Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
Status of Claims
Claims 1-4,6-7,9-12,14-15,17 and 19-21 are subject to examination. Claims, 5, 8, 13, 16, 18 are cancelled.
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 1-4,6-7,9-12,14-15,17 and 19-21 rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
Amended claims 1, 9, 17 contains, sending, over the network to a second device, an allowable expired list indicating one or more specific device operational certificates that are acceptable as valid even if expired, the one or more specific device operational certificates including the first device operational certificate, receipt of the list allowing the second device to authenticate the expired first device operational certificateto establish the secure connection communication between the first device and other devices in the BMS.
For the specification contains:
Para [0093] The allowable expired list 1155 contains the fingerprints of any expired operational certificates that the user would like the devices to accept. In this example, the allowable expired list 1155 would include the first fingerprint 1106. Thus, the devices 1112, 1122, 1132, would accept the expired first operational certificate 1104 from the first field device.
paragraph [0037]
PNG
media_image1.png
398
626
media_image1.png
Greyscale
The specification does not contain, “list” indicating one or more specific device operational certificates that are acceptable as valid even if expired. Rather, para 93 contains, allowable expired list 1155 contains the fingerprints of any expired operational certificates that the user would like the devices to accept.
The specification does not implement that the “list” would “allow” the second device to authenticate certificate to establish the secure connection.
A “list” cannot allow the second device to authenticate the expired first device operational certificate(without the second device indeed having it)
"indicating one or more specific device operational certificates that are acceptable as valid …". The boundaries of the functional language are unclear because the claim does not provide a discernable boundary on what performs the function, i.e. all the devices of BSM or few devices of BSM. The recited function does not follow the structure recited in the claim for which the certificates are acceptable, so it is unclear whether the function requires some other structure or is simply any entity to accept it. Thus, one of ordinary skill in the art would not be able to draw a clear boundary between what is and is not covered by the claim. See MPEP 2173.05(g) for more information.
Claims 2-4,6-7, 10-12,14-15, and 19-21 are dependent claims of claims 1, 9, 17 and hence subject to same rejections.
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-4,6-7,9-12,14-15,17 and 19-21 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Amended claims 1, 9, 17 contains, sending, over the network to a second device, an allowable expired list indicating one or more specific device operational certificates that are acceptable as valid even if expired, the one or more specific device operational certificates including the first device operational certificate, receipt of the list allowing the second device to authenticate the expired first device operational certificateto establish the secure connection communication between the first device and other devices in the BMS.
The term “specific” in claims 1, 8, 17 is a relative term which renders the claim indefinite. The term “specific” is not defined by the claim, the specification does not provide a standard for ascertaining the requisite degree, and one of ordinary skill in the art would not be reasonably apprised of the scope of the invention. The claimed “specific” certificates are available for all the devices of the BMS and/or other than BMS. It is not clear if the specific certificates versus not-specific certificates are for all the devices or not.
Claims 1, 8, 17 rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being incomplete for omitting essential elements, such omission amounting to a gap between the elements. See MPEP § 2172.01. The omitted elements are: The second device to indeed has a possession or an accessing step for the second device to access the expired first device operational certificate, in order to authenticate the expired first device operational certificateand to establish the secure connection communication between the first device and other devices in the BMS.
A receipt of list cannot provide the expired first device operational certificateto the second device to authenticate the expired first device operational certificateto establish the secure connection communication between the first device and other devices in the BMS.
Claims 2-4,6-7, 10-12,14-15, and 19-21 are dependent claims of claims 1, 9, 17 and hence subject to same rejections.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri et al., US 20210247731 in view of Shin, WO 2021158020 A1, Magnus et al., KR 20210103384 A and Official Notice.
Referring to claim 1, Poluri substantially discloses, a method of a device with an first device operational certificate in a building management system (BMS) (para 41), the method comprising: identifying that of a first device operational certificate of a first device (para 40) ,
[0034] generating a plurality of certificates for a plurality of client devices (such as the controllers 14 and/or clients 16 shown in FIG. 1) within a Building Management System (BMS) such as the BMS 12 using an application executing on a certificate management device. The certificate management device may include a user interface, and may be in communication with a remote server. The client management device, which in some cases may be a mobile device such as the mobile device 22, receives client device information. The client management device may transmit the received client device information to the remote server 20, as indicated at block 54. The remote server 20 may generate certificates for each of the client devices and download the certificates to the client management device. The client management device may receive the certificates and download certificates to the appropriate client device, which are then used for subsequent secure communication in the BMS. In some cases, as optionally indicated at block 60, the method 60 may further include tracking the expiration date of each of the certificates.
wherein authentication of the first device operational certificateis configured to enable a secure communication between the first device and other devices over a network (para 39, 29, 30)
[0029] the remote server 20 may transmit all of the generated controller certificates to the mobile device 22, and the mobile device 22 may distribute the generated controller certificates to the appropriate controllers. In some cases, the remote server 20 may transmit the generated controller certificates directly to the appropriate controllers.
