DETAILED ACTION
This action is in response to the application filed on February 17, 2025. Claims 1-20 are pending. Of such, claims 1-10 represent a method, and claims 11-20 represent an apparatus directed to managing dynamic access control and single log-out for current and future sessions in federated identity management systems.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Specification
The abstract of the disclosure is objected to because
The abstract contains the term “Fig. 1” at the end of the document and should be removed.
A corrected abstract of the disclosure is required and must be presented on a separate sheet, apart from any other text. See MPEP § 608.01(b).
The disclosure is objected to because of the following informalities:
In ¶ 1 of the specification, missing entry bracket for “0001]”.
In ¶ 3, Grammatical error, “on a first user accesses of one of several…”
In ¶ 53, the processors reference 503, however in Figure 5, reference 503 is directed to the databases.
In ¶ 53, Grammatical error “mechanisms to protect provide dynamic access control”
Appropriate correction is required.
The disclosure is objected to because it contains an embedded hyperlink and/or other form of browser-executable code (see ¶ 75 of specification). Applicant is required to delete the embedded hyperlink and/or other form of browser-executable code; references to websites should be limited to the top-level domain name without any prefix such as http:// or other browser-executable code. See MPEP § 608.01.
Drawings
The drawings are objected to because
On page 8 of the drawings, the drawings reference Fig. 7A and 7B however it seems to be a placeholder because pages 9 and 10 of the drawings reference Fig. 7A and 7B.
Corrected drawing sheets in compliance with 37 CFR 1.121(d) are required in reply to the Office action to avoid abandonment of the application. Any amended replacement drawing sheet should include all of the figures appearing on the immediate prior version of the sheet, even if only one figure is being amended. The figure or figure number of an amended drawing should not be labeled as “amended.” If a drawing figure is to be canceled, the appropriate figure must be removed from the replacement sheet, and where necessary, the remaining figures must be renumbered and appropriate changes made to the brief description of the several views of the drawings for consistency. Additional replacement sheets may be necessary to show the renumbering of the remaining figures. Each drawing sheet submitted after the filing date of an application must be labeled in the top margin as either “Replacement Sheet” or “New Sheet” pursuant to 37 CFR 1.121(d). If the changes are not accepted by the examiner, the applicant will be notified and informed of any required corrective action in the next Office action. The objection to the drawings will not be held in abeyance.
Claim Objections
Claims 1, 9, 11, 17, and 20 are objected to because of the following informalities:
Claim 1 – In line 6, the limitation describes “actions the first node takes” and in line 14 discloses “executing the action”. There is a singular/plural mismatch.
Claims 1, 11 – “single-sign on”, “single-sign-on”, and “Single Sign-On” used inconsistently throughout the claims and specification. The examiner recommends consistent verbiage throughout.
Claim 9, 17 – Bullets 1-4 discloses “access control” and bullets 5-8 disclose “an access control” – inconsistent.
Claim 9, 17 – Bullet 4 discloses “ a plurality of users associated with in the event message” is grammatically incorrect.
Claim 11 – In line 9, the limitation describes “defining actions” and in line 22 discloses “executing the action”. There is a singular/plural mismatch.
Claim 11 mixes the use of commas and semicolons. The examiner recommends to use semicolons consistently (i.e. “the processor;”)
Claims 9 and 17 – improper bullet points. A claim must be drafted as a single continued sentence.
Claim 19 and 20 – missing comma prior to the term “wherein”.
Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 9 and 17 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the enablement requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to enable one skilled in the art to which it pertains, or with which it is most nearly connected, to make and/or use the invention. Claim 9 and 17 disclose “adjusting implementation of an access control for a plurality of nodes and for a user other than the user referred to in the event message for a future sign-on session”. The specification fails to disclose how a node would identify or on what basis it would adjust access control for a user who is not the subject of the event message.
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 1 recites the limitation “the described event”. There is insufficient antecedent basis for this limitation in the claim.
Claim 2 recites the limitation “said triggering activities”. There is insufficient antecedent basis for this limitation in the claim.
