Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicants’ arguments filed 07/20/2026 have been fully considered but they are not persuasive for the following reasons:
Applicant Argument:
“First, Thornton does not extract the certificate from electronic device, and then transmit a request for validation after identifying that the certificate, which was previously extracted, is a new certificate. Paragraph [0094] (reproduced below) is describing whether a notification message includes a new certificate, and then extracts the certificate if the notification message includes the new certificate…
This new certificate is installed without any verification request being transmitted.”
Examiner’s response:
The examiner respectfully disagrees. Thornton explicitly demonstrates that certificate installation is subject to verification by a certificate signing request (THORNTON [0111] “A manual certificate renewal process is typically initiated at the server to which the certificate will be installed… Following the generation of the key pair, a certificate signing request (CSR) is generated, which is basically a partially completed certificate in that it contains the public key and server identification, but is not otherwise associated to a certificate authority or a root certificate… The signing process generates and attaches a signature to the certificate, which signature is generally an encrypted hash value generated from an unsigned certificate generated from the CSR information and from other information, such as the location of the root certificate and the validity period, which is encoded by the private key corresponding to a public key of a root certificate. The signed certificate is then ready for installation to the server.”).
Applicant Argument:
Sloat does not disclose "storing the certificate in the electronic device based on determining that the certificate is included in the exception list." While paragraph [0093] of Sloat (reproduced below) indicates that the allowable expired list is "pushed" to the electronic devices 1112, 1122, and 1132, and this is not a storage operation of the certificate itself… Thus, while a certificate may be identified as having a hash that is in the expired list in Stoat, this does not result in the same certificate being stored in the electronic device. This is primarily because Sloat is not directed to the internal cycle of the electronic device effectively checking whether its own certificate is expired and if so, whether its own certificate is included on an exception list.”
Examiner’s Response:
The examiner respectfully disagrees. While Sloat does disclose pushing an allowable expired list, Sloat further discloses where the expired certificates are stored in the electronic device. See FIG 6B where the 1102 Field Device stores an expired Operational Certificate (1104).
Thus, the rejections are maintained
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-3, 6-7, 9-10, 11-13, 16-17, 19-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over THORNTON (US 20050071630 A1), hereafter THORNTON, in view of SLOAT (US 20230160591 A1), hereafter SLOAT.
Regarding claim 1, THORNTON teaches:
A method (THORNTON [0078] “Disclosed below are a number of systems and methods useful in environments of certificate management.”) comprising: extracting a certificate from files stored in an electronic device(REF1 [0094] If a new certificate is referred to or included in the notification message, the certificate is extracted in step 83 from wherever it is located); transmitting a verification request for the certificate to a certificate issuing agency based on identifying that the certificate is a new certificate([0094] “Upon reception of a notification, the system tests whether the notification concerns a new certificate, as in step 82. If a new certificate is referred to or included in the notification message, the certificate is extracted in step 83 from wherever it is located. It may not be apparent which server is to be the target of the new certificate installation, and therefore a destination server is identified in step 84. The certificate may then be installed to the destination server, as in step 85.”, [0111] “A manual certificate renewal process is typically initiated at the server to which the certificate will be installed… Following the generation of the key pair, a certificate signing request (CSR) is generated, which is basically a partially completed certificate in that it contains the public key and server identification, but is not otherwise associated to a certificate authority or a root certificate. Having a certificate signing request, it may either be sent to a certificate authority or it may be signed in-house…The signing process generates and attaches a signature to the certificate…The signed certificate is then ready for installation to the server.” Upon identification of a new certificate, a certificate signing request (CSR) is sent to the certificate authority (certificate issuing agency) for signing (verification) prior to installation. )); determining whether a validity period of the certificate expires, based on a response from the certificate issuing agency indicating that the certificate is valid( [0176] “If in step 1308, the client certificate delivered to the server is found to be valid and not revoked, a check for an expired certificate may be performed in step 1316.);
Further regarding claim 1, THORNTON teaches the limitations previously demonstrated, however does not appear to explicitly teach the following limitations demonstrated by SLOAT:
determining whether the certificate is included in an exception list based on determining that the validity period of the certificate expires(SLOAT [0096] “Each device 510, 520 may perform additional validation checks to determine that the second validation check 522 is the only validation check that failed, indicating that the only issue preventing communication between the devices 510, 520 is that the first device operational certificate 525 is expired…At operation 605, the engine again performs a second validation check 552, this time also checking the allowable expired list, and accepts the fingerprint of the expired first device operational certificate 525 as if it were unexpired.”); and storing the certificate in the electronic device based on determining that the certificate is included in the exception list, wherein the exception list comprises at least one certificate(SLOAT [0093] “The user 1150 may input a command to the user interface device 1140 instructing it to push an allowable expired list 1155 to each of the devices 1112, 1122, 1132. The allowable expired list 1155 contains the fingerprints of any expired operational certificates that the user would like the devices to accept.”).