[0030] tracking the expiration date of each of the generated controller certificates and allowing automatic renewal of the generated controller certificates. In some cases, the mobile device 22 may receive a renewed controller certificates for each of the expiring certificates from the remote server 20, and the mobile device 22 may then download each of the renewed certificates to the corresponding one of the plurality of controllers of the BMS, optionally in response to a single click on a user interface of the mobile device.
sending, over the network to a second device operational certificates that are acceptable as valid, the one or more specific device operational certificates including the first device operating certificate
receipt of the list allowing the second device to authenticate the first device operational certificateto establish the secure connection between the first device and other devices in the BMS (para 39, 29, 30); and delivering, over the network and upon establishing the secure connection between the first device and other devices in the BMS, a replacement first device operational certificateto the first device to replace the first device operational certificate(para 39, 29, 30)
[0039] The screen 100 can be seen as including a Download Controller Certificates button 106, a Download Client Certificates button 108, a BACnet port button 110 and a Cancel button 112. It will be appreciated that the Download Controller Certificates button 106 may be used to initiate a download of the controller certificates from the remote server 20 so that the mobile device 22 can subsequently download the controller certificates to each of the controllers 14 of the BMS 12. Similarly, the Download Client Certificates button 108 may be used to initiate a download of the client certificates from the remote server 20 so that the mobile device 22 can subsequently download the client certificates to each of the clients 16 of BMS 12. The BACnet port button 110 may be used to set the BACnet port number for each controller
[0041] a building management system, other systems such as industrial process control systems and/or any other suitable system that uses security certificates.
PNG
media_image2.png
504
578
media_image2.png
Greyscale
PNG
media_image3.png
518
466
media_image3.png
Greyscale
In addition, Poluri also discloses a user interface of the client management device for sending information to other devices /server / the controllers for the controlled devices, para 35, which is similar to the claimed instruction that is sent.
Poluri specifically teaches, device certificate for each of the plurality of devices of the BMS
[0012] FIG. 5 providing device certificates to a plurality of devices of a building management system; [0026] Certificates are used by the controllers 14 and the clients 16 for providing secure communication between individual components of the BMS 12, such as communication between two or more different controllers 14, or between a controller 14 and a client 16, or between two or more different clients 16. [0042] Having thus described several illustrative embodiments of the present disclosure, those of skill in the art will readily appreciate that yet other embodiments may be made and used within the scope of the claims hereto attached. It will be understood, however, that this disclosure is, in many respects, only illustrative. Changes may be made in details, particularly in matters of shape, size, arrangement of parts, and exclusion and order of steps, without exceeding the scope of the disclosure. [0004] In another example, a plurality of client certificates for a plurality of client devices within a Building Management System (BMS) may be provided using an application executing on a certificate management device. The certificate management device may include a user interface and may be in communication with a remote server. One or more of the clients 16 may, for example, be involved in providing instructions to one or more of the controllers 14. These are just examples, as it will be appreciated that there are a number of different ways in which the controllers 14 and the clients 16 may be interconnected within the BMS 12. It is contemplated that the phrase “client device” may refer to the controllers 14 and/or other client devices (e.g. clients 16) within a building management system.
Poluri, do not specifically mention about, which is well-known in the art, which Shin discloses,
establishing communication after replacing of the certificate (
This procedure is also necessary when the device wants to reconnect when the credential is lost due to certificate expiration, 3rd last para, page 2.
The controller 500 may include at least one processor 520 , a memory 540 , and a storage device 560 , and controls the overall operation of the CS 102 . In particular, the controller 500 performs a process in charge of the CS 102 during the operation, 1st para, page 12
In general, the methods are preferably performed by some hardware device.
The device includes a processor and a memory for storing program instructions executed by the processor, when the program instructions are executed by the processor: Storing at least some information in the memory to store the information A command for performing an operation of configuring , connecting to the CSMS by establishing a secure channel between the CSMS for maintaining registration information for the device, and registering the device with the CSMS, abstract
The information may include connection information for the CSMS in charge of the device, credential information for establishing a secure channel with the CSMS, and registration information of the device, 3rd last para, page 9
those skilled in the art can variously modify and change the present invention without departing from the spirit and scope of the present invention.
The connection information may include at least one of an IP address and a port number of the CSMS and information necessary to communicate with the CSMS by a predetermined communication protocol, 3rd para, page 3
a remote configuration mode in which the information is stored in the device through a predetermined communication network from a server located at a remote location, claim 16
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing reconnecting / reestablishing communication. After the connection providing secure channel is dropped the server would no longer be able to send information to the controller. Hence, the reconnecting / reestablishing communication between the devices would reenable the server to send information to the controller. The information received by the controller for configuration would enable controller to carry out command operations.
Poluri, and Shin do not specifically mention about, which Magnus discloses, expired device operational certificate, the first device operational certificatehas expired, indicate that the certificate has expired and accept the expired certificate as valid, receipt allowing the second device to authenticate the expired certificate for communication between the first device and other devices (
As shown in FIG. 1 , environment 100 includes UE device 110 (or “UE 110”), any one of which may be described in the singular in FIG. 1 , “UE 140”). , a network 120 and a controller 130 , 3rd para, page 4
If the message is authenticated by the controller 130 , the controller identifies the state of the UE 140 as being in a rescue state. The controller 130 tracks the expiration status of the TLS certificates for the various UEs served by the controller 130, so the controller 130 expects a rescue request from a specific UE based on whether the UE's certificate has expired or not. You can recognize whether it is reasonable to do so. If so, the controller 130 may prompt the administrator to verify whether the administrator wishes to issue a new TLS certificate to the UE 140, last para, page 8
reauthorize an already expired certificate by modifying the key from the expired certificate. The second private/public key pair is not used until the certificate has already expired (eg in a rescue situation). Thus, when the UE recognizes that the certificate has expired, the UE signs a rescue request message using the private key of the expired certificate, and sends this request to the controller (or other " device with "rescue address"). When a request is made by the UE, the controller verifies the request through the application of this public key held by the controller despite the fact that the certificate associated with the UE's public key has already expired, last para, page 3
If attempted, the officer can simply re-establish the secure connection by sending a certificate request message signed with the UE's private key on the expired TLS certificate, 2nd para, page 5
The controller 130 maintains public keys for the various UEs with currently active TLS certificates, as well as other private keys for the various UEs that will be used to re-authorize the certificates in a rescue situation where the TLS certificates of the UEs have already expired.. In addition, the controller 130 verifies the certificate provisioning request message with the controller's paired public key of the expired certificate for the terminal 140, and then the UE 140 stores it in memory for ultimate use in a rescue situation, 3rd para page 5
UE 110 optionally includes a display such as an LCD screen or an LED screen. Further, the display is configured to indicate an expiration status of a Transport Layer Security (TLS) certificate. As discussed with respect to FIG. 2 , UE 110 includes an interface (eg, 2140 ), which interface may be physically, or such as Bluetooth or near-field connection (NFC). Through a paired wireless connection, it allows the UE 110 to connect to external computer resources that facilitates communication exchanges with the controller 130, 2nd last para, page 5
The controller 130 tracks the expiration status of the TLS certificates for the various UEs served by the controller 130, so the controller 130 expects a rescue request from a specific UE based on whether the UE's certificate has expired or not, last para, page 8
If so, the controller 130 may prompt the administrator to verify whether the administrator wishes to issue a new TLS certificate to the UE 140 . Alternatively, the metadata tag from the image file provided by the UE 140 in the request message (or associated message) is checked so that the date/time of this file can be verified so that the original TLS certificate for this UE 140 is still there. An automated process can be performed to see if it matches the date/time when it was valid. If so, the controller 130 can reasonably conclude that the rescue request from the UE 140 signed by the key from the TLS expired from the UE 140 is a valid request, last para, page 8
Since the controller 130 has the public key of the expired certificate, it can use it to verify the signature of the request message and determine whether the request message is valid.1st para, page 10).
