Ex Parte Hinton et al

Patent Trial and Appeal Board

Mar 29, 2017

11752576 (P.T.A.B. Mar. 29, 2017)

United States Patent and Trademark Office
UNITED STATES DEPARTMENT OF COMMERCE
United States Patent and Trademark Office
Address: COMMISSIONER FOR PATENTS
P.O.Box 1450
Alexandria, Virginia 22313-1450
www.uspto.gov
APPLICATION NO. FILING DATE FIRST NAMED INVENTOR ATTORNEY DOCKET NO. CONFIRMATION NO.
11/752,576 05/23/2007 Heather Maria Hinton AUS920070053US1 3992
63400 7590
IBM CORP. (DHJ)
c/o DAVID H. JUDSON
15950 DALLAS PARKWAY
SUITE 225
DALLAS, TX 75248
EXAMINER
SHIN, KYUNG H
ART UNIT PAPER NUMBER
2443
NOTIFICATION DATE DELIVERY MODE
03/31/2017 ELECTRONIC
Please find below and/or attached an Office communication concerning this application or proceeding.
The time period for reply, if any, is set in the attached communication.
Notice of the Office communication was sent electronically on above-indicated "Notification Date" to the
following e-mail address(es):
mail@davidjudson.com
PTOL-90A (Rev. 04/07)
UNITED STATES PATENT AND TRADEMARK OFFICE
BEFORE THE PATENT TRIAL AND APPEAL BOARD
Ex parte HEATHER MARIA HINTON, ANTHONY SCOTT MORAN,
and BENJAMIN BREWER HARMON
Appeal 2014-008913
Application 11/752,5761
Technology Center 2400
Before HUNG H. BUI, KEVIN C. TROCK, and
MICHAEL M. BARRY, Administrative Patent Judges.
TROCK, Administrative Patent Judge.
DECISION ON APPEAL
Appellants seek review under 35 U.S.C. § 134(a) from the Examiner’
Final Rejection of claims 1—7, 10-21, and 24—26.2 We have jurisdiction
under 35 U.S.C. § 6(b).
We AFFIRM.
1 Appellants indicate the Real Party in Interest is International Business
Machines Corporation. App. Br. 1.
2 Claims 8, 9, 22, and 23 are cancelled. App. Br. 32, 36.
Appeal 2014-008913
Application 11/752,576
Invention
The claimed invention relates to “session management in an enterprise
computing environment in which users access back-end resources through a
front end point of contact, such as a reverse proxy or web server plug-in.”
Spec. 1.
Exemplary Claim
Exemplary claim 1 is reproduced below with disputed limitations
emphasized:
1. A method, operative at an apparatus, the apparatus
comprising a processor, and computer memory holding
computer program instructions that when executed by the
processor comprise a point of contact that serves as an
intermediary between a client browser and one or more back end
applications, wherein each back-end application sets its own
server-side session management data for the point of contact that
is distinct from any client-side session management data set by
the point of contact and used by the point of contact to manage a
user session, the method comprising:
as a back end application returns a response to a first
request that has been issuedfrom the client browser, associating
with the server-side session management data a validity stamp
that is different from the server-side session management data
set by the back end application and is useful to determine validity
of the server-side session management data if the server-side
session management data and the validity stamp are later
received in association with a new request [referred to herein as
the “associating” step], and forwarding to the client browser the
response together with the server-side session management data
and the validity stamp; and
upon receipt of the new request that has associated
therewith the server-side session management data and the
validity stamp, determining whether the validity stamp is valid
and, if so, removing the validity stamp from the server-side
2
Appeal 2014-008913
Application 11/752,576
session management data and forwarding to the back-end
application the new request, together with the server-side session
management data [referred to herein as the “determining” step].
Examiner’s Rejections & References
(1) Claims 1, 2, 6, 7, 10-12, 16—20, 24, and 25 stand rejected under
35 U.S.C. § 103(a) as being unpatentable over Nakatsuyama (US PG Pub.
No. 2007/0288634 Al, pub. Dec. 13, 2007) and Fikes et al. (US Patent No.
7,779,103 Bl, issued Aug. 17, 2010) (“Fikes”).
(2) Claims 3, 4, 13, 14, and 21 stand rejected under 35 U.S.C. §
103(a) as being unpatentable over Nakatsuyama, Fikes, and Wilf (US Patent
No. 6,496,824 Bl, issued Dec. 17, 2002).
(3) Claims 5, 15, and 26 stand rejected under 35 U.S.C. § 103(a) as
being unpatentable over Nakatsuyama, Fikes, Wilf, and Turner et al. (US
Patent No. 7,694,335 Bl, issued Apr. 6, 2010) (“Turner”).
