Ex Parte Agrawal et alDownload PDFPatent Trial and Appeal BoardMay 11, 201711715607 (P.T.A.B. May. 11, 2017) Copy Citation United States Patent and Trademark Office UNITED STATES DEPARTMENT OF COMMERCE United States Patent and Trademark Office Address: COMMISSIONER FOR PATENTS P.O.Box 1450 Alexandria, Virginia 22313-1450 www.uspto.gov APPLICATION NO. FILING DATE FIRST NAMED INVENTOR ATTORNEY DOCKET NO. CONFIRMATION NO. 11/715,607 03/07/2007 Sunil Agrawal B411/ADBS.208567 6092 121363 7590 05/15/2017 Shook, Hardy & Bacon L.L.P. (Adobe Systems Incorporated) Intellectual Property Department 2555 Grand Blvd Kansas City, MO 64108 EXAMINER TRAN, ELLEN C ART UNIT PAPER NUMBER 2433 NOTIFICATION DATE DELIVERY MODE 05/15/2017 ELECTRONIC Please find below and/or attached an Office communication concerning this application or proceeding. The time period for reply, if any, is set in the attached communication. Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the following e-mail address(es): IPDOCKET@SHB.COM IPRCDKT@SHB.COM mjj ordan @ shb .com PTOL-90A (Rev. 04/07) UNITED STATES PATENT AND TRADEMARK OFFICE BEFORE THE PATENT TRIAL AND APPEAL BOARD Ex parte SUNIL AGRAWAL and ANDREI SHERETOV Appeal 2016-003150 Application 11/715,607 Technology Center 2400 Before CAROLYN D. THOMAS, ADAM J. PYONIN, and KARA L. SZPONDOWSKI, Administrative Patent Judges. PYONIN, Administrative Patent Judge. DECISION ON APPEAL This is a decision on appeal under 35 U.S.C. § 134(a) from the Final Rejection, mailed December 18, 2014, of claims 1—4, 8—14, 16, and 17, which are all of the pending claims. See App. Br. 3. We have jurisdiction under 35 U.S.C. § 6(b). We AFFIRM-IN-PART. Appeal 2016-003150 Application 11/715,607 STATEMENT OF THE CASE Introduction The Application is directed to secure network communications using a shared cryptographic key in a cookie stored on a client device. See Abstract. Claims 1, 8, and 14 are independent. Claim 1 is reproduced below for reference (with formatting and emphasis added): 1. A method comprising: establishing a secured connection between a client device and a subordinate web service of a single sign-on service for a user, using a shared cryptographic key in a Hypertext Transfer Protocol (HTTP) cookie stored on the client device that was transmitted over a different secured connection by a master web service of the single sign-on service, as part of authentication of the user for the single sign-on service, wherein the shared cryptographic key in a single cookie establishes multiple secured connections for different subordinate web services without requiring a public/private key exchange. References and Rejections Claims 1—4, 8—11, 13, 14, 16, and 17 stand rejected under 35 U.S.C. § 103(a) as being unpatentable over Yared (US 2003/0149781 Al; Aug. 7, 2003), Purpura (US 6,421,768 Bl; July 16, 2002), and Vick (US 7,082,532 Bl; July 25, 2006). Final Act. 3. Claim 12 stands rejected under 35 U.S.C. § 103(a) as being unpatentable over Yared, Purpura, Vick, and Mayo (US 2005/0204148 Al; Sept. 15,2005). Final Act. 11. 2 Appeal 2016-003150 Application 11/715,607 ANALYSIS We have reviewed the Examiner’s rejections in light of Appellants’ arguments that the Examiner erred. Except as indicated below with respect to dependent claim 12, we disagree with Appellants that the Examiner erred and adopt as our own the findings and reasons set forth by the Examiner. See Final Act. 2—10; Ans. 7—8 (Section 5). We highlight and address specific findings and arguments for emphasis as follows. A. Independent Claims Appellants argue the Examiner erred, because “the cited portions of Vick do not appear to teach or suggest the shared cryptographic key in a single cookie establishes multiple secured connections for different subordinate web services without requiring a public/private key exchange, as recited in independent claims 1, 8, and 14.” App. Br. 9; see also Reply Br. 4. Appellants further argue that “there was no apparent reason to pick and choose the asserted elements from Yared, Purpura and Vick, without improperly using the claims as a guide.” Id. 10. We are not persuaded the Examiner erred in finding the limitations of the independent claims to be taught by the cited references. Rather, we agree with the Examiner that Vick and Purpura teach the shared cryptographic key in a single cookie which “establishes multiple secured connections for different subordinate web services without requiring a public/private key exchange,” as claimed. See Ans. 8. Vick teaches “a user password cookie using a shared secret key” that is used for secure connections to multiple web services, such as web servers participating in an authentication ring. Vick Abstract, 4:8—25. Purpura, similarly, teaches 3 Appeal 2016-003150 Application 11/715,607 using a cookie for secured communication across multiple web services (Purpura’s first and second computers), as Purpura discloses using “a cryptographically assured cookie is made by creating a cryptographically assured voucher of a user characteristic at the first computer, and embedding the voucher into a cookie for transmission to the user’s computer and hence to the second computer.” Purpura Abstract; see also Purpura 2:42-44 (“[t]he first