials beyond the limit established by the break glass user credentials is determined locally by a break glass user (BGU) module associated with the remote device: Boccon-Gibod teaches a module (DRM engine) associated with the device that locally determines whether access constraints have been met (Boccon-Gibod, ¶0061, “DRM engine 232 for implementing some or all of the rights management functionality”; ¶0085, DRM engine includes or has access to secure persistent object store for tracking state objects including counts; ¶0095, state-based conditions including counters evaluated by the DRM engine). The DRM engine of Boccon-Gibod functions analogously to the claimed BGU module in that it is a module associated with the device that locally evaluates access constraints including login count limits.
wherein at least a portion of the BGU module is located remote from the remote device in at least one of a cloud-based system, software at an edge of the network, a gateway, or a head-end system: Boccon-Gibod teaches that portions of the access control functionality may be distributed remotely from the device (Boccon-Gibod, ¶0058, “a user’s system, such as system 108c, may communicate with a remote system, such as system 108b, (e.g., a server, another device in the user’s network of devices, such as a personal computer or television set-top box, and/or the like) that uses a digital rights management engine to make a determination 120 as to whether to grant the user access to content”; Boccon-Gibod, ¶0085, “a DRM engine executing on a first system may not have access to a local state database, and may be operable to access a remote state database, e.g., using web and/or host services. In some situations, it may be necessary for a DRM engine executing on a first system to access state information stored in a database on a remote system”). Examiner Note: Boccon-Gibod teaches that the DRM engine (analogous to the BGU module) can be split between a local device and a remote system such as a server, where the remote system provides state information or access determinations. The remote system (e.g., server, another device in the network) corresponds to at least one of a cloud-based system, software at an edge of the network, a gateway, or a head-end system.
and wherein the portion of the BGU module is not in communication with the directory server: Boccon-Gibod teaches that the remote system providing state information to the device operates independently of the directory server in certain configurations (Boccon-Gibod, ¶0085, the DRM engine on the remote system accesses its own state database rather than the directory server; Boccon-Gibod, ¶0058, the remote system makes its access determination independently based on its local DRM engine). Examiner Note: In Boccon-Gibod’s architecture, when a first system accesses state information from a remote system’s state database, the remote system’s state database operates independently of the directory server -- the remote system stores and evaluates its own state data without communicating with the directory server for that purpose.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to configure the break glass access system of Reddy-Childs-Boccon-Gibod-Harris such that a portion of the BGU module resides on a remote system (cloud, edge, gateway, or head-end) that operates independently of the directory server, as taught by the distributed DRM engine architecture of Boccon-Gibod, in order to provide access control decision-making capability in environments where not all system components have direct connectivity to the directory server (Boccon-Gibod, ¶¶0058, 0085).
Claim 13 recites substantially the same limitations as claim 5, in which the remote device is included in a plurality of similarly configured remote devices that each repeatedly log into the directory server, access credentials, and replace stored credentials, in the form of a remote device. Therefore, claim 13 is rejected under the same rationale as claim 5.
As per claim 14, Reddy-Childs-Boccon-Gibod-Harris disclosed the remote device of claim 13, wherein the repeated logging into the directory server is periodic such that all of the similarly configured remote devices are periodically synchronized with the directory server within a same synchronization period: Boccon-Gibod teaches periodic synchronization of multiple devices with the directory server using configurable freshness periods (Boccon-Gibod, ¶0195, freshness values from every 5 minutes to every week; ¶0202, each device’s DRM plugin refreshes memberships by contacting the directory server). Examiner Note: When all similarly configured remote devices are configured with the same freshness period, all devices will synchronize within that same period, corresponding to synchronization “within a same synchronization period.”
wherein sequential synchronization periods are temporally separated from one another through a predetermined waiting period between the sequential synchronization periods: Boccon-Gibod teaches that the freshness value defines the interval between successive synchronization events (Boccon-Gibod, ¶0195, “whatever freshness value the company chooses to define (e.g., 1 week, 1 day, 1 hour, every 5 minutes, etc.)”). The freshness value inherently defines a waiting period between sequential synchronization periods -- for example, if the freshness value is 24 hours, then each 24-hour synchronization period is temporally separated from the next by a 24-hour waiting period before the cycle repeats.