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing ignoring that the certificate has expired. After the connection providing channel is dropped the server would no longer be able to send information to the controller. Hence, until the new certificate is available, allowing communication even when the certificate is expired would reenable the server to continue sending information to the controller/device. The information received by the controller/device for configuration would enable controller to carry out command operations even when the new certificate is not available.
Poluri, Magnus and Shin do not specifically mention about valid even if expired / to use expired certificate for sometime until new certificate is available. And official notice is taken than such concept is well-known and excepted in the art. Until the new certificate is available, informing to use the expired certificate is not novel, rather had been used by many prior to the effective filling date of this application.
LEPESKA et al., CN 108476201 A in the frame 950, indicating the service 140 can process the expired certificate. For example, a cache entry may be associated based on maturity dates in the certificate and the certificate has expired. The service 140 can contact remote computing device to obtain a new certificate. For example, information of a computing device providing certificate expired certificate may include identification. Prompting service 140 can extract this information and attempt to establish secure communications with the computing device. 1st para, page 16.
TANIMOTO et al., JP 2006222535 A, It is possible to make a reservation for transmission until the expired certificate is updated, so that the message can be transmitted using the expired certificate, 1st para, page 6
Ponnuswamy et al., 20200235907
[0020] After establiShing the initial trust, the initial shared secret may be used later for re-establiShing the trust whenever the VCM's certificate expires
Koster et al, 20170104748 [0053] “Soft Expiration”—also referred to as a Soft Expiration Date, is an adjustable/resettable date of expiration for accepting the certificate. This date is intended to be different from the true expiration date that is encoded or embedded into the Certificate when provided. In varying embodiments the Certificate may be accepted on/through the Soft Expiration Date, or up to the Soft Expiration Date.
[0059] managing network access based on a Certificate with a Soft Expiration. In general a User is provided with a Certificate that he or she will use for access to a secured network access to one or more systems and sources. When a User holding such a Certificate makes a request for network access, the Authentication System receives the Certificate and rather than the traditional approach of determining validity based on the Certificate's expiration date, the Soft Expiration is evaluated. More specifically, the Certificate may be established with a very long life span such that it is very likely that the Certificate is technically valid, however the decision to accept the certificate as valid is not based on the actual expiration date but the Soft Expiration associated therewith. And, as will be discussed below, the Soft Expiration can be reset, thereby permitting continued use of the Certificate and managed network access for the User.
PHILIPS et al., GB 2530040 A
Furthermore, all certificates may be provided with an expiration duration, such that, for example, if a certificate received from a device has expired, the device can verify with the database server as to whether an updated device certificate is available. In such a scenario, the device is operable to control (e.g. allow) communication between the device and the service until the expiration issue is addressed, 4th para, page 10
Leblang et al., 11240043 (83) The device certificate 120 that may need renewal may still be used for the purposes of communications with the IoT device 106, until the new device certificate is issued, col., 16, lines 22-28.
HOU et al, CN 105723374 B
The user equipment can be configured to continue allowing a previous certificate is used, or can be arranged to prevent any certificate is input, until the new password on the user apparatus is determined to have "active" life, 7th para, page 5.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing use of expired certificate for sometime until new certificate is available. After the connection providing secure channel is dropped the server would no longer be able to send information to the controller. Hence, until the new certificate is available, allowing communication even when the certificate is expired would reenable the server to continue sending information to the controller/device. The information received by the controller/device for configuration would enable controller to carry out command operations even when the new certificate is not available.
Claim(s) 1, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri in view of Shin, Jacob Fredriksson, Cisco WLC or AP device certificate expired - what you can do (Year: 2019), September 16, 2019, pages 1-26 and Official Notice.
