Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
Applicant’s response filed 5/19/2026 was received and considered.
Claims 1-20 are pending.
Response to Arguments
Applicant's arguments filed 5/19/2026 have been fully considered but they are not persuasive.
Applicant’s remarks (pp. 7-8) argue that the references do not teach “receiving, via an endpoint associated with a tenant of the identity management system, a set of application programming interface (API) credentials that are usable to communicate with the respective plurality of applications via a respective plurality of APIs”. Applicant’s remarks argue that Sommer’s shared keys are SAML protocol-level cryptographic keys, rather than API credentials. The Examiner disagrees. Initially, it is noted that no formal, differentiating, definition for “API credentials” is provided in the specification or the claims. Although the claims are interpreted in light of the specification, limitations from the specification are not read into the claims. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993). In Cheng, the identity provider sends a plurality of logout requests to the service providers (Cheng, ¶41) and other IdPs (Cheng, ¶45) via an application interface (Cheng, ¶29; see also Fig. 1, 112), using SAML (Cheng, ¶58). Further, Sommer teaches that SAML uses keys shared between the identity providers and service providers (Sommer, p. 52, §B.1.9; see also p. 86, Lemma 20) to implement single logout (Sommer, p. 31, ¶¶3-4). In providing a logout request, the IdP provides a message ⟨LogoutRequest, id , issuer , session idx , subject⟩, where the requests are signed by keys k, to be authenticated by the message recipient (service provider, via the API over which the IdP communicates with the SP). Therefore, based on a reasonable interpretation of the claim scope, the Examiner respectfully submits that Cheng, in view of Sommer, teaches using SAML to communicate via API credentials (keys for authentication of messages), commensurate with the current scope of the claims.
Applicant’s remarks (pp. 8-9) argues that the credentials are not received “via an endpoint associated with a tenant of the identity management system”. It is noted that no formal, differentiating, definition for “tenant” or “endpoint” is provided in the specification or the claims. Although the claims are interpreted in light of the specification, limitations from the specification are not read into the claims. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993). The Examiner agrees that the keys are received as part of a provision for use in the SAML architecture. However, this interpretation reads on “via an endpoint associated with a tenant of the identity management system”, as the IdP is an endpoint associated with a tenant (participant) of the identity management system (Shibboleth), commensurate with the current claim scope.
Applicant’s remarks (pp. 9-10) suggest that the combination fails to teach “transmitting, via the respective plurality of APIs, a respective plurality of API calls to terminate the plurality of sessions between the user and the respective plurality of applications”, arguing that in Cheng, the multi-federation protocol manager does not communicate directly with service providers (applications). However, Cheng’s system utilizes an IdP to perform a logout with associated service providers (Cheng, ¶41) and teaches the multi-fed protocol manager to perform a logout with other IdPs (using an API/SPI). The multi-federation protocol manager extends this logout to multiple IdPs for performing a similar logout (Cheng, ¶43). Therefore, the IdP communicates a logout message to the connected service providers with whom sessions have been established (Cheng, ¶41) and communicates logout messages, again using SAML, to additional IdPs using SPI (Cheng, ¶¶57-59).
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 3-9, 11-17 and 19-20 are rejected under 35 U.S.C. 103 as being unpatentable over US 2010/0071056 A1 to Cheng et al. (Cheng), in view of “Formal Security Analysis of the Shibboleth Web Single Sign On System Using a Comprehensive Model of the Web” by Sommer.
