Ex Parte Hinton et alDownload PDFPatent Trial and Appeal BoardMar 29, 201711752576 (P.T.A.B. Mar. 29, 2017) Copy Citation United States Patent and Trademark Office UNITED STATES DEPARTMENT OF COMMERCE United States Patent and Trademark Office Address: COMMISSIONER FOR PATENTS P.O.Box 1450 Alexandria, Virginia 22313-1450 www.uspto.gov APPLICATION NO. FILING DATE FIRST NAMED INVENTOR ATTORNEY DOCKET NO. CONFIRMATION NO. 11/752,576 05/23/2007 Heather Maria Hinton AUS920070053US1 3992 63400 7590 IBM CORP. (DHJ) c/o DAVID H. JUDSON 15950 DALLAS PARKWAY SUITE 225 DALLAS, TX 75248 EXAMINER SHIN, KYUNG H ART UNIT PAPER NUMBER 2443 NOTIFICATION DATE DELIVERY MODE 03/31/2017 ELECTRONIC Please find below and/or attached an Office communication concerning this application or proceeding. The time period for reply, if any, is set in the attached communication. Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the following e-mail address(es): mail@davidjudson.com PTOL-90A (Rev. 04/07) UNITED STATES PATENT AND TRADEMARK OFFICE BEFORE THE PATENT TRIAL AND APPEAL BOARD Ex parte HEATHER MARIA HINTON, ANTHONY SCOTT MORAN, and BENJAMIN BREWER HARMON Appeal 2014-008913 Application 11/752,5761 Technology Center 2400 Before HUNG H. BUI, KEVIN C. TROCK, and MICHAEL M. BARRY, Administrative Patent Judges. TROCK, Administrative Patent Judge. DECISION ON APPEAL Appellants seek review under 35 U.S.C. § 134(a) from the Examiner’ Final Rejection of claims 1—7, 10-21, and 24—26.2 We have jurisdiction under 35 U.S.C. § 6(b). We AFFIRM. 1 Appellants indicate the Real Party in Interest is International Business Machines Corporation. App. Br. 1. 2 Claims 8, 9, 22, and 23 are cancelled. App. Br. 32, 36. Appeal 2014-008913 Application 11/752,576 Invention The claimed invention relates to “session management in an enterprise computing environment in which users access back-end resources through a front end point of contact, such as a reverse proxy or web server plug-in.” Spec. 1. Exemplary Claim Exemplary claim 1 is reproduced below with disputed limitations emphasized: 1. A method, operative at an apparatus, the apparatus comprising a processor, and computer memory holding computer program instructions that when executed by the processor comprise a point of contact that serves as an intermediary between a client browser and one or more back end applications, wherein each back-end application sets its own server-side session management data for the point of contact that is distinct from any client-side session management data set by the point of contact and used by the point of contact to manage a user session, the method comprising: as a back end application returns a response to a first request that has been issuedfrom the client browser, associating with the server-side session management data a validity stamp that is different from the server-side session management data set by the back end application and is useful to determine validity of the server-side session management data if the server-side session management data and the validity stamp are later received in association with a new request [referred to herein as the “associating” step], and forwarding to the client browser the response together with the server-side session management data and the validity stamp; and upon receipt of the new request that has associated therewith the server-side session management data and the validity stamp, determining whether the validity stamp is valid and, if so, removing the validity stamp from the server-side 2 Appeal 2014-008913 Application 11/752,576 session management data and forwarding to the back-end application the new request, together with the server-side session management data [referred to herein as the “determining” step]. Examiner’s Rejections & References (1) Claims 1, 2, 6, 7, 10-12, 16—20, 24, and 25 stand rejected under 35 U.S.C. § 103(a) as being unpatentable over Nakatsuyama (US PG Pub. No. 2007/0288634 Al, pub. Dec. 13, 2007) and Fikes et al. (US Patent No. 7,779,103 Bl, issued Aug. 17, 2010) (“Fikes”). (2) Claims 3, 4, 13, 14, and 21 stand rejected under 35 U.S.C. § 103(a) as being unpatentable over Nakatsuyama, Fikes, and Wilf (US Patent No. 6,496,824 Bl, issued Dec. 17, 2002). (3) Claims 5, 15, and 26 stand rejected under 35 U.S.C. § 103(a) as being unpatentable over Nakatsuyama, Fikes, Wilf, and Turner et al. (US Patent No. 7,694,335 Bl, issued Apr. 6, 2010) (“Turner”). ANALYSIS We have reviewed the Examiner’s rejections and the evidence of record in light of Appellants’ arguments that the Examiner has erred. We disagree with Appellants’ arguments and conclusions. We adopt as our own: (1) the findings and reasons set forth by the Examiner in the Office Action from which this appeal is taken and (2) the findings and reasons set forth in the Examiner’s Answer. We concur with the conclusions reached by the Examiner and further highlight specific findings and argument for emphasis as follows. Independent Claims 1 and 11 Appellants contend the Examiner erred in rejecting independent claims 3 Appeal 2014-008913 Application 11/752,576 1 and 11 because the combination of Nakatsuyama and Fikes does not teach or suggest the recited “associating” and “determining” steps of those claims (emphasized above for