Referring to claim 1, Poluri substantially discloses, a method of a device with an first device operational certificate in a building management system (BMS) (para 41), the method comprising: identifying that of a first device operational certificate of a first device (para 40) ,
[0034] generating a plurality of certificates for a plurality of client devices (such as the controllers 14 and/or clients 16 shown in FIG. 1) within a Building Management System (BMS) such as the BMS 12 using an application executing on a certificate management device. The certificate management device may include a user interface, and may be in communication with a remote server. The client management device, which in some cases may be a mobile device such as the mobile device 22, receives client device information. The client management device may transmit the received client device information to the remote server 20, as indicated at block 54. The remote server 20 may generate certificates for each of the client devices and download the certificates to the client management device. The client management device may receive the certificates and download certificates to the appropriate client device, which are then used for subsequent secure communication in the BMS. In some cases, as optionally indicated at block 60, the method 60 may further include tracking the expiration date of each of the certificates.
wherein authentication of the first device operational certificateis configured to enable a secure communication between the first device and other devices over a network (para 39, 29, 30)
[0029] the remote server 20 may transmit all of the generated controller certificates to the mobile device 22, and the mobile device 22 may distribute the generated controller certificates to the appropriate controllers. In some cases, the remote server 20 may transmit the generated controller certificates directly to the appropriate controllers.
[0030] tracking the expiration date of each of the generated controller certificates and allowing automatic renewal of the generated controller certificates. In some cases, the mobile device 22 may receive a renewed controller certificates for each of the expiring certificates from the remote server 20, and the mobile device 22 may then download each of the renewed certificates to the corresponding one of the plurality of controllers of the BMS, optionally in response to a single click on a user interface of the mobile device.
sending, over the network to a second device operational certificates that are acceptable as valid, the one or more specific device operational certificates including the first device operating certificate
receipt of the list allowing the second device to authenticate the first device operational certificateto establish the secure connection between the first device and other devices in the BMS (para 39, 29, 30); and delivering, over the network and upon establishing the secure connection between the first device and other devices in the BMS, a replacement first device operational certificateto the first device to replace the first device operational certificate(para 39, 29, 30)
[0039] The screen 100 can be seen as including a Download Controller Certificates button 106, a Download Client Certificates button 108, a BACnet port button 110 and a Cancel button 112. It will be appreciated that the Download Controller Certificates button 106 may be used to initiate a download of the controller certificates from the remote server 20 so that the mobile device 22 can subsequently download the controller certificates to each of the controllers 14 of the BMS 12. Similarly, the Download Client Certificates button 108 may be used to initiate a download of the client certificates from the remote server 20 so that the mobile device 22 can subsequently download the client certificates to each of the clients 16 of BMS 12. The BACnet port button 110 may be used to set the BACnet port number for each controller
[0041] a building management system, other systems such as industrial process control systems and/or any other suitable system that uses security certificates.
PNG
media_image2.png
504
578
media_image2.png
Greyscale
PNG
media_image3.png
518
466
media_image3.png
Greyscale
In addition, Poluri also discloses a user interface of the client management device for sending information to other devices /server / the controllers for the controlled devices, para 35, which is similar to the claimed instruction that is sent.
Poluri specifically teaches, device certificate for each of the plurality of devices of the BMS
[0012] FIG. 5 providing device certificates to a plurality of devices of a building management system; [0026] Certificates are used by the controllers 14 and the clients 16 for providing secure communication between individual components of the BMS 12, such as communication between two or more different controllers 14, or between a controller 14 and a client 16, or between two or more different clients 16. [0042] Having thus described several illustrative embodiments of the present disclosure, those of skill in the art will readily appreciate that yet other embodiments may be made and used within the scope of the claims hereto attached. It will be understood, however, that this disclosure is, in many respects, only illustrative. Changes may be made in details, particularly in matters of shape, size, arrangement of parts, and exclusion and order of steps, without exceeding the scope of the disclosure. [0004] In another example, a plurality of client certificates for a plurality of client devices within a Building Management System (BMS) may be provided using an application executing on a certificate management device. The certificate management device may include a user interface and may be in communication with a remote server. One or more of the clients 16 may, for example, be involved in providing instructions to one or more of the controllers 14. These are just examples, as it will be appreciated that there are a number of different ways in which the controllers 14 and the clients 16 may be interconnected within the BMS 12. It is contemplated that the phrase “client device” may refer to the controllers 14 and/or other client devices (e.g. clients 16) within a building management system.
Poluri, do not specifically mention about, which is well-known in the art, which Shin discloses,
establishing communication after replacing of the certificate (
This procedure is also necessary when the device wants to reconnect when the credential is lost due to certificate expiration, 3rd last para, page 2.
The controller 500 may include at least one processor 520 , a memory 540 , and a storage device 560 , and controls the overall operation of the CS 102 . In particular, the controller 500 performs a process in charge of the CS 102 during the operation, 1st para, page 12
In general, the methods are preferably performed by some hardware device.
The device includes a processor and a memory for storing program instructions executed by the processor, when the program instructions are executed by the processor: Storing at least some information in the memory to store the information A command for performing an operation of configuring , connecting to the CSMS by establishing a secure channel between the CSMS for maintaining registration information for the device, and registering the device with the CSMS, abstract
The information may include connection information for the CSMS in charge of the device, credential information for establishing a secure channel with the CSMS, and registration information of the device, 3rd last para, page 9
those skilled in the art can variously modify and change the present invention without departing from the spirit and scope of the present invention.
The connection information may include at least one of an IP address and a port number of the CSMS and information necessary to communicate with the CSMS by a predetermined communication protocol, 3rd para, page 3
a remote configuration mode in which the information is stored in the device through a predetermined communication network from a server located at a remote location, claim 16
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing reconnecting / reestablishing communication. After the connection providing secure channel is dropped the server would no longer be able to send information to the controller. Hence, the reconnecting / reestablishing communication between the devices would reenable the server to send information to the controller. The information received by the controller for configuration would enable controller to carry out command operations.
Poluri, and Shin do not specifically mention about, which Fredriksson discloses expired device operational certificate, the first device operational certificate has expired, indicate that the certificate has expired and accept the expired certificate as valid, receipt allowing the second device to authenticate the expired certificate for communication between the first device and other devices (Command/instruction to ignore cert-expiry (certificate expiry), 3 rd last para, page 6, 2nd last para, page 14).