Claims 4 and 14 recites the limitation “the event described in the event message”. There is insufficient antecedent basis for this limitation in the claim.
Claim 9 recites “selected from the group of scenarios including:” The term “including” renders the group open-ended and the metes and bounds indefinite.
Claim 9 discloses “a second node” and it is unclear if the second node disclosed in claim 9 is the same node as “at least one other node” disclosed in claim 1.
Claims 10 and 18 recites the limitation “the triggering action”. There is insufficient antecedent basis for this limitation in the claim.
Claims 10 and 18 recites the limitation “the first user”. There is insufficient antecedent basis for this limitation in the claim.
Claims 10 and 18 recites the limitation “the identify provider”. There is insufficient antecedent basis for this limitation in the claim.
Claims 10 and 18 recites the limitation “the corresponding action”. There is insufficient antecedent basis for this limitation in the claim.
Claim 10, 18 – discloses the limitation “a federated single-log out message performed by the first user” is indefinite. It is unclear whether the trigger is the user’s log out action or the message.
Claim 10, 18 – There is an inconsistency where Claim 10 requires a user to perform a trigger operation and the identify provider transmitting the event message however in claim 1, the first node is to receive the event message from another node. It is unclear how Claim 10 sits inside of Claim 1’s framework.
Claim 11 – “the identify provider” and “the identify provider server” lack antecedent basis and unclear if they are the same entity.
Claim 11 – There are duplicate and conflicting limitations of the dynamic access control rules. The non-volatile storage facility comprises “dynamic access control rules defining actions the identify provider takes in response to event messages received from at least one node” and then proceeds with program instructions that “store… dynamic access control rules defining actions the identify provider server takes in response to event messages received from at least one other node of said plurality of nodes”. This discloses two different rules/definitions, different actors, and different sources. Unclear if these are to be the same rules and if so they are redundant.
Claim 11 recites the limitation “the described event”. There is insufficient antecedent basis for this limitation in the claim.
Claim 12 recites the limitation “the process”. There is insufficient antecedent basis for this limitation in the claim.
Claim 12 recites the limitation “said triggering activities”. There is insufficient antecedent basis for this limitation in the claim.
Claim 13 recites the limitation “the identity management system”. There is insufficient antecedent basis for this limitation in the claim.
Claim 20 – Claim 11 requires the recited steps to be performed by “the identify provider server”. Claim 20 requires the server to be “ a service provider server operated by a service provider”. This claim is directly contradictory.
The remaining dependent claims are rejected due to their dependency on claims 1 and 11.
The following is a quotation of 35 U.S.C. 112(d):
(d) REFERENCE IN DEPENDENT FORMS.—Subject to subsection (e), a claim in dependent form shall contain a reference to a claim previously set forth and then specify a further limitation of the subject matter claimed. A claim in dependent form shall be construed to incorporate by reference all the limitations of the claim to which it refers.
The following is a quotation of pre-AIA 35 U.S.C. 112, fourth paragraph:
Subject to the following paragraph [i.e., the fifth paragraph of pre-AIA 35 U.S.C. 112], a claim in dependent form shall contain a reference to a claim previously set forth and then specify a further limitation of the subject matter claimed. A claim in dependent form shall be construed to incorporate by reference all the limitations of the claim to which it refers.
Claim 13, 19, and 20 are rejected under 35 U.S.C. 112(d) or pre-AIA 35 U.S.C. 112, 4th paragraph, as being of improper dependent form for failing to further limit the subject matter of the claim upon which it depends, or for failing to include all the limitations of the claim upon which it depends.
Claim 13 – Claim 11 already recites “a federated identify management system” and claim 13 does not further limit the claim.
Claim 19 – Claim 11 already recites the steps being performed by “the identify provider server” and claim 19 does not further limit the claim.
Claim 20 – Claim 20 does not further limit the claim and contradicts the parent claim 11.
Applicant may cancel the claim(s), amend the claim(s) to place the claim(s) in proper dependent form, rewrite the claim(s) in independent form, or present a sufficient showing that the dependent claim(s) complies with the statutory requirements.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claim(s) 1 and 3-10 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Nethi et al. (US 20160099931), hereinafter referred to as Nethi.
