DETAILED ACTION
1. Pending claims for reconsideration are claims 2-25.
Response to Arguments
2. Applicant's arguments filed 2/17/2026 have been fully considered but they are not persuasive.
In the remarks, applicant argues in substance:
That– The combination of references does not teach or suggest, "assigning, to
the user device, based on a determined authenticity of the authentication request according to the first security protocol, a device identifier," as claimed (pg.9)
In response to applicant’s arguments- as stated in the prior action dated 11/18/2025 It is the combination of the prior arts that teach the claimed language. the combination of Poling discloses the claimed language in its broadest most reasonable interpretation. polling discloses in figure 3 an authentication process in which the first security protocol (i.e. insertion of selected encryption key [Fig.3/item 306]) is processed and then in Fig.3 item 308 an insertion of the unique identifier corresponding to the copy of the generic binary distribution of the DRM client into the copy of the generic binary distribution of the DRM client is processed.
That– The combination of references does not teach or suggest, "assigning, to the user device and based on the security resource authentication result, a new device identifier," as claimed (pg.11
In response to applicant’s arguments- As stated in the prior action dated 11/18/2025 Polling Column 15/ lines 53-55 discloses “the build server may also be configured to embed a unique identifier of an instance of a DRM client into the binary representation of the DRM client.” It should be understood in the art that “a unique identifier is created new, often using algorithms that generate random or sequential numbers, timestamps, or combinations of data. Depending on the system, new unique identifiers are generated when a new entity is created, such as a new user, file, or database entry.”
That– The motivation to combine the references is not supported (pg.13)
In response to applicant’s arguments- - As stated in the office action dated 11/18/2025 and in the 103 rejection below, the examiner recognizes that obviousness may be established by combining or modifying the teachings of the prior art to produce the claimed invention where there is some teaching, suggestion, or motivation to do so found either in the references themselves or in the knowledge generally available to one of ordinary skill in the art. See In re Fine, 837 F.2d 1071, 5 USPQ2d 1596 (Fed. Cir. 1988), In re Jones, 958 F.2d 347, 21 USPQ2d 1941 (Fed. Cir. 1992), and KSR International Co. v. Teleflex, Inc., 550 U.S. 398, 82 USPQ2d 1385 (2007). In the case of claim 2, Poling and Binding would have been obvious to one of ordinary skill in the art at the time the invention was filed to modify Poling’s Digital rights management system comprising security protocols with Binding’s key exchange protocol within a network system in order to provide additional security. One of ordinary skill in the art would have been motivated to combine because Poling discloses a digital rights management system comprising security protocols that encompass an authentication process, Binding teaches a security protocol that utilizes a key exchanging process, and both are from the same field of endeavor.
In the case of claims 3-4, 8, and 22-23 it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Poling, and Binding as modified by Cheng. One of ordinary skill would have been motivated to modify Poling, and Binding, as modified by Cheng, in such a manner in order to secure the communication session using known and available communication standards.
In the case of claims 9-10, 14-17, 20-21, and 24-25, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Poling’s DRM using a secure end to protocol with Cheng’s Method for providing a secure link to a user in a DRM in which a second request and master key identifier are utilized within an authentication request using a shared key. One of ordinary skill would have been motivated to combine because Poling teaches a security protocol within a DRM comprising an authentication process and Cheng also teaches an authentication process, but using a second protocol request and shared key process. Both Poling and Cheng are from the same field of endeavor.
