CTNF 18/983,073 CTNF 86043 DETAILED ACTION This first non-final action is in response to applicants’ preliminary amendment filed on 01/29/2025. Claims 1-15 have been canceled, and new Claims 16-29 have been added. Therefore, Claims 16-29 are currently pending and have been considered as follows. Notice of Pre-AIA or AIA Status 07-03-aia AIA 15-10-aia The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA. 07-06 AIA 15-10-15 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. Priority Acknowledgment is made of applicants’ claim for foreign priority under 35 U.S.C. 119 (a)-(d). The certified copy has been received on 03/17/2025. Drawings The drawings filed on 01/29/2025 are accepted. Information Disclosure Statement The information disclosure statement (IDS) submitted on 12/16/2024 has been placed in the application file, and the information referred therein has been considered as to the merits. Examiner’s Note: The claims recite instances of the term “and/or” which under the broadest reasonable interpretation (BRI) would simply mean “or” such as limitations listed in the alternative. Claim Objections 07-29-01 AIA Claim s 18 and 21 are objected to because of the following informalities: Claim 18 line 6 recites “computing systemin response” which should be corrected as “computing systemin system in response”; Claim 21 line 6 recites “computing systemin response” which should be corrected as “computing systemin system in response”; Appropriate correction is required. 07-30-03-h AIA Claim Interpretation 07-30-03 AIA The following is a quotation of 35 U.S.C. 112(f): (f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof. The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph: An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof. 07-30-05 The claims in this application are given their broadest reasonable interpretation using the plain meaning of the claim language in light of the specification as it would be understood by one of ordinary skill in the art. The broadest reasonable interpretation of a claim element (also commonly referred to as a claim limitation) is limited by the description in the specification when 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is invoked. As explained in MPEP § 2181, subsection I, claim limitations that meet the following three-prong test will be interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph: (A) the claim limitation uses the term “means” or “step” or a term used as a substitute for “means” that is a generic placeholder (also called a nonce term or a non-structural term having no specific structural meaning) for performing the claimed function; (B) the term “means” or “step” or the generic placeholder is modified by functional language, typically, but not always linked by the transition word “for” (e.g., “means for”) or another linking word or phrase, such as “configured to” or “so that”; and (C) the term “means” or “step” or the generic placeholder is not modified by sufficient structure, material, or acts for performing the claimed function. Use of the word “means” (or “step”) in a claim with functional language creates a rebuttable presumption that the claim limitation is to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites sufficient structure, material, or acts to entirely perform the recited function. Absence of the word “means” (or “step”) in a claim creates a rebuttable presumption that the claim limitation is not to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is not interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites function without reciting sufficient structure, material or acts to entirely perform the recited function. Claim limitations in this application that use the word “means” (or “step”) are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action. Conversely, claim limitations in this application that do not use the word “means” (or “step”) are not being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action. 07-30-06 This application includes one or more claim limitations that do not use the word “means,” but are nonetheless being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because the claim limitation(s) uses a generic placeholder that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. Such claim limitation is: “ one security module ” in Claim 28 . Because this claim limitation is being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, it is being interpreted to cover the corresponding structure described in the specification as performing the claimed function, and equivalents thereof. Specification filed 01/29/2025 pages 8, 9, 13; Fig. 1 . If applicant does not intend to have this/these limitation(s) interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, applicant may: (1) amend the claim limitation(s) to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph (e.g., by reciting sufficient structure to perform the claimed function); or (2) present a sufficient showing that the claim limitation(s) recite(s) sufficient structure to perform the claimed function so as to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. Claim Rejections - 35 USC § 103 07-20-aia AIA The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. 07-20-02-aia AIA This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention. 