ANALYSIS
We have reviewed the Examiner’s rejections and the evidence of
record in light of Appellants’ arguments that the Examiner has erred. We
disagree with Appellants’ arguments and conclusions. We adopt as our
own: (1) the findings and reasons set forth by the Examiner in the Office
Action from which this appeal is taken and (2) the findings and reasons set
forth in the Examiner’s Answer. We concur with the conclusions reached by
the Examiner and further highlight specific findings and argument for
emphasis as follows.
Independent Claims 1 and 11
Appellants contend the Examiner erred in rejecting independent claims
3
Appeal 2014-008913
Application 11/752,576
1 and 11 because the combination of Nakatsuyama and Fikes does not teach
or suggest the recited “associating” and “determining” steps of those claims
(emphasized above for claim 1). App. Br. 9-30; Reply Br. 1—10. In
particular, Appellants argue the Examiner improperly construed the terms
“server-side session management data” and “validity stamp.” App. Br. 9—
14; Reply Br. 1—4. Appellants assert that neither Nakatsuyama nor Fikes
teaches or suggests a validity stamp because Nakatsuyama’s second
authentication ticket is nothing more than client-side session management
data and there is no validity stamp associated with it. App. Br. 15—17; Reply
Br. 5—6. Appellants also assert Nakatsuyama merely describes the browser
presenting the second authentication ticket during subsequent access and
does not teach any processing associated with the ticket, and therefore, does
not teach the recited “determining” step. App. Br. 17.
Appellants further argue Nakatsuyama’s digital signature is not a
validity stamp because it is not associated with the server-side session
management data, but is associated with a request from a client browser, not
the response to that request. Id. at 18. Appellants assert that Nakatsuyama
does not teach how the digital signature is processed, and that such a digital
signature is not associated with either the first or second authentication
ticket. Id.
Appellants next argue that Fikes’ operation of decrypting a first cookie
does not teach the recited removing the validity stamp, because the
decrypting simply recovers the cookie and does not remove any information
used to determine validity of the server-side management data. Id. at 19.
The Examiner finds, however, and we agree, there is no definition
within the Specification of what comprises server-side or client-side session
4
Appeal 2014-008913
Application 11/752,576
management data. Ans. 13—14. The Examiner broadly, yet reasonably,
interprets the term “server-side session management data” to comprise any
data setup and maintained by a server in order to manage a communication
session between a client and a server, and the term “client-side session
management data” to comprise any data setup and maintained by a client in
order to manage a communication session between a client and a server. Id.
at 14.
The Examiner notes that Appellants’ own Specification explains that a
validity stamp enables determining whether the session data received in a
subsequent request is valid. Ans. 15 (citing Spec. 10). The Examiner finds,
and we agree, that Nakatsuyama teaches a digital signature being utilized to
determine the validity of authentication data such as an authentication ticket
utilized in a subsequent access to a computing system. Ans. 15—16 (citing
Nakatsuyama 137:8—10).
The Examiner also finds, and we agree, Nakatsuyama teaches that
“included with the authentication ticket is a cookie which is session
management data for a server (i.e. server-side session management
data setup by the server).” Ans. 18. The Examiner finds, and we agree, that
Nakatsuyama teaches that the authentication ticket is utilized to provide
authentication for a subsequent session for the client. Id. The Examiner
further finds, and we agree, Nakatsuyama teaches that a request can include
a digital signature utilized as a validation or verification mechanism for
enabling communication between two network-connected entities (a client
and a server). Id. (citing Nakatsuyama 8—12, 37, 48—52).
The Examiner explains, and we agree, authentication information is
setup by a server to enable access to the server. Ans. 19. A client uses the
5
Appeal 2014-008913
Application 11/752,576
predetermined authentication data to enable access to the server. Id. The
second authentication ticket taught by Nakatsuyama indicates a server
authentication setup and that server-side session management data is used in
the user session. Id. The recited validity stamp is therefore analogous to a
digital signature (or a mechanism to determine whether session data is valid)
and is associated in Nakatsuyama with the authentication ticket (or
analogous token) and used for subsequent access to a computing system. Id.
at 19-20.
The Examiner further finds, and we further agree, that “Fikes discloses
the separation of the digital signature (or an analogous operation of removal
of a digital signature) which is required in order to authenticate the digital
signature (i.e. digital signature, validity stamp).” Ans. 22. The Examiner
also finds, and we also agree, Fikes teaches a cryptographic operation
(encryption, decryption), which is required in order to validate the digital
signature. Id. (citing Fikes 13:4 et seq., 18:22 etseq.; Fig. 7). Fikes
analyzes a first cookie to authenticate a digital signature included in the
cookie. Id. This suggests that a digital signature must be removed in order
to use the information to determine a successful authentication.
Accordingly, we are not persuaded by Appellants’ arguments that the
Examiner erred in finding the combination of Nakatsuyama and Fikes
teaches or suggests the disputed limitations of independent claim 1 and those
similarly recited in independent claim 11. Therefore, we sustain the
Examiner’s rejection of claims 1 and 11.
