DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statement (IDS) submitted by applicant dated 04/01/2025, 04/11/2025, 06/11/2025, 10/01/2025, 11/07/2025, 11/07/2025, 02/19/2026, 03/20/2026, 06/05/2026 have been considered by the examiner.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 1-4, 6-13 and 15-20 are rejected on the ground of nonstatutory obviousness-type double patenting as being unpatentable over claims 1-4, 7-8, 10-13 and 16 of USPN 12,301,556 (Appl. No: 18/162947). Although the claims at issue are not identical, they are not patentably distinct from each other. (see Claim-Comparison Table below for independent claim 1 of the instant application against Claims 1 and 2 of 12,301,556).
Claim
Application#19/079791
Claim
USPN # 12,301,556
1
A method comprising:
receiving, by a control plane of a first cloud infrastructure, a first request from a user associated with an account in a second cloud infrastructure, the first request requesting use of a service provided by the first cloud infrastructure and including a first token associated with the second cloud infrastructure; validating, by the control plane of the first cloud infrastructure, the first token associated with the second cloud infrastructure;
responsive to successfully validating the first token, generating by the control plane a second token that is associated with the first cloud infrastructure, wherein the second token is generated based on a configuration application that is previously setup between the first cloud infrastructure and the second cloud infrastructure; and
transmitting, by the control plane, the second token to the service provided by the first cloud infrastructure.
1&2
A method comprising:
receiving, by a multi-cloud infrastructure included in a first cloud infrastructure provided by a first cloud service provider (CSP), a first request from a user associated with an account in a second cloud infrastructure provided by a second CSP, the first request requesting use of a service provided by the first cloud infrastructure and including a first token issued by the second CSP;
validating, by the multi-cloud infrastructure, the first token issued by the second CSP; responsive to successfully validating the first token, sending by the multi-cloud infrastructure, a second request requesting a second token to an identity system of the first CSP, wherein the second request is a signed request including the first token, and wherein the identity system of the first CSP validates the first token based on a public key obtained from the second cloud infrastructure;
obtaining, by the multi-cloud infrastructure, the second token issued by the first CSP, wherein the second token is usable by the service, and the first token is not usable by the service; and
transmitting, by the multi-cloud infrastructure, the second token to the service, wherein the second token enables the user to utilize the service provided by the first cloud infrastructure.
wherein the second token is obtained by the multi-cloud infrastructure based on a configuration that is previously setup between the first CSP and the second CSP.
Claims 2-4, 6-13 and 15-20 of the instant application is equivalent in scope with claims 1-4, 7-8, 10-13 and 16 of USPN 12,301,556.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-4, 6-7, 10-13, 15-16 and 19-20 are rejected under 35 U.S.C. 103 as being unpatentable over Sitaram et al. “Keystone Federated Security” (hereinafter Sitaram), in view of Hinton et al. US2006/0236382 (hereinafter Hinton).
As per claim 1, Sitaram teaches a method comprising: receiving, by a control plane of a first cloud infrastructure, a first request from a user associated with an account in a second cloud infrastructure, the first request requesting use of a service provided by the first cloud infrastructure and including a first token (Sitaram Page 660 Figure 1, Section B. Pages 662-663 Section C, Section D, a user is associated with an account at the primary cloud. User sends request to foreign gateway of the remote cloud, the request including the GAT);
validating, by the control plane of the first cloud infrastructure, the first token (Sitaram Page 663 Section D, validate GAT);
responsive to successfully validating the first token, generating by the control plane a second token that is associated with the first cloud infrastructure, wherein the second token is generated based on a configuration application that is previously setup between the first cloud infrastructure and the second cloud infrastructure (Sitaram Page 663 Section D, the remote cloud issues the TAT. Sitaram Page 660 Section A, Section B, trust configuration between the primary cloud and remote cloud); and
transmitting, by the control plane, the second token to the service provided by the first cloud infrastructure (Sitaram Page 663 Section D, User sends request to service including the TAT).
Sitaram does not explicitly disclose first token associated with the second cloud infrastructure.
Hinton teaches first token associated with the second cloud infrastructure (Hinton paragraph [0131], domain 610 issues federated single sign on token).
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Sitaram of requesting access to a service with a first token with the teachings of Hinton to include generating a federated single sign on token at the first domain in order to allow the primary cloud to generate the GAT token. It would have also been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Sitaram of validating the user with the teachings of Hinton to include determining an identity mapping between the first and second domain in order to create a new local user account in the remote cloud when the user does not have an account in the remote cloud.
As per claim 2, Sitaram in view of Hinton teaches the method of claim 1, wherein the first cloud infrastructure is provided by a first cloud service provider (CSP) and the second cloud infrastructure is provided by a second CSP, the first cloud infrastructure being different than the second cloud infrastructure and the first CSP being different than the second CSP (Sitaram Page 659 Section 1, page 660 Section A, page 663 Section D, primary cloud and remote cloud are owned by different providers.).
As per claim 3, Sitaram in view of Hinton teaches the method of claim 1, wherein the first token is not usable by the service provided by the first cloud infrastructure and the second token is usable by the service provided by the first cloud infrastructure (Sitaram Page 663 Section D, the remote cloud issues the TAT. User sends request for service including the TAT to the remote cloud) (It is obvious to one of ordinary skill in the art that since the TAT is usable and obtained for the service, the GAT is not usable by the service; Hinton paragraph [0131]).