07-21-aia AIA Claim s 16, 18, 19, and 22-29 are rejected under 35 U.S.C. 103 as being unpatentable over LUO et al. (US 20180268156 A1, hereinafter Luo ) in view of QUINLAN (US 20160308845 A1) . As to Claim 16: Luo discloses a method for providing computer-implemented functionality in a computing system (e.g. Luo “systems and methods for managing access to secure resources in computing devices” [0001]) having at least one computing unit and one security module (e.g. Luo computing device includes processor [0044]; [0045] secure memory is a discrete physical module [0046]) , the method comprising the following steps: a provision request specifying a requested functionality (e.g. Luo “generating access requests each including a value identifying a container from which the access request originated” [0008]; “the secure computing resources may comprise trusted applications in said containers” [0010]; “the access requests comprise requests to perform operations using said secure computing resources” [0013]; [0062]; [0075]) ; sending the provision request to an access manager (e.g. Luo “Each of trusted application 212-1 and trusted application 212-2 is configured to receive requests from client applications 210 in containers 204. Trusted applications 212-1, 212-2 are further configured to perform permissions checks in response to receiving such requests” [0065]; “control of access to secure data is managed by discrete software modules within operating systems 206-1, 206-2, rather than individual trusted applications 212. Such components allow for standardization of functions for requesting secure data and for enforcing access rules” [0074]; “Access control driver 216 and secure access manager 218” [0076]) ; based on the checking being successful, sending, by the access manager, an access key for the requested functionality to the computing system (e.g. Luo “Access control driver 216 assigns an application access key to the client application 210-2 and provides instructions to secure access manager 218 to add a record to data structure 222 linking trusted application 212-2 with the assigned secure access key, so that client application is authorized to access secure data from trusted application 212-2” [0090]; “may be a request to retrieve an encryption key” [0099]) ; sending a container request for the requested functionality to a repository that stores a functionality container with the requested functionality (e.g. Luo “the request may be a request for performance of an operation by a trusted application 212, such as encryption or decryption of data. For example, secure communication client application 210-2 constructs a request intended for trusted application 212-2. The request may be a request for data to be decrypted or encrypted, in which case, the request includes or otherwise identifies the data, or it may be a request to retrieve an encryption key” [0099]; [0100]; [0101]) ; and based on a validity of the access key being confirmed, implementing, by the at least one computing unit, the functionality using the functionality container in the computing system (e.g. Luo “If access rules are satisfied, secure access manager 218 checks the relevant secure container's trusted application table 231 for the trusted application 212 identified in request 238” [0105]; “trusted application 212 reads the values in application table 231 and determines whether the combination of access parameters in message 240 appears in a corresponding field 236. If the combination of parameters in message 240 matches a combination of parameters in a corresponding field 236, a communications session is created between the client application 210 which originated the request and the trusted application 212 targeted by the request” [0106]; “If, as in the depicted example, the received combination of access parameters matches a combination listed in field 236 for the trusted application 212 identified in message 240, the requesting client application 210 is authorized to access the secure computing resource requested (e.g. secure data or trusted application 212” [0107]; [0108]) ; But Luo does not specifically disclose: signing a provision request using an authorization key stored by the security module; checking, by the access manager, an authenticity of the signed provision request. However, the analogous art QUINLAN does disclose signing a provision request using an authorization key stored by the security module (e.g. QUINLAN “applications 116 wants to access a file or data stored in encrypted form in a container on the computing device 100, it makes the data access application keys returned by the control program 114 unique to each requesting application 116… As the private key is known only to the requesting application 116, the signing of the request for the data access application key with that private key by the requesting application 116 inhibits the ability of other applications running on the computing device 100 to spoof the request for the data access application key sent by the requesting application 116. It may be noted also that signatures on the request by the application 116 and the response by the control program 114 described here may also serve to “authenticate”” [0047]) and checking, by the access manager, an authenticity of the signed provision request (e.g. QUINLAN “the first application 114 checks that the signature of the request is valid for the supplied public key and the other request data. If validation fails the request is rejected.” [0058]; [0065]) . Luo and QUINLAN are analogous art because they are from the same field of endeavor in secure containers. It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Luo and QUINLAN before him or her, to modify the disclosure of Luo with the teachings of QUINLAN to include signing a provision request using an authorization key stored by the security module