DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
1.This action is responsive to the communication filed on March 11, 2026. At this time, claims 1- 20 are pending and addressed below.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Double patenting
2. The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the "right to exclude" granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory obviousness-type double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Omum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); and In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on a nonstatutory double patenting ground provided the conflicting application or patent either is shown to be commonly owned with this application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement.
Effective January 1, 1994, a registered attorney or agent of record may sign a terminal disclaimer. A terminal disclaimer signed by the assignee must fully comply with 37 CFR 3.73(b).
Claims 1, 6, 14, 17 and 20 are rejected on the ground of nonstatutory obviousness-type double patenting as being unpatentable over claims 1, 5, 7 and 10 of US Patent number US 12335114 B2. The conflicting claims are not identical, they are not patentably distinct from each other because the current application contains claims that are similar in scope than the claims of the patent number US 12335114 B2 and are anticipated by the claims 1, 5, 7 and 10.
This is a Non-provisional double patenting rejection.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefore, subject to the conditions and requirements of this title.
Claims 1-5, 6-13, 14-16, 17-19 and 20 are rejected under 35 USC 101 as being directed to an abstract idea without being integrated into a practical application or being significantly more.
Regarding claim 1, the claim recites the limitations “ receiving, by a service proxy, a service request from a service consumer …;” “ selecting, by a service proxy, a first service producer …;” “ receiving, b y the service communication proxy, a response to the service request…;” and “ sending, by the service communication proxy, the response ….. “ Broadly interpreted, the aforementioned steps are directed to mental processes as said steps could be performed in the human mind. Therefore, the claims recite an abstract idea.
Said abstract idea and/or judicial exception is not integrated into a practical application as the claim does not recite any other active steps that could be considered that the abstract idea is being integrated into a practical application. It’s noted that the claim recites the operations “ network repository function;” and “communication service proxy.”
However, said functions are not sufficient to consider that the abstract idea is being interpreted into a practical application. Said functions are recited at a high level of generality in gathering/processing/storing information, which are a form of insignificant extra-solution activity.
It’s also noted that the claims recite additional limitation/elements (i.e., system, processor, memory, etc.,). However, said additional elements are recited at a high-level of generality (i.e., as a generic computing device performing a generic computer functions) such that it amounts no more than mere instructions to apply the exception or abstract idea using generic computer components. Accordingly, these additional elements do not integrate the abstract idea into a practical application because they do not impose any meaningful limits on practicing the abstract idea.
The claims do not include additional elements/limitations/embodiments that are sufficient to amount to significantly more than the judicial exception because the additional elements when considered both individually and as an ordered combination do not amount to significantly more than the abstract idea. As mentioned above, although the claims recite additional elements, said elements taken individually or as a combination, do not result in the claim amounting to significantly more than the abstract idea because as the additional elements perform generic computer content distributing functions routinely used in information technology field. As discussed above, the additional elements recited at a high-level of generality such that they amount no more than mere instructions to apply the exception using a generic computer component. Therefore, the claim is directed to non-statutory subject matter.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-19 are rejected under 35 U.S.C 103 as being unpatentable over Bykampadi, US 20190251241 A1 (IDS Submitted) in view of Nagendra, US pat. No 20190253894 (IDS Submitted)
1. Bykampadi discloses a communication method,(See Bykampadi, abstract; a first element or function in a visiting network of a communication system receives a first service discovery request from a second element or function in the visiting network for services provided by at least a third element or function in a home network of the communication system) comprising: receiving, by a service communication proxy, a service request
from a service consumer, (See Bykampadi;[0063] The scope in the JWT access token indicates the authorized level of access for the NF Service Consumer. If needed, the scope will include NF services that the NF Service Consumer is authorized to access in the NF Service Producer. The NF Service Consumer presents the obtained JWT to the NF Service Producer when requesting access to a service provided by the NF Service Producer. The NF Service Producer verifies the received JWT based on the NRF's public certificate. If the verification is successful, the requested NF service is granted to the NF Service Consumer by the NF Service Producer.)
wherein the service request comprises a token, the token comprises a service producer network
function set identifier for identifying a network function set, the network function set comprises at least two service producers, and the token is for the at least two service producers; (See Bykampadi, [0038]; For example, the network elements/functions 202 and 204 may represent NF Service Consumers, NF Service Producers, Authorization Servers (e.g., NRFs), etc. which interact for service authorization as described in further detail herein..) receiving, by the service communication proxy, a response to the service request from the first service producer; (See Bykampadi, [0091] While the FIG. 7 message flow is described above with respect to service discovery request (e.g., nrf_NFDiscovery_Request in step 701) and service discovery response (e.g., Nnrf_NFDiscovery_Response in step 705) messages, it should be appreciated that other suitable request and response messages may be utilized. For example, the NF Service Consumer 402 in step 701 may issue an access token request and the NRF 404 in step 705 may provide an access token response. ) Bykampadi does not appear to explicitly disclose selecting, by the service communication proxy, a first service producer from the at least two service producers; and sending, by the service communication proxy, the response to the service request to the service consumer.