and wherein the break glass user credentials stored in association with the break glass sync account are changed responsive to a determination that one of the individual remote devices has been logged into using the break glass user credentials beyond a limit established by the break glass user credentials (Harris, ¶0066, “The update of a device password may be carried out for example in response to a particular time occurring, a time interval passing, or an event taking place (for example, the number of times the active password has been used to gain access, an incorrect login attempt wherein a wrong password is used, etc.)”).
The reasons of obviousness for incorporating Harris have been stated in the rejection of claim 2 above, and are applicable herein. Therefore, claim 14 is rejected under the same rationale as claim 6, adapted for the remote device form.
Claim 18 recites substantially the same limitations as claim 2, in which the credentials were changed responsive to a determination that the device had been logged into beyond a limit, in the form of a non-transitory computer readable storage medium. Therefore, claim 18 is rejected under the same rationale as claim 2.
Claim 19 recites substantially the same limitations as claim 3, in which the break glass user credentials are accessed and previously stored credentials are replaced, in the form of a non-transitory computer readable storage medium. Therefore, claim 19 is rejected under the same rationale as claim 3.
As per claim 20, Reddy-Childs-Boccon-Gibod teaches the non-transitory computer readable storage medium of claim 17, wherein the instructions, when executed by the computer system, further cause the computer system to:
enable the remote device to activate a local alarm setting in response to detecting that a security-related event has occurred after allowing access to the protected information stored by the remote device, wherein the remote device is configured to both detect occurrence of the security-related event and activate the local alarm setting when the remote device is disconnected from the network: Boccon-Gibod teaches that upon invocation of an emergency access exception, information is automatically recorded regarding the invocation and circumstances (Boccon-Gibod, ¶0242, “invocation of the emergency access exception will cause information to be automatically recorded regarding the invocation and/or other circumstances, and, in this example, will also cause a notification to be sent”). Boccon-Gibod further teaches local logging of access events in a protected state database (Boccon-Gibod, ¶0204, “activity of consequences can be logged in a local protected state database such as that described herein”). Boccon-Gibod further teaches that such logging occurs when the device is disconnected from the network, as the logged information is reported only when connectivity is re-established (Boccon-Gibod, ¶0204, “when network connectivity is re-established the relevant content can be reported via services previously described” -- implying that the logging occurred while the device was disconnected). Examiner Note: Boccon-Gibod’s automatic recording of emergency access events in a local state database, which persists until network connectivity is restored, corresponds to activating a local alarm setting in response to detecting a security-related event while disconnected.
enable, after the remote device reconnects to the network, the remote device to reset the local alarm setting and send an alarm signal to a supervisory system based on the local alarm setting being activated: Boccon-Gibod teaches that upon reconnection, logged events are reported to a remote entity (Boccon-Gibod, ¶0204, “when network connectivity is re-established the relevant content can be reported via services previously described” -- sending alarm/event information to a remote system upon reconnection). Boccon-Gibod further teaches that the notification is sent to an authorized entity for responsive action (Boccon-Gibod, ¶0242, “will also cause a notification to be sent (e.g., to the patient’s preferred healthcare provider - i.e., an entity explicitly authorized by the patient - and/or the patient himself)”). Examiner Note: The reporting of logged events upon reconnection corresponds to sending an alarm signal to a supervisory system. The implicit clearing of the local log after successful reporting corresponds to resetting the local alarm setting.