and checking, by the access manager, an authenticity of the signed provision request as claimed. The suggestion/motivation for doing so would have been to inhibit the ability of other applications running on the computing device to spoof the request for the data access application key sent by the requesting application and to authenticate exchanges not vulnerable to “man-in-the-middle” attacks ( QUINLAN [0047]) . Therefore, it would have been obvious to combine Luo and QUINLAN to obtain the invention as specified in the instant claim(s). As to Claim 18: Luo in view of QUINLAN discloses the method according to claim 16, wherein the functionality container in the repository is cryptographically protected (e.g. QUINLAN “Using the client program 114 as an authentication delegate for the other applications avoids the user having to enter a password each time one of the other applications wants to access a file or data stored in encrypted form in a container on the computing device 100” [0038]) , so that the implementation of the requested functionality is not possible without knowledge of the access key (e.g. QUINLAN “a master container key (MCK) which is used to encrypt the data stored in the containers on the computing device 100. The master container key is stored 315 on the computing device 100, encrypted using the access code for the first application 114. A data container for the first application 114 is created 320 and encrypted with the master container key (MCK)” [0049]) , and wherein the method further comprises confirming the validity of the access key (e.g. Luo “trusted application 212-1 can use the application access key and active user ID to authorize a request and that trusted application 212-1 uses only the application access key” [0089]; “a message 238 is passed to secure access manager 218 identifying the container 204 from which the request originated and the relevant trusted application 212-1 and containing the parameters defining the data or operation requested and the access parameter, namely secure access key 228-1” [0102]) including: transmitting, by the repository, the protected functionality container to the computing systemin response to the container request; and removing, by the computing system, the cryptographic protection of the functionality container using the access key (e.g. QUINLAN “the first application 114 reads and decrypts 470 the master container key for the first application 114 which was stored in encrypted form at 355 above. Then, the first application 114 reads 475 the AuthDelegationSecret which was stored by the first application 114 in the container for the first application at 345 above. The first application 114 then calculates 480 a data access application key, which will be used by the second application 116 to encrypt and decrypt the master container key which is to be used to access encrypted files or data on the computing device 100” [0058]; [0072]) . The Examiner supplies the same rationale for the combination of references Luo and QUINLAN as in Claim 16 above. As to Claim 19: Luo in view of QUINLAN discloses the method according to claim 16, wherein the access key is sent as an encrypted access key to the computing system by the access manager (e.g. QUINLAN “that master database key is itself encrypted using the data access application key for the (or that particular) application 116 and stored in this encrypted form in a data store on the computing device 100 for the (or that particular) application 116. That encrypted master key can be accessed and decrypted by the application 116 using the data access application key as and when needed so that the application 116 can, in turn, then decrypt the data” [0042]; “The response message includes the data access application key in encrypted form” [0060]) . The Examiner supplies the same rationale for the combination of references Luo and QUINLAN as in Claim 16 above. As to Claim 22: Luo in view of QUINLAN discloses the method according to claim 16, wherein the computing system includes a communication module (e.g. Luo “a printed circuit board for communication between components” [0044]; “Network interface 110 is capable of connecting computing device 100 to one or more communication networks” [0049]; [0125]) , wherein communication with the access manager and the repository is carried out via the communication module, wherein communication with the access manager and the repository includes sending the signed provision request, receiving the access key as part of sending the access key to the computing system, sending the container request to the repository and, receiving the functionality container from the repository (e.g. Luo [0065]; [0074]; [0076]; [0090]; [0099]; [0100]; [0101]; [0106]-[0108]) . As to Claim 23: Luo in view of QUINLAN discloses the method according to claim 18, wherein the sending of the provision request and/or the sending of the access key and/or the sending of the container request and/or , the transmitting of the functionality container, is carried out in cryptographically protected form, wherein each message is encrypted (e.g. Luo “Trusted application 212-2 has access to a data structure (e.g. a database) of encryption keys for encrypting and decrypting data such as communications and documents” [0064]; see also QUINLAN “Moreover, inter-container communications between the client program 114 and the application 116 may be encrypted for security purposes, for example to stop some “eavesdropping” application which may be running on the computing device 100 being able to intercept and interpret the