DETAILED ACTION
This Office Action is in response to the amendment, filed on 07/15/2026.
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Per the instant Amendment, claims 1-20 have been examined and are pending in this application. Claims 1, 7, and 16 are independent.
Response to Arguments/Remarks
As to the objections to claims 16, the Applicant has not made any amendment for clarifying the claim language, nor provided any comment. Therefore, the objection is maintained.
Applicant’s arguments with respect to prior-art rejections to claims 1-20, filed on 07/15/2026, have been considered but are moot because the arguments do not apply to the combination of the references being used in the current rejection, where a new ground of rejection is applied with new art that is necessitated based on the amendment.
Applicant’s arguments in the instant Amendment, filed on 07/15/2026, with respect to the prior-art rejections to claims 1-20, and limitations listed below, have been fully considered but they are not persuasive.
Applicant’s Remarks: the Applicant submits that Watanabe does not describe or suggest authenticating an incoming message at the remote computing node by comparing a rotated encryption access key against a local copy. (Applicant Arguments/Remarks, 07/15/2026, pages 15-16)
The Examiner disagrees with the Applicants. The Examiner respectfully submits that while Watanabe does not teach of rotating the access key, Watanabe teaches of comparing the security code [i.e. access key] along with the registration code. While, in one scenario, Watanabe receives only the registration code and finds the mapping to the security code [i.e. access key] to decrypt the encrypted data after matching of the registration code (see Watanabe: pars 0011-0012), in another scenario, Watanabe discloses that The registration code and the security code are sent to a user terminal, and then the registration code and the security code are that are received by the user are sent from a user terminal, to the management server, verified to be identical to the stored copy, and encryption key is decrypted using the security code, for allowing access to the decrypted data. Therefore, in this alternative scenario, security code [i.e. access key] is also considered in the verification). (Watanabe: pars 0040, 0047, 0049; Fig 8).
Claim Objections
Claims 16 is objected to because of the following informalities:
As to claim 16, the claim is directed to “a computing storage device” [i.e., an apparatus, machine or a system], and the claim cites “having computer-executable instructions stored thereon, which, on execution by a computer, cause the computer to perform operations”. For better clarity and for directing the claim to a specific statuary subject matter, it is suggested that the preamble of claim be amended, in light of the figures 1 and 6, and the associated paragraphs 0058-0061, of the disclosure, in which the “computer storage device” is described as an exemplary of “computing device [i.e. an apparatus/system]”, to cite, as an example,
“A computing storage device comprising:
one or more processor, and a memory having computer-executable instructions stored thereon, which, on execution by the one or more processor, cause the computing storage device to perform operations comprising: ..”
If the Applicant meant to direct the claim to a non-transitory “computer storage media” [i.e. computer readable media] as a specific statuary subject matter, the Applicant may amendment claim accordingly, directing the claim to “non-transitory computer storage media”
Appropriate correction(s) is required.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
This application currently names joint inventors. In considering patentability of the claims the Examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the Examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Starr et al (“Starr,” US 2007/0195447, published on 08/23/2007), in view of Watanabe (“Watanabe,” US 2007/0162766, patented on 07/12/2007), and further in view Agarwal et al (“Agarwal,” US 20170004312, published on 01/05/2017).
As to claim 1, Starr teaches a system (Starr: pars 0007-0008, providing a method and apparatus for storing the encrypted data in a data storage library) comprising:
a processor; and a computer-readable medium storing instructions that are operative upon execution by the processor to:
generate, on a remote computing node, a primary encryption key operable for encrypting data (Starr: pars 0010-0012, 0023-0026; Fig 1, a storage library system [i.e. remote computing node], comprising an encryption engine encrypts data package(s), received over communication path from a client device, using a unique encryption key [i.e., primary encryption key]. Where, the unique encryption key is generated within the library system, and associated with the encrypted data, and stored within the library system associated with the stored encrypted data package(s));
wherein the primary encryption key is securely retained on the remote computing node and is not shared with the user computing node (Starr: pars 0023-0027; the unique encryption key is generated within the library system, and associated with the encrypted data, and stored within the library system associated with the stored encrypted data package(s). As an option, the library may be the only entity that has knowledge of the unique encryption key).