However, Nagendra discloses selecting, by the service communication proxy, a first service producer from the at least two service producers; (See Nagendra, (See Nagendra, [0053-0055]; In step 1, before invoking a Representational State Transfer (Restful) hypertext transfer protocol (HTTP) based application programming interface (API) on the resource server 406, the client 402 authenticates with the authorization server 404 by presenting its credentials. The credentials may include a client identifier (client_id) and a client secret (client_secret). The client_id is issued by the authorization server 404 when the client 402 registers with the authorization server 404 (e.g., in a separate step, which may be an out-of-band step). This registration may be part of a separate step not illustrated in FIG. 4. In step 2, the authorization server 404 validates the client 402 using the provided client_id and client_secret, and returns an access token to the client 402. In step 3, the client 402 uses the access token to call the API of resource server 406. See also [0066-0068] The scope in the JWT access token indicates the authorized level of access for the NF Service Consumer. If needed, the scope will include NF services that the NF Service Consumer is authorized to access in the NF Service Producer. The NF Service Consumer presents the obtained JWT to the NF Service Producer in the HPLMN when requesting access to a service provided by the NF Service Producer. The NF Service Producer verifies the received JWT based on the hNRF's public certificate. If the verification is successful, the requested NF service is granted to the NF Service Consumer by the NF Service Producer.) and sending, by the service communication proxy, the response to the service request to the service consumer. (See Nagendra, [0075]; in step 3, the NRF 704 sends an Access Token Response to the NF service consumer 702 which comprises access token, expiration time for the token, and scope of the token).)
Bykampadi and Nagendra are analogous art because they are from the same field of endeavor which is network repository function. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Bykampadi with the teaching of Nagendra to include the access token because it would have been used to prevent unauthorized access.
2. The combination of Bykampadi and Nagendra discloses the method according to claim 1, wherein in a case where the first service producer is unable to provide a service, the method further comprises:
selecting, by the service communication proxy, a second service producer from the at least
two service producers for the service consumer. (See Nagendra, [0053-0055]; In step 1, before invoking a Representational State Transfer (Restful) hypertext transfer protocol (HTTP) based application programming interface (API) on the resource server 406, the client 402 authenticates with the authorization server 404 by presenting its credentials. The credentials may include a client identifier (client_id) and a client secret (client_secret). The client_id is issued by the authorization server 404 when the client 402 registers with the authorization server 404 (e.g., in a separate step, which may be an out-of-band step). This registration may be part of a separate step not illustrated in FIG. 4. In step 2, the authorization server 404 validates the client 402 using the provided client_id and client_secret, and returns an access token to the client 402. In step 3, the client 402 uses the access token to call the API of resource server 406. See also [0066-0068] The scope in the JWT access token indicates the authorized level of access for the NF Service Consumer. If needed, the scope will include NF services that the NF Service Consumer is authorized to access in the NF Service Producer. The NF Service Consumer presents the obtained JWT to the NF Service Producer in the HPLMN when requesting access to a service provided by the NF Service Producer. The NF Service Producer verifies the received JWT based on the hNRF's public certificate. If the verification is successful, the requested NF service is granted to the NF Service Consumer by the NF Service Producer.) Bykampadi and Nagendra are analogous art because they are from the same field of endeavor which is network repository function. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Bykampadi with the teaching of Nagendra to include the access token because it would have been used to prevent unauthorized access.
3. The combination of Bykampadi and Nagendra discloses the method according to claim 2, wherein the selecting, by the service communication proxy, the second service producer from the at least two service producers for the service consumer comprises: directly selecting, by the service communication proxy, without initiating a new authorization procedure, the second service producer from the at least two service producers for the service consumer. (See Bykampadi, [0061] For the 5G SBA service authorization framework, aspects of the OAuth 2.0 framework and JWT, JWS and JWE standardized mechanisms may be adopted. The Network Repository Function (NRF) plays the role of the OAuth Authorization server (e.g., authorization server 404 in FIG. 4). The NRF's public certificate is shared with all NF Service Consumers within a PLMN, such as within the HPLMN or VPLMN of FIG. 3. NF Service Consumers (e.g., other NFs within the PLMN such as HPLMN or VPLMN of FIG. 3) play the role of the OAuth client (e.g., client 402 in FIG. 4). The client (e.g., NF Service Consumers) registers with the authorization server (e.g., the NRF) as part of the NF Registration procedure to obtain a client_id and client_secret from the NRF. A NF Service Consumer may provide its public key during registration. The public key of the NF Service Consumer is used if the JWT needs encryption. NF Service Producers play the role of the OAuth resource server (e.g., resource server 406 in FIG. 4).)
4. The combination of Bykampadi and Nagendra discloses the method according to claim 1, wherein the response to the service request comprises a service request failure indication. (See Nagendra; [0097] In step 802, the NF Service Producer 406 verifies the access token. Verifying the access token in some embodiments includes checking that the JWT is well formed, checking the signature of the JWT using the NRF 404's public key, validating the standard claims in the access token (e.g., the subject, expiration time, issuer, audience claims, etc.), and checking the client permissions (e.g., the scope in the access token). If the checks are successful, the NF Service Producer 406 is assured that the access token received in step 801 was issued by its local NRF 404 (e.g., hNRF 404-2) and that the access token was issued to the correct NF Service Consumer 402 (e.g., identifier match) in the VPLMN. In addition, the NF Service Producer 406 knows the exact scope that the NF Service Consumer 402 has been authorized by the NRF 404. In step 803, responsive to successful verification of the access token, the NF Service Producer 406 executes the requested service and provides a NF service response to the NF Service Consumer 402…The requested service is not executed if unsuccessful)
Bykampadi and Nagendra are analogous art because they are from the same field of endeavor which is network repository function. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Bykampadi with the teaching of Nagendra to include the access token because it would have been used to prevent unauthorized access.
