DETAILED ACTION
Claims 1-20 are presented for examination.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Allowable Subject Matter
Claims 8-11, and 17 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1 and 16 are rejected under 35 U.S.C. 101 because the claimed invention is directed to judicial exception (abstract idea implemented on a generic computer – Not significantly more than the abstract idea itself) without significantly more.
Regarding claim 1, claim is directed to non-statutory subject matter because the claim(s) as a whole, considering all claim elements both individually and in combination, do not amount to significantly more than an abstract idea. Claim 1 is directed to general concept of gathering data (e.g. access a datastore for storing control data), and utilizing the data (e.g. to control access). The claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception because the claims generally recite a method of 1) accessing a datastore storing first access control data, 2) receiving a request for access control data for a first application, 3) servicing the request for access control data for the first application. These method steps are abstract idea because they describe a general process of data access control, and are not tied to a machine (the claim do not require the use of a machine and may simply be performed mentally or with a pen and paper.) See Benson, 409 U.S at 67; see also In re Comiskey, 554 F.3d 967, 979 (Fed. Cir. 2009) (“[M]mental processes – or processes of human thinking – standing alone are not patentable even if they have practical application.”) See In re Grams, 888 F.2d 835, 839-40 (Fed. Cir. 1989) (the mere use of the machine to collect data necessary for application of the mental process does not make the claim patentable subject matter). In re Grams, 888 F.2d 835, 839-40 (Fed. Cir. 1989) (holding a pre-solution step of gathering data incapable of imparting patent-eligibility under § 101).
Step 2A, Prong 2:
The additional elements beyond the abstract idea includes a computer, a data store, a network, and an application. These elements are recited at a high level of generality and perform their ordinary functions of storing data, receiving request, transmitting data and processing information. Thus the computer components merely implement the abstract of determining and providing access control information and the claim does not integrate the abstract idea into a practical application.
Step 2B:
The claim does not include additional elements that amount to significantly more than the abstract idea. The data store , network, and computer components are generic computer elements performing well understood, routine , and conventional activities, including accessing a datastore storing first access control data, receiving a request for access control data for a first application, and servicing the request for access control data for the first application. Accordingly claims 1 and 16 are not directed patent eligible subject matter.
Double Patenting
The non-statutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper time-wise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A non-statutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg , 140 F.3d 1428, 46 USPQ2d 1226 (Fed.Cir. 1998); In re Goodman , 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi , 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985);In re Van Ornum , 686F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel , 422 F.2d 438, 164 USPQ619 (CCPA 1970); In re Thorington , 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or1.321(d) may be used to overcome an actual or provisional rejection based on non-statutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP §§ 706.02(l)(1) - 706.02(l)(3) for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The filing date of the application in which the form is filed determines what form (e.g.,PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information absolute Terminal Disclaimers, refer to
www.uspto.gov/patents/process/file/efs/guidance/eTD-info-I.jsp.
Claims 1-20 are rejected on the ground of non-statutory double patenting as being unpatentable over claims 1-30 of U.S. Patent No. 12,182,291 B2Although the claims at issue are not identical, they are not patentably distinct from each other because they are directed to a same system for controlling access to a target platform by a computing device. Claims 1 and 12 anticipate independent claim 1 of the instant application respectively as they contain all the limitations in claim 1. See table below:
Instant Application
U.S. Patent No. 12,182,291
1. A computer-implemented method for controlling application access to data, the method comprising: accessing a datastore storing first access control data for a plurality of applications, the first access control data comprising first device dependent access control data for a plurality of applications; receiving, over a network, a request for access control data for a first application; and servicing the request for access control data for the first application to return second access control data over the network to control access by the first application to application data over the network, wherein servicing the request for access control data for the first application comprises determining the second access control data from the first access control data, the second access control data comprising first access point-dependent access control data from the first device dependent access control data.
