Ex Parte Agrawal et al

Patent Trial and Appeal Board

May 11, 2017

11715607 (P.T.A.B. May. 11, 2017)

United States Patent and Trademark Office
UNITED STATES DEPARTMENT OF COMMERCE
United States Patent and Trademark Office
Address: COMMISSIONER FOR PATENTS
P.O.Box 1450
Alexandria, Virginia 22313-1450
www.uspto.gov
APPLICATION NO. FILING DATE FIRST NAMED INVENTOR ATTORNEY DOCKET NO. CONFIRMATION NO.
11/715,607 03/07/2007 Sunil Agrawal B411/ADBS.208567 6092
121363 7590 05/15/2017
Shook, Hardy & Bacon L.L.P.
(Adobe Systems Incorporated)
Intellectual Property Department
2555 Grand Blvd
Kansas City, MO 64108
EXAMINER
TRAN, ELLEN C
ART UNIT PAPER NUMBER
2433
NOTIFICATION DATE DELIVERY MODE
05/15/2017 ELECTRONIC
Please find below and/or attached an Office communication concerning this application or proceeding.
The time period for reply, if any, is set in the attached communication.
Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the
following e-mail address(es):
IPDOCKET@SHB.COM
IPRCDKT@SHB.COM
mjj ordan @ shb .com
PTOL-90A (Rev. 04/07)
UNITED STATES PATENT AND TRADEMARK OFFICE
BEFORE THE PATENT TRIAL AND APPEAL BOARD
Ex parte SUNIL AGRAWAL and ANDREI SHERETOV
Appeal 2016-003150
Application 11/715,607
Technology Center 2400
Before CAROLYN D. THOMAS, ADAM J. PYONIN, and
KARA L. SZPONDOWSKI, Administrative Patent Judges.
PYONIN, Administrative Patent Judge.
DECISION ON APPEAL
This is a decision on appeal under 35 U.S.C. § 134(a) from the Final
Rejection, mailed December 18, 2014, of claims 1—4, 8—14, 16, and 17,
which are all of the pending claims. See App. Br. 3. We have jurisdiction
under 35 U.S.C. § 6(b).
We AFFIRM-IN-PART.
Appeal 2016-003150
Application 11/715,607
STATEMENT OF THE CASE
Introduction
The Application is directed to secure network communications using a
shared cryptographic key in a cookie stored on a client device. See Abstract.
Claims 1, 8, and 14 are independent. Claim 1 is reproduced below for
reference (with formatting and emphasis added):
1. A method comprising:
establishing a secured connection between a client device
and a subordinate web service of a single sign-on service for a
user,
using a shared cryptographic key in a Hypertext Transfer
Protocol (HTTP) cookie stored on the client device that was
transmitted over a different secured connection by a master web
service of the single sign-on service, as part of authentication of
the user for the single sign-on service,
wherein the shared cryptographic key in a single cookie
establishes multiple secured connections for different
subordinate web services without requiring a public/private key
exchange.
References and Rejections
Claims 1—4, 8—11, 13, 14, 16, and 17 stand rejected under 35 U.S.C.
§ 103(a) as being unpatentable over Yared (US 2003/0149781 Al; Aug. 7,
2003), Purpura (US 6,421,768 Bl; July 16, 2002), and Vick (US 7,082,532
Bl; July 25, 2006). Final Act. 3.
Claim 12 stands rejected under 35 U.S.C. § 103(a) as being
unpatentable over Yared, Purpura, Vick, and Mayo (US 2005/0204148 Al;
Sept. 15,2005). Final Act. 11.
2
Appeal 2016-003150
Application 11/715,607
ANALYSIS
We have reviewed the Examiner’s rejections in light of Appellants’
arguments that the Examiner erred. Except as indicated below with respect
to dependent claim 12, we disagree with Appellants that the Examiner erred
and adopt as our own the findings and reasons set forth by the Examiner.
See Final Act. 2—10; Ans. 7—8 (Section 5). We highlight and address
specific findings and arguments for emphasis as follows.
A. Independent Claims
Appellants argue the Examiner erred, because “the cited portions of
Vick do not appear to teach or suggest the shared cryptographic key in a
single cookie establishes multiple secured connections for different
subordinate web services without requiring a public/private key exchange, as
recited in independent claims 1, 8, and 14.” App. Br. 9; see also Reply Br.
4. Appellants further argue that “there was no apparent reason to pick and
choose the asserted elements from Yared, Purpura and Vick, without
improperly using the claims as a guide.” Id. 10.
We are not persuaded the Examiner erred in finding the limitations of
the independent claims to be taught by the cited references. Rather, we
agree with the Examiner that Vick and Purpura teach the shared
cryptographic key in a single cookie which “establishes multiple secured
connections for different subordinate web services without requiring a
public/private key exchange,” as claimed. See Ans. 8. Vick teaches “a user
password cookie using a shared secret key” that is used for secure
connections to multiple web services, such as web servers participating in an
authentication ring. Vick Abstract, 4:8—25. Purpura, similarly, teaches
3
Appeal 2016-003150
Application 11/715,607
using a cookie for secured communication across multiple web services
(Purpura’s first and second computers), as Purpura discloses using “a
cryptographically assured cookie is made by creating a cryptographically
assured voucher of a user characteristic at the first computer, and embedding
the voucher into a cookie for transmission to the user’s computer and hence
to the second computer.” Purpura Abstract; see also Purpura 2:42-44
