DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1, 16, 20 have been amended.
Claims 1-20 are currently pending.
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 1-15, 20 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
Regarding Claim 1, the claim recites the additional limitation “generate a global trust score for the device based on a weighted average of one or more local trust scores, wherein a weight is assigned to the one or more local trust scores based on one of a network session duration and a trust level associated with one or more access nodes” in conjunction with “and transmit the local trust score to the identity provider” in lines 14-18 of Claim 1 on Page 2 of Claims. Regarding generation of a global trust score, the specification recites this process being performed by an identity provider as described in Fig. 6 and paragraphs [0098]-[0105] of the Applicant’s specification. Regarding the other limitations of Claim 1 however, these limitations are directed towards a process implemented by an access node, an entity distinct from the identity provider, as described in Fig. 4 and paragraphs [0080]-[0086] of the Applicant’s specification, and this is exemplified with the last limitation regarding transmission of the local trust score to the identity provider. No information is provided in the specification in how the device of Claim 1, i.e. the access node, would generate the global trust score, something meant to be created by the identity provider by aggregating local trust scores received by access nodes, but then transmit a local trust score to an identity provider despite this global trust score generation beyond what is claimed. That is, no information is provided in which one of ordinary skill in the art could predict to have an access node function both as an access node and identity provider simultaneously. For this reason, a person of ordinary skill in the art would not view the applicant to have been in possession of the generic subject matter claimed based on the information disclosed in the specification.
Claims 2-15 are rejected for similar reasons as above by virtue of depending upon Claim 1. It is further noted by the Examiner that dependent Claim 5 reintroduces a global trust score despite it previously being generated in amended Claim 1.
Regarding Claim 20, the claim recites the additional limitation “generating a local trust score for the user device based on a weighted average of one or more local trust scores, wherein a weight is assigned to the one or more local trust scores based on one of a network session duration and a trust level associated with a plurality of access nodes” in conjunction with “and transmitting the local trust score to the identity provider” in lines 1-5 of Page 6 of Claims. Regarding a weighted average of local trust scores, the specification recites that this is directed towards calculation of a global trust score and this process being performed by an identity provider as described in Fig. 6 and paragraphs [0098]-[0105] of the Applicant’s specification. Regarding the other limitations of Claim 20 however, these limitations are directed towards a process implemented by an access node, an entity distinct from the identity provider, as described in Fig. 4 and paragraphs [0080]-[0086] of the Applicant’s specification, and this is exemplified with the last limitation regarding transmission of the local trust score to the identity provider. No information is provided in the specification in how the device of Claim 1, i.e. the access node, would generate a weighted trust score, something meant to be created by the identity provider by aggregating local trust scores received by access nodes, but then transmit a local trust score to an identity provider despite this weighted trust score generation beyond what is claimed. That is, no information is provided in which one of ordinary skill in the art could predict to have a device function both as an access node and identity provider simultaneously. For this reason, a person of ordinary skill in the art would not view the applicant to have been in possession of the generic subject matter claimed based on the information disclosed in the specification.
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 1 is rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being incomplete for omitting essential elements, such omission amounting to a gap between the elements. See MPEP § 2172.01. The omitted elements are how the device of Claim 1 can perform the functionality of both an access node and identity provider with regards to generating a global trust score and transmitting a local trust score. As argued previously, the lack of written description in the specification, i.e. omission of these elements, prevent one of ordinary skill in the art to predict how to have a device function both as an access node and identity provider simultaneously, rendering the scope of the claim indefinite.
Claim 1 recites the limitation "transmit the local trust score to the identity provider" in line 18 of Claim 1 on Page 2 of Claims. There is insufficient antecedent basis for this limitation in the claim. Claim 1 previously recites “one or more local trust scores”, and it is therefore ambiguous as to what “the local trust score” specifically refers to, rendering the claim indefinite.
Claims 2-15 are rejected for similar reasons as above by virtue of depending upon Claim 1.
Claim 6 recites the limitation "the global trust score" in line 1 of Claim 6. There is insufficient antecedent basis for this limitation in the claim. Claim 6 depends upon both Claims 1 and 5, but amended Claim 1 recites a generated global trust score while Claim 5 recites a received global trust score, making it ambiguous as to what “the global trust score” refers to, rendering the claim indefinite.
Claim 7 recites the limitation "the global trust score" in line 2 of Claim 7. There is insufficient antecedent basis for this limitation in the claim. Claim 7 depends upon both Claims 1 and 5, but amended Claim 1 recites a generated global trust score while Claim 5 recites a received global trust score, making it ambiguous as to what “the global trust score” refers to, rendering the claim indefinite.
