Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
Applicant’s amendment filed on 05/06/2026 has been entered. Applicant has amended claims 6, 9-14 and 16-20. Currently claims 1-20 are pending in this application.
Response to Arguments
Applicant's arguments with respect to claims 1, 9 and 16 have been considered but they are not persuasive.
Applicant argued:
PNG
media_image1.png
240
589
media_image1.png
Greyscale
PNG
media_image2.png
226
589
media_image2.png
Greyscale
In reply, examiner would like to point out that examiner is interpreting CMK as a local secret, See, Page 5 of office action mailed on 02/19/2026). As pointed out in Paragraph 0004, CMK from the requesting computer is transmitted over the computer communication network to a key management service separate from the encryption process, as part of request for a key encryption key. Applicant simply concluded with a statement that “nowhere in Mistry is there any disclosure relating to any local secret” but did not provide any argument why CMK could not be interpreted as a claimed local secret. CMK is local to the computer that is requesting KEK. Mistry clearly discloses generating decryption key (KEK) based on a response (encrypted KEK) from the remote key management service that includes an encryption key (encrypted KEK), wherein the encryption key (encrypted EKE) is transformed using a cryptographic technique based on the local secret (encrypted KEK is decrypted using CMK into KEK, See, Paragraph 0018, “The encryption process 100 then stores the CMK encrypted KEK 170 in the database 180…the KEK 160 may be recovered with the database 180 providing the CMK encrypted KEK 170 and the CMK 120 so as to decrypt the CMK encrypted KEK 170 into the KEK 160”). As a result, the arguments are not persuasive and the rejection is maintained.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claim(s) 1-5, 9-13 and 16-20 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Mistry (US 2020/0195425 A1), hereinafter, “Mistry”.
Regarding Claims 1, 9 and 16, Mistry discloses an apparatus, corresponding method and computer program product wherein the apparatus comprises:
a memory (See, Paragraph 0029);
a processing device operatively coupled to the memory (See, Paragraph 0029), configured to:
transmit, by a storage system, a local secret to a remote key management service (See, Paragraph 0004, “the encryption process transmits the CMK over the computer communications network to a key management service (KMS) separate from the encryption process, as part of a request for a key encryption key (KEK)”, Note: Examiner is interpreting CMK as a local secret);
generate, by the storage system, a decryption key based on a response from the remote key management service that includes an encryption key, wherein the encryption key is transformed using a cryptographic technique based on the local secret into the decryption key (See, Paragraph 0018, “The encryption process 100 then stores the CMK encrypted KEK 170 in the database 180…the KEK 160 may be recovered with the database 180 providing the CMK encrypted KEK 170 and the CMK 120 so as to decrypt the CMK encrypted KEK 170 into the KEK 160”); and
decrypt, by the storage system, based on the decryption key, a local data encryption key for encrypting or decrypting local data (See, Paragraph 0019, “The KEK 160 accessible by the encryption process 100 then decrypts the KEK encrypted DK 165 so as to produce the DK 150 which then may be used to decrypt the DK encrypted data 155. Finally, the decrypted data may be provided to the requestor”).
Regarding Claims 2, 10 and 17, the rejection of claims 1, 9 and 16 is incorporated and Mistry further discloses after transmitting the local secret to the remote key management service, receive, from the remote key management service, an encryption key based on the local secret (See, Paragraphs 0004 and 0018).
Regarding Claims 3, 11 and 18, the rejection of claims 2, 10 and 17 is incorporated and Mistry further discloses wherein encrypting the local data further comprises: transforming the encryption key from the remote key management service into a key-encrypting key (See, Paragraphs 0018 and 0019).
Regarding Claims 4, 12 and 19, the rejection of claims 3, 11 and 18 is incorporated and Mistry further discloses decrypting, based on the key-encrypting key derived from transforming the encryption key from the remote key management service, the local data encryption key used to encrypt and decrypt the local data (See, Paragraph 0019).
Regarding Claims 5, 13 and 20, the rejection of claims 4, 12 and 19 is incorporated and Mistry further discloses decrypting, based on the local data encryption key, the local data (See, Paragraph 0019).
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 6 and 14 is rejected under 35 U.S.C. 103 as being unpatentable over Mistry in view of Lee et al. (US 2014/0101444 A1), hereinafter, “Lee”.
Regarding Claims 6 and 14, the rejection of claims 1 and 9 is incorporated and Mistry does not explicitly disclose transforming the local secret to generate a transformed local secret using a cryptographic technique that includes a cryptographic hash function wherein: the cryptographic hash function includes using a one-way cryptographic hash.