Regarding Claim 1, Nethi discloses:
A method for operating a first node, in an identity management system supporting single-sign on to a plurality of nodes, to dynamically adjust access control in response to one or more events observed by one of the plurality of nodes (In ¶ 13, Nethi discloses “One example of SSO is the federated single sign on model (FSSO). FSSO links a user's identity across multiple SaaS providers.” and further discloses in ¶ 21 “The network device 103 may also include a single sign on service in which the authentication or login approved by the network device 103 is sent to the one or more SaaS providers 101.”), the method comprising: storing, by the first node, dynamic access control rules defining actions the first node takes in response to event messages received from at least one other node of said plurality of nodes (In ¶ 39, Nethi discloses “The single sign off service 133 may be configured to send the event message only when the trigger is of a specified type such as disconnect, logoff, and IP lease expiry. In another example, the single sign off service 133 may perform a redundancy check in which at least two network events are received from other switches or routers before the event trigger message is generated and sent to a SaaS provider or an identity server.” and further discloses in ¶ 37 “The session database 134 is a running list of the currently active sessions with SaaS providers”); receiving, by the first node, an event message from the at least one other node of said plurality of nodes (In ¶ 38, Nethi discloses “the layer 2 switches 123 and the layer 3 switches 125 may communicate any of the events described above to the edge router 127”); upon receiving, by the first node, the event message, determining whether the described event triggers a rule of said stored dynamic access control rules (In ¶ 38, Nethi discloses “Upon receiving or identifying a network trigger event, the edge router 127 may extract the IP address or other identifier for the endpoint from the network trigger event and query one or more of the session databases 132 and 134.”); and upon determining that the described event triggers a rule of said stored dynamic access control rules, executing the action indicated by said triggered rule (In ¶ 38, Nethi discloses “If there is an entry for such a session, the edge router 127 sends the network event trigger to the associated SaaS provider.” and further discloses in ¶ 25 “The signoff message instructs the one or more SaaS providers 101 to end active sessions associated with the endpoint 105.”).
Regarding Claim 3, Nethi discloses:
The method of Claim 1, wherein the identity management system is a federated identity management system. (In ¶ 13, Nethi discloses “One example of SSO is the federated single sign on model (FSSO). FSSO links a user's identity across multiple SaaS providers.”)
Regarding Claim 4, Nethi discloses:
The method of Claim 1, wherein the event described in the event message is an activity performed by a user. (In ¶ 30, Nethi discloses “The logoff event may be intentional (e.g., the user selects logoff) or unintentional (e.g., the endpoint is disconnected).”)
Regarding Claim 5, Nethi discloses:
The method of Claim 4, wherein the user is a registered user of a subset of the plurality of nodes. (In ¶ 37, Nethi discloses “The session database 134 is a running list of the currently active sessions with SaaS providers. Some endpoints may have multiple entries in the session database 134.” And further discloses in ¶ 56 “The entry in the session database may include a credential.”)
Regarding Claim 6, Nethi discloses:
The method of Claim 1, wherein the first node is an identity provider (In ¶ 14, Nethi discloses “ A SSO gateway is a network device configured to act as federation broker.” and further discloses in ¶ 36 “The authentication connector 131 establishes authentications between the endpoints and the network.”).
Regarding Claim 7, Nethi discloses:
The method of Claim 1, wherein the first node is a subscriber node in a publisher-subscriber scheme. (In ¶ 43, Nethi discloses “All network devices and services that listen for the network events may play the role of subscribers and purge corresponding authentication caches appropriately.” And further discloses in ¶ 40 “edge router 127 may publish the network event using a publish and subscribe (pub-sub) system.”)
Regarding Claim 8, Nethi discloses:
The method of Claim 1, wherein said action of said triggered rule is to transmit a take-action message to one or more nodes of said plurality of nodes. (In ¶ 25, Nethi discloses “The signoff message instructs the one or more SaaS providers 101 to end active sessions associated with the endpoint 105” and further discloses in ¶ 57 “At act S107, the communication interface 305 sends a signoff message based on the network event trigger to the SaaS provider from the entry.”)