communications” [0039]) and/or signed. The Examiner supplies the same rationale for the combination of references Luo and QUINLAN as in Claim 16 above. As to Claim 24: Luo in view of QUINLAN discloses the method according to claim 23, wherein the encryption and/or the signing and/or decryption and/or a signature check of messages in the computing system are carried out by the security module, wherein cryptographic keys used are stored by the security module (e.g. Luo “Client application 210-2 has associated encryption/decryption key information stored by a trusted application 212-2 in operating system 206-2, namely an encryption/decryption utility… Trusted application 212-2 has access to a data structure (e.g. a database) of encryption keys for encrypting and decrypting data such as communications and documents” [0064]; [0088]; “an encryption key may be retrieved from secure storage 114 and used to generate a decrypted value to be returned to a client application 210” [0110]; a discrete secure memory [0114]; “control of access to trusted applications 212 and to secure data stored by trusted applications 212 is centrally managed by secure access manager 218 in concert with and using information provided by access control library 214 and access control driver 216” [0121]; [0122]) . As to Claim 25: Luo in view of QUINLAN discloses the method according to claim 16, wherein the provision request and/or the container request is generated by at least one computing unit of the computing system (e.g. Luo computing device processor to provide “a software module executable within said second operating system for receiving access requests from applications in said first operating system and selectively passing said requests to said secure computing resources based on container access rules” [0005]) . As to Claim 26: Luo in view of QUINLAN discloses the method according to claim 16, wherein the functionality container contains a program module and/or program parameters (e.g. Luo “provides software within each container with access to hardware of computing device 100. The operating systems within containers 204 may be operating systems of the same or similar type as operating system 206-1” [0053]; [0062]; [0071]) . As to Claim 27: Luo discloses a method performed in a computing system (e.g. Luo “systems and methods for managing access to secure resources in computing devices” [0001]) having at least one computing unit and one security module (e.g. Luo computing device includes processor [0044]; [0045] secure memory is a discrete physical module [0046]) , the method comprising: a provision request specifying a requested functionality (e.g. Luo “generating access requests each including a value identifying a container from which the access request originated” [0008]; “the secure computing resources may comprise trusted applications in said containers” [0010]; “the access requests comprise requests to perform operations using said secure computing resources” [0013]; [0062]; [0075]) ; sending the provision request to an access manager (e.g. Luo “Each of trusted application 212-1 and trusted application 212-2 is configured to receive requests from client applications 210 in containers 204. Trusted applications 212-1, 212-2 are further configured to perform permissions checks in response to receiving such requests” [0065]; “control of access to secure data is managed by discrete software modules within operating systems 206-1, 206-2, rather than individual trusted applications 212. Such components allow for standardization of functions for requesting secure data and for enforcing access rules” [0074]; “Access control driver 216 and secure access manager 218” [0076]) ; receiving an access key for the requested functionality from the access manager (e.g. Luo “Access control driver 216 assigns an application access key to the client application 210-2 and provides instructions to secure access manager 218 to add a record to data structure 222 linking trusted application 212-2 with the assigned secure access key, so that client application is authorized to access secure data from trusted application 212-2” [0090]; “may be a request to retrieve an encryption key” [0099]) ; sending a container request for the requested functionality to a repository that stores a functionality container with the requested functionality (e.g. Luo “the request may be a request for performance of an operation by a trusted application 212, such as encryption or decryption of data. For example, secure communication client application 210-2 constructs a request intended for trusted application 212-2. The request may be a request for data to be decrypted or encrypted, in which case, the request includes or otherwise identifies the data, or it may be a request to retrieve an encryption key” [0099]; [0100]; [0101]) ; But Luo does not specifically disclose: signing a provision request using an authorization key stored by the security module; wherein: (i) the container request contains the access key and the method further comprises: receiving the functionality container from the repository and implementing the functionality by the at least one computing unit using the functionality container; or (ii) functionality container is received as a cryptographically protected functionality container from the repository and the method further comprises: removing the cryptographic protection of the functionality container using the access key and implementing the functionality by the at least one computing unit using the functionality container. However, the analogous art QUINLAN