Boccon-Gibod further teaches remediation mechanisms that include resetting security state after reporting (Boccon-Gibod, ¶0836, table showing remediation and renewal mechanisms for various threats including “Stale Security Metadata” with “Security Metadata Assertion” as remediation and “Security Metadata update service. Software upgrade.” as renewal mechanism -- teaching a cycle of detection, reporting, remediation, and renewal of security state; Boccon-Gibod, ¶0851, “Agents can be crafted to destroy state in secure storage (e.g., the state database) to affect changes in domain membership or to remove keys that are no longer usable” — teaching selective modification/reset of state objects in the local database after security events have been processed).
wherein the alarm signal prompts the supervisory system to change the secure password mechanism of the break glass user credentials while remaining attributes of the break glass user credentials remain unchanged after the local alarm setting is activated and the secure password mechanism is changed: Boccon-Gibod teaches that the notification prompts responsive action by an authorized entity (Boccon-Gibod, ¶0242, notification sent to authorized entity upon emergency access — the notification is intended to trigger a remediation response). Boccon-Gibod further teaches selective modification of security objects -- specifically, that individual credential attributes can be changed without altering the entire credential set (Boccon-Gibod, ¶0851, “Agents can be crafted to destroy state in secure storage (e.g., the state database) to affect changes in domain membership or to remove keys that are no longer usable (e.g., due to changes in membership or policy)” -- teaching targeted modification of specific security attributes while leaving others intact; Boccon-Gibod, ¶0861, “Expiration is a remediation mechanism that relies upon some temporal event to invalidate a credential or object. Effective use of expiration may require renewal mechanisms whereby the credential or object can be refreshed to enable continued access” -- teaching selective credential renewal).
Boccon-Gibod does not explicitly teach that the alarm signal prompts a supervisory system to change specifically the password while other credential attributes remain unchanged.
In an analogous art in the field of password management, Harris teaches changing a password in response to security events while maintaining other aspects of the credential system (Harris, ¶0066, “In order to help keep a password protected device secure on a network, the password to access the device can be updated from time to time. The update of a device password may be carried out for example in response to a particular time occurring, a time interval passing, or an event taking place (for example, the number of times the active password has been used to gain access, an incorrect login attempt wherein a wrong password is used, etc.)”; Harris, ¶0067, “If a reserve password successfully gains access to the password protected device, the PMS 200 may update its active password to be this reserve password, and update the password database to remove this password from among the reserve passwords”). Examiner Note: Harris teaches updating specifically the password in response to a security event, while the password management system (PMS) and account structure remain intact -- the PMS updates only the active password, not the user identity, access configuration, or other credential attributes.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention that when an alarm signal is sent to a supervisory system in response to break glass access (as taught by Boccon-Gibod), the supervisory system would change specifically the password (secure password mechanism) while leaving other credential attributes unchanged, because: (1) The password is the credential element that was divulged during the emergency access event and is therefore the element requiring remediation; (2) Harris teaches that password changes are the standard remediation response to access events (Harris, ¶0066); (3) Changing only the compromised element (password) while preserving unchanged elements (username, login count, access level) minimizes operational disruption and avoids unnecessary reconfiguration of the credential system; and (4) Such selective modification is a predictable application of Boccon-Gibod’s teaching of targeted security state modification (¶0851) and Harris’s password-specific update mechanism (¶0066).
wherein the remaining attributes include at least a username of the break glass synchronization user, a login count defining a number of logins permitted into the remote device, and an access level defining a permitted type of access to the remote device:
Boccon-Gibod teaches credential attributes including username/identity (Boccon-Gibod, ¶¶1000-1001, device personality nodes with identity; ¶0070, node objects representing entities with associated attributes), counter-based access constraints equivalent to login count (Boccon-Gibod, ¶0095, “conditions involving counters (e.g., number of plays, number of exports, elapsed time limits, etc.)”; ¶0531, COUNTER_CONSTRAINT), and role-based access levels (Boccon-Gibod, ¶¶0899-0900, “entities that already possess authentication credentials are assigned role assertions that associate a named set of capabilities with the distinguished name of the entity”). Examiner Note: Boccon-Gibod teaches credentials that include (i) a username/entity identity (personality node identity, ¶¶1000-1001), (ii) a login/usage count (counter constraints, ¶¶0095, 0531), and (iii) an access level (role assertions with named capabilities, ¶¶0899-0900). These correspond to the claimed remaining attributes that are not changed when the password is changed.
and wherein the permitted type of access is selected from a group comprising unrestricted access, security access, read/write access, and read-only access: Boccon-Gibod teaches different types of access permissions (Boccon-Gibod, ¶0637, “some of the metadata fields can be changed by clients of the database (i.e., they are read-write (RW) accessible), while other metadata fields are read-only (RO)” -- teaching at least read/write and read-only access types; Boccon-Gibod, ¶¶0899-0900, role assertions define named capabilities -- different roles can correspond to different access types).