5. The combination of Bykampadi and Nagendra discloses the method according to claim 1, wherein an audience claim of the token comprises the service producer network function set identifier. (See Nagendra [0037] It is also to be noted that while FIG. 1 illustrates system elements as singular functional blocks, the various subnetworks that make up the 5G network are partitioned into so-called network slices. Network slices (network partitions) comprise a series of network function (NF) sets (i.e., function chains) for each corresponding service type using network function virtualization (NFV) on a common physical infrastructure ) Bykampadi and Nagendra are analogous art because they are from the same field of endeavor which is network repository function. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Bykampadi with the teaching of Nagendra to include the access token because it would have been used to prevent unauthorized access.
6. As to claim 6, the claim is rejected under the same rationale as claim 1. See the rejection of claim 1 above.
7. The combination of Bykampadi and Nagendra discloses the method according to claim 6, wherein the verifying, by the
first service producer, the token based on the service producer network function set identifier,
comprises: verifying, by the first service producer, whether the service producer network function set
identifier is consistent with a network function set identifier of a network function set to which
the first service producer belongs; (See Nagendra, [0053-0055]; In step 1, before invoking a Representational State Transfer (Restful) hypertext transfer protocol (HTTP) based application programming interface (API) on the resource server 406, the client 402 authenticates with the authorization server 404 by presenting its credentials. The credentials may include a client identifier (client_id) and a client secret (client_secret). The client_id is issued by the authorization server 404 when the client 402 registers with the authorization server 404 (e.g., in a separate step, which may be an out-of-band step). This registration may be part of a separate step not illustrated in FIG. 4. In step 2, the authorization server 404 validates the client 402 using the provided client_id and client_secret, and returns an access token to the client 402. In step 3, the client 402 uses the access token to call the API of resource server 406. See also [0066-0068] The scope in the JWT access token indicates the authorized level of access for the NF Service Consumer. If needed, the scope will include NF services that the NF Service Consumer is authorized to access in the NF Service Producer. The NF Service Consumer presents the obtained JWT to the NF Service Producer in the HPLMN when requesting access to a service provided by the NF Service Producer. The NF Service Producer verifies the received JWT based on the hNRF's public certificate. If the verification is successful, the requested NF service is granted to the NF Service Consumer by the NF Service Producer.) and wherein, when the service producer network function set identifier is consistent with the network function set identifier of the network function set to which the first service producer belongs, verification of the token succeeds; or when the service producer network function set identifier is not consistent with the network function set identifier of the network function set to which the first service producer belongs, verification of the token fails. (See Nagendra, [0053-0055]; In step 1, before invoking a Representational State Transfer (Restful) hypertext transfer protocol (HTTP) based application programming interface (API) on the resource server 406, the client 402 authenticates with the authorization server 404 by presenting its credentials. The credentials may include a client identifier (client_id) and a client secret (client_secret). The client_id is issued by the authorization server 404 when the client 402 registers with the authorization server 404 (e.g., in a separate step, which may be an out-of-band step). This registration may be part of a separate step not illustrated in FIG. 4. In step 2, the authorization server 404 validates the client 402 using the provided client_id and client_secret, and returns an access token to the client 402. In step 3, the client 402 uses the access token to call the API of resource server 406. See also [0066-0068] The scope in the JWT access token indicates the authorized level of access for the NF Service Consumer. If needed, the scope will include NF services that the NF Service Consumer is authorized to access in the NF Service Producer. The NF Service Consumer presents the obtained JWT to the NF Service Producer in the HPLMN when requesting access to a service provided by the NF Service Producer. The NF Service Producer verifies the received JWT based on the hNRF's public certificate. If the verification is successful, the requested NF service is granted to the NF Service Consumer by the NF Service Producer.) Bykampadi and Nagendra are analogous art because they are from the same field of endeavor which is network repository function. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Bykampadi with the teaching of Nagendra to include the access token because it would have been used to prevent unauthorized access.
8. The combination of Bykampadi and Nagendra discloses the method according to claim 7, wherein when the verification of the token fails, the response to the service request comprises a service request failure indication. (See Nagendra; [0097] In step 802, the NF Service Producer 406 verifies the access token. Verifying the access token in some embodiments includes checking that the JWT is well formed, checking the signature of the JWT using the NRF 404's public key, validating the standard claims in the access token (e.g., the subject, expiration time, issuer, audience claims, etc.), and checking the client permissions (e.g., the scope in the access token). If the checks are successful, the NF Service Producer 406 is assured that the access token received in step 801 was issued by its local NRF 404 (e.g., hNRF 404-2) and that the access token was issued to the correct NF Service Consumer 402 (e.g., identifier match) in the VPLMN. In addition, the NF Service Producer 406 knows the exact scope that the NF Service Consumer 402 has been authorized by the NRF 404. In step 803, responsive to successful verification of the access token, the NF Service Producer 406 executes the requested service and provides a NF service response to the NF Service Consumer 402…The requested service is not executed if unsuccessful) Bykampadi and Nagendra are analogous art because they are from the same field of endeavor which is network repository function. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Bykampadi with the teaching of Nagendra to include the access token because it would have been used to prevent unauthorized access.