Starr does not explicitly teach the limitations, generate an encryption access key for encrypting the primary encryption key; share by the remote computing node and a user computing node, the encryption access keys, on a user computing node; associate, on the remote computing node, the primary encryption key with the current one of the encryption access keys; and restrict, on the remote computing node, access to the primary encryption key based on at least authenticating the incoming message by comparing the current one of the encryption access keys, comprised in the incoming message to a local copy of the current one of the encryption access keys.
However, in an analogous art, Watanabe teaches generate an encryption access key for encrypting the primary encryption key; share, by the remote computing node and a user computing node, the encryption access keys, on a user computing node; associate, on the remote computing node, the primary encryption key with the current one of the encryption access keys (Watanabe: pars 0026-0029, 0040; Fig 1, user’s data document is encrypted with an encryption key and stored in management database [i.e., database 18] of a data storage management system. Then the encryption key is encrypted with a security code [i.e., encryption access key] at the management system for security the security of the stored data, and the security code is associated with a registration code. The registration code and the security code are sent to a user terminal), restrict, on the remote computing node, access to the primary encryption key based on at least authenticating the incoming message by comparing the current one of the encryption access keys, comprised in the incoming message to a local copy of the current one of the encryption access keys (Watanabe: pars 0040, 0047, 0049; Fig 8, the registration code and the security code are that are received by the user are sent from a user terminal, to the management server, verified to be identical to the stored copy, and encryption key is decrypted using the security code, for allowing access to the decrypted data).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Watanabe with the method/system of Starr to include the limitations, generate an encryption access key for encrypting the primary encryption key; share, by the remote computing node and a user computing node, the encryption access keys, on a user computing node; associate, on the remote computing node, the primary encryption key with the current one of the encryption access keys; and restrict, on the remote computing node, access to the primary encryption key based on at least authenticating the incoming message by comparing the current one of the encryption access keys, comprised in the incoming message to a local copy of the current one of the encryption access keys, where one would have been motivated to encrypt the data encryption key with another key [such a security code, and can be seen as encryption access key], and only sending the security code to the user for access reference, and receive the security code from user at the storage management system, and decrypt the identified encryption/decryption key with the received security code, and then decrypt the user’s previously stored data with the decrypted key for user access. Where the encryption/decryption key not need to leave the storage management system, and thus, storage management system can provide better security, including the additional security benefit of generating different encryption/decryption key when the encryption key/decryption is leaked for any reason (Watanabe: pars 0026-0029).
While Starr teaches that the encryption key can be changed in desired increments of time such as every week, for example, and the encryption key can be different for each client (see Starr: par 0049), and Watanabe teaches that when the encryption key is leaked, a different encryption key is generated when the user information is again sent to the user management server (see Watanabe: par 0029), but Starr or Watanabe does not explicitly teach, any key rotation or renewal, and thus does not teach the limitations, rotate, on the remote computing node, the encryption access key in response to a trigger event; wherein a current one of the rotated encryption access keys is held in a user authentication certificate; and [authentication process using] one of the rotated encryption access keys.
However, in an analogous art, Agarwal teaches the limitations, rotate, on the remote computing node, the encryption access key in response to a trigger event (Agarwal: pars 0036-0038, 0048, 0054, 0149, a centralized framework of data encryption/decryption service, applying encryption objects (e.g., encryption keys and/or certificates). Where the encryption key and/or a certificate [encryption objects] gets refreshed [i.e., key rotation] based on a monitoring and triggering engine’s action, indication, and/or alert [i.e., trigger event]);
wherein a current one of the rotated encryption access keys is held in a user authentication certificate; and [authentication process using] one of the rotated encryption access keys (Agarwal: pars 0036-0038, 0048, 0054, 0149, the encryption objects (e.g., encryption keys and/or certificates) that that is applied based received encryption/decryption request from user, and can be used to prove ownership about an owner's identity]).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Agarwal with the method/system of Starr and Watanabe to include the limitation(s), rotate, on the remote computing node, the encryption access key in response to a trigger event; wherein a current one of the rotated encryption access keys is held in a user authentication certificate; and [authentication process using] one of the rotated encryption access keys, where one would have been motivated to rotate/renew the key encryption key, in according with policy, for a triggering situation is created when a rotation/renewal is needed for maintain data security (Agarwal: pars 0036-0038, 0048, 0054, 0149).