Regarding claim 1, Cheng discloses a method, comprising: receiving a request (user request to logout, ¶40) to terminate a plurality of sessions between a user of an identity management system (user of identity provider and federation manager, ¶38) and a respective plurality of applications that are accessible via the identity management system (service providers reliant on the identity provider and federation manager, ¶38), an endpoint (user device) associated with a tenant of the identity management system (user is a client of the service provider and the identity provider; service provider is a client of the identity provider), communicating via a respective plurality of APIs (multi-federation protocol manager communicates with other identity providers and service providers to initiate logout with corresponding service providers using SLO service provider interfaces, ¶43, ¶59; IdPs logout of service providers, ¶41); transmitting, via the respective plurality of APIs, a respective plurality of API calls to terminate the plurality of sessions between the user and the respective plurality of applications in accordance with a universal logout (ULO) operation or a single logout (SLO) operation (multi-federation protocol manager invokes a logout for each identity provider, ¶43, which performs a single logout with each corresponding service provider, ¶45); and outputting metadata associated with a result of the ULO operation or the SLO operation (multi-federation protocol manager receives status from the identity provider, ¶¶46-47). Cheng lacks the request comprising information associated with the user, information associated with the plurality of sessions, or both, lacks receiving, via the endpoint associated with a tenant of the identity management system, a set of application programming interface (API) credentials that are usable to communicate with the respective plurality of applications via a respective plurality of APIs, and lacks the respective plurality of API calls including the set of API credentials, the information associated with the user, the information associated with the plurality of sessions, or any combination thereof and lacks outputting, to an observability log maintained by the identity management system, metadata associated with a result of the ULO operation or the SLO operation. However, Sommer, in an analogous art (single logout, p. 14, ¶2, using SAML, p. 13), teaches that it was known for an IdP to send logout requests to service providers and to forward logout responses to the IdP (p. 28, §4.3, ¶1) and report successful logout at the SP to a user (p. 31, ¶4; see also Fig. 5.2), including the request (logout request) comprising information associated with the user (logout request identifies subject of the request, p. 52, §B.1.9), information associated with the plurality of sessions (logout request identifies session_idx, p. 52, §B.1.9), or both, receiving, via an endpoint associated with a tenant of the identity management system, a set of application programming interface (API) credentials that are usable to communicate with the respective plurality of applications via a respective plurality of APIs (logout requests are signed with shared keys and thus shared keys are received for creation and verification of the logout requests at the service provider interface, p. 52, §B.1.9; see also p. 86, Lemma 20 for discussion of credential usage in Logout Requests), the respective plurality of API calls including the set of API credentials, the information associated with the user, the information associated with the plurality of sessions, or any combination thereof (logout requests are signed with shared keys and thus shared keys are received for creation and verification of the logout requests, p. 52, §B.1.9; logout requests further include subject, session_idx, p. 52, §B.1.9) and outputting, to an observability log maintained by the identity management system, metadata associated with a result of the ULO operation or the SLO operation (Logout Response messages comprising the status of the SLO operation, p. 52, §B.1.10; see also p. 68, “script_slo_result” outputting the result of the SLO run and p. 69, writing “logoutSummary(Q,b,i)” to the browser). Therefore, it would have been obvious to one having ordinary skill in the art before the effective filing date of the claimed invention to modify Cheng such that (1) the request comprises information associated with the user, information associated with the plurality of sessions, or both, (2) to include receiving, via an endpoint associated with a tenant of the identity management system, a set of application programming interface (API) credentials that are usable to communicate with the respective plurality of applications via a respective plurality of APIs, and the respective plurality of API calls including the set of API credentials, the information associated with the user, the information associated with the plurality of sessions, or any combination thereof and (3) to include outputting, to an observability log maintained by the identity management system, metadata associated with a result of the ULO operation or the SLO operation.
Regarding claim 9, the claim is similar in scope to claim 1 and is therefore rejected using a similar rationale (note that Cheng discloses at least one memory storing code (¶62) and one or more processors coupled with the at least one memory and individually or collectively operable to execute the code (processor(s) 402, ¶62) to cause the apparatus to perform the steps (¶62).
Regarding claim 17, the claim is similar in scope to claim 1 and is therefore rejected using a similar rationale (note that Cheng discloses a non-transitory computer-readable medium storing code that comprises instructions executable by one or more processors toto cause the apparatus to perform the steps, ¶62).