9. The combination of Bykampadi and Nagendra discloses the method according to claim 6, wherein an audience claim of the token comprises the service producer network function set identifier. (See Nagendra, [0037] It is also to be noted that while FIG. 1 illustrates system elements as singular functional blocks, the various subnetworks that make up the 5G network are partitioned into so-called network slices. Network slices (network partitions) comprise a series of network function (NF) sets (i.e., function chains) for each corresponding service type using network function virtualization (NFV) on a common physical infrastructure ) Bykampadi and Nagendra are analogous art because they are from the same field of endeavor which is network repository function. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Bykampadi with the teaching of Nagendra to include the access token because it would have been used to prevent unauthorized access.
10. The combination of Bykampadi and Nagendra discloses the method according to claim 6, further comprising: receiving, by the service communication proxy, the service request from a service
consumer; (See Nagendra; [0053] In 5G SBA, there are multiple NFs requesting services from each other. A service authorization framework is required that supports: (i) NF Service Consumer—NF Service Producer interactions when the two NFs are in different PLMNs (e.g., in roaming scenarios); (ii) authentication of the NF Service Consumer that is requesting access to the service(s) of another NF (e.g., services of a NF Service Producer) in a different PLMN; (iii) obtaining authorization grants during Network Function Service discovery that allow the NF Service Consumer to obtain service access of a NF in a different PLMN; (iv) using the obtained authorization grants during Network Function Service access; and (v) NF and Network Function Service registration and de-registration. In addition, a service authorization framework should be scalable for different network scenarios, including: (i) whether granularity of authorization is for a NF, or for each service within the NF; (ii) whether the granularity is per user; and (iii) whether authorization is time-based, has a duration associated with it, etc.)
selecting, by the service communication proxy, the first service producer from the at least
two service producers; (See Nagendra, [0053-0055]; In step 1, before invoking a Representational State Transfer (Restful) hypertext transfer protocol (HTTP) based application programming interface (API) on the resource server 406, the client 402 authenticates with the authorization server 404 by presenting its credentials. The credentials may include a client identifier (client_id) and a client secret (client_secret). The client_id is issued by the authorization server 404 when the client 402 registers with the authorization server 404 (e.g., in a separate step, which may be an out-of-band step). This registration may be part of a separate step not illustrated in FIG. 4. In step 2, the authorization server 404 validates the client 402 using the provided client_id and client_secret, and returns an access token to the client 402. In step 3, the client 402 uses the access token to call the API of resource server 406. See also [0066-0068] The scope in the JWT access token indicates the authorized level of access for the NF Service Consumer. If needed, the scope will include NF services that the NF Service Consumer is authorized to access in the NF Service Producer. The NF Service Consumer presents the obtained JWT to the NF Service Producer in the HPLMN when requesting access to a service provided by the NF Service Producer. The NF Service Producer verifies the received JWT based on the hNRF's public certificate. If the verification is successful, the requested NF service is granted to the NF Service Consumer by the NF Service Producer.) receiving, by the service communication proxy, the response to the service request from the first service producer; (See Nagendra, [0053-0055]; In step 1, before invoking a Representational State Transfer (Restful) hypertext transfer protocol (HTTP) based application programming interface (API) on the resource server 406, the client 402 authenticates with the authorization server 404 by presenting its credentials. The credentials may include a client identifier (client_id) and a client secret (client_secret). The client_id is issued by the authorization server 404 when the client 402 registers with the authorization server 404 (e.g., in a separate step, which may be an out-of-band step). This registration may be part of a separate step not illustrated in FIG. 4. In step 2, the authorization server 404 validates the client 402 using the provided client_id and client_secret, and returns an access token to the client 402. In step 3, the client 402 uses the access token to call the API of resource server 406. See also [0066-0068] The scope in the JWT access token indicates the authorized level of access for the NF Service Consumer. If needed, the scope will include NF services that the NF Service Consumer is authorized to access in the NF Service Producer. The NF Service Consumer presents the obtained JWT to the NF Service Producer in the HPLMN when requesting access to a service provided by the NF Service Producer. The NF Service Producer verifies the received JWT based on the hNRF's public certificate. If the verification is successful, the requested NF service is granted to the NF Service Consumer by the NF Service Producer.) and sending, by the service communication proxy, the response to the service request to the service consumer. (See Nagendra; [0097] In step 802, the NF Service Producer 406 verifies the access token. Verifying the access token in some embodiments includes checking that the JWT is well formed, checking the signature of the JWT using the NRF 404's public key, validating the standard claims in the access token (e.g., the subject, expiration time, issuer, audience claims, etc.), and checking the client permissions (e.g., the scope in the access token). If the checks are successful, the NF Service Producer 406 is assured that the access token received in step 801 was issued by its local NRF 404 (e.g., hNRF 404-2) and that the access token was issued to the correct NF Service Consumer 402 (e.g., identifier match) in the VPLMN. In addition, the NF Service Producer 406 knows the exact scope that the NF Service Consumer 402 has been authorized by the NRF 404. In step 803, responsive to successful verification of the access token, the NF Service Producer 406 executes the requested service and provides a NF service response to the NF Service Consumer 402…The requested service is not executed if unsuccessful)
Bykampadi and Nagendra are analogous art because they are from the same field of endeavor which is network repository function. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Bykampadi with the teaching of Nagendra to include the access token because it would have been used to prevent unauthorized access.