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing ignoring that the certificate has expired. After the connection providing channel is dropped the server would no longer be able to send information to the controller. Hence, until the new certificate is available, allowing communication even when the certificate is expired would reenable the server to continue sending information to the controller/device. The information received by the controller/device for configuration would enable controller to carry out command operations even when the new certificate is not available.
Poluri, Fredriksson and Shin do not specifically mention about valid even if expired / to use expired certificate for sometime until new certificate is available. And official notice is taken than such concept is well-known and excepted in the art. Until the new certificate is available, informing to use the expired certificate is not novel, rather had been used by many prior to the effective filling date of this application.
LEPESKA et al., CN 108476201 A in the frame 950, indicating the service 140 can process the expired certificate. For example, a cache entry may be associated based on maturity dates in the certificate and the certificate has expired. The service 140 can contact remote computing device to obtain a new certificate. For example, information of a computing device providing certificate expired certificate may include identification. Prompting service 140 can extract this information and attempt to establish secure communications with the computing device. 1st para, page 16.
TANIMOTO et al., JP 2006222535 A, It is possible to make a reservation for transmission until the expired certificate is updated, so that the message can be transmitted using the expired certificate, 1st para, page 6
Ponnuswamy et al., 20200235907
[0020] After establiShing the initial trust, the initial shared secret may be used later for re-establiShing the trust whenever the VCM's certificate expires
Koster et al, 20170104748 [0053] “Soft Expiration”—also referred to as a Soft Expiration Date, is an adjustable/resettable date of expiration for accepting the certificate. This date is intended to be different from the true expiration date that is encoded or embedded into the Certificate when provided. In varying embodiments the Certificate may be accepted on/through the Soft Expiration Date, or up to the Soft Expiration Date.
[0059] managing network access based on a Certificate with a Soft Expiration. In general a User is provided with a Certificate that he or she will use for access to a secured network access to one or more systems and sources. When a User holding such a Certificate makes a request for network access, the Authentication System receives the Certificate and rather than the traditional approach of determining validity based on the Certificate's expiration date, the Soft Expiration is evaluated. More specifically, the Certificate may be established with a very long life span such that it is very likely that the Certificate is technically valid, however the decision to accept the certificate as valid is not based on the actual expiration date but the Soft Expiration associated therewith. And, as will be discussed below, the Soft Expiration can be reset, thereby permitting continued use of the Certificate and managed network access for the User.
PHILIPS et al., GB 2530040 A
Furthermore, all certificates may be provided with an expiration duration, such that, for example, if a certificate received from a device has expired, the device can verify with the database server as to whether an updated device certificate is available. In such a scenario, the device is operable to control (e.g. allow) communication between the device and the service until the expiration issue is addressed, 4th para, page 10
Leblang et al., 11240043 (83) The device certificate 120 that may need renewal may still be used for the purposes of communications with the IoT device 106, until the new device certificate is issued, col., 16, lines 22-28.
HOU et al, CN 105723374 B
The user equipment can be configured to continue allowing a previous certificate is used, or can be arranged to prevent any certificate is input, until the new password on the user apparatus is determined to have "active" life, 7th para, page 5.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing use of expired certificate for sometime until new certificate is available. After the connection providing secure channel is dropped the server would no longer be able to send information to the controller. Hence, until the new certificate is available, allowing communication even when the certificate is expired would reenable the server to continue sending information to the controller/device. The information received by the controller/device for configuration would enable controller to carry out command operations even when the new certificate is not available.
Claim(s) 2, 3, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri in view of Shin, Magnus, Official Notice and Koster et al, 20170104748.
Referring to claim 2, Poluri in view of Shin, Magnus do not disclose which Koster discloses receiving an indication from the second device that an other attributes of the first device operational certificate indicate that the first device operational certificate is valid (valid beyond expired), wherein accepting the expired first device operational certificate as valid is performed in response to determining that the other attribute indicate that the first device operational certificate is valid, valid beyond expired, invalidity (
[0053] “Soft Expiration”—also referred to as a Soft Expiration Date, is an adjustable/resettable date of expiration for accepting the certificate. This date is intended to be different from the true expiration date that is encoded or embedded into the Certificate when provided. In varying embodiments the Certificate may be accepted on/through the Soft Expiration Date, or up to the Soft Expiration Date.
[0059] managing network access based on a Certificate with a Soft Expiration. In general a User is provided with a Certificate that he or she will use for access to a secured network access to one or more systems and sources. When a User holding such a Certificate makes a request for network access, the Authentication System receives the Certificate and rather than the traditional approach of determining validity based on the Certificate's expiration date, the Soft Expiration is evaluated. More specifically, the Certificate may be established with a very long life span such that it is very likely that the Certificate is technically valid, however the decision to accept the certificate as valid is not based on the actual expiration date but the Soft Expiration associated therewith. And, as will be discussed below, the Soft Expiration can be reset, thereby permitting continued use of the Certificate and managed network access for the User.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing use of expired certificate for sometime until new certificate is available. Hence, until the new certificate is available, allowing communication even when the certificate is expired would reenable the server to continue sending information to the controller/device. The information received by the controller/device for configuration would enable controller to carry out command operations even when the new certificate is not available.
Referring to claim(s) 3, Koster discloses the first device operational certificate being well formed, the first device operational certificate not having been revoked, or the first device operational certificate having been signed by a locally configured certificate authority (CA) (not revoked or not renewed, but expired, valid beyond expired, invalidity, valid after expiration, para 53, 59).
Claim(s) 4, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri in view of Shin, Magnus, Official Notice, Koster, LITTLE et al., CA 2555659 C.
