Ex Parte Kern et alDownload PDFPatent Trial and Appeal BoardJan 26, 201511379088 (P.T.A.B. Jan. 26, 2015) Copy Citation UNITED STATES PATENT AND TRADEMARK OFFICE UNITED STATES DEPARTMENT OF COMMERCE United States Patent and Trademark Office Address: COMMISSIONER FOR PATENTS P.O. Box 1450 Alexandria, Virginia 22313-1450 www.uspto.gov APPLICATION NO. FILING DATE FIRST NAMED INVENTOR ATTORNEY DOCKET NO. CONFIRMATION NO. 11/379,088 04/18/2006 David S. Kern CAM920060007US1/1174-005 9228 44185 7590 01/27/2015 BAINWOOD HUANG & ASSOCIATES LLC c/o LOTUS AND RATIONAL SOFTWARE 2 Connector Road Westborough, MA 01581 EXAMINER HOLDER, BRADLEY W ART UNIT PAPER NUMBER 2439 MAIL DATE DELIVERY MODE 01/27/2015 PAPER Please find below and/or attached an Office communication concerning this application or proceeding. The time period for reply, if any, is set in the attached communication. PTOL-90A (Rev. 04/07) UNITED STATES PATENT AND TRADEMARK OFFICE ____________ BEFORE THE PATENT TRIAL AND APPEAL BOARD ____________ Ex parte DAVID S. KERN, SHIU F. POON, and ROBERT J. PAGANETTI ____________ Appeal 2012-008782 Application 11/379,088 Technology Center 2400 ____________ Before JOHN A. JEFFERY, JEREMY J. CURCURI, and IRVIN E. BRANCH, Administrative Patent Judges. JEFFERY, Administrative Patent Judge. DECISION ON APPEAL Appellants appeal under 35 U.S.C. § 134(a) from the Examiner’s decision to reject claims 1–17. We have jurisdiction under 35 U.S.C. § 6(b). We reverse. STATEMENT OF THE CASE Appellants’ invention recovers automatically a credential store when a user forgets their password by using a temporary encryption key pair created based on a new password provided by the user. See generally Abstract. Appeal 2012-008782 Application 11/379,088 2 Claim 1 is illustrative: 1. A method, embodied in at least one computer system, of recovering a user's credential store, comprising at least the following steps performed by said computer system: receiving an indication from said user that said user has forgotten their previous password; responsive to receipt of said indication that said user has forgotten their password, generating a user interface object in a user interface displayed to said user, said user interface object for receiving a new password from said user; receiving said new password from said user through said user interface object; generating, on a client computer system, a temporary encryption key pair based on said new password obtained from said user, said temporary encryption key pair including a public key and a private key; sending said public key from said client computer system to a recovery process executing on a recovery server computer system; receiving, by said recovery process, an approval message from a help desk administrator; obtaining, by said recovery process, recovery information associated with said credential store; encrypting, by said recovery process responsive to receipt of said approval message, said recovery information using said public key; downloading said encrypted recovery information to said client computer system; decrypting said recovery information on said client computer system using said private key; and obtaining a decrypted copy of said credential store based on said decrypted recovery information. Appeal 2012-008782 Application 11/379,088 3 THE REJECTIONS The Examiner rejected claims 1–3, 9–11, and 17 under 35 U.S.C. § 103(a) as unpatentable over Parsons (WO 2005/045550 A2; May 19, 2005) and Grawrock (US 2002/0080974 A1; June 27, 2002). Ans. 5–11. 1 The Examiner rejected claims 4–8 and 12–16 under 35 U.S.C. § 103(a) as unpatentable over Parsons, Grawrock, and Koren (US 2002/0194095 A1; Dec. 19, 2002). Ans. 11–15. THE REJECTION OVER PARSONS AND GRAWROCK The Examiner finds that Parsons discloses every recited element of claim 1 except for (1) generating a temporary public/private encryption key pair, and (2) sending the public key from the client computer system to a recovery process executing on a recovery server computer system. Ans. 5– 9, 16–27. The Examiner, however, cites Grawrock as teaching these features in concluding that the claim would have been obvious. Id. Appellants argue that the cited prior art does not teach or suggest (1) generating, on a client computer system, a temporary encryption key pair based on a new password obtained from the user through a user interface object generated responsive to a received indication that the user forgot their password, and (2) using a public key of the temporary pair to encrypt obtained recovery information as claimed. App. Br. 15–21; Reply Br. 4–5. According to Appellants, when a user needs to recover their password in Parsons, an encrypted recovery code is sent to another user who then 1 Throughout this opinion, we refer to (1) the Appeal Brief filed December 19, 2011 (“App. Br.”); (2) the Examiner’s Answer mailed April 6, 2012 (“Ans.”); and (3) the Reply Brief filed May 21, 2012 (“Reply Br.”). Appeal 2012-008782 Application 