11. The combination of Bykampadi and Nagendra discloses the method according to claim 10, further comprising: sending, by the service consumer, the service request to the service communication proxy; (See Nagendra;[0091] The vNRF 404-1 (e.g., the local NRF for the NF Service Consumer 402) in step 702 authenticates the client NF Service Consumer 402 based on the provided client credentials. If the NF Service Consumer 402 is successfully authenticated, the vNRF 404-1 identifies the NRF in the HPLMN (i.e., hNRF 404-2) based on the home PLMN ID included in the Nnrf_NFDiscovery_Request received in step 701. The vNRF 404-1 then requests discovery from the hNRF 404-2 in step 703 by sending an Nnrf_NFDiscovery_Request to the hNRF 404-2.)
and receiving, by the service consumer, the response to the service request from the service
communication proxy. (See Nagendra; [0091] The vNRF 404-1 (e.g., the local NRF for the NF Service Consumer 402) in step 702 authenticates the client NF Service Consumer 402 based on the provided client credentials. If the NF Service Consumer 402 is successfully authenticated, the vNRF 404-1 identifies the NRF in the HPLMN (i.e., hNRF 404-2) based on the home PLMN ID included in the Nnrf_NFDiscovery_Request received in step 701. The vNRF 404-1 then requests discovery from the hNRF 404-2 in step 703 by sending an Nnrf_NFDiscovery_Request to the hNRF 404-2.) Bykampadi and Nagendra are analogous art because they are from the same field of endeavor which is network repository function. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Bykampadi with the teaching of Nagendra to include the access token because it would have been used to prevent unauthorized access.
12. The combination of Bykampadi and Nagendra discloses the method according to claim 11, further comprising: sending, by the service consumer, a token request to a network repository function, wherein
the token request comprises the service producer network function set identifier; (See Nagendra; [0094] In step 706, the signed JWT access token is included in an Nnrf_NFDiscovery_Request response message that is sent from the hNRF 404-2 to the vNRF 404-1. See also For example, the network elements/functions 202 and 204 may represent NF Service Consumers, NF Service Producers, Authorization Servers (e.g., NRFs in visiting and home networks), etc. which interact for service authorization as described in further detail herein.)
and receiving, by the service consumer, a response to the token request from the network repository function, wherein the response comprises the token. (See Nagendra; [0071] NRF returns the stored access token request in the Access Token Response message (step 404). Clause 13.4.1.1 of the above-referenced 3GPP TS 33.501 describes a procedure for obtaining an access token from the NRF. This is executed by the Consumer NF Instance before service access. Illustrative embodiments provide, inter alia, the following changes to the existing procedure:) Bykampadi and Nagendra are analogous art because they are from the same field of endeavor which is network repository function. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Bykampadi with the teaching of Nagendra to include the access token because it would have been used to prevent unauthorized access.
13. The combination of Bykampadi and Nagendra discloses the method according to claim 12, further comprising: receiving, by the network repository function, the token request from the service consumer; (See Nagendra, [0071] NRF returns the stored access token request in the Access Token Response message (step 404). Clause 13.4.1.1 of the above-referenced 3GPP TS 33.501 describes a procedure for obtaining an access token from the NRF. This is executed by the Consumer NF Instance before service access. Illustrative embodiments provide, inter alia, the following changes to the existing procedure)
and sending, by the network repository function, the response to the service consumer. (See Nagendra; [0097] In step 802, the NF Service Producer 406 verifies the access token. Verifying the access token in some embodiments includes checking that the JWT is well formed, checking the signature of the JWT using the NRF 404's public key, validating the standard claims in the access token (e.g., the subject, expiration time, issuer, audience claims, etc.), and checking the client permissions (e.g., the scope in the access token). If the checks are successful, the NF Service Producer 406 is assured that the access token received in step 801 was issued by its local NRF 404 (e.g., hNRF 404-2) and that the access token was issued to the correct NF Service Consumer 402 (e.g., identifier match) in the VPLMN) Bykampadi and Nagendra are analogous art because they are from the same field of endeavor which is network repository function. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Bykampadi with the teaching of Nagendra to include the access token because it would have been used to prevent unauthorized access.
14. As to claim 14, the claim is rejected under the same rationale as claim 1. See the rejection of claim 1 above. at least one memory storing executable instructions; (See Nagendra, [0014]) and at least one processor coupled to the at least one memory and configured to execute the executable instructions to cause the service communication proxy to (See Nagendra, [0014]) Bykampadi and Nagendra are analogous art because they are from the same field of endeavor which is network repository function. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Bykampadi with the teaching of Nagendra to include the access token because it would have been used to prevent unauthorized access.
