DETAILED ACTION
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
This Office Action is in response to the communication filed on 7/23/2024.
Claims 1-20 are pending for consideration.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Specification
The lengthy specification has not been checked to the extent necessary to determine the presence of all possible minor errors. Applicant’s cooperation is requested in correcting any errors of which applicant may become aware in the specification.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 7/23/2024 is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 1-20 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-20 of U.S. Patent No. 12052247. Although the claims at issue are not identical, they are not patentably distinct from each other because both applications disclose a common subject matter, such as, access control in secure computing environments in general and more specifically to using a delegation based model for enabling access in highly secure environments (see claims Comparison Table below).
Instant Application 18781365
Patent Application 12052247
Claim 1:
A computer implemented method for authenticating users, the method comprising:
obtaining, based on a request for access to a system from a user, a personalized session host assigned to the user;
obtaining a temporary certificate having an expiry time;
providing access to the personalized session host based on the temporary certificate, the access allowing the user to connect to the system; and
terminating the access to at least one of the personalized session host or the system in response to expiration of the expiry time of the temporary certificate.
Claim 1:
A computer implemented method for authenticating users, the computer implemented method comprising:
receiving from a user, a request for access to one or more systems of a plurality of systems, the request comprising an access token generated responsive to performing authentication via an authentication device; obtaining a personalized virtual machine assigned to the user; exchanging, using a certificate generation service, the access token for a temporary certificate having an expiry time; providing the temporary certificate to the personalized virtual machine;
providing the user with access to the personalized virtual machine; allowing the user to connect to any of the plurality of systems without requiring the user to authenticate again using the authentication device, comprising, repeating a plurality of times before the temporary certificate is expired: receiving, by the personalized virtual machine, a request to connect to a system selected from the plurality of systems, and providing, by the personalized virtual machine, the user with access to the selected system; and
responsive to exceeding the expiry time of the temporary certificate, denying, by the personalized virtual machine, subsequent requests from the user to connect to any of the plurality of systems.
Claim 8:
A non-transitory computer readable storage medium having stored thereon instructions that, when executed by one or more computer processors, cause the one or more computer processors to performs steps, comprising: obtaining, based on a request for access to a system from a user, a personalized session host assigned to the user; obtaining a temporary certificate having an expiry time; providing access to the personalized session host based on the temporary certificate, the access allowing the user to connect to the system; and terminating the access to at least one of the personalized session host or the system in response to expiration of the expiry time of the temporary certificate.
Claim 9:
A non-transitory computer readable storage medium storing instructions that when executed by one or more computer processors cause the one or more computer processors to perform steps comprising: receiving from a user, a request for access to one or more systems of a plurality of systems, the request comprising an access token generated responsive to performing authentication via an authentication device; obtaining a personalized virtual machine assigned to the user; exchanging, using a certificate generation service, the access token for a temporary certificate having an expiry time; providing the temporary certificate to the personalized virtual machine; providing the user with access to the personalized virtual machine; allowing the user to connect to any of the plurality of systems without requiring the user to authenticate again using the authentication device, comprising, repeating a plurality of times before the temporary certificate is expired: receiving, by the personalized virtual machine, a request to connect to a system selected from the plurality of systems, and providing, by the personalized virtual machine, the user with access to the selected system; and responsive to exceeding the expiry time of the temporary certificate, denying, by the personalized virtual machine, subsequent requests from the user to connect to any of the plurality of systems.
Claim 15:
A computer system comprising:
a memory; and
one or more processors configured to:
obtain, based on a request for access to a system from a user, a personalized session host assigned to the user;
obtain a temporary certificate having an expiry time;
provide access to the personalized session host based on the temporary certificate, the access allowing the user to connect to the system; and
terminate the access to at least one of the personalized session host or the system in response to expiration of the expiry time of the temporary certificate.
Claim 15:
A computer system comprising: one or more computer processors; and non-transitory computer readable storage medium storing instructions that when executed by the one or more computer processors causes the one or more computer processors to perform steps comprising: receiving from a user, a request for access to one or more systems of a plurality of systems, the request comprising an access token generated responsive to performing authentication via an authentication device; obtaining a personalized virtual machine assigned to the user; exchanging, using a certificate generation service, the access token for a temporary certificate having an expiry time; providing the temporary certificate to the personalized virtual machine; providing the user with access to the personalized virtual machine; allowing the user to connect to any of the plurality of systems without requiring the user to authenticate again using the authentication device, comprising, repeating a plurality of times before the temporary certificate is expired: receiving, by the personalized virtual machine, a request to connect to a system selected from the plurality of systems, and providing, by the personalized virtual machine, the user with access to the selected system; and responsive to exceeding the expiry time of the temporary certificate, denying, by the personalized virtual machine, subsequent requests from the user to connect to any of the plurality of systems.