does disclose signing a provision request using an authorization key stored by the security module (e.g. QUINLAN “applications 116 wants to access a file or data stored in encrypted form in a container on the computing device 100, it makes the data access application keys returned by the control program 114 unique to each requesting application 116… As the private key is known only to the requesting application 116, the signing of the request for the data access application key with that private key by the requesting application 116 inhibits the ability of other applications running on the computing device 100 to spoof the request for the data access application key sent by the requesting application 116. It may be noted also that signatures on the request by the application 116 and the response by the control program 114 described here may also serve to “authenticate”” [0047]) and (ii) functionality container is received as a cryptographically protected functionality container from the repository (e.g. QUINLAN “Using the client program 114 as an authentication delegate for the other applications avoids the user having to enter a password each time one of the other applications wants to access a file or data stored in encrypted form in a container on the computing device 100” [0038]) and the method further comprises: removing the cryptographic protection of the functionality container using the access key and implementing the functionality by the at least one computing unit using the functionality container (e.g. QUINLAN “the first application 114 reads and decrypts 470 the master container key for the first application 114 which was stored in encrypted form at 355 above. Then, the first application 114 reads 475 the AuthDelegationSecret which was stored by the first application 114 in the container for the first application at 345 above. The first application 114 then calculates 480 a data access application key, which will be used by the second application 116 to encrypt and decrypt the master container key which is to be used to access encrypted files or data on the computing device 100” [0058]; [0072]) . Luo and QUINLAN are analogous art because they are from the same field of endeavor in secure containers. It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Luo and QUINLAN before him or her, to modify the disclosure of Luo with the teachings of QUINLAN to include signing a provision request using an authorization key stored by the security module and wherein: (i) the container request contains the access key and the method further comprises: receiving the functionality container from the repository and implementing the functionality by the at least one computing unit using the functionality container; or (ii) functionality container is received as a cryptographically protected functionality container from the repository and the method further comprises: removing the cryptographic protection of the functionality container using the access key and implementing the functionality by the at least one computing unit using the functionality container as claimed. The suggestion/motivation for doing so would have been to inhibit the ability of other applications running on the computing device to spoof the request for the data access application key sent by the requesting application and to authenticate exchanges not vulnerable to “man-in-the-middle” attacks ( QUINLAN [0047]) . Therefore, it would have been obvious to combine Luo and QUINLAN to obtain the invention as specified in the instant claim(s). As to Claim 28: Luo discloses a computing system configured to provide computer-implemented functionality (e.g. Luo “systems and methods for managing access to secure resources in computing devices” [0001]) , the computing system including at least one computing unit and one security module (e.g. Luo computing device includes processor [0044]; [0045] secure memory is a discrete physical module [0046]) , the computing system configured to: a provision request specifying a requested functionality (e.g. Luo “generating access requests each including a value identifying a container from which the access request originated” [0008]; “the secure computing resources may comprise trusted applications in said containers” [0010]; “the access requests comprise requests to perform operations using said secure computing resources” [0013]; [0062]; [0075]) ; send the provision request to an access manager (e.g. Luo “Each of trusted application 212-1 and trusted application 212-2 is configured to receive requests from client applications 210 in containers 204. Trusted applications 212-1, 212-2 are further configured to perform permissions checks in response to receiving such requests” [0065]; “control of access to secure data is managed by discrete software modules within operating systems 206-1, 206-2, rather than individual trusted applications 212. Such components allow for standardization of functions for requesting secure data and for enforcing access rules” [0074]; “Access control driver 216 and secure access manager 218” [0076]) ; based on the checking being successful, send, by the access manager, an access key for the requested functionality to the computing system (e.g. Luo “Access control driver 216 assigns an application access key to the client application 210-2 and provides instructions to secure access manager 218 to add a record to data structure 222 linking trusted application 212-2 with the assigned secure access key, so that client application is authorized to access secure data from trusted application 212-2” [0090]; “may