claim 1). App. Br. 9-30; Reply Br. 1—10. In particular, Appellants argue the Examiner improperly construed the terms “server-side session management data” and “validity stamp.” App. Br. 9— 14; Reply Br. 1—4. Appellants assert that neither Nakatsuyama nor Fikes teaches or suggests a validity stamp because Nakatsuyama’s second authentication ticket is nothing more than client-side session management data and there is no validity stamp associated with it. App. Br. 15—17; Reply Br. 5—6. Appellants also assert Nakatsuyama merely describes the browser presenting the second authentication ticket during subsequent access and does not teach any processing associated with the ticket, and therefore, does not teach the recited “determining” step. App. Br. 17. Appellants further argue Nakatsuyama’s digital signature is not a validity stamp because it is not associated with the server-side session management data, but is associated with a request from a client browser, not the response to that request. Id. at 18. Appellants assert that Nakatsuyama does not teach how the digital signature is processed, and that such a digital signature is not associated with either the first or second authentication ticket. Id. Appellants next argue that Fikes’ operation of decrypting a first cookie does not teach the recited removing the validity stamp, because the decrypting simply recovers the cookie and does not remove any information used to determine validity of the server-side management data. Id. at 19. The Examiner finds, however, and we agree, there is no definition within the Specification of what comprises server-side or client-side session 4 Appeal 2014-008913 Application 11/752,576 management data. Ans. 13—14. The Examiner broadly, yet reasonably, interprets the term “server-side session management data” to comprise any data setup and maintained by a server in order to manage a communication session between a client and a server, and the term “client-side session management data” to comprise any data setup and maintained by a client in order to manage a communication session between a client and a server. Id. at 14. The Examiner notes that Appellants’ own Specification explains that a validity stamp enables determining whether the session data received in a subsequent request is valid. Ans. 15 (citing Spec. 10). The Examiner finds, and we agree, that Nakatsuyama teaches a digital signature being utilized to determine the validity of authentication data such as an authentication ticket utilized in a subsequent access to a computing system. Ans. 15—16 (citing Nakatsuyama 137:8—10). The Examiner also finds, and we agree, Nakatsuyama teaches that “included with the authentication ticket is a cookie which is session management data for a server (i.e. server-side session management data setup by the server).” Ans. 18. The Examiner finds, and we agree, that Nakatsuyama teaches that the authentication ticket is utilized to provide authentication for a subsequent session for the client. Id. The Examiner further finds, and we agree, Nakatsuyama teaches that a request can include a digital signature utilized as a validation or verification mechanism for enabling communication between two network-connected entities (a client and a server). Id. (citing Nakatsuyama 8—12, 37, 48—52). The Examiner explains, and we agree, authentication information is setup by a server to enable access to the server. Ans. 19. A client uses the 5 Appeal 2014-008913 Application 11/752,576 predetermined authentication data to enable access to the server. Id. The second authentication ticket taught by Nakatsuyama indicates a server authentication setup and that server-side session management data is used in the user session. Id. The recited validity stamp is therefore analogous to a digital signature (or a mechanism to determine whether session data is valid) and is associated in Nakatsuyama with the authentication ticket (or analogous token) and used for subsequent access to a computing system. Id. at 19-20. The Examiner further finds, and we further agree, that “Fikes discloses the separation of the digital signature (or an analogous operation of removal of a digital signature) which is required in order to authenticate the digital signature (i.e. digital signature, validity stamp).” Ans. 22. The Examiner also finds, and we also agree, Fikes teaches a cryptographic operation (encryption, decryption), which is required in order to validate the digital signature. Id. (citing Fikes 13:4 et seq., 18:22 etseq.; Fig. 7). Fikes analyzes a first cookie to authenticate a digital signature included in the cookie. Id. This suggests that a digital signature must be removed in order to use the information to determine a successful authentication. Accordingly, we are not persuaded by Appellants’ arguments that the Examiner erred in finding the combination of Nakatsuyama and Fikes teaches or suggests the disputed limitations of independent claim 1 and those similarly recited in independent claim 11. Therefore, we sustain the Examiner’s rejection of claims 1 and 11. Independent Claims 10 and 24 Appellants contend the Examiner erred in rejecting independent claims 10 and 24 because the combination of Nakatsuyama and Fikes does not 6 Appeal 2014-008913 