Brucker further teaches levels of access including different permission tiers (Brucker, ¶0023, “access to resources and/or authorization to perform tasks are to be restricted to certain user roles (e.g., clerks, managers) of users” -- different user roles have different access levels corresponding to different permitted types of access). Examiner Note: While the specific labels “unrestricted access, security access, read/write access, and read-only access” are not explicitly recited in the prior art, the concept of defining multiple discrete access levels ranging from full access to restricted access is well-known in the access control art. Boccon-Gibod’s read-write and read-only access levels, combined with Boccon-Gibod’s role-based capabilities and Brucker’s role-based access tiers, teach a system in which the permitted type of access is selected from a defined group of access levels. The specific labels used for the access levels do not impose a structural or functional limitation beyond defining different tiers of access permission, which is taught by the prior art.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of Reddy–Childs–Boccon-Gibod to incorporate local event logging of emergency access with deferred notification upon reconnection and selective password change as taught by Boccon-Gibod and Harris, in order to maintain an audit trail of emergency access events, enable timely remediation of potential security breaches upon reconnection, and minimize operational disruption by changing only the compromised credential element (Boccon-Gibod, ¶¶0204, 0242, 0836, 0851; Harris, ¶¶0006, 0066).
Claim(s) 7 and 15 are rejected under 35 U.S.C. 103 as being unpatentable over Reddy in view of Childs and Boccon-Gibod as applied to claims 1 and 9 above, and further in view of US 20200329025 A1 to Kahn et al. (hereinafter “Kahn”).
As per claim 7, Reddy-Childs-Boccon-Gibod teaches the method of claim 1; Reddy-Childs-Boccon-Gibod does not explicitly teach wherein the secure password mechanism is or includes a salted hash password having a format including an encryption identifier defining a type of encryption algorithm associated with the salted hash password.
In an analogous art in the field of authentication security, Kahn teaches wherein the secure password mechanism is or includes a salted hash password (Kahn, ¶0034, “IDP device 106 compares the new salted hashed password to the stored salted hashed password in attempt table 110 to determine whether the newly received password is the same as the previously received password”; Kahn, ¶0036, “IDP device 106 applies the hash function and corresponding salt value for each stored password to each newly received password for a given user account to determine whether the newly received password is the same as any of the stored passwords for the user account”).
Regarding the format including an encryption identifier defining a type of encryption algorithm: Kahn teaches that different hash functions and corresponding salt values are applied (Kahn, ¶0036, “applies the hash function and corresponding salt value for each stored password”), implying that different encryption algorithms may be used and that the system must identify which algorithm is associated with a given stored password. The well-known modular crypt format is a standard, conventional method for storing salted hash passwords that includes an encryption identifier within the password format. It would have been obvious to one of ordinary skill in the art to implement Kahn’s salted hash passwords using the modular crypt format, which inherently includes an encryption identifier defining the type of encryption algorithm, because this format is the standard and conventional approach for storing salted hash passwords in systems that support multiple hashing algorithms, and using this format enables interoperability and proper verification across such systems.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of Reddy-Childs-Boccon-Gibod by incorporating salted hash passwords with encryption identifiers as taught by Kahn, in order to securely verify user credentials while supporting multiple encryption algorithms (Kahn, ¶¶0026, 0036).