Since THORNTON and SLOAT are from the same field of endeavor as both are directed to certificate management functions, which is within the same field of endeavor as the claimed invention, it would have been obvious to one of ordinary skilled in the art before the effective filing date of the claimed invention to modify and combine the teachings of THORNTON and SLOAT by incorporating the teachings of SLOAT into THORNTON. The motivation to combine is to improve certificate management and verification thereof. (THORNTON [AB]; SLOAT [AB]). This motivation is equally applicable for rejections hereafter.
Regarding claim 2, THORNTON-SLOAT teaches:
The method of claim 1, further comprising identifying the certificate as the new certificate based on identifying that the extracted certificate is stored in a memory of the electronic device or a database corresponding to the electronic device(THORNTON [0133] “A certificate installation or renewal system may also perform a verification operation to verify that a newly requested certificate has been installed correctly and is available for use. In an exemplary method, the system may act as a client for the particular service for which the certificate is being used. For example, if a new certificate is for a web server supporting HTTPS, the installation/renewal system may attempt a secure HTTPS connection with the destination server. The verification may include checking for use of the new certificate and general operation of the secure use.”).
Regarding claim 3, THORNTON-SLOAT teaches:
The method of claim 2, wherein determining whether the validity period of the certificate expires is further performed based on identifying that the extracted certificate is not the new certificate(THORNTON [0084] “A certificate database may be maintained to provide information regarding the state of certificates in a network at given times. This may be used, in one example, by an administrator to identify certificates due to expire, or certificates that have expired. In another use, certificates may be related to servers to identify unused or duplicate certificates. In yet another use, a survey may be conducted using the database to identify certificate authorities being used”).
Regarding claim 6, THORNTON-SLOAT teaches:
The method of claim 1, wherein extracting the certificate from the file stored in the electronic device comprises: identifying files stored in the electronic device(THORNTON [0088] “In an alternate method, an attempt may be made to mount a device's filesystem (or a portion thereof) through an NFS or SMB connection. Following establishment of a connection, a search may be conducted through the exported file system to locate probable certificates, which can be verified by attempting a parsing of the suspected file.”); extracting character string information from the files; identifying at least one piece of authentication information from the character string information (THORNTON [0105] “The command "find / -name httpd.conf", or a similar command, is also executed to locate the server configuration file. Next the certificate and key name are extracted from the configuration file”); and extracting the certificate from the at least one piece of authentication information(THORNTON [0105] “A new configuration file is then generated either including or referencing the new certificate, and written to the destination server.”, [0069] “Signed certificates are produced by choosing a root certificate, signing the certificate with the private key of the chosen root certificate, including identification of the root certificate with the signed certificate and returning the signed certificate to the requesting party.”).
Regarding claim 7, THORNTON-SLOAT teaches:
The method of claim 6, wherein the file of the electronic device comprises an image file that comprises data related to software and firmware installed in the electronic device(THORNTON [0105] “In a fifth related installation, information is first retrieved to effect contacting and install the certificate to the destination web server, accelerator or other device, that information including at least some of the platform type, the operating system, a detault protocol such as telnet, SSH, HTTP, HTTPS, etc., the certificate text, the destination server's IP address or hostname, a user name and password to log onto the destination, a password for the certificate store, the certificate common name, and a port number to initiate contact with the destination.”).
Regarding claim 9, THORNTON-SLOAT teaches:
The method of claim 6, further comprising: identifying certificate start information from the character string information; identifying certificate end information (THORNTON [0124] “If it is desired to use intermediate root certificates to sign end certificates, before creating a CSR an examination of available intermediate root certificates may be performed to ensure the period of validity of the end certificate is within the period of validity of a selected intermediate root certificate. Should an intermediate root certificate expire before the desired end certificate period of validity, or the root certificate become valid after the start of the period of validity of the end certificate, an administrator may be notified of a problem.”); and extracting a character string between the certificate start information and the certificate end information as the certificate(THORNTON [0111] “The signing process generates and attaches a signature to the certificate, which signature is generally an encrypted hash value generated from an unsigned certificate generated from the CSR information and from other information, such as the location of the root certificate and the validity period, which is encoded by the private key corresponding to a public key of a root certificate.”).