Referring to claim(s) 4, Shin, Magnus, Koster does not specifically mention about, which is well-known in the art, which LITTLE discloses, receiving an indication from the first device or second device that the first device operational certificate has expired, (an expired certificate indication by the device, claim 14, displaying the indicators for the signature/certificate by the device, claim 8, expired or revoked or has an invalid signature, in which case an indication is provided by the device, page 21, lines 11-12.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide informing that the certificate has expired. The device would know the current status of the certificate. Based on the status the device would be able to determine on further steps for handling the certificate for securing the traffic, claim 14, page 21, lines 11-12.
Claim(s) 6, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri in view of Shin, Magnus, Official Notice, Koster, Hazlewood et al., 8862874 and Mehta et al., 10063382.
Referring to claim(s) 6, Shin discloses configured CA, 8th para, page 6.
Poluri in view of Shin, Magnus, Koster does not specifically mention about, which is well-known in the art, which Hazlewood discloses, retrieving the replacement first device operational certificate (Claim 11, retrieving the replacement server certificate is one of (i) obtaining the replacement server certificate from a certificate authority, (ii) generating the replacement server certificate, and (iii) retrieving the replacement server certificate from a certificate repository, the replacement server certificate replacing an old certificate presented from the server).
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide obtaining the replacement device operational certificate. After the expiry of the certificate there would be a need for use of the certificate. Among different option getting the certificate for replacement would ensure securing the traffic even after the certificate is expired, claim 11.
Poluri, Shin, Magnus, Koster, Hazlewood does not specifically mention about, which is well-known in the art, which Mehta discloses, locally configured CA (
a local CA for obtaining a certificate. The local CA issues certificates to the appliance and other devices. The local CA is not at the cloud and may be disposed locally at or near the appliance, col., 2, lines 11-21.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known CA that is local. The local CA would not be at the cloud or at a remote location. The local CA would be disposed locally at or near the device. There would not be a concern for network disconnection due to the CA being local, col., 2, lines 11-21.
Claim(s) 7, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri in view of Shin, Magnus, Official Notice, Koster, Hazlewood and IGNATCHENKO et al., EP 2864924 B1.
Referring to claim(s) 7, Shin discloses resetting a connection between the first device and the second device, 3rd last para, page 2. Poluri in view of Shin, Hazlewood, Magnus, Koster does not specifically mention about, which is well-known in the art, which IGNATCHENKO discloses, validating the replacement device operational certificate.
( verify that the replacement certificate identified by the replacement certificate identifier 215, i.e., the new active root certificate, corresponds to one of the N signatures (e.g., 230 or 231 on Figure 2) of the message 200. In the example shown on Figure 2, the replacement certificate identified by the replacement certificate identifier 215 is root certificate B. It corresponds to Signature 1, shown as 230 on Figure 2., 3rd last para, page 7.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide obtaining the replacement device operational certificate. After the obtaining of the certificate that is replaced, it would be validated to ensure that the certificate is valid for use. Among different option getting the certificate for replacement would ensure securing the traffic even after the certificate is expired, 3rd last para, page 7.
Claim(s) 2, 3, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri in view of Shin, Fredriksson, Official Notice and Koster et al, 20170104748.
Referring to claim 2, Poluri in view of Shin, Fredriksson do not disclose which Koster discloses receiving an indication from the second device that an other attributes of the first device operational certificate indicate that the first device operational certificate is valid (valid beyond expired), wherein accepting the expired first device operational certificate as valid is performed in response to determining that the other attribute indicate that the first device operational certificate is valid, valid beyond expired, invalidity (
[0053] “Soft Expiration”—also referred to as a Soft Expiration Date, is an adjustable/resettable date of expiration for accepting the certificate. This date is intended to be different from the true expiration date that is encoded or embedded into the Certificate when provided. In varying embodiments the Certificate may be accepted on/through the Soft Expiration Date, or up to the Soft Expiration Date.
[0059] managing network access based on a Certificate with a Soft Expiration. In general a User is provided with a Certificate that he or she will use for access to a secured network access to one or more systems and sources. When a User holding such a Certificate makes a request for network access, the Authentication System receives the Certificate and rather than the traditional approach of determining validity based on the Certificate's expiration date, the Soft Expiration is evaluated. More specifically, the Certificate may be established with a very long life span such that it is very likely that the Certificate is technically valid, however the decision to accept the certificate as valid is not based on the actual expiration date but the Soft Expiration associated therewith. And, as will be discussed below, the Soft Expiration can be reset, thereby permitting continued use of the Certificate and managed network access for the User.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing use of expired certificate for sometime until new certificate is available. Hence, until the new certificate is available, allowing communication even when the certificate is expired would reenable the server to continue sending information to the controller/device. The information received by the controller/device for configuration would enable controller to carry out command operations even when the new certificate is not available.
Referring to claim(s) 3, Koster discloses the first device operational certificate being well formed, the first device operational certificate not having been revoked, or the first device operational certificate having been signed by a locally configured certificate authority (CA) (not revoked or not renewed, but expired, valid beyond expired, invalidity, valid after expiration, para 53, 59 ).
Claim(s) 4, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri in view of Shin, Fredriksson, Official Notice, Koster, LITTLE et al., CA 2555659 C.
Referring to claim(s) 4, Shin, Fredriksson, Koster does not specifically mention about, which is well-known in the art, which LITTLE discloses, receiving an indication from the first device or second device that the first device operational certificate has expired, (an expired certificate indication by the device, claim 14, displaying the indicators for the signature/certificate by the device, claim 8, expired or revoked or has an invalid signature, in which case an indication is provided by the device, page 21, lines 11-12.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide informing that the certificate has expired. The device would know the current status of the certificate. Based on the status the device would be able to determine on further steps for handling the certificate for securing the traffic, claim 14, page 21, lines 11-12.