As per claim 15, Reddy-Childs-Boccon-Gibod-Kahn disclosed the remote device of claim 9, wherein the secure password mechanism is or includes a salted hash password (Kahn, ¶0034, “IDP device 106 compares the new salted hashed password to the stored salted hashed password in attempt table 110 to determine whether the newly received password is the same as the previously received password”; Kahn, ¶0036, “IDP device 106 applies the hash function and corresponding salt value for each stored password to each newly received password for a given user account to determine whether the newly received password is the same as any of the stored passwords for the user account”, the reasons of obviousness have been noted in the rejection of claim 7 above and applicable herein);
and wherein the remote device comprises at least one of a remote terminal unit (RTU), a programmable logic controller (PLC), or a multivariable transmitter (MVT): Reddy-Childs-Boccon-Gibod-Kahn does not explicitly teach that the remote device is an RTU, PLC, or MVT. However, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to implement the break glass access method on an RTU, PLC, or MVT because: (1) RTUs, PLCs, and MVTs are well-known types of remote devices used in industrial automation systems that communicate with centralized supervisory systems (e.g., SCADA systems) via communication networks; (2) Such devices are known to face the same access control challenges addressed by the prior art combination -- namely, the need for emergency access when disconnected from a host network; and (3) Applying known access control and credential management techniques to known types of remote computing devices yields predictable results. See KSR Int’l Co. v. Teleflex Inc., 550 U.S. 398, 416 (2007).
Claim(s) 8 and 16 are rejected under 35 U.S.C. 103 as being unpatentable over Reddy in view of Childs and Boccon-Gibod as applied to claims 1 and 9 above, and further in view of US 20170171215 A1 to Brucker et al. (hereinafter “Brucker”) and US 20210279325 A1 to Harris (hereinafter “Harris”).
As per claim 8, Reddy-Childs-Boccon-Gibod teaches the method of claim 1. Reddy-Childs-Boccon-Gibod does not explicitly teach all elements of the pre-defined items recited in claim 8. Claim 8 recites wherein the break glass user credentials include pre-defined items stored as part of the break glass user credentials on the remote device, the pre-defined items including a level of access and a permissible break glass user (BGU) login count.
Regarding a level of access that defines which protected information stored by the remote device or selected functionality of the remote device will be accessible to a BGU once the BGU is logged into the remote device: In an analogous art in the field of access control, Brucker teaches wherein the break glass user credentials include pre-defined items including a level of access, wherein the level of access defines which protected information or selected functionality will be accessible to a user (Brucker, ¶0023, “Example compliance and security requirements can include access control, separation of duty (SoD), binding of duty (BoD), and need to know. With regard to access control, access to resources and/or authorization to perform tasks are to be restricted to certain user roles (e.g., clerks, managers) of users”; Brucker, ¶0052, “The policy management system 206 includes a policy/security store 218 (database) that stores configurations that describe the current security policy (e.g., the access control policy, user-role-configuration, etc.) of respective processes”).
Boccon-Gibod further supports this teaching (Boccon-Gibod, ¶¶0899–0900, “entities that already possess authentication credentials are assigned role assertions that associate a named set of capabilities with the distinguished name of the entity… An entity may hold as many role attributes as are required by the application being built”; Boccon-Gibod, ¶0637, read-write (RW) and read-only (RO) access defined for state database objects).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of Reddy-Childs-Boccon-Gibod by incorporating access-level-based privileges as taught by Brucker, in order to prevent unintended policy violations by restricting emergency access to appropriate levels of functionality (Brucker, ¶0002).
Regarding a permissible BGU login count that is determined by the remote device and defines a total quantity of times when logins into the remote device are permitted during a predefined time frame:
In an analogous art in the field of password management, Harris teaches a permissible login count that defines when logins are permitted on the basis of count and time frame (Harris, ¶0066, “The update of a device password may be carried out for example in response to a particular time occurring, a time interval passing, or an event taking place (for example, the number of times the active password has been used to gain access, an incorrect login attempt wherein a wrong password is used, etc.)”). Examiner Note: Harris teaches tracking the number of times a password has been used to gain access and using that count as a basis for credential management, corresponding to a permissible login count. The “time interval passing” aspect teaches a time frame within which accesses are monitored.