15. The combination of Bykampadi and Nagendra discloses the service communication proxy according to claim 14, wherein the service communication proxy is further caused to: select a second service producer from the at least two service producers for the service consumer in a case where the first service producer is unable to provide a service. (See Nagendra, [0053-0055]; In step 1, before invoking a Representational State Transfer (Restful) hypertext transfer protocol (HTTP) based application programming interface (API) on the resource server 406, the client 402 authenticates with the authorization server 404 by presenting its credentials. The credentials may include a client identifier (client_id) and a client secret (client_secret). The client_id is issued by the authorization server 404 when the client 402 registers with the authorization server 404 (e.g., in a separate step, which may be an out-of-band step). This registration may be part of a separate step not illustrated in FIG. 4. In step 2, the authorization server 404 validates the client 402 using the provided client_id and client_secret and returns an access token to the client 402. In step 3, the client 402 uses the access token to call the API of resource server 406. See also [0066-0068] The scope in the JWT access token indicates the authorized level of access for the NF Service Consumer. If needed, the scope will include NF services that the NF Service Consumer is authorized to access in the NF Service Producer. The NF Service Consumer presents the obtained JWT to the NF Service Producer in the HPLMN when requesting access to a service provided by the NF Service Producer. The NF Service Producer verifies the received JWT based on the hNRF's public certificate. If the verification is successful, the requested NF service is granted to the NF Service Consumer by the NF Service Producer.) Bykampadi and Nagendra are analogous art because they are from the same field of endeavor which is network repository function. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Bykampadi with the teaching of Nagendra to include the access token because it would have been used to prevent unauthorized access.
16. The combination of Bykampadi and Nagendra discloses the service communication proxy according to claim 15, wherein the service communication proxy is further caused to: directly select, without initiating a new authorization procedure, the second service producer from the at least two service producers for the service consumer in the case where the first service producer is unable to provide a service. (See Nagendra, [0053-0055]; In step 1, before invoking a Representational State Transfer (Restful) hypertext transfer protocol (HTTP) based application programming interface (API) on the resource server 406, the client 402 authenticates with the authorization server 404 by presenting its credentials. The credentials may include a client identifier (client_id) and a client secret (client_secret). The client_id is issued by the authorization server 404 when the client 402 registers with the authorization server 404 (e.g., in a separate step, which may be an out-of-band step). This registration may be part of a separate step not illustrated in FIG. 4. In step 2, the authorization server 404 validates the client 402 using the provided client_id and client_secret, and returns an access token to the client 402. In step 3, the client 402 uses the access token to call the API of resource server 406. See also [0066-0068] The scope in the JWT access token indicates the authorized level of access for the NF Service Consumer. If needed, the scope will include NF services that the NF Service Consumer is authorized to access in the NF Service Producer. The NF Service Consumer presents the obtained JWT to the NF Service Producer in the HPLMN when requesting access to a service provided by the NF Service Producer. The NF Service Producer verifies the received JWT based on the hNRF's public certificate. If the verification is successful, the requested NF service is granted to the NF Service Consumer by the NF Service Producer.) Bykampadi and Nagendra are analogous art because they are from the same field of endeavor which is network repository function. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Bykampadi with the teaching of Nagendra to include the access token because it would have been used to prevent unauthorized access.
17. As to claim 17, the claim is rejected under the same rationale as claim 1. See the rejection of claim 1 above. A service producer, comprising: at least one memory storing executable instructions; and at least one processor coupled to the at least one memory and configured to execute the (See Nagendra, [0014] ) executable instructions to cause the service producer to:
verify the token based on the service producer network function set identifier; (See Nagendra, [0066] The scope in the JWT access token indicates the authorized level of access for the NF Service Consumer. If needed, the scope will include NF services that the NF Service Consumer is authorized to access in the NF Service Producer. The NF Service Consumer presents the obtained JWT to the NF Service Producer in the HPLMN when requesting access to a service provided by the NF Service Producer. The NF Service Producer verifies the received JWT based on the hNRF's public certificate. If the verification is successful, the requested NF service is granted to the NF Service Consumer by the NF Service Producer.) and send a response to the service request to the service communication proxy.( Nagendra, [0066] The scope in the JWT access token indicates the authorized level of access for the NF Service Consumer. If needed, the scope will include NF services that the NF Service Consumer is authorized to access in the NF Service Producer. The NF Service Consumer presents the obtained JWT to the NF Service Producer in the HPLMN when requesting access to a service provided by the NF Service Producer. The NF Service Producer verifies the received JWT based on the hNRF's public certificate. If the verification is successful, the requested NF service is granted to the NF Service Consumer by the NF Service Producer.) Bykampadi and Nagendra are analogous art because they are from the same field of endeavor which is network repository function. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Bykampadi with the teaching of Nagendra to include the access token because it would have been used to prevent unauthorized access.
