DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Objections
Claims 7 and 18 are objected to because of the following informalities: Currently claims 7 and 18 depends from claims 2 and 13 respectively and recites, “wherein the communications are additionally…”, which lacks antecedent basis as claims 2 and 13 (or independent claims 1 and 12) fails to provide any mention of the term “communications”. Claims 7 and 18 should depend from claims 6 and 17 respectively which provide proper antecedent basis. Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(d):
(d) REFERENCE IN DEPENDENT FORMS.—Subject to subsection (e), a claim in dependent form shall contain a reference to a claim previously set forth and then specify a further limitation of the subject matter claimed. A claim in dependent form shall be construed to incorporate by reference all the limitations of the claim to which it refers.
The following is a quotation of pre-AIA 35 U.S.C. 112, fourth paragraph:
Subject to the following paragraph [i.e., the fifth paragraph of pre-AIA 35 U.S.C. 112], a claim in dependent form shall contain a reference to a claim previously set forth and then specify a further limitation of the subject matter claimed. A claim in dependent form shall be construed to incorporate by reference all the limitations of the claim to which it refers.
Claim 10 is rejected under 35 U.S.C. 112(d) or pre-AIA 35 U.S.C. 112, 4th paragraph, as being of improper dependent form for failing to further limit the subject matter of the claim upon which it depends, or for failing to include all the limitations of the claim upon which it depends. Claim 10 fails to further limit any element of claim 1. Applicant may cancel the claim(s), amend the claim(s) to place the claim(s) in proper dependent form, rewrite the claim(s) in independent form, or present a sufficient showing that the dependent claim(s) complies with the statutory requirements.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-4, 8-10, 12-15 and 19-20 are rejected under 35 U.S.C. 103 as being unpatentable over Morrison et al. (US 2015/0213449 A1), hereinafter, “Morrison” and in view of Taylor (US 2018/0114000 A1), hereinafter, “Taylor” and further in view of Debois et al. (US 2018/0219679 A1), hereinafter, “Debois”.
Regarding Claims 1, 12 and 20, Morrison discloses a server device (See, Fig. 1, Numeral 120) and corresponding method and non-transitory computer readable medium for authenticating client devices communicating with an enterprise system, the server device comprising:
a processor (See, Fig. 6, Numeral 620); and
a memory coupled to the processor (See, Fig. 6, Numeral 630), the memory storing computer executable instructions that when executed by the processor cause the server device to:
intercept an application programming interface (API) call to an API used to access an application (See, Fig. 1, Numerals 122a…122y and Paragraph 0024, “The PEP 122 receives (block 202) the API transaction request, and may be configured to intercept the API transaction request to prevent it from reaching the destination node 110 without the PEP 122 first authorizing its delivery to the destination node 110”), and enable the PEI to communicate with a policy information point (PIP) (See, Paragraph 0028, “The PEP 122 may, based on the risk assessment score (e.g. risk assessment score not satisfying a defined threshold value or other risk assessment rule), initiate further authentication through an authentication challenge process that attempts to authenticate the source node 100, the application that generated (block 200) the API transaction request, a person operating the source node 100, etc.”);
review a requested entitlements to determine whether the requested entitlements have been validated (See, Paragraph 0028, “The PEP 122 validates (block 214) content of the authentication response message and can control (block 216) deliverability of API transaction request based on whether or not the authentication response message was properly validated. For example, when the PEP 122 determines that credentials received in the API transaction request are invalid or otherwise suspicious (e.g., based on a defined validation rule or other risk assessment rule), the PEP 122 may discard the API transaction request without delivering it to the source node 110”);
validate that the account has access privileges to complete the API call (See, Paragraph 0028, “The PEP 122 validates (block 214) content of the authentication response message and can control (block 216) deliverability of API transaction request based on whether or not the authentication response message was properly validated. For example, when the PEP 122 determines that credentials received in the API transaction request are invalid or otherwise suspicious (e.g., based on a defined validation rule or other risk assessment rule), the PEP 122 may discard the API transaction request without delivering it to the source node 110” and Paragraph 0050, “The PEP 122 and/or the PDP 124 may determine the type of application and/or device of the source node 100 (e.g., Apple IOS device, Android OS device, Windows OS device, Unix OS device, etc.), and may restrict deliverability and/or privileges of the API transaction request based thereon” and also see, Paragraphs 0056 and 0057); and
in response to validation, permit invocation of the API to access the application (See, Paragraph 0027, “The PEP 122 can deliver the API transaction request to the destination node 110 for receipt (block 218). The destination node 110 processes (block 220) the API transaction request to generate an API transaction response (e.g., by retrieving or generating information requested by the API transaction request), and communicates (block 222) the API transaction response to the source node 100. The source node 100 receives (block 224) the API transaction response, and provides (block 226) the API transaction response to the application on the source node 104 for processing”).