Claim(s) 6, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri in view of Shin, Fredriksson, Official Notice, Koster, Hazlewood et al., 8862874 and Mehta et al., 10063382.
Referring to claim(s) 6, Shin discloses configured CA, 8th para, page 6.
Poluri in view of Shin, Fredriksson, Koster does not specifically mention about, which is well-known in the art, which Hazlewood discloses, retrieving the replacement first device operational certificate(Claim 11, retrieving the replacement server certificate is one of (i) obtaining the replacement server certificate from a certificate authority, (ii) generating the replacement server certificate, and (iii) retrieving the replacement server certificate from a certificate repository, the replacement server certificate replacing an old certificate presented from the server).
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide obtaining the replacement device operational certificate. After the expiry of the certificate there would be a need for use of the certificate. Among different option getting the certificate for replacement would ensure securing the traffic even after the certificate is expired, claim 11.
Poluri, Shin, Fredriksson, Koster, Hazlewood does not specifically mention about, which is well-known in the art, which Mehta discloses, locally configured CA (
a local CA for obtaining a certificate. The local CA issues certificates to the appliance and other devices. The local CA is not at the cloud and may be disposed locally at or near the appliance, col., 2, lines 11-21.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing well-known CA that is local. The local CA would not be at the cloud or at a remote location. The local CA would be disposed locally at or near the device. There would not be a concern for network disconnection due to the CA being local, col., 2, lines 11-21.
Claim(s) 7, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri in view of Shin, Fredriksson, Official Notice, Koster, Hazlewood and IGNATCHENKO et al., EP 2864924 B1.
Referring to claim(s) 7, Shin discloses resetting a connection between the first device and the second device, 3rd last para, page 2. Poluri in view of Shin, Hazlewood, Fredriksson, Koster does not specifically mention about, which is well-known in the art, which IGNATCHENKO discloses, validating the replacement device operational certificate.
( verify that the replacement certificate identified by the replacement certificate identifier 215, i.e., the new active root certificate, corresponds to one of the N signatures (e.g., 230 or 231 on Figure 2) of the message 200. In the example shown on Figure 2, the replacement certificate identified by the replacement certificate identifier 215 is root certificate B. It corresponds to Signature 1, shown as 230 on Figure 2., 3rd last para, page 7.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide obtaining the replacement device operational certificate. After the obtaining of the certificate that is replaced, it would be validated to ensure that the certificate is valid for use. Among different option getting the certificate for replacement would ensure securing the traffic even after the certificate is expired, 3rd last para, page 7.
Claim(s) 9, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri in view of Shin, Magnus and Official Notice.
Referring to claim 9, Poluri substantially discloses, A BMS comprising: a first device comprising a device operational certificate; and a second device comprising one or more hardware processors and one or more computer-readable storage media having instructions stored thereon that, when executed by the one or more hardware processors, cause the one or more hardware processors to implement operations comprising: (para 40, 41),
[0034] generating a plurality of certificates for a plurality of client devices (such as the controllers 14 and/or clients 16 shown in FIG. 1) within a Building Management System (BMS) such as the BMS 12 using an application executing on a certificate management device. The certificate management device may include a user interface, and may be in communication with a remote server. The client management device, which in some cases may be a mobile device such as the mobile device 22, receives client device information. The client management device may transmit the received client device information to the remote server 20, as indicated at block 54. The remote server 20 may generate certificates for each of the client devices and download the certificates to the client management device. The client management device may receive the certificates and download certificates to the appropriate client device, which are then used for subsequent secure communication in the BMS. In some cases, as optionally indicated at block 60, the method 60 may further include tracking the expiration date of each of the certificates.
identifying that the first device operational certificate of the first device has expired, wherein authentication of the first device operational certificate enables communication between the first device and other devices over a network (para 39, 29, 30): receiving, via the network, an instruction regarding the first device operational certificate (from the user interface, para 39, 29, 30),
[0029] the remote server 20 may transmit all of the generated controller certificates to the mobile device 22, and the mobile device 22 may distribute the generated controller certificates to the appropriate controllers. In some cases, the remote server 20 may transmit the generated controller certificates directly to the appropriate controllers.
[0030] tracking the expiration date of each of the generated controller certificates and allowing automatic renewal of the generated controller certificates. In some cases, the mobile device 22 may receive a renewed controller certificates for each of the expiring certificates from the remote server 20, and the mobile device 22 may then download each of the renewed certificates to the corresponding one of the plurality of controllers of the BMS, optionally in response to a single click on a user interface of the mobile device.
authenticating, in response to receiving the instruction, the expired first device operational certificate to reestablish communication between the first device and other devices in the BMS (para 39, 29, 30); and delivering, over the network and upon communication with the first device, a replacement first device operational certificate to the first device to replace the expired first device operational certificate (para 39, 29, 30)
[0039] The screen 100 can be seen as including a Download Controller Certificates button 106, a Download Client Certificates button 108, a BACnet port button 110 and a Cancel button 112. It will be appreciated that the Download Controller Certificates button 106 may be used to initiate a download of the controller certificates from the remote server 20 so that the mobile device 22 can subsequently download the controller certificates to each of the controllers 14 of the BMS 12. Similarly, the Download Client Certificates button 108 may be used to initiate a download of the client certificates from the remote server 20 so that the mobile device 22 can subsequently download the client certificates to each of the clients 16 of BMS 12. The BACnet port button 110 may be used to set the BACnet port number for each controller
[0041] a building management system, other systems such as industrial process control systems and/or any other suitable system that uses security certificates.