18. As to claim 18, the claim is rejected under the same rationale as claim 7. See the rejection of claim 7 above.
19. As to claim 18, the claim is rejected under the same rationale as claim 4. See the rejection of claim 4 above.
Claim 1 is rejected under 35 U.S.C 103 as being unpatentable over Nagendra, US pat. No 20190253894 (IDS Submitted) in view of Bykampadi, US 20190251241 A1 (IDS Submitted).
20. Nagendra discloses a system, (See Nagendra, abstract; a first element or function in a visiting network of a communication system receives a first service discovery request from a second element or function in the visiting network for services provided by at least a third element or function in a home network of the communication system) comprising at least one of the following: a service communication proxy, (See Nagendra, [0014]) configured to:
receive a service request from a service consumer, (See Nagendra; [0093] If the requested service can be provided to the NF Service Consumer 402 of the declared type, the hNRF 404-2 in step 705 generates a JWT based access token with appropriate claims included. The generated JWT is signed with the hNRF 404-2's private key. The claims in the JWT access token include the identity of the hNRF 404-2 (e.g., the issuer), the identity of the NF Service Consumer 402 (e.g., the subject), the identity of the NF instance (e.g., NF Service Producer 406) that provides the requested service (e.g., the audience), the expiration time, etc.)
wherein the service request comprises a token, the token comprises a service producer network function set identifier that is used to identify for identifying a network function set, the network function set comprises at least two service producers and the token is for the at least two service producers; (See Nagendra; [0094] In step 706, the signed JWT access token is included in an Nnrf_NFDiscovery_Request response message that is sent from the hNRF 404-2 to the vNRF 404-1. See also For example, the network elements/functions 202 and 204 may represent NF Service Consumers, NF Service Producers, Authorization Servers (e.g., NRFs in visiting and home networks), etc. which interact for service authorization as described in further detail herein.)
receive the service request from the service communication proxy; (See Nagendra, [0071] NRF returns the stored access token request in the Access Token Response message (step 404). Clause 13.4.1.1 of the above-referenced 3GPP TS 33.501 describes a procedure for obtaining an access token from the NRF. This is executed by the Consumer NF Instance before service access. Illustrative embodiments provide, inter alia, the following changes to the existing procedure:)
and send a response to the service request to the service communication proxy; (See Nagendra; [0097] In step 802, the NF Service Producer 406 verifies the access token. Verifying the access token in some embodiments includes checking that the JWT is well formed, checking the signature of the JWT using the NRF 404's public key, validating the standard claims in the access token (e.g., the subject, expiration time, issuer, audience claims, etc.), and checking the client permissions (e.g., the scope in the access token). If the checks are successful, the NF Service Producer 406 is assured that the access token received in step 801 was issued by its local NRF 404 (e.g., hNRF 404-2) and that the access token was issued to the correct NF Service Consumer 402 (e.g., identifier match) in the VPLMN. In addition, the NF Service Producer 406 knows the exact scope that the NF Service Consumer 402 has been authorized by the NRF 404. In step 803, responsive to successful verification of the access token, the NF Service Producer 406 executes the requested service and provides a NF service response to the NF Service Consumer 402…The requested service is not executed if unsuccessful) the service consumer, configured to:
send a token request to a network repository function, wherein the token request comprises the service producer network function set identifier; (See Nagendra; [0094] In step 706, the signed JWT access token is included in an Nnrf_NFDiscovery_Request response message that is sent from the hNRF 404-2 to the vNRF 404-1. See also For example, the network elements/functions 202 and 204 may represent NF Service Consumers, NF Service Producers, Authorization Servers (e.g., NRFs in visiting and home networks), etc. which interact for service authorization as described in further detail herein.)
receive a response to the token request from the network repository function, wherein the response comprises the token; (See Nagendra; [0094] In step 706, the signed JWT access token is included in an Nnrf_NFDiscovery_Request response message that is sent from the hNRF 404-2 to the vNRF 404-1. The response message of step 706 may also include an expiration time (e.g., expires_in), an end point address for the discovered NF instance, etc. The scope and expires_in may be equivalent to the corresponding claims in the JWT access token from step 705. The scope field may include all the services that the NF Service Consumer 402 is authorized to access. In step 707, the vNRF 404-1 forwards the response message received in step 706 to the NF Service Consumer 402.)
send the service request to the service communication proxy; (See Nagendra; [0093] If the requested service can be provided to the NF Service Consumer 402 of the declared type, the hNRF 404-2 in step 705 generates a JWT based access token with appropriate claims included. The generated JWT is signed with the hNRF 404-2's private key. The claims in the JWT access token include the identity of the hNRF 404-2 (e.g., the issuer), the identity of the NF Service Consumer 402 (e.g., the subject), the identity of the NF instance (e.g., NF Service Producer 406) that provides the requested service (e.g., the audience), the expiration time, etc. In some embodiments, the hNRF 404-2 may restrict access to specific services in the NF Service Producer 406. In such cases, the hNRF 404-2 in step 705 may include an authorized set of services in a separate claim (e.g., the scope) in the JWT access token.)
and receive the response to the service request from the service communication proxy; (See Nagendra, [0097]; In addition, the NF Service Producer 406 knows the exact scope that the NF Service Consumer 402 has been authorized by the NRF 404. In step 803, responsive to successful verification of the access token, the NF Service Producer 406 executes the requested service and provides a NF service response to the NF Service Consumer 402.)