Regarding claims 3, 11 and 19, Cheng discloses wherein the user is associated with the tenant of the identity management system (user agent includes functionality to request access to each service provider, ¶18 and the user agent is a client of the identity provider that employs the identity provider for authentication, ¶35).
Regarding claims 4, 12 and 20, Cheng discloses wherein at least one of the respective plurality of applications comprises a third-party application (the service provider may provide banking services, on-demand video services, ring tones for mobile telephones, gaming services, real-time alerts, and other services, ¶19).
Regarding claims 5 and 13, Cheng discloses wherein the request is initiated by an administrative user associated with the tenant of the identity management system (the user agent initiates a logout with one of the service providers (step 231), ¶38).
Regarding claims 6 and 14, Cheng discloses wherein the request is triggered by a risk metric exceeding a threshold for the user (logout request may be based on the expiration of a time limit to access the service provider, ¶40).
Regarding claims 7 and 15, Cheng discloses wherein the SLO operation comprises logging the user out of a specific session between the user and an application or logging the user out of all sessions between the user and the application (when the user is logged off of one service provider, the user may be logged off of all service providers in the circle of trust, ¶39; the corresponding identity provider may perform a method call on the multi-federation protocol manager to perform a single logout across all identity providers within the circle of trust, ¶42; rather than sending the logout request to each of the other identity providers, the multi-federation protocol manager may only send the logout request to identity providers which have sessions with the user, ¶44).
Regarding claims 8 and 16, Cheng discloses wherein at least one of the plurality of sessions is terminated using Security Assertion Markup Language (SAML) 2.0, OpenID Connect (OIDC), System for Cross-domain Identity Management (SCIM), or any combination thereof (Cheng discloses at least SAML V2, ¶50).1
Claims 2, 10 and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Cheng and Sommer, as applied to claims 1, 9 and 17, in view of US 2012/0008786 A1 to Cronk et al. (Cronk).
Regarding claims 2, 10 and 18, Cheng, as modified, is silent regarding wherein the request comprises an identifier of the user, an identifier of at least one session of the plurality of sessions, one or more options for the ULO operation or the SLO operation, or any combination thereof (note that Sommer teaches that messages comprise assertions, which generally comprise a NameID (subject name), p. 16)). However, Cronk, in an analogous art (single logout), teaches that a logout request comprises a field for a NameID and session index, ¶¶185-188). Therefore, it would have been obvious to one having ordinary skill in the art before the effective filing date of the claimed invention to further modify Cheng such that the request (initial request) comprises an identifier of the user (NameID), an identifier of at least one session of the plurality of sessions (session index to logout), one or more options for the ULO operation or the SLO operation, or any combination thereof. One of ordinary skill in the art would have been motivated to perform such a modification to identify, at the SP, the initial logout request, as taught by Cronk.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
“OpenID Connect Back-Channel Logout 1.0” (Jones, M. et al.) teaches OpenID back-channel logout, including sending a logout request to an RP with a logout_token (§2.5), where the token is validated at the RP (§2.6).
“Authentication and Authorization for the front-end web developer” (Paul, Biraj) teaches using API keys to authenticate clients using a particular API (p. 15, §2.4) and further teaches OIDC single logout (pp. 30-32).
“Logout” (Wilson, Yvonne, and Abhishek Hingnikar) teaches logout mechanisms in OIDC, Oauth 2 and SAML 2.0 (pp. 225-228).
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MICHAEL J SIMITOSKI whose telephone number is (571)272-3841. The examiner can normally be reached Monday - Friday, 7:00-3:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Carl Colin can be reached at 571-272-3862. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Michael Simitoski/ Primary Examiner, Art Unit 2493
July 7, 2026
1 US 20180077144 A1 (GANGAWANE; Jay Vijay et al.) also teaches industry standards (e.g., OpenID Connect, OAuth2, Security Assertion Markup Language 2 (“SAML2”), System for Cross-domain Identity Management (“SCIM”), Representational State Transfer (“REST”), etc.) for ease of integration with various applications (¶36).
Prosecution Insights