DETAILED ACTION
This Office Action is in response to application 18/408,969 filed on January 10, 2024.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claims 1 is pending and herein considered.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 01/10/2024 is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/process/file/efs/guidance/eTD-info-I.jsp.
Claims 1-22 rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-23 the following U.S. Patent No. 11,909,730 in view of Innes et al. (Innes) 2014/0331297.
U.S. Patent No. 11,909,730 fails to explicitly disclose: creating, by the first device, a session key for the third device; encrypting, by the first device, the session key using a symmetric key; However, in the same field of endeavor, Innes discloses a system and method for creating, by the first device, a session key for the third device; encrypting, by the first device, the session key (Innes: par. [0156] In step 952, if the signature is valid (step 950: Y), the resource/authentication server may generate and/or send a session key to the proxy device 710. In Kerberos authentication, the resource/authentication server may also send a ticket, such as a TGT or a service ticket, to the proxy device 710. The session key and/or ticket may be encapsulated using another key that the proxy device 710 and/or the client device 705 can decrypt). Giving the teaching of Innes, a person having ordinary skills in the art would have readily recognized the desirability and advantages of modifying U.S. Patent No. 11,909,730, such as disclosed by Innes, in order to improve security and prevent the unauthorized access of session key.
19038785
Patent 12261835
A method comprising:determining a remote attack surface of a network of an organization, wherein determining the remote attack surface of the network of the organization comprises,determining, based on indications of a plurality of public Internet Protocol (IP) addresses used by a plurality of endpoint devices issued by the organization, if any of the plurality of endpoint devices connected to an external network not associated with the organization during a first time window, wherein determining if any of the plurality of endpoint devices connected to an external network during the first time window comprises determining if any of the plurality of public IP addresses are not associated with the organization ;determining that a first of the plurality of endpoint devices connected to a first external network during the first time window based on determining that a first of the plurality of public IP addresses used by the first endpoint device is not associated with the organization, wherein the first public IP address is associated with the first external network;retrieving first data obtained from probing the first public IP address; and determining, based on the first data obtained from probing the first public IP address, that the first external network is associated with a first security risk; andindicating the remote attack surface of the network of the organization and any associated security risks, wherein the remote attack surface comprises the first endpoint device, and wherein the associated security risks comprise the first security risk.
A method comprising:based on analyzing first endpoint data obtained from a plurality of endpoint devices associated with an organization,determining that a first endpoint device of the plurality of endpoint devices has established a first network connection to a first external network that is not associated with the organization based, at least in part, on determining that a first public Internet Protocol (IP) address corresponding to the first external network is not associated with the organization; and determining that a second endpoint device of the plurality of endpoint devices has established a second network connection to a second external network that is not associated with the organization, wherein the second external network is different from the first external network;correlating a first subset of the first endpoint data corresponding to the first endpoint device with first data obtained from probing the first public IP address associated with the first external network;correlating a second subset of the first endpoint data corresponding to the second endpoint device with second data obtained from probing a second public IP address associated with the second external network;determining, based on at least one of the first data and the second data, that at least one of the first external network and the second external network is associated with a security risk; andindicating that at least one of the first network connection established by the first endpoint device and the second network connection established by the second endpoint device is a security issue for the organization.
Related Art
The following prior art made of record and cited on PTO-892, but not relied upon, is considered pertinent to applicant’s disclosure:
Henry et al. (US Patent No. 6856800-B1, hereinafter “Henry”) teaches authentication credential includes a security certificate having a public key for the network access device and an expiration time. The security certificate is signed with a private key for the remote authentication server. The access point locally validates the authentication credential by accessing the public key of the remote authentication server from a local database, and checking the signature and expiration time of the security certificate. The access granted message includes a session key encrypted with a public key for the network access device.
Bagley (US Pre-Grant Publication No. 2006/0080545-A1) teaches public key infrastructures (PKIs), using a public/private key pair and a digital certificate, are examples of asymmetric encryption. Information encrypted with the public key can only be decrypted with the corresponding private key, and vice-versa. Typically, the public/private key pair and digital certificate are used for authentication and for exchanging a symmetric key to encrypt future exchanges.
Marathe et al. (US Patent No. 9787668-B1, hereinafter “Marathe”) teaches cryptographic protocol allows the custodial web service to use a digital certificate presented by the application and asymmetric cryptography to authenticate the application and to negotiate a symmetric session key for use in cryptographically encrypting data sent via the cryptographically secured network communications channel.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to VU V TRAN whose telephone number is (571)270-1708. The examiner can normally be reached M-F, 8 AM- 4 PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ashok Patel can be reached on 571-272-3972. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/VU V TRAN/ Primary Examiner, Art Unit 2491
Prosecution Insights