While Morrison discloses requesting and receiving entitlement from client system and also validating client’s access request locally, Morrison fails to disclose request entitlements of an account associated with the intercepted API call; obtain, via an encrypted communications channel, the requested entitlements from an entitlements database and determining if the requested entitlements have been altered.
Taylor discloses a system wherein application server request entitlements of an account; obtain, via an
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to request, for the account associated with the intercepted API call in the system of Morrison, entitlements, via a communication channel from an entitlements database and determining if the requested entitlements have been altered as taught by Taylor in order to separate service provider server from also pervading attestation services and this will allow the attestation mechanism to be delivered as a service to the vendor of the application whose authenticity needs to be verified. Moreover, the attestation server devices may be shared for the attestation of various different application server devices, verifying various distinct applications. This configuration provides some distinct advantages as information relating to the valid configuration of operating systems on target client devices can be pooled across attestation services for different applications, since the set of target devices and their operating systems will be common (See, Taylor, Paragraph 0057).
While Taylor discloses obtaining entitlements using a communication channel, Taylor fails to explicitly disclose receiving entitlements using an encrypted communication channel.
Debois discloses receiving entitlements using an encrypted communication channel (See, Abstract and Paragraph 0282).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to receive, for the account associated with the intercepted API call in the system of Morrison and Taylor, entitlements using an encrypted communication channel as taught by Debois in order to not only provide integrity verification but also secure communication of entitlements between the service provide and authentication provider.
Regarding Claims 2 and 13, the rejection of claims 1 and 12 is incorporated and the combination of Morrison, Taylor and Debois further discloses wherein a policy enforcement interceptor (PEI), a policy information point (PIP), and a policy decision point (PDP) are utilized by the server device as modules to access applications accessible to the client device via one or more APls (See, Morrison, Fig. 6 and Paragraph 0061).
Regarding Claims 3 and 14, the rejection of claims 2 and 13 is incorporated and the combination of Morrison, Taylor and Debois further discloses wherein the PIP is provided as a separate service from the API used to access the application (See, Morrison, Fig. 1, Numerals 124 and 100a).
Regarding Claims 4 and 15, the rejection of claims 2 and 13 is incorporated and the combination of Morrison, Taylor and Debois further discloses wherein the PIP is configured to serve a plurality of APIs used to access corresponding ones of a plurality of applications accessible to the client device (See, Morrison, Fig. 1, Numerals 124 and 110 and Paragraph 0024).
Regarding Claims 8 and 19, the rejection of claims 1 and 12 is incorporated and the combination of Morrison, Taylor and Debois further discloses wherein the computer executable instructions further cause the server device to update the entitlements database (See, Morrison, Paragraph 0058).
Regarding Claim 9, the rejection of claim 1 is incorporated and the combination of Morrison, Taylor and Debois further discloses the server device to communicate with an API controller for the application to obtain an appropriate API response to the API call to permit invocation of the API (See, Morrison, Paragraphs 0044-0045).
Regarding Claim 10, the rejection of claim 1 is incorporated and the combination of Morrison, Taylor and Debois further discloses a data model is populated using a set of different views, the set of different views structured to include data elements according to a policy evaluation required (See, Morrison, Paragraph 0057).
Claims 5 and 16 are rejected under 35 U.S.C. 103 as being unpatentable over Morrison in view of Taylor and Debois and further in view of Lim (US 2008/0060051 A1), hereinafter, “Lim”.
Regarding Claims 5 and 16, the rejection of claims 2 and 13 is incorporated and the combination of Morrison, Taylor and Debois does not explicitly disclose wherein the policy information point is deployed using a software development kit (SDK).