and second computers could be, without limitation, virtually any type of content service provider on the Internet.”). We find the combined disclosure of the cited references, including Vick’s password cookie and Purpura’s cryptographically assured cookie, to teach the single cookie within the meaning of the claims. See Final Act. 4—5. We are also not persuaded the Examiner erred in finding the references combine in the manner claimed. See Ans. 7—8; Final Act. 3—5. We note the claimed “shared cryptographic key in a single cookie” does not preclude Vick’s teachings of using other cookies in addition to the “password cookie” as cited by the Examiner for teaching distributed web server authentication. See Final Act. 4—5; Vick 3:45 49. Yared also discloses that cookies can be used to “enable a cross-domain single sign-on implementation.” Yared 1 52. Although Yared suggests that such implementation can require certain security settings on a user device (id.), Purpura teaches improved methods of using cookies which account for such security settings (see Purpura 1:64—2:29) and Vick teaches federating web sites to support the same cookie key (see Vick 4:8—25). See Final Act. 4—5. Appellants’ argument that Yared’s teaching of using multiple domains is incompatible with Purpura’s teaching of shared domains is unpersuasive for requiring a bodily incorporation of the teaching of each references: for 4 Appeal 2016-003150 Application 11/715,607 instance, although Yared discloses multiple domains, we are not persuaded that one of ordinary skill would recognize Yared as requiring multiple domains when modified by the teachings of the other cited references.1 See App. Br. 10-11; Yared 142; Purpura 5:3—15; Vick Abstract; see also In re Sneed, 710 F.2d 1544, 1550 (Fed. Cir. 1983) (“it is not necessary that the inventions of the references be physically combinable to render obvious the invention under review.”). Accordingly, we agree with the Examiner that one of ordinary skill would combine the teachings of Yared with Purpura and Vick, to allow for “transferring authentication data” using a system “that is simper to implement [and] that enables of passing user credentials between multiple separate enterprise servers.” Final Act. 4—5; see also Purpura 2:9:31; Vick 2:59-67. We find the Examiner’s explanation to constitute articulated reasoning with rational underpinnings sufficient to justify the legal conclusion of obviousness. See In re Kahn, 441 F.3d 977, 988 (Fed. Cir 2006). We sustain the Examiner’s rejection of independent claims 1, 8, and 14, and dependent claims 2-4, 9—11, 13, 16, and 17, which are not separately argued. See App. Br. 12. B. Dependent Claim 12 Claim 12 depends from independent claim 8, and further recites “wherein establishing the second secured connection comprises establishing a Transport Layer Security (TLS) connection with the subordinate web 1 We note Yared teaches using common domains to facilitate usage of cookies in single sign on authentication. See Yared Fig. 4; 167. 5 Appeal 2016-003150 Application 11/715,607 service.” The Examiner finds an artisan of ordinary skill would modify Yared, Purpura, and Vick with the TLS teachings of Mayo: It would have been obvious to one of ordinary skill in the art at the time of the invention of a distributed network identity system taught in [Yared] and Purpura to include a means to utilize a newer protocol such as TLS. One of ordinary skill in the art would have been motivated to perform such a modification [] because the previous [single sign on] services were expensive to deploy and maintain see [Mayo] (paragraph 4). Final Act. 11 (citing Mayo ^fl[ 4, 30—33). Appellants argue the Examiner erred, because “Mayo suggests a different technical approach to sharing user authentication information” and “[a]side from the conclusory assertion in the Office Action, there does not appear to be any reason to believe that adopting only the TLS protocol of Mayo would reduce the cost or simplify the maintenance of the systems of Yared, Purpura and/or Vick.” App. Br. 14. We are persuaded by Appellants’ arguments. The Examiner does not respond to the issues raised by Appellants’ arguments. See MPEP 1207.02(A)(2). Further, we agree with Appellants that the Examiner did not sufficiently establish that the cited combination—particularly with the addition of Mayo’s Transport Layer Security—would mitigate the expenses of the system of Yared, Purpura, and Mayo. See App. Br. 14; Final Act. 11; Mayo 14 (describing the difficulties of single-sign on systems unrelated to the use of security protocols such as TLS). Thus, the Examiner has not presented reasoning sufficient to justify the legal conclusion of obviousness. See KSR Int’l Co. v. Teleflex Inc., 550 U.S. 398, 418 (2007). Accordingly, we do not sustain the Examiner’s rejection of dependent claim 12. 6 Appeal 2016-003150 Application 11/715,607 DECISION The Examiner’s rejection of claims 1—4, 8—11, 13, 14, 16, and 17 is affirmed. The Examiner’s rejection of claim 12 is reversed. No time period for taking any subsequent action in connection with this appeal may be extended under 37 C.F.R. § 1.136(a)(l)(iv). AFFIRMED-IN-PART 7 Copy with citationCopy as parenthetical citation