Regarding claim 10, THORNTON-SLOAT teaches:
The method of claim 1, further comprising transmitting the verification request for the certificate to the certificate issuing agency through an access point (AP)(THORNTON “[0115] The submitting a certificate signing request to a certificate authority is typically performed through a network connection over the Internet. The certificate authority (CA) presents an interface, for example in a web browser, in which an administrator may enter the CSR and other information related to the request, such as the requesting entity's identification, account number or a challenge phrase.”, [0130] “In a first exemplary abstractor, the certificate request information contains only a certificate signing request generated externally, for example at the server destined to receive a signed certificate.”).
Regarding claims (11-13), (16-17 & 19-20):
Claims 11-13, 16-17, 19-20 are rejected for similar reasoning and rationale as claims 1-3, 6-7, 9-10, as they recite substantially similar limitations as claims 1-3, 6-10, but for recitation as an electronic device, comprising: memory; and at least one processor electrically connected to the memory, wherein the processor is configured (SLOAT [0071] “Memory 408 can be or include volatile memory or non-volatile memory. Memory 408 can include database components, object code components, script components, or any other type of information structure for supporting the various activities and information structures described in the present application. According to some embodiments, memory 408 is communicably connected to processor 406 via processing circuit 404 and includes computer code for executing (e.g., by processing circuit 404 and/or processor 406) one or more processes described herein.”), such as taught by THORNTON-SLOAT.
Claim(s) 4-5 and 14-15 is/are rejected under 35 U.S.C. 103 as being unpatentable over THORNTON-SLOAT, as applied in rejections above, in further view of AH KUN (US 11190504 B1), hereafter AH KUN.
Regarding claim 4, THORNTON-SLOAT teaches the limitations previously demonstrated however does not appear to explicitly teach the following limitations demonstrated by AH KUN:
The method of claim 3, further comprising removing the certificate from the electronic device based on identifying that the certificate is not included in the exception list(AH KUN col 12, lines46-50 “If the number of client computer systems does not exceed a threshold value, execution advances to block 716 and the expired iterated trusted digital certificate is removed from the trust store maintained by the service.”).
Since THORNTON-SLOAT and AH KUN are from the same field of endeavor as both are directed to certificate management functions, which is within the same field of endeavor as the claimed invention, it would have been obvious to one of ordinary skilled in the art before the effective filing date of the claimed invention to modify and combine the teachings of THORNTON-SLOAT and AH KUN by incorporating the teachings of AH KUN into THORNTON-SLOAT. The motivation to combine is to improve certificate management and verification thereof. (THORNTON [AB]; SLOAT [AB]; AH KUN [AB]). This motivation is equally applicable for rejections hereafter.
Regarding claim 5, THORNTON-SLOAT in further view of AH KUN teaches:
The method of claim 1, further comprising removing the certificate from the electronic device based on a response from the certificate issuing agency indicating that the certificate is invalid(AH KUN col 2-3 lines 59-3 “In some examples, under certain conditions, a trusted digital certificate may become expired and be removed from a trust store by the service, rendering the trusted digital certificate unavailable for use in verifying client certificates….When a trusted digital certificate expires, the trusted digital certificate may be removed from the trust store maintained by the service without intervention from the customer administrator.”).
Claims 14-15 are rejected for similar reasoning and rationale as claims 4-5, as they recite substantially similar limitations as claims 4-5, but for recitation as an electronic device, comprising: memory; and at least one processor electrically connected to the memory, wherein the processor is configured (SLOAT [0071] “Memory 408 can be or include volatile memory or non-volatile memory. Memory 408 can include database components, object code components, script components, or any other type of information structure for supporting the various activities and information structures described in the present application. According to some embodiments, memory 408 is communicably connected to processor 406 via processing circuit 404 and includes computer code for executing (e.g., by processing circuit 404 and/or processor 406) one or more processes described herein.”), such as taught by THORNTON-SLOAT in further view of AH KUN.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
/K.J.G./Examiner, Art Unit 2408
/LINGLAN EDWARDS/Supervisory Patent Examiner, Art Unit 2408