The dependent claims of the instant application recite language similar to the dependent claims of the Patent application and are covered by the Patent application.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claim(s) 1-3, 5-10, 12-17 and 19-20 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Innes et al. (US 20180007059) (hereinafter Innes).
Regarding claim 1, Innes discloses a computer implemented method for authenticating users (Innes: paragraphs 0081 and 0084, “The enterprise services 508 may include authentication services … Authentication services 558 may include user authentication services, device authentication services, application authentication services, data authentication services and the like”), the method comprising:
obtaining, based on a request for access to a system from a user, a personalized session host assigned to the user (Innes: see Abstract and paragraphs 0117, 0151 and 0179, “for granting or denying a client device access to one or more resources in a remote computing environment”…“Once it is verified that the client 1201 is authenticated, the gateway 1223, application store 1225, and/or delivery controller 1235 (e.g., a Desktop Delivery Controller) may authorize the credential mapper 1229 to obtain a time-limited (e.g., temporary) smart card class certificate for AD logon on a designated virtualization machine.”);
obtaining a temporary certificate having an expiry time (Innes: paragraphs 0117, 0151 and 0179-0180, “Time-limited certificates may be valid for minutes, hours, days, or even shorter or longer. To support the authorization step, the store 1225/controller 1235 may present the original SAML token from the IdP 1213, for its validity to be verified again by the credential mapping service 1229. For example, the credential mapper 1229 may communicate with the IdP 1213 to verify the SAML token”);
providing access to the personalized session host based on the temporary certificate, the access allowing the user to connect to the system (Innes: paragraphs 0180-0183 and 0288, “a proof key held by the client agent 1201 may be linked (e.g., bound) to the short-lived certificate. Optionally, the credential mapper 1229 may be presented with the original IdP authentication token as evidence of a valid logon by the client 1201. The logon ticket may additionally or alternatively be used to encrypt a secure reference to the virtual smart card provided by the credential mapper 1229”… “The smart card class certificates may be trusted by the directory service 1241 (e.g., an AD domain) as interactive logon credentials for the relevant user accounts. In other words, the certificates may be treated as virtual smart cards, e.g., a smart card class user certificate. The certificates may have appropriate key usage for AD logon”); and
terminating the access to at least one of the personalized session host or the system in response to expiration of the expiry time of the temporary certificate (Innes: paragraphs 0179, 0221-0222 and 0290, “Time-limited certificates may be valid for minutes, hours, days, or even shorter or longer.”… “The reconnect handlers may tear down, remove, or disable connections, sessions, or other artifacts that relate to the previous context and labels”).
Regarding claim 8, claim 8 discloses a medium claim that is substantially equivalent to the method of claim 1. Therefore, the arguments set forth above with respect to claim 1 are equally applicable to claim 8 and rejected for the same reasons.
Regarding claim 15, claim 15 discloses a system claim that is substantially equivalent to the method of claim 1. Therefore, the arguments set forth above with respect to claim 1 are equally applicable to claim 15 and rejected for the same reasons.
Regarding claims 2, 9 an 16, Innes discloses wherein the request for access includes an access token generated responsive to performing authentication via an authentication device (Innes: paragraphs 0115, 0162 and 0179, “when an application uses the certificate to build a secure session token, and when an application uses private keys for digital signing of important data”… “Once it is verified that the client 1201 is authenticated, the gateway 1223, application store 1225, and/or delivery controller 1235 (e.g., a Desktop Delivery Controller) may authorize the credential mapper 1229 to obtain a time-limited (e.g., temporary) smart card class certificate for AD logon on a designated virtualization machine. In other words, a temporary certificate may be created to emulate a smart card (e.g., one or more certificates in a smart card). Time-limited certificates may be valid for minutes, hours, days, or even shorter or longer. To support the authorization step, the store 1225/controller 1235 may present the original SAML token from the IdP 1213,”).