Claims 8-14 are rejected for similar reasons as above by virtue of depending upon Claim 7 or further reciting “the global trust score”.
Claim 16 recites the limitation "the one or more local trust scores" in line 2 of Page 5 of Claims. There is insufficient antecedent basis for this limitation in the claim. Claim 16 previously recites receiving “one or more trust scores” in line 8 of Claim 16 on page 4 of Claims in conjunction with a weighted average of “one or more local trust scores” in line 1 of page 5 of Claims 5, and it is therefore ambiguous as to what “the one or more local trust scores” specifically refers to, rendering the claim indefinite. It is recommended by the Examiner that the “one or more local trust scores” recited in line 1 of page 5 of Claims 5 read as “the one or more local trust scores” instead.
Claims 17-19 are rejected for similar reasons as above by virtue of depending upon Claim 16.
Claim 20 is rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being incomplete for omitting essential method steps, such omission amounting to a gap between the steps. See MPEP § 2172.01. The omitted steps are how the method of Claim 20 performs the functionality of both an access node and identity provider with regards to generating a weighted average trust score and transmitting a local trust score. As argued previously, the lack of written description in the specification, i.e. omission of these essential method steps, prevent one of ordinary skill in the art to predict how to have a device function both as an access node and identity provider simultaneously, rendering the scope of the claim indefinite.
Claim 20 recites the limitation "transmit the local trust score to the identity provider" in line 5 of Page 6 of Claims. There is insufficient antecedent basis for this limitation in the claim. Claim 20 previously recites “generating a local trust score” in conjunction with “one or more local trust scores”, and it is therefore ambiguous as to what “the local trust score” specifically refers to, rendering the claim indefinite.
Allowable Subject Matter
Claims 16-19 are indicated as having allowable subject matter.
Claims 16-19 would be allowable if rewritten or amended to overcome the rejection(s) under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), 2nd paragraph, set forth in this Office action.
The following is a statement of reasons for the indication of allowable subject matter:
Barton et al. (U.S. Pub. No. 2022/0337629 A1) hereinafter referred to as “Barton”, is directed towards a system for user trust scoring in authentication with identity federations (Par. [0012]-[0013]. Barton further teaches monitoring a device for network violations (Fig. 4, Par. [0039]-[0041]) and authentication of a user device with an identity provider (Par. [0010], Par. [0023]-[0024], Par. [0029]-[0030]). Barton further teaches that these network violations can be tracked and shared with the identity provider/federation (Par. [0027], Par. [0041]).
Danino (U.S. Pub. No. 2025/0211551 A1) hereinafter referred to as “Danino”, is directed towards cloud system security which includes abnormal access detection (Par. [0246]-[0248]). Danino further teaches that the risk of certain access groups can be assigned a total risk score based on categories and weights which include a session length and session time (Par. [0257]-[0277]).
The prior art of record does not explicitly disclose, in light of other features recited in independent claim 16, “generate a global trust score for the user device based on an aggregation of the one or more local trust scores, wherein the global trust score is based on a weighted average of one or more local trust scores, wherein a weight is assigned to the one or more local trust scores based on one of a network session duration and a trust level associated with the plurality of access nodes” in conjunction with “and share the global trust score for the user device with an identity federation” as recited in independent Claim 16. While Barton teaches tracking a record of network violations which can be considered a type of global trust score, Barton is silent with regards to this global trust score being a weighted average of local trust scores using weights relying on both network session duration and trust levels of access nodes. On the other hand, while Danino teaches that a risk score can comprise a weighted average of parameters including session length, this session length is a singular category in the risk score calculation of Danino rather than a weight, and Danino is silent with regards to using both a session length and access node trust level as a weight. Therefore, while the prior art of record discloses methods of access control for devices in connecting to networks with regards to identity providers/federations, the recitation of the specific global trust score being a weighted average based on both network session duration and access node trust level as presented in independent claim 16 is not anticipated nor obvious over the prior art of record.
Related Art
The following prior art made of record and cited on PTO-892, but not relied upon, is considered pertinent to applicant’s disclosure:
Amar et al. (U.S. Pub. No. 2017/0230418 A1) – Includes methods regarding user authenticity monitoring
Plaza Fonseca et al. (U.S. Pub. No. 2013/0042298 A1) – Includes methods regarding trust level generation
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ETHAN V VO whose telephone number is (571)272-2505. The examiner can normally be reached M-F 8am-5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lynn Feild can be reached on (571)272-2092. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/E.V.V./Examiner, Art Unit 2431 /SARAH SU/Primary Examiner, Art Unit 2431