However, transforming values using hashing functions prior to sending them to servers are well known in the art of computer security. Lee discloses transforming a local secret to generate a transformed local secret using a cryptographic technique that includes a cryptographic hash function wherein: the cryptographic hash function includes using a one-way cryptographic hash (See, Paragraphs 0027 and 0041 and 0042).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to transform, the local secret in the system of Mistry, to generate a transformed local secret using a cryptographic technique that includes a cryptographic hash function wherein: the cryptographic hash function includes using a one-way cryptographic hash as taught by Lee because if actual ID and authentication data (in this case CMK) instead of a value obtained by applying a certain hash function to the user ID are transmitted to the secret key issuing server in the second step, and the secret key is issued in response thereto, the malicious third party may intercept the request and response to find out an ID and secret key pair. However, by sending the value obtained by applying a certain hash function to the user ID in the second step, the malicious third party cannot find out the ID related to the secret key even through spying (See, Lee, Paragraph 0041). Applying a hash to the CMK would protect the CMK from interception by the malicious third party and the key server could simply use the hashed CMK for encrypting KEK rather than CMK in order to provide further protection.
Claims 7 and 15 are rejected under 35 U.S.C. 103 as being unpatentable over Mistry in view of Brizek et al. (US 2008/0082819 A1), hereinafter, “Brizek”.
Regarding Claims 7 and 15, the rejection of claims 1 and 10 is incorporated and Mistry does not explicitly disclose wherein the cryptographic technique includes use of a cryptographic hash function that is used by a hash-based message authentication code protocol.
However, hash-based message authentication code protocol is well known in the art of computer security. Brizek discloses cryptographic technique includes cryptographic hash function that is used by a hash-based message authentication code protocol (See, Paragraph 0021).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to use, in the system of Mistry, hash-based message authentication code protocol as taught by Brizek because “[A] a keyed-hash message authentication code is calculated using a cryptographic hash function in combination with a secret key. It may be used to verify data integrity and the authenticity of a message” (See, Brizek, Paragraph 0021).
Claim 8 is rejected under 35 U.S.C. 103 as being unpatentable over Mistry in view of Lanc et al. (US 2017/0005797 A1), hereinafter, “Lanc”.
Regarding Claim 8, the rejection of claim 1 is incorporated and the combination of Alwen and Varley does not explicitly disclose reconstructing the local secret based on multiple portions of the local secret distributed among a plurality of storage devices.
Lanc discloses reconstructing a local secret based on multiple portions of the local secret distributed among a plurality of storage devices (See, Paragraphs 0019, 0023 and 0024).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to use, in the system of Mistry, secret sharing scheme such that reconstructing the local secret is based on multiple portions of the local secret distributed among a plurality of storage devices as taught by Lanc because “[I]in this manner, loss of an independent storage means or loss of a particle within that independent storage means preferably results in loss of at most one share” (See, Lanc, Paragraph 0019).
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/ patents/apply/applying-online/eterminal-disclaimer.
Claims 1-20 rejected on the ground of nonstatutory double patenting as being unpatentable over claim 1-15 of U.S. Patent No. 12,063,296 B2. Although the claims at issue are not identical, they are not patentably distinct from each other because claims 1-15 of US Patent No. 12,063,296 B2 anticipates claims 1-20.
Claims 1-20 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-17 of U.S. Patent No. 11,431,488 B1 in view of Mistry.
Claims 1-20 requires following additional limitation: wherein the encryption key is transformed using a cryptographic technique based on the local secret into the decryption key.
Mistry discloses wherein the encryption key is transformed using a cryptographic technique based on the local secret into the decryption key (See, Paragraph 0018, “The encryption process 100 then stores the CMK encrypted KEK 170 in the database 180…the KEK 160 may be recovered with the database 180 providing the CMK encrypted KEK 170 and the CMK 120 so as to decrypt the CMK encrypted KEK 170 into the KEK 160”) (See, Paragraph 0018, “The encryption process 100 then stores the CMK encrypted KEK 170 in the database 180…the KEK 160 may be recovered with the database 180 providing the CMK encrypted KEK 170 and the CMK 120 so as to decrypt the CMK encrypted KEK 170 into the KEK 160”).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to transform an encryption key using a cryptographic technique based on a local secret into the decryption key as taught by Mistry in order to recover KEK which is used to decrypt and data key and finally encrypting and/or decrypting the data.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to YOGESH PALIWAL whose telephone number is (571)270-1807. The examiner can normally be reached M-F 9:00AM-5:00PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Amir Mehrmanesh can be reached at (571)270-3351. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/YOGESH PALIWAL/ Primary Examiner, Art Unit 2435
Prosecution Insights