2. The computer-implemented method of claim 1, wherein the request for access control data for the first application comprises an access point identifier for an access point, wherein determining the second access control data from the first access control data comprises determining the first access point-dependent access control data from the first device dependent access control data based on an association between the first access point-dependent access control data and the access point identifier.
3. The computer-implemented method of claim 1, wherein the request for access control data for the first application comprises an application identifier identifying the first application, and wherein determining the second access control data from the first access control data comprises determining the second access control data based on an association between the second access control data and the application identifier.
4. The computer-implemented method of claim 1, wherein the request for access control data for the first application comprises an application identifier identifying the first application and an access point identifier identifying an access point, wherein determining the second access control data from the first access control data comprises identifying the second access control data from the first access control data using the application identifier and the access point identifier.
5. The computer-implemented method of claim 4, wherein determining the second access control data from the first access control data comprises determining that the first access point-dependent access control data is associated with both the application identifier and the access point identifier.
6. The computer-implemented method of claim 1, wherein the request for access control data for the first application comprises network path information for a network path, and wherein determining the second access control data from the first access control data comprises determining second device dependent access control data from the first device dependent access control data based on an association between the second device dependent access control data and a device in the network path.
7. The computer-implemented method of claim 1, wherein the request for access control data for the first application comprises an application identifier for the first application and network path information for a network path, and wherein determining the second access control data from the first access control data comprises determining the second access control data using the application identifier and the network path information.
8. The computer-implemented method of claim 7, wherein the second access control data comprises second device dependent access control data from the first device dependent access control data, and wherein determining the second access control data using the application identifier and the network path information comprises determining the first access point-dependent access control data based on an association between the first access point-dependent access control data and the application identifier and determining the second device dependent access control data from the first device dependent access control data based on an association between the second device dependent access control data and a device in the network path.
9. The computer-implemented method of claim 1, wherein the request for access control data for the first application comprises an application identifier for the first application, an access point identifier for an access point and network path information for a network path, and wherein determining the second access control data from the first access control data comprises determining the second access control data using the application identifier, the access point identifier and the network path information.
10. The computer-implemented method of claim 9, wherein the second access control data comprises second device dependent access control data from the first device dependent data, and wherein determining the second access control data using the application identifier, the access point identifier and the network path information comprises: determining the first access point-dependent access control data based on an association between the first access point-dependent access control data and the application identifier and the access point identifier; and determining the second device dependent access control data from the first device dependent access control data based on an association between the second device dependent access control data and a device in the network path.
11. The computer-implemented method of claim 1, further comprising: receiving, over the network, a request for access control data for a second application; and servicing the request for access control data for the second application to return third access control data over the network to control access by the second application to the application data over the network, wherein servicing the request for access control data for the second application comprises determining the third access control data from the first access control data, the third access control data comprising second access point-dependent access control data from the first device dependent access control data.
12. The computer-implemented method of claim 11, wherein the first application and the second application execute on a same computing device.
13. The computer-implemented method of claim 1, wherein the second access point-dependent access control data comprises an access point identifier and an associated level of access.
14. The computer-implemented method of claim 1, wherein the second access point-dependent access control data comprises a plurality of access point identifiers and an associated level of access for each of the plurality of access point identifiers.
15. The computer-implemented method of claim 1, wherein the request for the access control data for the first application is serviced by a first computing device, the first application executes on a second computing device, and the application data is hosted by a third computing device.
16. A computer program product comprising a non-transitory, computer-readable medium, the non-transitory, computer-readable medium storing computer-executable instructions, the computer-executable instructions comprising instructions for: accessing a datastore storing first access control data, the first access control data comprising first device dependent access control data for a plurality of applications; receiving, over a network, a request for access control data for a first application; and servicing the request for access control data for the first application to return second access control data over the network to control access by the first application to application data over the network, wherein servicing the request for access control data for the first application comprises determining the second access control data from the first access control data, the second access control data comprising first access point-dependent access control data from the first device dependent access control data.