As to claim 2, the combination of Starr, Watanabe, and Agarwal teaches the system of claim 1,
Watanabe and Watanabe further teaches wherein the instructions are further operative to: generate, on the user computing node, an encryption message comprising the encryption access key and identifying a cleartext file to encrypt, wherein the encryption access key is the current one of the rotated encryption access keys; transmit the encryption message to the remote computing node across a computer network; based on at least authenticating the encryption message using the encryption access key, encrypt, by the remote computing node, the cleartext file into a ciphertext file using the primary encryption key, without disclosing the primary encryption key to the user computing node; and either: transmit, from the remote computing node to the user computing node, the ciphertext file; or transmit, from the remote computing node to the user computing node, an indication that encryption is complete (Watanabe: pars 0026-0029; Fig 1, user’s data document is encrypted with an encryption key and stored in management database of a data storage management system. Then the encryption key is encrypted with a security code [i.e., encryption access key] at the management system for security the security of the stored data. Watanabe: pars 0040, 0047, 0049; Fig 8, the registration code and the security code are that are received by the user are sent from a user terminal, to the management server, verified to be identical to the stored copy, and encryption key is decrypted using the security code, for allowing access to the decrypted data).
As to claim 3, the combination of Starr, Watanabe, and Agarwal teaches the system of claim 2,
Starr further teaches wherein the cleartext file is located on the user computing node, and wherein the cleartext file is identified using attachment to the encryption message; or wherein the cleartext file is located in a data store, wherein the cleartext file is identified in the encryption message, and wherein the instructions are further operative to: retrieve, by the remote computing node, the cleartext file from the data store; and store the ciphertext file in the data store (Starr: pars 0010-0012, 0023-0026; Fig 1, the encryption engine encrypts data package(s), received over communication path from a client device, using a unique encryption key, and associated with the encrypted data, and stored within the library system associated with the stored encrypted data package(s)).
As to claim 4, the combination of Starr, Watanabe, and Agarwal teaches the system of claim 1,
Starr and Watanabe further teaches wherein the instructions are further operative to: generate, on the user computing node, a decryption message comprising the encryption access key and identifying a ciphertext file to decrypt, wherein the encryption access key is the current one of the rotated encryption access keys; transmit the decryption message to the remote computing node across a computer network; based on at least authenticating the decryption message using the encryption access key, decrypt, by the remote computing node, the ciphertext file into a cleartext file using the primary decryption key, without disclosing the primary decryption key to the user computing node; and either: transmit, from the remote computing node to the user computing node, the cleartext file; or transmit, from the remote computing node to the user computing node, an indication that decryption is complete (Starr: pars 0027, 0034; Fig 1, during user retrieval of a specific data package(s), the encryption engine decrypts data package(s), using the associated key to form an original contiguous form, and transmit to the client. Watanabe: pars 0040, 0047, 0049; Fig 8, the registration code and the security code are that are received by the user are sent from a user terminal, to the management server, verified to be identical to the stored copy, and encryption key is decrypted using the security code, for allowing access to the decrypted data).
As to claim 5, the combination of Starr, Watanabe, and Agarwal teaches the system of claim 4,
Starr further teaches wherein the ciphertext file is located on the user computing node, and wherein the ciphertext file is identified using attachment to the decryption message; or wherein the ciphertext file is located in a data store, wherein the ciphertext file is identified in the decryption message, and wherein the instructions are further operative to: retrieve, by the remote computing node, the ciphertext file from the data store; and store the cleartext file in the data store (Starr: pars 0027, 0034; Fig 1, during user retrieval of a specific data package(s), the encryption engine decrypts data package(s), using the associated key that is identified by the storage library system).