Application 11/752,576 teach or suggest: as the first end user interacts with the back end application during the user session, associating a validity stamp with the server-side session management data returned from the point of contact, the validity stamp being different from the server-side session management data set by the back end application and is useful to determine validity of the server-side session management data if the server-side session management data and the validity stamp are later received in association with a request from the second end user; and as the second end user interacts with the back end application after the first end user has logged off, using the validity stamp to determine whether the second user obtains access to the first end user’s resources at the back-end application, as recited in those claims. App. Br. 21—25; Reply Br. 6—7. Appellants reiterate some of the same arguments asserted with respect to claims 1 and 11. For example, Appellants argue that the second authentication ticket in Nakatsuyama — the one that can be reused by the browser in subsequent accesses — is nothing more than the client-side session management data, because that is the data in Nakatsuyama that is used by the SSO module to manage a user session. App. Br. 23. Appellants also argue that Nakatsuyama’s SSO module just returns the second authentication ticket without any associated validity stamp. Id. Appellants conclude that, at best, Nakatsuyama’s second authentication ticket is client- side session management data, and not the recited server-side session management data. Id. at 24. As discussed above with respect to claims 1 and 11, the Examiner finds, and we agree, Nakatsuyama’s second authentication ticket is server setup and server-side session management data for a user session. Ans. 24. The Examiner finds that Nakatsuyama teaches that included within the 7 Appeal 2014-008913 Application 11/752,576 authentication ticket is a cookie which is session management data for a server (i.e., server-side session management data). Id. The Examiner also finds that Nakatsuyama teaches the authentication ticket is utilized to provide authentication access for a subsequent session for the client. Id. The Examiner further finds that Nakatsuyama teaches that a digital signature associated with authentication type data is used as a validation mechanism. Id. (citing Nakatsuyama Tflf 8—12, 37). Accordingly, we are not persuaded by Appellants’ arguments the Examiner erred rejecting independent claims 10 and 24. Therefore, we sustain the Examiner’s rejection of these claims. Independent Claims 20 and 25 Appellants contend the Examiner erred in rejecting independent claims 20 and 25 because the combination of Nakatsuyama and Fikes does not teach or suggest: as a back end application returns a response to a first request that has been issued from the client browser, stamping a session cookie set by the back end application and forwarding to the client browser the response together with the stamped session cookie, wherein the stamped session cookie is different from the session cookie set by the back end application; and upon receipt of a new request that has associated therewith the stamped session cookie, forwarding to the back end application the new request together with the session cookie if the stamped session cookie is determined to be valid, as recited in those claims. App. Br. 25—27; Reply Br. 7—8. Appellants argue the Examiner did not recite the “stamped session cookie” claim language or attempt to apply the cited art to this element. App. Br. 26. Appellants assert the Examiner provided no explicit reasoning how the cited art allegedly teaches this subject matter. Id. Appellants argue 8 Appeal 2014-008913 Application 11/752,576 that a “stamped session cookie” is more than just providing a “cookie” and that Nakatsuyama’s applying a digital signature to a client request header is not the recited operation because it does not occur upon a server request. Id. The Examiner finds, however, and we agree, Appellants’ own Specification explains that the recited “validity stamp” enables determining whether session data, if received in a subsequent request, is valid. Ans. 25 (citing Spec. 10). A digital signature is utilized to determine the validity of digital data (such as authentication data used for subsequent access to a computing system). The Examiner further finds, and we further agree, Nakatsuyama teaches a digital signature utilized in a determination of the validity of authentication data such as an authentication ticket utilized for subsequent access to a computing system. Id. (citing Nakatsuyama Tflf 8—12; 37) (digital signature added to message (i.e., request) to ensure that message is not faked (i.e., message is valid)). The Examiner finds that with the disclosed digital signature, Nakatsuyama teaches a validity check is required in order to ensure that the authentication data is valid. Id. The Examiner also finds, and we also agree, the recited “stamped session cookie is utilized as authentication data whereby a validity check is performed utilizing a digital signature in order to verify that the authentication data is valid.” Id. at 25—26. Accordingly, we are not persuaded