Independent Claims 10 and 24
Appellants contend the Examiner erred in rejecting independent claims
10 and 24 because the combination of Nakatsuyama and Fikes does not
6
Appeal 2014-008913
Application 11/752,576
teach or suggest:
as the first end user interacts with the back end application during
the user session, associating a validity stamp with the server-side
session management data returned from the point of contact, the
validity stamp being different from the server-side session
management data set by the back end application and is useful to
determine validity of the server-side session management data if
the server-side session management data and the validity stamp
are later received in association with a request from the second
end user; and as the second end user interacts with the back end
application after the first end user has logged off, using the
validity stamp to determine whether the second user obtains
access to the first end user’s resources at the back-end
application,
as recited in those claims. App. Br. 21—25; Reply Br. 6—7.
Appellants reiterate some of the same arguments asserted with respect
to claims 1 and 11. For example, Appellants argue that the second
authentication ticket in Nakatsuyama — the one that can be reused by the
browser in subsequent accesses — is nothing more than the client-side
session management data, because that is the data in Nakatsuyama that is
used by the SSO module to manage a user session. App. Br. 23. Appellants
also argue that Nakatsuyama’s SSO module just returns the second
authentication ticket without any associated validity stamp. Id. Appellants
conclude that, at best, Nakatsuyama’s second authentication ticket is client-
side session management data, and not the recited server-side session
management data. Id. at 24.
As discussed above with respect to claims 1 and 11, the Examiner
finds, and we agree, Nakatsuyama’s second authentication ticket is server
setup and server-side session management data for a user session. Ans. 24.
The Examiner finds that Nakatsuyama teaches that included within the
7
Appeal 2014-008913
Application 11/752,576
authentication ticket is a cookie which is session management data for a
server (i.e., server-side session management data). Id. The Examiner also
finds that Nakatsuyama teaches the authentication ticket is utilized to
provide authentication access for a subsequent session for the client. Id.
The Examiner further finds that Nakatsuyama teaches that a digital signature
associated with authentication type data is used as a validation mechanism.
Id. (citing Nakatsuyama Tflf 8—12, 37).
Accordingly, we are not persuaded by Appellants’ arguments the
Examiner erred rejecting independent claims 10 and 24. Therefore, we
sustain the Examiner’s rejection of these claims.
Independent Claims 20 and 25
Appellants contend the Examiner erred in rejecting independent
claims 20 and 25 because the combination of Nakatsuyama and Fikes does
not teach or suggest:
as a back end application returns a response to a first request that
has been issued from the client browser, stamping a session
cookie set by the back end application and forwarding to the
client browser the response together with the stamped session
cookie, wherein the stamped session cookie is different from the
session cookie set by the back end application; and
upon receipt of a new request that has associated therewith the
stamped session cookie, forwarding to the back end application
the new request together with the session cookie if the stamped
session cookie is determined to be valid,
as recited in those claims. App. Br. 25—27; Reply Br. 7—8.
Appellants argue the Examiner did not recite the “stamped session
cookie” claim language or attempt to apply the cited art to this element.
App. Br. 26. Appellants assert the Examiner provided no explicit reasoning
how the cited art allegedly teaches this subject matter. Id. Appellants argue
8
Appeal 2014-008913
Application 11/752,576
that a “stamped session cookie” is more than just providing a “cookie” and
that Nakatsuyama’s applying a digital signature to a client request header is
not the recited operation because it does not occur upon a server request. Id.
The Examiner finds, however, and we agree, Appellants’ own
Specification explains that the recited “validity stamp” enables determining
whether session data, if received in a subsequent request, is valid. Ans. 25
(citing Spec. 10). A digital signature is utilized to determine the validity of
digital data (such as authentication data used for subsequent access to a
computing system). The Examiner further finds, and we further agree,
Nakatsuyama teaches a digital signature utilized in a determination of the
validity of authentication data such as an authentication ticket utilized for
subsequent access to a computing system. Id. (citing Nakatsuyama Tflf 8—12;
37) (digital signature added to message (i.e., request) to ensure that message
is not faked (i.e., message is valid)). The Examiner finds that with the
disclosed digital signature, Nakatsuyama teaches a validity check is required
in order to ensure that the authentication data is valid. Id. The Examiner
also finds, and we also agree, the recited “stamped session cookie is utilized
as authentication data whereby a validity check is performed utilizing a
digital signature in order to verify that the authentication data is valid.” Id.
at 25—26.
Accordingly, we are not persuaded by Appellants’ arguments that the
Examiner erred in rejecting independent claims 20 and 25. Therefore, we
sustain the Examiner’s rejection of these claims.