be a request to retrieve an encryption key” [0099]) ; send a container request for the requested functionality to a repository that stores a functionality container with the requested functionality (e.g. Luo “the request may be a request for performance of an operation by a trusted application 212, such as encryption or decryption of data. For example, secure communication client application 210-2 constructs a request intended for trusted application 212-2. The request may be a request for data to be decrypted or encrypted, in which case, the request includes or otherwise identifies the data, or it may be a request to retrieve an encryption key” [0099]; [0100]; [0101]) ; and based on a validity of the access key being confirmed, implement, by the at least one computing unit, the functionality using the functionality container in the computing system (e.g. Luo “If access rules are satisfied, secure access manager 218 checks the relevant secure container's trusted application table 231 for the trusted application 212 identified in request 238” [0105]; “trusted application 212 reads the values in application table 231 and determines whether the combination of access parameters in message 240 appears in a corresponding field 236. If the combination of parameters in message 240 matches a combination of parameters in a corresponding field 236, a communications session is created between the client application 210 which originated the request and the trusted application 212 targeted by the request” [0106]; “If, as in the depicted example, the received combination of access parameters matches a combination listed in field 236 for the trusted application 212 identified in message 240, the requesting client application 210 is authorized to access the secure computing resource requested (e.g. secure data or trusted application 212” [0107]; [0108]) ; But Luo does not specifically disclose: sign a provision request using an authorization key stored by the security module; check, by the access manager, an authenticity of the signed provision request. However, the analogous art QUINLAN does disclose sign a provision request using an authorization key stored by the security module (e.g. QUINLAN “applications 116 wants to access a file or data stored in encrypted form in a container on the computing device 100, it makes the data access application keys returned by the control program 114 unique to each requesting application 116… As the private key is known only to the requesting application 116, the signing of the request for the data access application key with that private key by the requesting application 116 inhibits the ability of other applications running on the computing device 100 to spoof the request for the data access application key sent by the requesting application 116. It may be noted also that signatures on the request by the application 116 and the response by the control program 114 described here may also serve to “authenticate”” [0047]) and check, by the access manager, an authenticity of the signed provision request (e.g. QUINLAN “the first application 114 checks that the signature of the request is valid for the supplied public key and the other request data. If validation fails the request is rejected.” [0058]; [0065]) . Luo and QUINLAN are analogous art because they are from the same field of endeavor in secure containers. It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Luo and QUINLAN before him or her, to modify the disclosure of Luo with the teachings of QUINLAN to include sign a provision request using an authorization key stored by the security module and check, by the access manager, an authenticity of the signed provision request as claimed. The suggestion/motivation for doing so would have been to inhibit the ability of other applications running on the computing device to spoof the request for the data access application key sent by the requesting application and to authenticate exchanges not vulnerable to “man-in-the-middle” attacks ( QUINLAN [0047]) . Therefore, it would have been obvious to combine Luo and QUINLAN to obtain the invention as specified in the instant claim(s). As to Claim 29: Luo discloses a non-transitory machine-readable storage medium on which is stored a computer program for providing computer-implemented functionality in a computing system (e.g. Luo “computer-readable medium has instructions thereon for execution by a processor” [0025]) having at least one computing unit and one security module (e.g. Luo computing device includes processor [0044]; [0045] secure memory is a discrete physical module [0046]) , the computer program, when executed by the computing system, causing the computing system to perform the following steps: a provision request specifying a requested functionality (e.g. Luo “generating access requests each including a value identifying a container from which the access request originated” [0008]; “the secure computing resources may comprise trusted applications in said containers” [0010]; “the access requests comprise requests to perform operations using said secure computing resources” [0013]; [0062]; [0075]) ; sending the provision request to an access manager (e.g. Luo “Each of trusted application 212-1 and trusted application 212-2 is configured to receive requests from client applications 210 in containers 204. Trusted applications 212-1, 212-2 are further configured to perform permissions checks in response to receiving such requests” [0065]; “control of access to secure data is managed by discrete software modules within operating systems 