1. A computer-implemented method for controlling application access to data, the method comprising: accessing a datastore storing first access control data for a plurality of applications, the first access control data comprising first device dependent access control data for a plurality of applications; receiving, over a network, a request for access control data for a first application, wherein the request for access control data for the first application comprises: an access point identifier for an access point used by the first application; an application identifier for the first application, and network path information for a network path; and servicing the request for access control data for the first application to return second access control data over the network to control access by the first application to application data over the network, wherein servicing the request for access control data for the first application comprises determining the second access control data from the first access control data, wherein the determining comprises determining the second access control data using the application identifier, the access point identifier and the network path information, the second access control data comprising first access point-dependent access control data from the first device dependent access control data, wherein the second access point-dependent access control data specifies a level of access for the first application when using the access point identified by the access point identifier to access the application data.
2. The computer-implemented method of claim 1, wherein the request for access control data for the first application comprises the access point identifier for an access point, wherein determining the second access control data from the first access control data comprises determining the first access point-dependent access control data from the first device dependent access control data based on an association between the first access point-dependent access control data and the access point identifier.
3. The computer-implemented method of claim 1, wherein the application identifier identifies the first application, and wherein the determining of the second access control data from the first access control data comprises determining the second access control data based on an association between the second access control data and the application identifier.
4. The computer-implemented method of claim 1, wherein the request for access control data for the first application comprises an application identifier identifying the first application and the access point identifier identifying an access point, wherein determining the second access control data from the first access control data comprises identifying the second access control data from the first access control data using the application identifier and the access point identifier.
5. The computer-implemented method of claim 4, wherein the determining of the second access control data from the first access control data comprises determining that the first access point-dependent access control data is associated with both the application identifier and the access point identifier.
6. The computer-implemented method of claim 1, wherein the request for access control data for the first application comprises network path information for a network path, and wherein determining the second access control data from the first access control data comprises determining second device dependent access control data from the first device dependent access control data based on an association between the second device dependent access control data and a device in the network path.
7. The computer-implemented method of claim 1, wherein the request for access control data for the first application comprises an application identifier for the first application and network path information for a network path, and wherein determining the second access control data from the first access control data comprises determining the second access control data using the application identifier and the network path information.
8. The computer-implemented method of claim 7, wherein the second access control data comprises second device dependent access control data from the first device dependent access control data, and wherein determining the second access control data using the application identifier and the network path information comprises determining the first access point-dependent access control data based on an association between the first access point-dependent access control data and the application identifier and determining the second device dependent access control data from the first device dependent access control data based on an association between the second device dependent access control data and a device in the network path.
9. The computer-implemented method of claim 1, wherein the second access control data comprises second device dependent access control data from the first device dependent data, and wherein determining the second access control data using the application identifier, the access point identifier and the network path information comprises: determining the first access point-dependent access control data based on an association between the first access point-dependent access control data and the application identifier and the access point identifier; and determining the second device dependent access control data from the first device dependent access control data based on an association between the second device dependent access control data and a device in the network path.
10. The computer-implemented method of claim 1, further comprising: receiving, over the network, a request for access control data for a second application; and servicing the request for access control data for the second application to return third access control data over the network to control access by the second application to the application data over the network, wherein servicing the request for access control data for the second application comprises determining the third access control data from the first access control data, the third access control data comprising second access point-dependent access control data from the first device dependent access control data.
11. The computer-implemented method of claim 10, wherein the first application and the second application execute on a same computing device.
12. The computer-implemented method of claim 1, wherein the second access point-dependent access control data comprises the access point identifier and an associated level of access.
13. The computer-implemented method of claim 1, wherein the second access point-dependent access control data comprises a plurality of access point identifiers and an associated level of access for each of the plurality of access point identifiers.
14. The computer-implemented method of claim 1, wherein the request for the access control data for the first application is serviced by a first computing device, the first application executes on a second computing device, and the application data is hosted by a third computing device.