11/379,088 4 decrypts the code and sends it to the original user to enable that user to change their password by entering the received code. App. Br. 17, 19–20. Appellants emphasize that this password-recovery functionality requiring another user differs from the recited recovery technique, and Grawrock does not cure that deficiency. App. Br. 21. ISSUE Under § 103, has the Examiner erred in rejecting claim 1 by finding that Parsons and Grawrock collectively would have taught or suggested (1) generating, on a client computer system, a temporary encryption key pair based on a new password obtained from the user through a user interface object generated responsive to a received indication that the user forgot their password, and (2) using a public key of the temporary pair to encrypt recovery information responsive to receiving an approval message from a help desk administrator? ANALYSIS We will not sustain the Examiner’s rejection of independent claim 1 essentially for the reasons indicated by Appellants. App. Br. 15–21; Reply Br. 4–5. Among other things, claim 1 requires generating, on a client computer system, a temporary encryption key pair based on a new password obtained from the user through a user interface object, where that object is generated responsive to a received indication that the user forgot their password. According to the Examiner, Parsons’ recovery system generates this user interface object by providing recovery code to the user that is used Appeal 2012-008782 Application 11/379,088 5 to change a password or create a new one. Ans. 6, 19 (citing Parsons 5:31– 33; 6:8–10; Figs. 1–2). Even assuming, without deciding, that this recovery code is associated with a displayable user interface object for receiving a new user password as the Examiner contends, we still fail to see how Parsons and Grawrock collectively teach generating a temporary encryption key pair on a client computer system based on this new password, where a public key of this pair is used to encrypt obtained recovery information as claimed. Although Grawrock generates temporary public and private key pairs as noted in the Abstract, we find problematic the Examiner’s reliance on Parsons’ password recovery process that requires an additional user who functions as an intermediary and whose key is used to encrypt the recovery information— not the key of the user who forgot their password. See Parsons 5:31–6:8. As shown in steps 100 and 110 of Parsons’ Figure 2, when User A is locked out of their computer by forgetting their password, User A provides identity information to recovery system 40, as does User B. Parsons 5:26– 31. The recovery system then encrypts recovery code with User B’s encryption key and sends the encrypted code to User B, who then decrypts the code and sends it to User A. Parsons 5:31–6:8; Fig. 2 (steps 120–130). Upon entering the recovery code, User A can then decrypt an encrypted encryption key to change their password. Parsons 6:7–10. Although User A uses the received recovery code to generate a new password, and a key can be encrypted depending on that password (Parsons 2:21–22), we fail to see how that encrypted key (or a public key in light of Grawrock) is used to encrypt Parsons’ recovery code—a key aspect of the Appeal 2012-008782 Application 11/379,088 6 public encryption key in claim 1. Rather, Parsons’ recovery code is encrypted by the key of another user, namely User B. See Parsons 6:28–30. To the extent that the Examiner’s position is based on User B’s system generating the recited temporary encryption keys in light of Grawrock, such a position is likewise problematic. Although nothing in claim 1 precludes User B’s computer system from constituting a “client computer system,” User B’s key that encrypts the recovery code is not generated based on User A’s new password as claim 1 requires, but rather is user B’s pre-existing encryption key DKB. See Parsons 6:28–30. To the extent that the Examiner contends that it would have been obvious to replace User B’s pre-existing encryption key with a temporary key pair generated based on User A’s new password (see Ans. 9), such a position has no reasonable evidentiary basis on this record and is, therefore, untenable. Therefore, we are constrained by this record to find that the Examiner erred in rejecting (1) independent claim 1; (2) independent claims 9 and 17 reciting commensurate limitations; and (3) dependent claims 2, 3, 10, and 11 for similar reasons. THE REMAINING OBVIOUSNESS REJECTION Because the Examiner has not shown that Koren cures the deficiencies noted above regarding the independent claims, we will not sustain the obviousness rejection of dependent claims 4–8 and 12–16 (Ans. 11–15) for similar reasons. Appeal 2012-008782 Application 11/379,088 7 CONCLUSION The Examiner erred in rejecting claims 1–17 under § 103. DECISION The Examiner’s decision rejecting claims 1–17 is reversed. REVERSED ELD Copy with citationCopy as parenthetical citation