As per claim 4, Sitaram in view of Hinton teaches the method of claim 1, wherein the configuration application includes information mapping an identity of the user in the second cloud infrastructure to a corresponding user identity in the first cloud infrastructure (Sitaram Page 663 Section D, Section E, Page 664 Section E, database includes configuration information that maps user’s primary cloud ID, with user’s role and user’s foreign cloud ID; Hinton paragraph [0134]-[0136], configuration includes user identify mapping between the two domains).
As per claim 6, Sitaram in view of Hinton teaches the method of claim 1, further comprising: validating the user that issued the first request by analyzing a subject attribute and a subject mapping attribute included in the configuration application to determine existence of the user in a domain of the first cloud infrastructure (Sitaram Page 663 Section D, validate user and generate TAT; Hinton paragraph [0132]-[0136], analyze identity mapping for the user and generate local token).
As per claim 7, Sitaram in view of Hinton teaches the method of claim 6, further comprising: responsive to determining that the user does not exist in the domain of the first cloud infrastructure, creating, the account for the user associated with the first cloud infrastructure (Sitaram Page 660 Figure 1, Page 663 Section D; Hinton paragraph [0168], [0170], if the user does not have account in the domain, create a new account for the user).
As per claims 10-13, 15-16 and 19-20, the claims claim a computer readable non-transitory media and a computing device essentially corresponding to the method claims 1-4 and 6-7 above, and they are rejected, at least for the same reasons.
Claims 5, 8, 14 and 17 are rejected under 35 U.S.C. 103 as being unpatentable over Sitaram in view of Hinton, and further in view of Jamkhedkar et al. US2019/0386831 (hereinafter Jamkhedkar).
As per claim 5, Sitaram in view of Hinton teaches the method of claim 4, further comprising: attribute included in the configuration application (Sitaram Page 663 Section D, Section E, Page 664 Section E, database includes configuration information that maps user’s primary cloud ID, with user’s role and user’s foreign cloud ID; Hinton paragraph [0134]-[0136], configuration includes user identify mapping between the two domains).
Sitaram in view of Hinton does not explicitly disclose determining, a lifetime of second token based on a first attribute, wherein the lifetime of the second token corresponds to an amount of time the second token is usable.
Jamkhedkar teaches determining, a lifetime of second token based on a first attribute, wherein the lifetime of the second token corresponds to an amount of time the second token is usable (Jamkhedkar paragraph [0066]-[0067], claim 2, expiration for a token).
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Sitaram in view of Hinton of generating a second token with the teachings of Jamkhedkar to include generating a token with a plurality of attributes such as issuer, expiration time, etc. in order to indicate the issuer of the token and provide an expiration for the token for security purposes.
As per claim 8, Sitaram in view of Hinton teaches the method of claim 1, wherein the configuration application comprises a plurality of attributes including: a subject attribute corresponding to an actor who is authenticated at a second CSP, a subject mapping attribute corresponding to a second ID of the subject attribute in the first CSP (Sitaram Page 663 Section D, Section E, Page 664 Section E, database includes configuration information that maps user’s primary cloud ID, with user’s role and user’s foreign cloud ID; Hinton paragraph [0134]-[0136], configuration includes user identify mapping between the two domains).
Sitaram in view of Hinton does not explicitly disclose a provider attribute corresponding to a first ID of a service provider (SP) issuing a token, a type attribute corresponding to a standard for exchanging authorization/authentication information, a signature attribute corresponding to a signature of the token, and a claims attribute corresponding to an expiration time of the token.
Jamkhedkar teaches a provider attribute corresponding to a first ID of a service provider (SP) issuing a token, a type attribute corresponding to a standard for exchanging authorization/authentication information, a signature attribute corresponding to a signature of the token, and a claims attribute corresponding to an expiration time of the token (Jamkhedkar paragraph [0066]-[0067], claim 2, plurality of attributes for a token).
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Sitaram in view of Hinton of generating a second token with the teachings of Jamkhedkar to include generating a token with a plurality of attributes such as issuer, expiration time, etc. in order to indicate the issuer of the token and provide an expiration for the token for security purposes.
As per claims 14 and 17, the claims claim a computer readable non-transitory media essentially corresponding to the method claims 5 and 8 above, and they are rejected, at least for the same reasons.
Claims 9 and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Sitaram in view of Hinton, and further in view of Engan et al. US 2019/0312733 (hereinafter Engan).
As per claim 9, Sitaram in view of Hinton teaches the method of claim 1.
Sitaram in view of Hinton does not explicitly disclose wherein first infrastructure further validates first token based on a public key obtained from second infrastructure.
Engan teaches wherein first infrastructure further validates first token based on a public key obtained from second infrastructure (Engan paragraph [0019], verify token based on a public key).
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Sitaram of validating the first token with the teachings of Engan to include signing a token and verifying the signature of the token with a public key in order to provide authentication of origin and integrity protection of the first token.
As per claim 18, the claim claims a computer readable non-transitory media essentially corresponding to the method claim 9 above, and is rejected, at least for the same reasons.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to HENRY TSANG whose telephone number is (571)270-7959. The examiner can normally be reached M-F 9am - 5pm EST.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Farid Homayounmehr can be reached at (571) 272-3739. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/HENRY TSANG/Primary Examiner, Art Unit 2495
Prosecution Insights