206-1, 206-2, rather than individual trusted applications 212. Such components allow for standardization of functions for requesting secure data and for enforcing access rules” [0074]; “Access control driver 216 and secure access manager 218” [0076]) ; based on the checking being successful, sending, by the access manager, an access key for the requested functionality to the computing system (e.g. Luo “Access control driver 216 assigns an application access key to the client application 210-2 and provides instructions to secure access manager 218 to add a record to data structure 222 linking trusted application 212-2 with the assigned secure access key, so that client application is authorized to access secure data from trusted application 212-2” [0090]; “may be a request to retrieve an encryption key” [0099]) ; sending a container request for the requested functionality to a repository that stores a functionality container with the requested functionality (e.g. Luo “the request may be a request for performance of an operation by a trusted application 212, such as encryption or decryption of data. For example, secure communication client application 210-2 constructs a request intended for trusted application 212-2. The request may be a request for data to be decrypted or encrypted, in which case, the request includes or otherwise identifies the data, or it may be a request to retrieve an encryption key” [0099]; [0100]; [0101]) ; and based on a validity of the access key being confirmed, implementing, by the at least one computing unit, the functionality using the functionality container in the computing system (e.g. Luo “If access rules are satisfied, secure access manager 218 checks the relevant secure container's trusted application table 231 for the trusted application 212 identified in request 238” [0105]; “trusted application 212 reads the values in application table 231 and determines whether the combination of access parameters in message 240 appears in a corresponding field 236. If the combination of parameters in message 240 matches a combination of parameters in a corresponding field 236, a communications session is created between the client application 210 which originated the request and the trusted application 212 targeted by the request” [0106]; “If, as in the depicted example, the received combination of access parameters matches a combination listed in field 236 for the trusted application 212 identified in message 240, the requesting client application 210 is authorized to access the secure computing resource requested (e.g. secure data or trusted application 212” [0107]; [0108]) ; But Luo does not specifically disclose: signing a provision request using an authorization key stored by the security module; checking, by the access manager, an authenticity of the signed provision request. However, the analogous art QUINLAN does disclose signing a provision request using an authorization key stored by the security module (e.g. QUINLAN “applications 116 wants to access a file or data stored in encrypted form in a container on the computing device 100, it makes the data access application keys returned by the control program 114 unique to each requesting application 116… As the private key is known only to the requesting application 116, the signing of the request for the data access application key with that private key by the requesting application 116 inhibits the ability of other applications running on the computing device 100 to spoof the request for the data access application key sent by the requesting application 116. It may be noted also that signatures on the request by the application 116 and the response by the control program 114 described here may also serve to “authenticate”” [0047]) and checking, by the access manager, an authenticity of the signed provision request (e.g. QUINLAN “the first application 114 checks that the signature of the request is valid for the supplied public key and the other request data. If validation fails the request is rejected.” [0058]; [0065]) . Luo and QUINLAN are analogous art because they are from the same field of endeavor in secure containers. It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Luo and QUINLAN before him or her, to modify the disclosure of Luo with the teachings of QUINLAN to include signing a provision request using an authorization key stored by the security module and checking, by the access manager, an authenticity of the signed provision request as claimed. The suggestion/motivation for doing so would have been to inhibit the ability of other applications running on the computing device to spoof the request for the data access application key sent by the requesting application and to authenticate exchanges not vulnerable to “man-in-the-middle” attacks ( QUINLAN [0047]) . Therefore, it would have been obvious to combine Luo and QUINLAN to obtain the invention as specified in the instant claim(s) . 