Allowable Subject Matter
3. Claims 5-7 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
4. Claims 11-13, are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
5. Claims 18-19 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
6. Claim 2 is rejected under 35 U.S.C. 103 as being unpatentable over Patent No.: US 8,972,726 B1 to Poling, in view of Patent No.: US 6,751,731 B1 to Binding et al (hereafter referenced as Binding)
Regarding claim 2, Poling discloses “a method (Poling: Fig 1) comprising: receiving, from a user device(client system 200), an authentication request according to a first security protocol (Poling: Fig 1, server 220 receives authentication request 252 from client system 200; col 7, lines 26-42 provides for various different authentication algorithms or “security protocols” for content of the authentication request; Also, col 9, line 6 – col 10, line 42 provides the authentication request may be an encrypted authentication request according to a variety of encryption algorithms including AES; Any of these authentication mechanisms or encryption protocols is equivalent to “a first security protocol”; see also col 10, line 60 – col 11, line 32);assigning , to the user device , based on a determined authenticity of the authentication request according to the first security protocol, a device identifier(polling discloses in figure 3 an authentication process in which the first security protocol (i.e. insertion of selected encryption key [Fig.3/item 306]) is processed and then in Fig.3 item 308 an insertion of the unique identifier corresponding to the copy of the generic binary distribution of the DRM client into the copy of the generic binary distribution of the DRM client is processed) ; “sending, to the user device, based on the determined authenticity of the authentication request according to the first security protocol, a token” (Poling: col 12, lines 30-46 for verifying authenticity of the authentication request; col 12, lines 47-63 for sending authentication token to client; The entire point of the token is to uniquely identify the client, see for example col 16, lines 39-44 “the client application identified by the authentication token, see also Col.7/lines 55- 62 which disclose “In some embodiments, the authentication server may be configured to send an authentication token to the DRM client implemented within the client application. The authentication token may be stored on the client system on which the client application is running and may be used by the client application as proof that the identity of the client application has been validated by a trusted party and that the client application is a trusted consumer of protected content” ), “wherein the request comprises the device identifier and the token” (Poling: col 16, lines 7-49 provides the request for content license includes the previously issued authentication token); “and authenticating, based on the device identifier and the token,” (Poling: col 16, lines 28-48 provides license server authenticates client to ensure they are authorized to access requested content, all based on “the client application identified by the authentication token”
Poling does not explicitly disclose “receiving, from the user device, a request to access content secured according to a second security protocol encrypted using a shared key, decrypting the request using the shared key.”
However, Binding in an analogous art discloses “receiving, from the user device, a request to access content secured according to a second security protocol(said content response uses a Second existing message type onto which is piggy backed Second Security data Binding[Col.31/lines 65—67]) encrypted using a shared key”(by using input of both parties to generate the Session key, and then using this shared key to encrypt Session data, Security is increased beyond what would be achieved if a Single party generated Such a key (where an error-prone implementation of that Single party might reuse the same key value repeatedly, leading to a Security exposure Binding[Col.11/lines 22-28]), “decrypting the request using the shared key”(thus, the privacy of the content is also protected, and the client will be able to decrypt this protected content only by using the appropriate key (that is, the shared key in a private key System, or the client's private key in a public key System Binding[Col.13/lines 10-14]).
Therefore, it would have been obvious to one of ordinary skill in the art at the time the invention was filed to modify Poling’s Digital rights management system comprising security protocols with Binding’s key exchange protocol within a network system in order to provide additional security. One of ordinary skill in the art would have been motivated to combine because Poling discloses a digital rights management system comprising security protocols that encompass an authentication process, Binding teaches a security protocol that utilizes a key exchanging process, and both are from the same field of endeavor.
7. Claims 3-4, 8, and 22-23 are rejected under 35 U.S.C. 103 as being unpatentable over Patent No.: US 8,972,726 B1 to Poling, in view of Patent No.: US 6,751,731 B1 to Binding et al (hereafter referenced as Binding) in view of Pub.No.: US 2010/0262831 A1 to Cheng et al (hereafter referenced as Cheng),
Regarding claim 3 in view of claim 2, neither Poling nor Binding disclose “further comprising using the shared key as an input to a key derivation function, and wherein an output of the key derivation function comprises information related to the shared key.”
However, Cheng in an analogous art discloses “further comprising using the shared key (using key shared between SIM and trusted management server Cheng[par.0024] as an input to a key derivation function (key derivation input function KDF used to derive Ks NAF from Ks is based on HMAC-SHA 256, as specified by GBA. For the derivation of Ks. NAF Dev from Ks NAF, the same KDF can be used Cheng [par.0043]), and wherein an output of the key derivation function comprises information related to the shared key.” (SAC-secure authenticated channel Cheng [Fig.3] creates output of key derivation between SIM and key derivation module Cheng [par.0044]).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Poling, and Binding as modified by Cheng. One of ordinary skill would have been motivated to modify Poling, and Binding, as modified by Cheng, in such a manner in order to secure the communication session using known and available communication standards.
Regarding claim 4 in view of claim 2, neither Poling nor Binding disclose “wherein the authentication request indicates a device class of the user device, and wherein the device identifier is based on at least one of a software version, a timestamp, a random number, a vendor identifier, or a device class identifier.”