Boccon-Gibod further supports this teaching (Boccon-Gibod, ¶0095, “conditions involving counters (e.g., number of plays, number of exports, elapsed time limits, etc.)”; Boccon-Gibod, ¶0531, COUNTER_CONSTRAINT and TEMPORAL_CONSTRAINT defined as locally evaluated constraint parameters; Boccon-Gibod, ¶0085, DRM engine includes persistent state database for storing play-counts — demonstrating that counter-based access limits are determined locally by the device). Examiner Note: Boccon-Gibod teaches that the device locally tracks access counts in its persistent state database (¶0085) and locally evaluates counter-based constraints (¶0095, ¶0531), corresponding to the login count being “determined by the remote device.” The combination of Boccon-Gibod’s locally tracked counter constraints with Harris’s count-and-time-based credential management teaches a total quantity of permitted logins during a predefined time frame.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to further modify the method of Reddy-Childs-Boccon-Gibod-Brucker by incorporating count-and-time-based login restrictions as taught by Harris, in order to keep the device secure on the network by limiting the use of emergency credentials (Harris, ¶0006).
As per claim 16, Reddy-Childs-Boccon-Gibod-Brucker-Harris disclosed the remote device of claim 9, wherein the break glass user credentials include pre-defined items including at least a level of access and a permissible break glass user (BGU) login count, wherein the level of access defines which protected information stored by the remote device or selected functionality of the remote device will be accessible to a BGU once the BGU is logged into the remote device (This limitation is taught by Brucker and Boccon-Gibod as set forth in the rejection of claim 8 above.);
and wherein the permissible BGU login count defines at least two of: a predefined time interval during which logins into the remote device are permitted; a number of logins permitted into the remote device per predefined time interval; a number of logins permitted into the remote device for all BGUs having access to the break glass sync account; and a number of logins permitted into the remote device per BGU: Harris teaches login count management based on both count and time (Harris, ¶0066, “the number of times the active password has been used to gain access” and “a time interval passing” -- teaching both a number of logins and a time interval, corresponding to at least two of the recited criteria).
Boccon-Gibod further teaches multiple concurrent constraint types that can be simultaneously evaluated (Boccon-Gibod, ¶0531, the LocalFlags field defines separate bits for COUNTER_CONSTRAINT, TEMPORAL_CONSTRAINT, GROUP_CONSTRAINT, and DEVICE_CONSTRAINT -- the system is explicitly designed to evaluate multiple constraint categories concurrently; Boccon-Gibod, ¶¶0090-0096, the virtual machine supports arbitrarily complex programs testing multiple conditions simultaneously including time-based conditions, state-based conditions involving counters, and group-based conditions). Examiner Note: Boccon-Gibod’s teaching that multiple constraint types are simultaneously evaluated (¶0531) provides a framework for defining at least two of the recited login count criteria. Specifically: TEMPORAL_CONSTRAINT (¶0531) combined with login count tracking corresponds to “a predefined time interval during which logins into the remote device are permitted” and “a number of logins permitted into the remote device per predefined time interval”; COUNTER_CONSTRAINT (¶0531) applied per user corresponds to “a number of logins permitted into the remote device per BGU”; GROUP_CONSTRAINT (¶0531) applied to all users having access corresponds to “a number of logins permitted into the remote device for all BGUs having access to the break glass sync account.”
The combination of Harris’s count-and-time-based credential management with Boccon-Gibod’s multi-constraint evaluation framework renders obvious the claimed login count defining at least two of the four recited criteria.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to configure the permissible login count to define at least two of the recited criteria, as the prior art teaches tracking multiple types of access constraints simultaneously (Boccon-Gibod, ¶0531) and managing credentials based on both count and time factors (Harris, ¶0066), and combining these known constraint types to define a comprehensive login policy yields predictable results.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Linglan Edwards whose telephone number is (571)270-5440. The examiner can normally be reached 8:30am - 5:00pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/LINGLAN EDWARDS/Supervisory Patent Examiner, Art Unit 2408