(“[t]he first and second computers could be, without limitation, virtually any
type of content service provider on the Internet.”). We find the combined
disclosure of the cited references, including Vick’s password cookie and
Purpura’s cryptographically assured cookie, to teach the single cookie within
the meaning of the claims. See Final Act. 4—5.
We are also not persuaded the Examiner erred in finding the
references combine in the manner claimed. See Ans. 7—8; Final Act. 3—5.
We note the claimed “shared cryptographic key in a single cookie” does not
preclude Vick’s teachings of using other cookies in addition to the
“password cookie” as cited by the Examiner for teaching distributed web
server authentication. See Final Act. 4—5; Vick 3:45 49. Yared also
discloses that cookies can be used to “enable a cross-domain single sign-on
implementation.” Yared 1 52. Although Yared suggests that such
implementation can require certain security settings on a user device (id.),
Purpura teaches improved methods of using cookies which account for such
security settings (see Purpura 1:64—2:29) and Vick teaches federating web
sites to support the same cookie key (see Vick 4:8—25). See Final Act. 4—5.
Appellants’ argument that Yared’s teaching of using multiple domains is
incompatible with Purpura’s teaching of shared domains is unpersuasive for
requiring a bodily incorporation of the teaching of each references: for
4
Appeal 2016-003150
Application 11/715,607
instance, although Yared discloses multiple domains, we are not persuaded
that one of ordinary skill would recognize Yared as requiring multiple
domains when modified by the teachings of the other cited references.1 See
App. Br. 10-11; Yared 142; Purpura 5:3—15; Vick Abstract; see also In re
Sneed, 710 F.2d 1544, 1550 (Fed. Cir. 1983) (“it is not necessary that the
inventions of the references be physically combinable to render obvious the
invention under review.”).
Accordingly, we agree with the Examiner that one of ordinary skill
would combine the teachings of Yared with Purpura and Vick, to allow for
“transferring authentication data” using a system “that is simper to
implement [and] that enables of passing user credentials between multiple
separate enterprise servers.” Final Act. 4—5; see also Purpura 2:9:31; Vick
2:59-67. We find the Examiner’s explanation to constitute articulated
reasoning with rational underpinnings sufficient to justify the legal
conclusion of obviousness. See In re Kahn, 441 F.3d 977, 988 (Fed. Cir
2006). We sustain the Examiner’s rejection of independent claims 1, 8, and
14, and dependent claims 2-4, 9—11, 13, 16, and 17, which are not separately
argued. See App. Br. 12.
B. Dependent Claim 12
Claim 12 depends from independent claim 8, and further recites
“wherein establishing the second secured connection comprises establishing
a Transport Layer Security (TLS) connection with the subordinate web
1 We note Yared teaches using common domains to facilitate usage of
cookies in single sign on authentication. See Yared Fig. 4; 167.
5
Appeal 2016-003150
Application 11/715,607
service.” The Examiner finds an artisan of ordinary skill would modify
Yared, Purpura, and Vick with the TLS teachings of Mayo:
It would have been obvious to one of ordinary skill in the art at
the time of the invention of a distributed network identity system
taught in [Yared] and Purpura to include a means to utilize a
newer protocol such as TLS. One of ordinary skill in the art
would have been motivated to perform such a modification []
because the previous [single sign on] services were expensive to
deploy and maintain see [Mayo] (paragraph 4).
Final Act. 11 (citing Mayo ^fl[ 4, 30—33).
Appellants argue the Examiner erred, because “Mayo suggests a
different technical approach to sharing user authentication information” and
“[a]side from the conclusory assertion in the Office Action, there does not
appear to be any reason to believe that adopting only the TLS protocol of
Mayo would reduce the cost or simplify the maintenance of the systems of
Yared, Purpura and/or Vick.” App. Br. 14.
We are persuaded by Appellants’ arguments. The Examiner does not
respond to the issues raised by Appellants’ arguments. See MPEP
1207.02(A)(2). Further, we agree with Appellants that the Examiner did not
sufficiently establish that the cited combination—particularly with the
addition of Mayo’s Transport Layer Security—would mitigate the expenses
of the system of Yared, Purpura, and Mayo. See App. Br. 14; Final Act. 11;
Mayo 14 (describing the difficulties of single-sign on systems unrelated to
the use of security protocols such as TLS). Thus, the Examiner has not
presented reasoning sufficient to justify the legal conclusion of obviousness.
See KSR Int’l Co. v. Teleflex Inc., 550 U.S. 398, 418 (2007). Accordingly,
we do not sustain the Examiner’s rejection of dependent claim 12.
6
Appeal 2016-003150
Application 11/715,607
DECISION
The Examiner’s rejection of claims 1—4, 8—11, 13, 14, 16, and 17 is
affirmed.
The Examiner’s rejection of claim 12 is reversed.
No time period for taking any subsequent action in connection with
this appeal may be extended under 37 C.F.R. § 1.136(a)(l)(iv).
AFFIRMED-IN-PART
7