However, Cheng in an analogous art discloses “wherein the authentication request indicates a device class of the user device” (first request comprises a device identifier Cheng [par.0007]), “and wherein the device identifier is based on at least one of a software version, a timestamp, a random number, a vendor identifier, or a device class identifier” (class device identifier Cheng [par.0007]).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Poling, and Binding as modified by Cheng. One of ordinary skill would have been motivated to modify Poling, and Binding, as modified by Cheng, in such a manner in order to secure the communication session using known and available communication standards.
Regarding claim 8 in view of claim 2, neither Poling nor Binding disclose “further comprising: receiving, from a security resource based on the request to access the content, a security challenge; sending, to the security resource, a security resource authentication request comprising a security resource identifier and the device identifier; and receiving, based on the security resource authentication request, a security resource authentication result.”
However, Cheng in an analogous art discloses “further comprising: receiving, from a security resource based on the request to access the content, a security challenge” (Server 225 uses a challenge/response Scheme with DRM device Cheng[par.0041]) ; “:sending, to the security resource, a security resource authentication request comprising a security resource identifier and the device identifier” (At step 405 a first request is sent from DRM Device 235 to a user identity module, i.e., *SIM215.. Cheng [par.0047]); “and receiving, based on the security resource authentication request, a security resource authentication result” (authentication the device Cheng [Fig.5/item 515]).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Poling, and Binding as modified by Cheng. One of ordinary skill would have been motivated to modify Poling, and Binding, as modified by Cheng, in such a manner in order to secure the communication session using known and available communication standards.
Regarding claim 22 in view of claim 2, the references combined disclose “wherein the token comprises a time-based token” (authentication token license server may ensure that the client system is not on a machine revocation list (e.g., a list that identifies systems whose authentication token has expired or systems known to be security threats or otherwise unsuitable for receiving a content license) Poling [Col.8/lines 50-55]).
Regarding claim 23 in view of claim 2, the references combined disclose “wherein authenticating the request comprises determining the token is not expired” (authentication token license server may ensure that the client system is not on a machine revocation list (e.g., a list that identifies systems whose authentication token has expired or systems known to be security threats or otherwise unsuitable for receiving a content license) Poling [Col.8/lines 50-55]).
8. Claims 9-10, 14-17, 20-21, and 24-25 are rejected under 35 U.S.C. 103 as being unpatentable over Patent No.: US 8,972,726 B1 to Poling, in view of Pub.No.: US 2010/0262831 A1 to Cheng et al (hereafter referenced as Cheng).
Regarding claim 9, Poling discloses “a method (Poling: Fig 1) comprising: receiving, from a user device (client system 200), a first authentication request according to a first security protocol (Poling: Fig 1, server 220 receives authentication request 252 from client system 200; col 7, lines 26-42 provides for various different authentication algorithms or “security protocols” for content of the authentication request; Also, col 9, line 6 – col 10, line 42 provides the authentication request may be an encrypted authentication request according to a variety of encryption algorithms including AES; Any of these authentication mechanisms or encryption protocols is equivalent to “a first security protocol”; see also col 10, line 60 – col 11, line 32); “wherein the first request comprises the first device identifier and a first token” (Poling: col 12, lines 30-46 for verifying authenticity of the authentication request; col 12, lines 47-63 for sending authentication token to client; The entire point of the token is to uniquely identify the client, see for example col 16, lines 39-44 “the client application identified by the authentication token” ), “based on the determined authenticity of the first authentication request according to the first security protocol” (Poling: Fig 1, server 220 receives authentication request 252 from client system 200; col 7, lines 26-42 provides for various different authentication algorithms or “security protocols” for content of the authentication request; Also, col 9, line 6 – col 10, line 42 provides the authentication request may be an encrypted authentication request according to a variety of encryption algorithms including AES; Any of these authentication mechanisms or encryption protocols is equivalent to “a first security protocol”; see also col 10, line 60 – col 11, line 32), assigning , to the user device , based on a determined authenticity of the authentication request according to the first security protocol, a device identifier; (polling discloses in figure 3 an authentication process in which the first security protocol (i.e. insertion of selected encryption key [Fig.3/item 306]) is processed and then in Fig.3 item 308 an insertion of the unique identifier corresponding to the copy of the generic binary distribution of the DRM client into the copy of the generic binary distribution of the DRM client is processed)
Poling does not explicitly disclose “receiving, from a second user device, a second authentication request according to a second security protocol; sending, to the first user device; a first token assigning , to the second user device, based on a determined authenticity of the second authentication request according to the second security protocol, a second device identifier; and receiving, from the first user device, a first request to access first content secured according to a third security protocol.