15. A computer program product comprising a non-transitory, computer-readable medium, the non-transitory, computer-readable medium storing computer-executable instructions, the computer-executable instructions comprising instructions for: accessing a datastore storing first access control data, the first access control data comprising first device dependent access control data for a plurality of applications; receiving, over a network, a request for access control data for a first application, wherein the request for access control data for the first application comprises an access point identifier for an access point used by the first application; servicing the request for access control data for the first application to return second access control data over the network to control access by the first application to application data over the network, wherein servicing the request for access control data for the first application comprises determining the second access control data from the first access control data, the second access control data comprising first access point-dependent access control data from the first device dependent access control data, wherein the second access point-dependent access control data specifies a level of access for the first application when using the access point identified by the access point identifier to access the application data; receiving, over the network, a request for access control data for a second application; and servicing the request for access control data for the second application to return third access control data over the network to control access by the second application to the application data, wherein servicing the request for access control data for the second application comprises determining the third access control data from the first access control data, the third access control data comprising second access point-dependent access control data from the first device dependent access control data.
This is a non-provisional double patenting rejection since the conflicting claims have in fact been patented.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-7,12-16, and 18-20 are rejected under 35 U.S.C. 103 as being unpatentable over Kariv et al. (US Patent Application No. 20110307947) (Hereinafter Kariv) in view of Horn et al. (US Patent Application No. 20090129338) (Hereinafter Horn).
As per claim 1, Kariv discloses a computer-implemented method for controlling application access to data, the method comprising:
accessing a datastore storing first access control data for a plurality of applications (fig 2, para 30, controlled by the enterprise and may have access to the enterprise's identity management and access policy infrastructure, either directly (e.g., having direct access to one or more databases storing user identity information and/or access policies);
receiving, over a network, a request for access control data for a first application (fig 3, para 44 , the client computer 310 initiates the interactions at act by sending an access request to the hosted resource.); and
servicing the request for access control data for the first application to return second access control data over the network (fig 3, para 44-46, a request for a security token ) to control access by the first application to application data over the network, wherein servicing the request for access control data for the first application comprises determining the second access control data from the first access control data (fig 3, para 46, a request for a security token to provide security token), the second access control data (para 46 , security token) comprising first access point-dependent access (para 53, gateway) control data from the first device dependent access control data(fig 3-4, para 52-53, the enterprise access gateway may allow by intercepting communications directed to the enterprise.).
Kariv does not specifically disclose the first access control data comprising first device dependent access control data for a plurality of applications. However, Horn discloses the first access control data comprising first device dependent access control data for a plurality of applications (para 13, 15, 47, 48, 57, 63, 69 the apparatus/mobile device determines an identifier of the access point).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Kariv in view of Horn to determine access control data for a second application and control access to data over the network by the second application in order to provide granular access control over applications executing on the device.
The Examiner notes that this motivation applies to all dependent and/or otherwise subsequently addressed claims.
As per claim 2, claim is rejected for the same reasons and motivation as claim 1, above. In addition, Horn discloses the request for access control data for the first application comprises an access point identifier for an access point (para 13, 15, 47, 48, 57, 63, 69 the apparatus/mobile device determines an identifier of the access point), wherein determining the second access control data from the first access control data comprises determining the first access point-dependent access control data from the first device dependent access control data based on an association between the first access point-dependent access control data and the access point identifier par.13, 15, 47, 48, 57, 63, 69, the apparatus/mobile device determines an identifier of the access point).
As per claim 3, claim is rejected for the same reasons and motivation as claim 1, above. In addition, Horn discloses, wherein the request for access control data for the first application comprises an application identifier identifying the first application, and wherein determining the second access control data from the first access control data comprises determining the second access control data based on an association between the second access control data and the application identifier (para 55-58, broadcast signal evaluator 302 and an access list controller determine access point identifier and the restricted association indicator, determine which access point to connect to based on the restricted association and the list).
