DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-20 have been examined.
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 7/29/26 has been entered.
Response to Arguments
Applicant’s arguments with respect to claims 1-20 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument. Specifically, Nguyen et al. U.S. 2024/0126916 is relied upon for the newly recited limitation.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-3, 5-10, 12-17, 19 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Kominar et al. U.S. 2018/0248698 (hereinafter Kominar) in view of KishorVarshney et al. U.S. 2007/0245032 (hereinafter KishorVarshney) and further in view of Nguyen et al. U.S. 2024/0126916 (hereinafter Nguyen).
As per claim 1, 8, 15, Kominar discloses a method/system/CRM for managing authentication information for a user, comprising:
a processor set (Kominar: Fig. 9);
a set of one or more computer-readable storage media (Kominar: Fig. 9; [0088]-[0089]); and
program instructions stored on the set of one or more storage media to cause the processor set to perform operations comprising:
intercept a user input entered by the user, wherein the user input comprises textual data to be sent to a computer network (Kominar: Fig. 3; [0036]; [0058]-[0059]: monitor text input) ;
transmit textual data from the user input to a software tool for managing passwords in an encrypted fashion (Kominar: [0019]: password manager program; [0059]: check to see if entered text is likely a password; Figs. 5-7 and [0068]-[0074]: software to detect inadvertent entry of password);
generate a number of permutations based on the textual data from the user input using the software tool (Kominar: [0019]-[0020]: when a user enters a word whose one or more hash values matches a stored hash value, that entered word is likely password that was inadvertently entered via application and operating system; [0051]: input monitor is able to generate compute hash values for each dataset entered into the input field; [0070]-[0071]: multiple hash values are able to be determined for a particular input dataset to support various processing);
compare each permutation from the number of permutations to a list of passwords stored in the software tool to generate a number of comparisons using the software tool (Kominar: [0040]-[0044]: generate password tokens based on entered text and compare with stored password tokens; [0051]: compare the calculated hash values to the hash value storage);
determine whether the textual data from the user input comprises authentication information for the user based on the number of comparisons (Kominar: [0041]-[0044]: determine if the entered text is likely password); and
in response to determining that the textual data from the user input comprises authentication information for the user, alerting the user before the textual data from the user input is sent to the computer network (Kominar: [0064]: the user is notified and various protection measures can be taken).
Kominar does not explicitly disclose generating, by a processor set, a list of URLs for a number of trusted pages, wherein URL from the list of URLs prevent interception of user inputs from the user, in responsive to determining that the user is not providing a user input using the number of trusted pages based on the list of URLs, intercept the user input, and wherein the list of URLs for the number of trusted pages are stored in the software tool. However, KishorVarshney discloses a data blocker module coupled to browser to monitor user’s communication, wherein the data blocker module is bypassed when the communication is directed toward trusted website according to a list of trusted URLs (KishorVarney: Fig. 4; [0005]-[0009]; [0051]-[0052]). It would have been obvious to one having ordinary skill in the art to bypass processing or monitoring of browser communication when the website is on the list of trusted URLs because Kominar and KishorVarney are in the same field of endeavor of monitoring user input data to prevent data leakage through browser. The motivation to combine would be to reduce unnecessary monitoring/analysis and improve resource utilization as well known in the art. Kominar discloses monitoring input from keyboard to detect entry of password or sensitive information into non-password entry field (Kominar: [0020]). Kominar does not explicitly disclose monitoring keystroke input from the user to continuously check inputs separated by spaces against the list of passwords using an operating system linked to the software tool. However, Nguyen discloses monitoring keystroke through keystroke listener to detect patterns of keystrokes that were identified as being an entry of sensitive data using machine learning model (Nguyen: Fig 1: monitor input via user device to detect entry of sensitive information; Fig. 6; [0116]-[0120]: listening to keystrokes on the user device to identify pattern of the keystrokes). It would have been obvious to one having ordinary skill in the art to monitor keystrokes from keyboard to detect and identify sensitive data entered into data fields based on pattern or list because Nguyen and Kominar are in the same field of endeavor of preventing inadvertent disclosure of sensitive information. The motivation to combine would be to detect and identify entry at early phase of user interaction.
As per claim 2, 9, 16, Kominar discloses the limitations of claims 1, 8 and 15 respectively. Kominar further discloses wherein the operations further comprise: in response to determining that the textual data from the user input does not comprise authentication information for the user, sending the textual data to the computer network (Kominar: [0060]: if it’s likely password, protective measures are taken, otherwise no security action is taken).
As per claim 3, 10 and 17. Kominar discloses the limitations of claims 1, 8 and15 respectively. Kominar further discloses notifying user and modifying display of the likely password (Kominar: [0060]). Kominar does not explicitly disclose wherein the operations further comprise: receiving, by the processor set, a second user input from the user to edit the textual data from the user input. However, it would have been obvious to one having ordinary skill in the art to notify the user and prompt user to edit the input to prevent disclosure of sensitive information as well known in the art.
As per claim 5 and 12, Kominar discloses the limitations of claims 1 and 8 respectively. Kominar further discloses wherein the computer network comprises a social application for receiving the textual data from the user input (Kominar: [0016]-[0017]).
As per claim 6, 13 and 19, Kominar discloses the limitations of claims 1, 8 and 15 respectively. Kominar further discloses wherein the number of permutations comprise arrangement for a given set of elements including characters, words, or phrases from the textual data (Kominar: [0040]-[0044]: monitor texts entered into input fields to determine token values, which are permutations of the text inputs).
As per claim 7, 14 and 20, Kominar discloses the limitations of claims 1, 8 and 15 respectively. Kominar further discloses wherein the textual data is masked on a graphical user interface (Kominar: [0060]: display of the likely password is replaced with asterisks, blurred or obscured). Kominar does not explicitly disclose masking data during a screen share that involves the user. However, the system of Kominar would effectively prevent disclosure of content displayed on screen whether via screen sharing or local display.
Claims 4, 11 and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Kominar in view of KishorVarshney and further in view of Nguyen and further in view of Kendapadi et al. U.S. 2024/0171398 (hereinafter Kendapadi).
As per claim 4, 11 and 18. Kominar discloses the limitations of claims 1, 8 and 15 respectively. Kominar does not explicitly disclose wherein the comparisons between each permutation from the number of permutations to a list of passwords stored in the software tool are performed using a machine learning model. However, Kendapadi discloses machine learning model to determine similarity between entered credential/password with stored password (Kendapadi: [0101]-[0102]). It would have been obvious to one having ordinary skill in the art to use similarity machine learning model to determine likelihood of password entry to enhance capability of handling various types of data based on different permutations.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Fitzgerald et al. U.S. 2013/0091564 discloses method for mitigating the unauthorized use of a device by logging of keystrokes to identify unauthorized user.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SHIN HON (ERIC) CHEN whose telephone number is (571)272-3789. The examiner can normally be reached Monday to Thursday 9am- 7pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lynn Feild can be reached at 571-272-2092. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SHIN-HON (ERIC) CHEN/ Primary Examiner, Art Unit 2431