However, Cheng in an analogous art teaches “receiving, from a second user device (DRM Device Fig.1/item 115]) , “a second authentication request according to a second security protocol” (Receive a request from DRM device Cheng [Fig.5/item 505] in which a second request is sent to a trusted key device from the DRM device Cheng [Fig.5/item 515]); “sending, to the first user device(send a first request to SIM of user device Cheng [Fig.4/item 405]), “a first token assigning , to the second user device”(DRM device Cheng [Fig.1]), based on a determined authenticity of the second authentication request according to the second security protocol” (DRM device is authenticated in a DRM-specific way, a second request is sent to a trusted key according to management server protocol Cheng[par.0008]), “a second device identifier and information related to a second shared key” (second request comprises at least the master key identifier, the device identifier, and the random number Cheng [par.0007]); and receiving, from the first user device (receive first request from DRM device Cheng [Fig.5/item 505]), a first request to access first content secured according to a third security protocol”( after first security protocol at [Cheng step 505] and second security protocol [Cheng step 525], proceed to third security protocol at [Cheng step 555] by use of a challenge/ response scheme to determine if derived key matches derived key of the DRM device).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Poling’s DRM using a secure end to protocol with Cheng’s Method for providing a secure link to a user in a DRM in which a second request and master key identifier are utilized within an authentication request using a shared key. One of ordinary skill would have been motivated to combine because Poling teaches a security protocol within a DRM comprising an authentication process and Cheng also teaches an authentication process, but using a second protocol request and shared key process. Both Poling and Cheng are from the same field of endeavor.
Regarding claim 10 in view of claim 9, the references combined disclose “ further comprising: decrypting the first request using the first shared key” (decrypt the encrypted response including the type of authentication Credentials with the encryption key Poling [Fig.2/item 206]); “authenticating, based on the first device identifier and the first token” (Poling: col 12, lines 30-46 for verifying authenticity of the authentication request; col 12, lines 47-63 for sending authentication token to client; The entire point of the token is to uniquely identify the client, see for example col 16, lines 39-44 “the client application identified by the authentication token”, “the first request; and facilitating access to the first content” (the authentication server may use the identifier to look-up an encryption key that matches the encryption key embedded in the DRM client access request Poling[Col.40/lines 41-43]).
Regarding claim 14 in view of claim 9, the references combined disclose “wherein the first authentication request indicates a first device class of the first user device” (first request comprises a device identifier Cheng [par.0007]), “and wherein the second authentication request indicates a second device class of the second user device” (class device identifier Cheng[par.0007]).
Regarding claim 15 in view of claim 9, the references combined disclose “further comprising: receiving, from a security resource based on the first request to access the first content, a security challenge” (Server 225 uses a challenge/response Scheme with DRM device Cheng[par.0041]); “sending, to the security resource, a security resource authentication request comprising a security resource identifier and the first device identifier” (At step 405 a first request is sent from DRM Device 235 to a user identity module, i.e., *SIM215.. Cheng [par.0047]); “and receiving, based on the security resource authentication request, a security resource authentication result” (authentication the device Cheng [Fig.5/item 515]).
Regarding claim 16, Poling discloses “a method comprising: receiving, from a user device(receiving from a computer system 600), “a request to access content secured according to a first security protocol” (Poling: Fig 1, server 220 receives authentication request 252 from client system 200; col 7, lines 26-42 provides for various different authentication algorithms or “security protocols” for content of the authentication request; Also, col 9, line 6 – col 10, line 42 provides the authentication request may be an encrypted authentication request according to a variety of encryption algorithms including AES; Any of these authentication mechanisms or encryption protocols is equivalent to “a first security protocol”; see also col 10, line 60 – col 11, line 32), wherein the request comprises a token and a device identifier separate from the token”, (Poling: col 12, lines 30-46 for verifying authenticity of the authentication request; col 12, lines 47-63 for sending authentication token to client; The entire point of the token is to uniquely identify the client, see for example col 16, lines 39-44 “the client application identified by the authentication token. See also Col.7/lines 55- 62 which disclose “In some embodiments, the authentication server may be configured to send an authentication token to the DRM client implemented within the client application. The authentication token may be stored on the client system on which the client application is running and may be used by the client application as proof that the identity of the client application has been validated by a trusted party and that the client application is a trusted consumer of protected content.”), and assigning , to the user device , based on a determined authenticity of the authentication request according to the first security protocol, a device identifier;” (polling discloses in figure 3 an authentication process in which the first security protocol (i.e. insertion of selected encryption key [Fig.3/item 306]) is processed and then in Fig.3 item 308 an insertion of the unique identifier corresponding to the copy of the generic binary distribution of the DRM client into the copy of the generic binary distribution of the DRM client is processed).