However, deploying module using a software development kit (SDK) is well known in the art. Lim discloses deploying various policy modules using a software development kit (SDK) (See, Paragraphs 0158 and 0181).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to deploy policy information point in the system of Morrison, Taylor and Debois using a software development kit (SDK) as taught by Lim in order to provide a third party integration which can be “can be extremely useful because in a specific implementation where policy enforcers are deployed company-wide, managing all types of information, the management system has access to information in a distributed environment without having to go through additional authentication and authorization processes. For example, a customer relationship management (CRM) application may instruct a policy enforcement system through an external event to archive all documents related to a customer on the closing of an account. The handling of such an external event may include rolling up: files on file servers and desktop and laptop computers, e-mail messages on mail servers and all mail clients, and documents in document management systems” (See, Lim, Paragraph 0181).
Claims 6-7 and 17-18 are rejected under 35 U.S.C. 103 as being unpatentable over Morrison in view of Taylor and Debois and further in view of Ramakrishna (US 2007/0094503 A1), hereinafter, “Ramakrishna”.
Regarding Claims 6 and 17, the rejection of claims 2 and 13 is incorporated and the combination of Morrison, Taylor and Debois does not explicitly disclose wherein communications to and from the policy enforcement interceptor, the policy information point, and the policy decision point are secured by an encrypted communications channel.
However, secure communication between multiple entities using encrypted communications channel and authorization security token in well known in the art of computer security. Ramakrishna discloses secure communication between multiple entities using encrypted communications channel (See, Paragraphs 0022, 0028 and 0031).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to secure communication, between policy enforcement interceptor, the policy information point, and the policy decision point in the system of Morrison, Taylor and Debois, using encrypted communications channel as taught by Ramakrishna in order to provide security in case the various modules are distributed and/or communicating using an unsecure medium.
Regarding Claims 7 and 18, the rejection of claims 2 and 13 is incorporated and the combination of Morrison, Taylor and Debois does not explicitly disclose wherein communications to and from the policy enforcement interceptor, the policy information point, and the policy decision point are additionally secured using authorization security tokens.
However, secure communication between multiple entities using authorization security token in well known in the art of computer security. Ramakrishna discloses secure communication between multiple entities using authorization security tokens (See, Paragraphs 0022, 0028 and 0031).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to secure communication, between policy enforcement interceptor, the policy information point, and the policy decision point in the system of Morrison, Taylor and Debois, using authorization security token as taught by Ramakrishna in order to provide security in case the various modules are distributed and/or communicating using an unsecure medium.
Claim 11 is rejected under 35 U.S.C. 103 as being unpatentable over Morrison in view of Taylor and Debois and further in view of de los Reyes et al. (US 2011/0289134 A1), hereinafter, “Reyes”.
Regarding Claim 11, the rejection of claim 1 is incorporated and Morrison, Taylor and Debois does not explicitly disclose wherein a database for managing entitlements in communication with PIP comprises entitlements for the client device that correspond to a plurality of organizational units.
However, providing database that support plurality of organizational units is well-known in the art. Reyes discloses an entitlements database comprises entitlements for client device that correspond to a plurality of organizational units (See, Paragraphs 0016 and 0027).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include in the entitlement database in the system of Morrison, Taylor and Debois entitlements for the client device that correspond to a plurality of organizational units as taught by Reyes in order to order to provide a third party service that support multiple enterprises and each enterprise could still configures enterprise specific policies.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 1-20 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-20 of U.S. Patent No. 12,015,607 B2. Although the claims at issue are not identical, they are not patentably distinct from each other because claims 1-20 are anticipated by claims 1-20 of U.S. Patent No. 12,015,607 B2.
Claims 1-20 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-20 of U.S. Patent No. 12,363,114 B2. Although the claims at issue are not identical, they are not patentably distinct from each other because claims 1-20 are anticipated by claims 1-20 of U.S. Patent No. 12,363,114 B2.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to YOGESH PALIWAL whose telephone number is (571)270-1807. The examiner can normally be reached M-F 9:00AM-5:00PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Amir Mehrmanesh can be reached at (571)270-3351. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/YOGESH PALIWAL/ Primary Examiner, Art Unit 2435
Prosecution Insights