the network repository function, configured to: receive the token request from the service consumer; (See Nagendra, [0093]; [0093] If the requested service can be provided to the NF Service Consumer 402 of the declared type, the hNRF 404-2 in step 705 generates a JWT based access token with appropriate claims included. The generated JWT is signed with the hNRF 404-2's private key. The claims in the JWT access token include the identity of the hNRF 404-2 (e.g., the issuer), the identity of the NF Service Consumer 402 (e.g., the subject), the identity of the NF instance (e.g., NF Service Producer 406) that provides the requested service (e.g., the audience), the expiration time, etc.) and send the response to the service token request to the service consumer. (See Nagendra, [0094]; In step 706, the signed JWT access token is included in an Nnrf_NFDiscovery_Request response message that is sent from the hNRF 404-2 to the vNRF 404-1. The response message of step 706 may also include an expiration time (e.g., expires_in), an end point address for the discovered NF instance, etc. The scope and expires_in may be equivalent to the corresponding claims in the JWT access token from step 705. The scope field may include all the services that the NF Service Consumer 402 is authorized to access. In step 707, the vNRF 404-1 forwards the response message received in step 706 to the NF Service Consumer 402.)
Nagendra does not appear to explicitly disclose select a first service producer from the at least two service producers;
receive a response to the service request from the first service producer; verify the token based on the service producer network function set identifier;
However, Bykampadi discloses select a first service producer from the at least two service producers; (See Nagendra, (See Nagendra, [0053-0055]; In step 1, before invoking a Representational State Transfer (Restful) hypertext transfer protocol (HTTP) based application programming interface (API) on the resource server 406, the client 402 authenticates with the authorization server 404 by presenting its credentials. The credentials may include a client identifier (client_id) and a client secret (client_secret). The client_id is issued by the authorization server 404 when the client 402 registers with the authorization server 404 (e.g., in a separate step, which may be an out-of-band step). This registration may be part of a separate step not illustrated in FIG. 4. In step 2, the authorization server 404 validates the client 402 using the provided client_id and client_secret, and returns an access token to the client 402. In step 3, the client 402 uses the access token to call the API of resource server 406. See also [0066-0068] The scope in the JWT access token indicates the authorized level of access for the NF Service Consumer. If needed, the scope will include NF services that the NF Service Consumer is authorized to access in the NF Service Producer. The NF Service Consumer presents the obtained JWT to the NF Service Producer in the HPLMN when requesting access to a service provided by the NF Service Producer. The NF Service Producer verifies the received JWT based on the hNRF's public certificate. If the verification is successful, the requested NF service is granted to the NF Service Consumer by the NF Service Producer.)
receive a response to the service request from the first service producer; (See Bykampadi, [0075]; in step 3, the NRF 704 sends an Access Token Response to the NF service consumer 702 which comprises access token, expiration time for the token, and scope of the token).)
and send the response to the service request to the service consumer; (See Bykampadi, [0075]; in step 3, the NRF 704 sends an Access Token Response to the NF service consumer 702 which comprises access token, expiration time for the token, and scope of the token).) the first service producer, configured to:
verify the token based on the service producer network function set identifier; (See Bykampadi, [0053-0055]; In step 1, before invoking a Representational State Transfer (Restful) hypertext transfer protocol (HTTP) based application programming interface (API) on the resource server 406, the client 402 authenticates with the authorization server 404 by presenting its credentials. The credentials may include a client identifier (client_id) and a client secret (client_secret). The client_id is issued by the authorization server 404 when the client 402 registers with the authorization server 404 (e.g., in a separate step, which may be an out-of-band step). This registration may be part of a separate step not illustrated in FIG. 4. In step 2, the authorization server 404 validates the client 402 using the provided client_id and client_secret, and returns an access token to the client 402. In step 3, the client 402 uses the access token to call the API of resource server 406. See also [0066-0068] The scope in the JWT access token indicates the authorized level of access for the NF Service Consumer. If needed, the scope will include NF services that the NF Service Consumer is authorized to access in the NF Service Producer. The NF Service Consumer presents the obtained JWT to the NF Service Producer in the HPLMN when requesting access to a service provided by the NF Service Producer. The NF Service Producer verifies the received JWT based on the hNRF's public certificate. If the verification is successful, the requested NF service is granted to the NF Service Consumer by the NF Service Producer.)
Nagendra and Bykampadi are analogous art because they are from the same field of endeavor which is network repository function. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Nagendra with the teaching of Bykampadi to include the access token because it would have been used to prevent unauthorized access.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Choyi, Vinod Kumar, US11902445, title “ System and method for enabling secure service-based communications via 5G proxies.”
Rajput, Jay, US12192764, title “ Methods, systems, and computer readable media for delegated authorization at security edge protection proxy (SEPP)”
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JOSNEL JEUDY whose telephone number is (571)270-7476. The examiner can normally be reached M-F 10:00-8:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Arani T Taghi can be reached at (571)272-3787. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
Date: 9/16/2026
/JOSNEL JEUDY/ Primary Examiner, Art Unit 2438
Prosecution Insights