Dependent Claims 2 and 12
Claims 2 and 12 depend from independent claims 1 and 11,
respectively. These claims add the limitation of a validity stamp derived as
9
Appeal 2014-008913
Application 11/752,576
a function of a data string set by a back-end application. Appellants reiterate
the same arguments previously made, e.g., Nakatsuyama’s second
authentication ticket is just provided to the web browser and is not
associated or processed in any way. See App. Br. 27—28; Reply Br. 8.
Appellants also assert the Examiner failed to provide adequate reasons for
combining Nakatsuyama and Fikes. Id. at 28.3 We are not persuaded by
Appellants’ arguments. Accordingly, for the reasons set forth above we
sustain the Examiner’s rejection of dependent claims 2 and 12.
Dependent Claims 5 and 15
Claims 5 and 15 indirectly depend from independent claims 1 and 11,
respectively. These claims add the limitation of evaluating whether the
validity stamp can be re-created from the data string (or session cookie) and
a current point of contact one-time use value for a current user session.
Appellants assert that the Turner algorithm is not evaluating a “current point
of contact one-time user value for a current user session.” App. Br. 29;
Reply Br. 9. Appellants, however, proffer no evidence to support this
assertion.
The Examiner finds, and we agree, Turner teaches the usage
of a one-time use value in the processing of authentication data. Ans. 28
(citing Turner 6:6 et seq.; Figs 3, 4 (solving to the algorithm which involves
recreating the values (6:42—48; 7:1—11); secure cookie generated utilizing
3 Although the Examiner’s articulation of the motivation to combine
Nakatsuyama and Fikes with respect to dependent claims 2 and 12 appears
to have been inadvertently truncated (see Final Act. 5), it is reasonable to
believe that the rationale for combining Nakatsuyama and Fikes with respect
to claims 2 and 12 is identical to the rationale for combining Nakatsuyama
and Fikes with respect to claims 1 and 11 (see Final Act. 4). This, therefore,
is harmless error.
10
Appeal 2014-008913
Application 11/752,576
RN and RD (first and second random numbers); secure cookie generator
combines parameters to generate a secure cookie)). The Examiner notes the
Specification explains that the one-time use value can be a pseudorandom
number. Ans. 28 (citing Spec. p. 11,11. 24—28 (one-time piece of
information maintained (by the PoC) within the user's session (. . . a strong
pseudorandom number . . .)).
We are not persuaded by Appellants’ arguments. Accordingly, for the
reasons set forth above we sustain the Examiner’s rejection of dependent
claims 5 and 15.
Dependent Claim 26
Claim 26 depends from independent claim 1, and adds the limitation of
“the validity stamp is derived as a concatenation of the server-side session
management data together with a cryptographic hash of a given value, the
given value being an encoding of the server-side session management data
concatenated with one of: a unique identifier, and a pseudorandom number.”
Appellants assert that Turner fails to teach a “concatenation” because the
random numbers RN and RD are combined but not “concatenated.” App.
Br. 29-30; Reply Br. 9-10. Appellants also assert the random numbers are
not “server-side session management data.” Id.
The Examiner finds, however, and we agree, Turner teaches the
concatenation (or joining) of data strings whereby one of the data strings is a
random number. Ans. 29. The Examiner reasons, and we agree, that the
broadest reasonable definition of the term concatenation is the joining or
combining of data such as data strings. Id. (citing Turner col. 6,11. 6 et seq.;
Figs. 3, 4 (solving to the algorithm which involves recreating the values);
col. 6,11. 42-48; col. 7,11. 1—11 (secure cookie generated utilizing RN and
11
Appeal 2014-008913
Application 11/752,576
RD, first and second random numbers; secure cookie generator combines
parameters to generate a secure cookie). The Examiner finds, and we agree,
Turner discloses the concatenation of two entities in the processing of digital
data. Id.
We are not persuaded by Appellants’ arguments. Accordingly, for the
reasons set forth above we sustain the Examiner’s rejection of dependent
claim 26.
Remaining Claims
Appellants have not presented separate, substantive arguments with
respect to claims 3, 4, 6, 7, 13, 14, 16—19, and 21. See App. Br. 12—30.
Therefore, we are not persuaded the Examiner erred in rejecting these
claims. See 37 C.F.R. § 41.37(c)(l)(iv) (2014); In reLovin, 652 F.3d 1349,
1356 (Fed. Cir. 2011) (“We conclude that the Board has reasonably
interpreted Rule 41.37 to require applicants to articulate more substantive
arguments if they wish for individual claims to be treated separately.”).
Accordingly, we sustain the Examiner’s rejection of claims 2-4, 6—12, 14,
and 15.
DECISION
We AFFIRM the Examiner’s rejection of claims 1—7, 10—21, and 24—
26.
No time period for taking any subsequent action in connection with
this appeal may be extended under 37 C.F.R. § 1.136(a)(l)(iv).
AFFIRMED
12