Regarding Claim 9, Nethi discloses:
The method of Claim 4, wherein the event message is received from a second node, and wherein the action applies to a scenario selected from the group of scenarios including:* adjusting implementation of access control solely for the second node and solely for the user referred to in the event message for a current sign-on session * adjusting implementation of access control for a plurality of nodes and solely for the user referred to in the event message for a current sign-on session * adjusting implementation of access control solely for the second node and for a plurality of users associated with the event message for a current sign-on session * adjusting implementation of access control for a plurality of nodes and for a plurality of users associated with in the event message for a current sign-on session * adjusting implementation of an access control solely for the second node and solely for the user referred to in the event message for a future sign-on session * adjusting implementation of an access control for a plurality of nodes and solely for the user referred to in the event message for a future sign-on session * adjusting implementation of an access control solely for the second node and for a plurality of users associated with the event message for a future sign-on session * adjusting implementation of an access control for a plurality of nodes and for a user other than the user referred to in the event message for a future sign-on session. (In ¶ 25, Nethi discloses “Multiple sessions associated with the endpoint 105 at different services may be purged.” Wherein the examiner maps the alternative stated in the second bullet of this claim)
Regarding Claim 10, Nethi discloses:
The method of Claim 4, wherein the triggering action is a federated single-log out message performed by the first user and the corresponding action is transmission by the identity provider of an event message to a plurality of nodes having active single-sign-on sessions with the first user in order to log out the first user from the plurality of nodes. (In ¶ 47, Nethi discloses “access database 145 according to the identity to determine which of the services have an active session with the endpoint…address the signoff message to the corresponding services” and further discloses in ¶ 57 “The one or more SaaS providers purge the token or tokens associated with the session in response to the signoff message. ”)
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 2 and 11-20 are rejected under 35 U.S.C. 103 as being unpatentable over Nethi et al. (US 20160099931), hereinafter referred to as Nethi, in view of Barhudarian et al. (US 20210136076), hereinafter referred to as Barhudarian.
Regarding Claim 2, Nethi discloses the limitations of claim 1.
However, Nethi does not explicitly disclose access control policies.
Barhudarian discloses:
storing, by the first node, access control policies, wherein the dynamic access control rules modify implementation of the access control policies based on said triggering activities. (In ¶ 30, Barhudarian discloses “In some embodiments, the conditional access termination service 114 may be associated with a policy server including both set policies and the ability to enforce the set policies.”)
One in ordinary skill in the art of cryptography would have been motivated, before the effective filing date of the claimed invention to modify Nethi’s approach by utilizing Barhudarian’s approach of dynamically controlling access policies as the motivation would be to ensure instant enforcement of IT policies to resource providers as vulnerabilities may arise (See Barhudarian, ¶¶ 16, 18, 27).