As per claim 4, claim is rejected for the same reasons and motivation as claim 1, above. In addition, Horn discloses wherein the request for access control data for the first application comprises an application identifier identifying the first application and an access point identifier identifying an access point, wherein determining the second access control data from the first access control data comprises identifying the second access control data from the first access control data using the application identifier and the access point identifier (para 44-45, there are a plurality of access points and the mobile device can attempt to reselect an access point with highest ranking among the plurality of access points, as discussed above, are also applied for other access points, e.g. a second access point. ).
As per claim 5, claim is rejected for the same reasons and motivation as claim 1, above. In addition, Horn discloses wherein determining the second access control data from the first access control data comprises determining that the first access point-dependent access control data is associated with both the application identifier and the access point identifier(para 55-58, broadcast signal evaluator 302 and an access list controller 304; para 47-48, 51-53, 58, determining which access point to connect to based on the restricted association and the list).
As per claim 6, claim is rejected for the same reasons and motivation as claim 1, above. In addition, Horn discloses wherein the request for access control data for the first application comprises network path information for a network path, and wherein determining the second access control data from the first access control data comprises determining second device dependent access control data from the first device dependent access control data based on an association between the second device dependent access control data and a device in the network path (para 44-45 there are a plurality of access points and the mobile device can attempt to reselect an access point with highest ranking among the plurality of access points, as discussed above, are also applied for other access points, e.g. a second access point). Kariv disclose network path (para 44, such as by using a Universal Resource Locator (URL)).
As per claim 7, claim is rejected for the same reasons and motivation as claim 1, above. In addition, Horn discloses, wherein the request for access control data for the first application comprises an application identifier for the first application and network path information for a network path, and wherein determining the second access control data from the first access control data comprises determining the second access control data using the application identifier and the network path information (Notes: Examiner interprets “a path to a target server” recited here in the claim can simply be device(s) through which a mobile device transmits data/request to the target server. see para 44-48, the mobile device utilizes access points to access to computer resources at a corporation. One or more of the access points can be restricted access points which restrict the mobile device from accessing the resources. The mobile device detects a restricted association indicator in the broadcast signal and additionally evaluate/compare the access point to a list of accessible identifiers to determine whether to utilize the access point to access the resources).
As per claim 12, claim is rejected for the same reasons and motivation as claim 1, above. In addition, Kariv discloses wherein the first application and the second application execute on a same computing device (para 58, fig 5, application programs).
As per claim 13, claim is rejected for the same reasons and motivation as claim 1, above. In addition, Horn discloses wherein the second access point-dependent access control data comprises an access point identifier and an associated level of access (para 47, the restricted association indicator can indicate a level of restricted association; the access point can restrict all access and/or signaling access, data access).
As per claim 14, claim is rejected for the same reasons and motivation as claim 1, above. In addition, Horn discloses wherein the second access point-dependent access control data comprises a plurality of access point identifiers and an associated level of access for each of the plurality of access point identifiers (para 94, the type can relate to restricted association indicators and/or enumerations of indicators for varying levels of restriction).
As per claim 15, claim is rejected for the same reasons and motivation as claim 1, above. In addition, Kariv discloses, wherein the request for the access control data for the first application is serviced by a first computing device, the first application executes on a second computing device, and the application data is hosted by a third computing device (fig 2, access gateway , enterprise server, client computer).
As per claim 16, claim is rejected for the same reasons and motivation, as claim 1, above.
As per claim 18, claim is rejected for the same reasons and motivations as claims 16 and 3, above.
As per claim 19, claim is rejected for the same reasons and motivations as claims 16 and 4, above.
As per claim 20, claim is rejected for the same reasons and motivation as claims 16 and 6, above.
Conclusion
Please see the attached PTO-892 for the prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MOHAMMAD A SIDDIQI whose telephone number is (571)272-3976. The examiner can normally be reached Monday-Friday.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Carl G Colin can be reached at 571-272-3862. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MOHAMMAD A SIDDIQI/Primary Examiner, Art Unit 2493
Prosecution Insights