Poling does not explicitly disclose “and is encrypted according to a second security protocol, receiving, from a security resource, based on the request to access the content, a security challenge ; sending, to the security resource based on the security challenge, a security resource authentication request comprising a security resource identifier, the token, and the device identifier ; and receiving, based on the security resource authentication request, a security resource authentication result
However, Cheng in an analogous art discloses “and is encrypted according to a second security protocol” (after Successful user authentication results in a key shared between the *SIM and a trusted key management server [par.0024] also see Cheng[Fig.5/item 535] in which a derived key may be used to authenticate and/or encrypt any DRM system protocol messages exchanged between the device 235, 305 and the DRM server 225 Cheng[par.0045]), receiving, from a security resource, based on the request to access the content, a security challenge” (Server 225 uses a challenge/response Scheme with DRM device Cheng[par.0041]); “sending, to the security resource based on the security challenge, a security resource authentication request comprising a security resource identifier, the token, and the device identifier” (At step 405 a first request is sent from DRM Device 235 to a user identity module, i.e., *SIM215.. Cheng [par.0047]); “and receiving, based on the security resource authentication request, a security resource authentication result.” (authentication device Cheng [Fig.5/item 515]),0020
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Poling’s DRM using a secure end to protocol with Cheng’s Method for providing a secure link to a user in a DRM in which a second request and master key identifier are utilized within an authentication request. One of ordinary skill would have been motivated to combine because Poling teaches a security protocol within a DRM comprising an authentication process and Cheng also teaches an authentication process, but using a second protocol request. Both Poling and Cheng are from the same field of endeavor.
Regarding claim 17 in view of claim 16, the references combined disclose “further comprising facilitating, based on the security resource authentication result, access to the content.” (access the content [Fig.4/item 406]).
Regarding claim 20 in view of claim 16, the references combined disclose “further comprising: receiving, from the user device(send a first request to SIM of to be received by the user device Cheng [Fig.4/item 455], an authentication request according to the second security protocol(second request to a trusted key management server [Fig.5/item 525]”; “and sending, to the user device based on a determined authenticity of the authentication request according to the second security protocol” (DRM device is authenticated in a DRM-specific way, a second request is sent to a trusted key according to management server protocol Cheng[par.0008]), “the new device identifier and information related to a shared key.” (second request comprises at least the master key identifier, the device identifier, and the random number Cheng [par.0007]
Regarding claim 21 in view of claim 20, the references combined disclose “further comprising: decrypting the authentication request using the shared key (decrypt the encrypted response including the type of authentication Credentials with the encryption key Poling [Fig.2/item 206];”and authenticating, based on the new device identifier, the request” (the authentication server may use the identifier to look-up an encryption key that matches the encryption key embedded in the DRM client access request Poling[Col.40/lines 41-43]).
Regarding claim 24 in view of claim 9, the references combined disclose “wherein the first token comprises a time-based token” (authentication token license server may ensure that the client system is not on a machine revocation list (e.g., a list that identifies systems whose authentication token has expired or systems known to be security threats or otherwise unsuitable for receiving a content license) Poling [Col.8/lines 50-55]).
Regarding claim 25 in view of claim 16, the references combined disclose “wherein receiving the security resource authentication result comprises determining the token is not expired” (authentication token license server may ensure that the client system is not on a machine revocation list (e.g., a list that identifies systems whose authentication token has expired or systems known to be security threats or otherwise unsuitable for receiving a content license) Poling [Col.8/lines 50-55]).
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MICHAEL D ANDERSON whose telephone number is (571)270-5159. The examiner can normally be reached Mon-Fri 9am-6pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Pwu can be reached at (571) 272-6798. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MICHAEL D ANDERSON/Examiner, Art Unit 2433
/JEFFREY C PWU/Supervisory Patent Examiner, Art Unit 2433
Prosecution Insights