Regarding Claim 11, Nethi discloses:
A server, operated as a first node in a federated identity management system operable to allowing federated single-sign on to a plurality of nodes, for dynamically adjusting access control in response to events observed by one of the plurality of nodes (In ¶ 13, Nethi discloses “One example of SSO is the federated single sign on model (FSSO). FSSO links a user's identity across multiple SaaS providers.” and further discloses in ¶ 21 “The network device 103 may also include a single sign on service in which the authentication or login approved by the network device 103 is sent to the one or more SaaS providers 101.”), the server comprising: a processor, a communications interface connected to the processor and to a network, and a non-volatile storage facility connected to the processor for storing data and programs (In ¶ 50, Nethi discloses “The network device 300 includes at least a memory 301, a controller 303, and a communication interface 305”), the non-volatile storage facility comprising: and program instructions that direct the processor to: store, by the identity provider server, dynamic access control rules defining actions the identity provider server takes in response to event messages received from at least one other node of said plurality of nodes (In ¶ 39, Nethi discloses “The single sign off service 133 may be configured to send the event message only when the trigger is of a specified type such as disconnect, logoff, and IP lease expiry. In another example, the single sign off service 133 may perform a redundancy check in which at least two network events are received from other switches or routers before the event trigger message is generated and sent to a SaaS provider or an identity server.” and further discloses in ¶ 37 “The session database 134 is a running list of the currently active sessions with SaaS providers”); receive, by the identity provider server, an event message from the at least one other node of said plurality of nodes (In ¶ 38, Nethi discloses “the layer 2 switches 123 and the layer 3 switches 125 may communicate any of the events described above to the edge router 127”); determine, upon receiving, by the identity provider server, whether the event message triggers a rule of said stored dynamic access control rules (In ¶ 38, Nethi discloses “Upon receiving or identifying a network trigger event, the edge router 127 may extract the IP address or other identifier for the endpoint from the network trigger event and query one or more of the session databases 132 and 134.”); and execute, upon determining that the described event triggers a rule of said stored dynamic access control rules, the action indicated by said triggered rule (In ¶ 38, Nethi discloses “If there is an entry for such a session, the edge router 127 sends the network event trigger to the associated SaaS provider.” and further discloses in ¶ 25 “The signoff message instructs the one or more SaaS providers 101 to end active sessions associated with the endpoint 105.”).
However, Nethi does not explicitly disclose access control policies.
Barhudarian discloses:
access control policies for users and user groups (In ¶ 3, Barhudarian discloses “ IT Administrative policies for an organization are often configured centrally on the identity provider used by the organization.” and further discloses in ¶ 29 “embodiments may include an identity provider 106 that includes as part of the identity provider 106 the conditional access termination service 114.”); dynamic access control rules defining actions the identity provider takes in response to event messages received from at least one node (In ¶ 39, Barhudarian discloses “The conditional access termination service 114, which in this case is a policy server” and further discloses in ¶ 44 “an administrator may change memberships or roles for a user, resulting in one or more events 118 being issued.”);
One in ordinary skill in the art of cryptography would have been motivated, before the effective filing date of the claimed invention to modify Nethi’s approach by utilizing Barhudarian’s approach of dynamically controlling access policies as the motivation would be to ensure instant enforcement of IT policies to resource providers as vulnerabilities may arise (See Barhudarian, ¶¶ 16, 18, 27).
Regarding Claim 12, the combination of Nethi and Barhudarian disclose the limitations of claim 11.
However, Nethi does not explicitly disclose access control policies.
Barhudarian discloses:
The server of Claim 11, wherein the instructions that direct the process further comprises instructions to cause the processor to: store, by the identity provider server, access control policies, wherein the dynamic access control rules modify implementation of the access control policies based on said triggering activities. (In ¶ 30, Barhudarian discloses “In some embodiments, the conditional access termination service 114 may be associated with a policy server including both set policies and the ability to enforce the set policies.”)
One in ordinary skill in the art of cryptography would have been motivated, before the effective filing date of the claimed invention to modify Nethi’s approach by utilizing Barhudarian’s approach of dynamically controlling access policies as the motivation would be to ensure instant enforcement of IT policies to resource providers as vulnerabilities may arise (See Barhudarian, ¶¶ 16, 18, 27).
Regarding Claim 13, the combination of Nethi and Barhudarian disclose:
The server of Claim 11, wherein the identity management system is a federated identity management system. (In ¶ 13, Nethi discloses “One example of SSO is the federated single sign on model (FSSO). FSSO links a user's identity across multiple SaaS providers.”)
Regarding Claim 14, the combination of Nethi and Barhudarian disclose:
The server of Claim 11, wherein the event described in the event message is an activity performed by a user. (In ¶ 30, Nethi discloses “The logoff event may be intentional (e.g., the user selects logoff) or unintentional (e.g., the endpoint is disconnected).”)
Regarding Claim 15, the combination of Nethi and Barhudarian disclose:
The server of Claim 14, wherein the user is a registered user of a subset of the plurality of nodes. (In ¶ 37, Nethi discloses “The session database 134 is a running list of the currently active sessions with SaaS providers. Some endpoints may have multiple entries in the session database 134.” And further discloses in ¶ 56 “The entry in the session database may include a credential.”)