As to claim 6, the combination of Starr, Watanabe, and Agarwal teaches the system of claim 1,
Starr further teaches wherein the primary encryption key comprises a symmetric encryption key useable for file decryption, such that the primary encryption key also comprises a primary decryption key; or wherein generating the primary encryption key comprises generating a primary encryption key pair comprising the primary encryption key and a different key as a primary decryption key, wherein a file encrypted using the primary encryption key may be decrypted using the primary decryption key (Starr: pars 0023-0026, 0034, a storage library system [i.e. remote computing node], comprising an encryption engine encrypts data package(s), received over communication path from a client device, using the unique encryption key [i.e., primary encryption key], that is generated within the library system, for encrypting user’s data package(s) is used for decrypting the data during user’s retrieval [i.e., the key is a symmetric key involving symmetric encryption and decryption]).
As to claim 7, the claim is directed to storage device, [i.e., an apparatus, machine or a system], and the scope of the claim limitations is similar to the scope of system claim 1, and therefore, rejected for the same reason set forth above for claim 1.
As to claims 8-12, the scopes of the claims are similar the scopes of claims 2-6, respectively, and are rejected for the same reasons set above for claim 2-6.
As to claim 13, the combination of Starr, Watanabe, and Agarwal teaches the system of claim 1,
Starr teaches of further comprising: encrypting data traffic, between the remote computing node and the user computing node, using a transit encryption key (Starr: pars 0027, 0034; Fig 1, during user retrieval of a specific data package(s), the encryption engine decrypts data package(s), using the associated key to form an original contiguous form, and transmit to the client).
As to claim 14, the combination of Starr, Watanabe, and Agarwal teaches the system of claim 1,
Starr and Agarwal further teaches wherein the trigger events comprise periodic timer events and/or user-defined trigger events (Starr: par 0049, the encryption key can be changed in desired increments of time such as every week [i.e. periodic timer event]. Agarwal: pars 0036-0038, 0048, 0054, 0149, the encryption key and/or a certificate [encryption objects] gets refreshed [i.e., key rotation] based on a monitoring and triggering engine’s action, indication, and/or alert [i.e., trigger event]).
As to claim 15, the combination of Starr, Watanabe, and Agarwal teaches the system of claim 1,
Watanabe, and Agarwal further teaches wherein associating the primary encryption key with the current one of the rotated encryption access keys comprises encrypting the primary encryption key using the current one of the rotated encryption access keys (Watanabe: pars 0040, 0047, 0049; Fig 8, the registration code and the security code are that are received by the user are sent from a user terminal, to the management server, verified to be identical to the stored copy, and encryption key is decrypted using the security code, for allowing access to the decrypted data. Agarwal: pars 0036-0038, 0048, 0054, 0149, the encryption key and/or a certificate [encryption objects] is get refreshed [i.e., key rotation] based on a monitoring and triggering engine’s action, indication, and/or alert [i.e., trigger event]).
As to claim16, the claim is directed to method, and the scope of the claim limitations is similar to the scope of system claim 1, and therefore, rejected for the same reason set forth above for claim 1.
As to claims 17-20, the scopes of the claims are similar the scopes of claims 2-5, respectively, and are rejected for the same reasons set above for claim 2-5.
Conclusion
Applicant’s amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Jahangir Kabir whose telephone number is (571) 270-3355. The examiner can normally be reached on 9:00- 5:00 Mon-Thu.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Luu Pham can be reached on (571) 270-5002. The fax number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from Patent Center and the Private Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from Patent Center or Private PAIR. Status information for unpublished applications is available through Patent Center and Private PAIR for authorized users only. Should you have questions about access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) Form at https://www.uspto.gov/patents/uspto-automated- interview-request-air-form.
/JAHANGIR KABIR/ Primary Examiner, Art Unit 2439