by Appellants’ arguments that the Examiner erred in rejecting independent claims 20 and 25. Therefore, we sustain the Examiner’s rejection of these claims. Dependent Claims 2 and 12 Claims 2 and 12 depend from independent claims 1 and 11, respectively. These claims add the limitation of a validity stamp derived as 9 Appeal 2014-008913 Application 11/752,576 a function of a data string set by a back-end application. Appellants reiterate the same arguments previously made, e.g., Nakatsuyama’s second authentication ticket is just provided to the web browser and is not associated or processed in any way. See App. Br. 27—28; Reply Br. 8. Appellants also assert the Examiner failed to provide adequate reasons for combining Nakatsuyama and Fikes. Id. at 28.3 We are not persuaded by Appellants’ arguments. Accordingly, for the reasons set forth above we sustain the Examiner’s rejection of dependent claims 2 and 12. Dependent Claims 5 and 15 Claims 5 and 15 indirectly depend from independent claims 1 and 11, respectively. These claims add the limitation of evaluating whether the validity stamp can be re-created from the data string (or session cookie) and a current point of contact one-time use value for a current user session. Appellants assert that the Turner algorithm is not evaluating a “current point of contact one-time user value for a current user session.” App. Br. 29; Reply Br. 9. Appellants, however, proffer no evidence to support this assertion. The Examiner finds, and we agree, Turner teaches the usage of a one-time use value in the processing of authentication data. Ans. 28 (citing Turner 6:6 et seq.; Figs 3, 4 (solving to the algorithm which involves recreating the values (6:42—48; 7:1—11); secure cookie generated utilizing 3 Although the Examiner’s articulation of the motivation to combine Nakatsuyama and Fikes with respect to dependent claims 2 and 12 appears to have been inadvertently truncated (see Final Act. 5), it is reasonable to believe that the rationale for combining Nakatsuyama and Fikes with respect to claims 2 and 12 is identical to the rationale for combining Nakatsuyama and Fikes with respect to claims 1 and 11 (see Final Act. 4). This, therefore, is harmless error. 10 Appeal 2014-008913 Application 11/752,576 RN and RD (first and second random numbers); secure cookie generator combines parameters to generate a secure cookie)). The Examiner notes the Specification explains that the one-time use value can be a pseudorandom number. Ans. 28 (citing Spec. p. 11,11. 24—28 (one-time piece of information maintained (by the PoC) within the user's session (. . . a strong pseudorandom number . . .)). We are not persuaded by Appellants’ arguments. Accordingly, for the reasons set forth above we sustain the Examiner’s rejection of dependent claims 5 and 15. Dependent Claim 26 Claim 26 depends from independent claim 1, and adds the limitation of “the validity stamp is derived as a concatenation of the server-side session management data together with a cryptographic hash of a given value, the given value being an encoding of the server-side session management data concatenated with one of: a unique identifier, and a pseudorandom number.” Appellants assert that Turner fails to teach a “concatenation” because the random numbers RN and RD are combined but not “concatenated.” App. Br. 29-30; Reply Br. 9-10. Appellants also assert the random numbers are not “server-side session management data.” Id. The Examiner finds, however, and we agree, Turner teaches the concatenation (or joining) of data strings whereby one of the data strings is a random number. Ans. 29. The Examiner reasons, and we agree, that the broadest reasonable definition of the term concatenation is the joining or combining of data such as data strings. Id. (citing Turner col. 6,11. 6 et seq.; Figs. 3, 4 (solving to the algorithm which involves recreating the values); col. 6,11. 42-48; col. 7,11. 1—11 (secure cookie generated utilizing RN and 11 Appeal 2014-008913 Application 11/752,576 RD, first and second random numbers; secure cookie generator combines parameters to generate a secure cookie). The Examiner finds, and we agree, Turner discloses the concatenation of two entities in the processing of digital data. Id. We are not persuaded by Appellants’ arguments. Accordingly, for the reasons set forth above we sustain the Examiner’s rejection of dependent claim 26. Remaining Claims Appellants have not presented separate, substantive arguments with respect to claims 3, 4, 6, 7, 13, 14, 16—19, and 21. See App. Br. 12—30. Therefore, we are not persuaded the Examiner erred in rejecting these claims. See 37 C.F.R. § 41.37(c)(l)(iv) (2014); In reLovin, 652 F.3d 1349, 1356 (Fed. Cir. 2011) (“We conclude that the Board has reasonably interpreted Rule 41.37 to require applicants to articulate more substantive arguments if they wish for individual claims to be treated separately.”). Accordingly, we sustain the Examiner’s rejection of claims 2-4, 6—12, 14, and 15. DECISION We AFFIRM the Examiner’s rejection of claims 1—7, 10—21, and 24— 26. No time period for taking any subsequent action in connection with this appeal may be extended under 37 C.F.R. § 1.136(a)(l)(iv). AFFIRMED 12 Copy with citationCopy as parenthetical citation