Regarding Claim 16, the combination of Nethi and Barhudarian disclose:
The server of Claim 11, wherein said action of said triggered rule is to transmit a take-action message to one or more nodes of said plurality of nodes. (In ¶ 25, Nethi discloses “The signoff message instructs the one or more SaaS providers 101 to end active sessions associated with the endpoint 105” and further discloses in ¶ 57 “At act S107, the communication interface 305 sends a signoff message based on the network event trigger to the SaaS provider from the entry.”)
Regarding Claim 17, the combination of Nethi and Barhudarian disclose:
The server of Claim 14, wherein the event message is received from a second node, and wherein the action applies to a scenario selected from the group of scenarios including:" adjusting implementation of access control solely for the second node and solely for the user referred to in the event message for a current sign-on session " adjusting implementation of access control for a plurality of nodes and solely for the user referred to in the event message for a current sign-on session " adjusting implementation of access control solely for the second node and for a plurality of users associated with the event message for a current sign-on session " adjusting implementation of access control for a plurality of nodes and for a plurality of users associated with in the event message for a current sign-on session e adjusting implementation of an access control solely for the second node and solely for the user referred to in the event message for a future sign-on session " adjusting implementation of an access control for a plurality of nodes and solely for the user referred to in the event message for a future sign-on session " adjusting implementation of an access control solely for the second node and for a plurality of users associated with the event message for a future sign-on session " adjusting implementation of an access control for a plurality of nodes and for a user other than the user referred to in the event message for a future sign-on session. (In ¶ 25, Nethi discloses “Multiple sessions associated with the endpoint 105 at different services may be purged.” Wherein the examiner maps the alternative stated in the second bullet of this claim)
Regarding Claim 18, the combination of Nethi and Barhudarian disclose:
The server of Claim 14, wherein the triggering action is a federated single-log out message performed by the first user and the corresponding action is transmission by the identity provider of an event message to a plurality of nodes having active single-sign-on sessions with the first user in order to log out the first user from the plurality of nodes. (In ¶ 47, Nethi discloses “access database 145 according to the identity to determine which of the services have an active session with the endpoint…address the signoff message to the corresponding services” and further discloses in ¶ 57 “The one or more SaaS providers purge the token or tokens associated with the session in response to the signoff message. ”)
Regarding Claim 19, the combination of Nethi and Barhudarian disclose:
The server of Claim 11 wherein the server is an identity provider server operated by an identity provider. (In ¶ 14, Nethi discloses “ A SSO gateway is a network device configured to act as federation broker.” and further discloses in ¶ 36 “The authentication connector 131 establishes authentications between the endpoints and the network.”).
Regarding Claim 20, the combination of Nethi and Barhudarian disclose:
The server of Claim 11 wherein the server is a service provider server operated by a service provider. (In ¶ 26, Nethi discloses “the SaaS providers 101 start a timer in response to the network event trigger. The timer allows for temporarily disconnected endpoints to rejoin the network and the SaaS service within a predetermined time. If the timer reaches the predetermined time period, the SaaS providers 101 proceed with purging the associated sessions.” and further discloses in ¶ 41 “The SaaS providers 101 may be configured to purge an entry in the session cache (e.g., user credentials, user tokens, or directory entries associated with a user) in response to receiving the instructions.”)
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Innes et al. (US 20180007059) discloses methods and systems for granting or denying a client device access to one or more resources in a remote computing environment.
Gangawane et al. (US 20180077144) discloses a cloud-based identity and access management system that implements single sign-on (“SSO”) receives a first request for an identity management service configured to allow for accessing applications.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SHADI H KOBROSLI whose telephone number is (571)272-1952. The examiner can normally be reached M-F 9am-5pm ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Rupal Dharia can be reached at 571-272-3880. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SHADI H KOBROSLI/Examiner, Art Unit 2492 /RUPAL DHARIA/Supervisory Patent Examiner, Art Unit 2492