Regarding claims 3, 10 and 17, Innes discloses further comprising exchanging, using a certificate generation service, the access token for the temporary certificate (Innes: paragraphs 0177-0179, “The client agent 1201 may send the SAML token to the gateway server 1223 and/or the application store 1225 when a full domain logon is to be requested.”…“ Once it is verified that the client 1201 is authenticated, the gateway 1223, application store 1225, and/or delivery controller 1235 (e.g., a Desktop Delivery Controller) may authorize the credential mapper 1229 to obtain a time-limited (e.g., temporary) smart card class certificate for AD logon on a designated virtualization machine.”).
Regarding claims 5, and 12, Innes discloses further comprising:
unassigning the personalized virtual machine from the user in response to receiving a request to revoke access to the user (Innes: paragraphs 0194 and 0288-0290, “the credential mapper 1229 may determine which CA and certificate template combination to use to obtain a certificate for a particular session. Customers can use the Authentication Mechanism Assurance feature of AD and Enterprise Certificate Services (e.g., WINDOWS SERVER 2008) to cause user sessions based on these certificates to belong to particular security groups, such as WINDOWS security groups. This may allow the virtualization session 1237 to be granted or denied access to network resources using standard WINDOWS access control lists (ACLs).”).
Regarding claims 6, 13 and 19, Innes discloses wherein the personalized session host is a personalized virtual machine (Innes: paragraphs 0177-0179 and 0283, “ Once it is verified that the client 1201 is authenticated, the gateway 1223, application store 1225, and/or delivery controller 1235 (e.g., a Desktop Delivery Controller) may authorize the credential mapper 1229 to obtain a time-limited (e.g., temporary) smart card class certificate for AD logon on a designated virtualization machine.”).
Regarding claims 7, 14 and 20, Innes discloses further comprising:
obtaining a markup language token for the user in response to the request for access (Innes: paragraphs 0162-0163, “users may authenticate to a virtual desktop session, physical PC, or a remote desktop server session as an Active Directory user account by providing a SAML authorization token”); and
storing the markup language token in a browser cache of the personalized session host, wherein the providing of the access is further based on the stored markup language token (Innes: paragraphs 0170-0171, “The client agent 1201 may send credentials to the IdP 1213 for logon. Webview 1203 may also support standard security assertion markup language (SAML) protocol for SAML logon to the gateway server 1223 or application stores 1225. The gateway server 1223 may be a server or other resource that provides access to enterprise resources and/or cloud resources. During the logon process, the IdP 1213 may send an identity confirmation token (e.g., a SAML token) back to the client agent 1201. The SAML token may be used by the client agent 1201 as proof that it has authenticated with the identity system 1211, which may comprise an external partner of the resource system 1221.”).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 4, 11 and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Innes in view of Rossi (US 20210144015) (hereinafter Rossi).
Regarding claims 4, 11 and 18, Innes does not explicitly disclose the following limitation which is disclosed by Rossi, wherein the exchanging includes:
sending a public key received from the personalized session host to the certificate generation service (Rossi: paragraphs 0071, 0077 and 0090-0094, “For example, “authorized keys” files of target accounts can have been populated with the public keys of the corresponding “Principal Keypairs””… “When the user sends a request for access into a target host (this can be a legacy host or a cloud host), the request can include an indication that the CA shall sign the public key of the user device and return a certificate.”… “the agent sends a request to a CA for signing of a public key request.”);
receiving a signed certificate from the certificate generation service (Rossi: paragraphs 0091 and 0094-0095, “At this stage the CA can return the signed certificate and principal keys to the agent. The agent can then forward the certificate and the principal keys to the client.”); and
providing the signed certificate to the personalized session host (Rossi: paragraphs 0091 and 0094-0095, “At this stage the CA can return the signed certificate and principal keys to the agent. The agent can then forward the certificate and the principal keys to the client.”).
Innes and Rossi are analogous art because they are from the same field of endeavor, access protection. Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art, having the teachings of Innes and Rossi before him or her, to modify the system of Innes to include sending a public key received from a personalized session host to a certificate generation service, receiving a signed certificate from the certificate generation service and providing the signed certificate to the personalized session host of Rossi. The suggestion/motivation for doing so would have been to enhance data security (Rossi: paragraph 0010).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to TRANG T DOAN whose telephone number is (571)272-0740. The examiner can normally be reached Monday-Friday 7-4 ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lynn D Feild can be reached on (571)272-2092. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/TRANG T DOAN/Primary Examiner, Art Unit 2431