07-21-aia AIA Claim 17 is rejected under 35 U.S.C. 103 as being unpatentable over Luo in view of QUINLAN as applied to Claim 16, and further in view of GOUNARES (US 20160301676 A1) . As to Claim 17: Luo in view of QUINLAN discloses the method according to claim 16, the method further comprises confirming the validity of the access key (e.g. Luo “trusted application 212-1 can use the application access key and active user ID to authorize a request and that trusted application 212-1 uses only the application access key” [0089]; “a message 238 is passed to secure access manager 218 identifying the container 204 from which the request originated and the relevant trusted application 212-1 and containing the parameters defining the data or operation requested and the access parameter, namely secure access key 228-1” [0102]) , but does not specifically disclose: wherein the container request contains the access key, and including: checking, by the repository, the validity of the access key; and based on the validity check being successful, transmitting, by the repository, the functionality container to the computing system. However, the analogous art GOUNARES does disclose wherein the container request contains the access key, and including: checking, by the repository, the validity of the access key; and based on the validity check being successful, transmitting, by the repository, the functionality container to the computing system (e.g. GOUNARES “Instance manager 315 may provide the encrypted, closed copy 323 of the container to E/D manager 318. Instance manager may also provide E/D manager with authentication data, such as a key obtained via the request to open the container. Assuming the key is authentic, E/D manager may decrypt the closed, encrypted copy 323 of the container and provide a decrypted version to instance manager 315. Instance manager 315 may then instantiate a corresponding open container instance 320 and provide session router 303 with appropriate routing information” [0042]; “Container instance manager 305 may authenticate open container request 508, e.g. by attempting to decrypt 520 the encrypted container copy using a key obtained (or identified) via the open container request. Assuming open container request 508 is authenticated, container instance manager may provide a container opened response 523 to session router 303, informing the session router the requested container has been opened successfully” [0069]) . Luo , QUINLAN , and GOUNARES are analogous art because they are from the same field of endeavor in secure containers. It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art, having the teachings of Luo , QUINLAN , and GOUNARES before him or her, to modify the combination of Luo and QUINLAN with the teachings of GOUNARES to include wherein the container request contains the access key, and including: checking, by the repository, the validity of the access key; and based on the validity check being successful, transmitting, by the repository, the functionality container to the computing system as claimed. The suggestion/motivation for doing so would have been for preventing large-scale breaches of highly valuable information using a system of highly distributed individual containers to encapsulate individual records of large data sets along with all of the applications needed to work with the data ( GOUNARES [0002]) . Therefore, it would have been obvious to combine Luo , QUINLAN , and GOUNARES to obtain the invention as specified in the instant claim(s) . Allowable Subject Matter 12-151-08 AIA 07-43 12-51-08 Claim s 20 and 21 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims. Conclusion 07-96 The prior art made of record and not relied upon is considered pertinent to applicants’ disclosure. Suarez et al. (US 20170177877 A1) Lewis et al. (US 20190260753 A1) KNUTSSON et al. (US 20200356642 A1) Any inquiry concerning this communication or earlier communications from the examiner should be directed to Kenneth Chang whose telephone number is (571)270-7530. The examiner can normally be reached Monday - Friday 9:30am-5:30pm EST. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Taghi Arani can be reached at 571-272-3787. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /KENNETH W CHANG/Primary Examiner, Art Unit 2438 PNG media_image1.png 35 280 media_image1.png Greyscale 06.10.2026 Application/Control Number: 18/983,073 Page 2 Art Unit: 2438 Application/Control Number: 18/983,073 Page 3 Art Unit: 2438 Application/Control Number: 18/983,073 Page 4 Art Unit: 2438 Application/Control Number: 18/983,073 Page 5 Art Unit: 2438 Application/Control Number: 18/983,073 Page 6 Art Unit: 2438 Application/Control Number: 18/983,073 Page 7 Art Unit: 2438 Application/Control Number: 18/983,073 Page 8 Art Unit: 2438 Application/Control Number: 18/983,073 Page 9 Art Unit: 2438 Application/Control Number: 18/983,073 Page 10 Art Unit: 2438 Application/Control Number: 18/983,073 Page 11 Art Unit: 2438 Application/Control Number: 18/983,073 Page 12 Art Unit: 2438 Application/Control Number: 18/983,073 Page 13 Art Unit: 2438 Application/Control Number: 18/983,073 Page 14 Art Unit: 2438 Application/Control Number: 18/983,073 Page 15 Art Unit: 2438 Application/Control Number: 18/983,073 Page 16 Art Unit: 2438 Application/Control Number: 18/983,073 Page 17 Art Unit: 2438 Application/Control Number: 18/983,073 Page 18 Art Unit: 2438 Application/Control Number: 18/983,073 Page 19 Art Unit: 2438 Application/Control Number: 18/983,073 Page 20 Art Unit: 2438 Application/Control Number: 18/983,073 Page 21 Art Unit: 2438 Application/Control Number: 18/983,073 Page 22 Art Unit: 2438 Application/Control Number: 18/983,073 Page 23 Art Unit: 2438 Application/Control Number: 18/983,073 Page 24 Art Unit: 2438 Application/Control Number: 18/983,073 Page 25 Art Unit: 2438 Application/Control Number: 18/983,073 Page 26 Art Unit: 2438 Application/Control Number: 18/983,073 Page 27 Art Unit: 2438 Application/Control Number: 18/983,073 Page 28 Art Unit: 2438 Application/Control Number: 18/983,073 Page 29 Art Unit: 2438 Application/Control Number: 18/983,073 Page 30 Art Unit: 2438 Application/Control Number: 18/983,073 Page 31 Art Unit: 2438
Prosecution Insights