PNG
media_image2.png
504
578
media_image2.png
Greyscale
PNG
media_image3.png
518
466
media_image3.png
Greyscale
In addition, Poluri also discloses a user interface of the client management device for sending information to other devices /server / the controllers for the controlled devices, para 35, which is similar to the claimed instruction that is sent.
Poluri specifically teaches, device certificate for each of the plurality of devices of the BMS
[0012] FIG. 5 providing device certificates to a plurality of devices of a building management system; [0026] Certificates are used by the controllers 14 and the clients 16 for providing secure communication between individual components of the BMS 12, such as communication between two or more different controllers 14, or between a controller 14 and a client 16, or between two or more different clients 16. [0042] Having thus described several illustrative embodiments of the present disclosure, those of skill in the art will readily appreciate that yet other embodiments may be made and used within the scope of the claims hereto attached. It will be understood, however, that this disclosure is, in many respects, only illustrative. Changes may be made in details, particularly in matters of shape, size, arrangement of parts, and exclusion and order of steps, without exceeding the scope of the disclosure. [0004] In another example, a plurality of client certificates for a plurality of client devices within a Building Management System (BMS) may be provided using an application executing on a certificate management device. The certificate management device may include a user interface and may be in communication with a remote server. One or more of the clients 16 may, for example, be involved in providing instructions to one or more of the controllers 14. These are just examples, as it will be appreciated that there are a number of different ways in which the controllers 14 and the clients 16 may be interconnected within the BMS 12. It is contemplated that the phrase “client device” may refer to the controllers 14 and/or other client devices (e.g. clients 16) within a building management system.
Poluri, do not specifically mention about, which is well-known in the art, which Shin discloses,
reconnecting, reestablishing communication (
This procedure is also necessary when the device wants to reconnect when the credential is lost due to certificate expiration, 3rd last para, page 2.
The controller 500 may include at least one processor 520 , a memory 540 , and a storage device 560 , and controls the overall operation of the CS 102 . In particular, the controller 500 performs a process in charge of the CS 102 during the operation, 1st para, page 12
In general, the methods are preferably performed by some hardware device.
The device includes a processor and a memory for storing program instructions executed by the processor, when the program instructions are executed by the processor: Storing at least some information in the memory to store the information A command for performing an operation of configuring , connecting to the CSMS by establishing a secure channel between the CSMS for maintaining registration information for the device, and registering the device with the CSMS, abstract
The information may include connection information for the CSMS in charge of the device, credential information for establishing a secure channel with the CSMS, and registration information of the device, 3rd last para, page 9
those skilled in the art can variously modify and change the present invention without departing from the spirit and scope of the present invention.
The connection information may include at least one of an IP address and a port number of the CSMS and information necessary to communicate with the CSMS by a predetermined communication protocol, 3rd para, page 3
a remote configuration mode in which the information is stored in the device through a predetermined communication network from a server located at a remote location, claim 16
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing reconnecting / reestablishing communication. After the connection providing secure channel is dropped the server would no longer be able to send information to the controller. Hence, the reconnecting / reestablishing communication between the devices would reenable the server to send information to the controller. The information received by the controller for configuration would enable controller to carry out command operations.
Poluri, and Shin do not specifically mention about, which Magnus discloses ignore that the certificate has expired and accept the expired certificate as valid, receipt of the instruction causing the second device to authenticate the expired certificate for communication between the first device and other devices (
As shown in FIG. 1 , environment 100 includes UE device 110 (or “UE 110”), any one of which may be described in the singular in FIG. 1 , “UE 140”). , a network 120 and a controller 130 , 3rd para, page 4
If the message is authenticated by the controller 130 , the controller identifies the state of the UE 140 as being in a rescue state. The controller 130 tracks the expiration status of the TLS certificates for the various UEs served by the controller 130, so the controller 130 expects a rescue request from a specific UE based on whether the UE's certificate has expired or not. You can recognize whether it is reasonable to do so. If so, the controller 130 may prompt the administrator to verify whether the administrator wishes to issue a new TLS certificate to the UE 140, last para, page 8
reauthorize an already expired certificate by modifying the key from the expired certificate. The second private/public key pair is not used until the certificate has already expired (eg in a rescue situation). Thus, when the UE recognizes that the certificate has expired, the UE signs a rescue request message using the private key of the expired certificate, and sends this request to the controller (or other " device with "rescue address"). When a request is made by the UE, the controller verifies the request through the application of this public key held by the controller despite the fact that the certificate associated with the UE's public key has already expired, last para, page 3
If attempted, the officer can simply re-establish the secure connection by sending a certificate request message signed with the UE's private key on the expired TLS certificate, 2nd para, page 5
The controller 130 maintains public keys for the various UEs with currently active TLS certificates, as well as other private keys for the various UEs that will be used to re-authorize the certificates in a rescue situation where the TLS certificates of the UEs have already expired.. In addition, the controller 130 verifies the certificate provisioning request message with the controller's paired public key of the expired certificate for the terminal 140, and then the UE 140 stores it in memory for ultimate use in a rescue situation, 3rd para page 5
UE 110 optionally includes a display such as an LCD screen or an LED screen. Further, the display is configured to indicate an expiration status of a Transport Layer Security (TLS) certificate. As discussed with respect to FIG. 2 , UE 110 includes an interface (eg, 2140 ), which interface may be physically, or such as Bluetooth or near-field connection (NFC). Through a paired wireless connection, it allows the UE 110 to connect to external computer resources that facilitates communication exchanges with the controller 130, 2nd last para, page 5
The controller 130 tracks the expiration status of the TLS certificates for the various UEs served by the controller 130, so the controller 130 expects a rescue request from a specific UE based on whether the UE's certificate has expired or not, last para, page 8
If so, the controller 130 may prompt the administrator to verify whether the administrator wishes to issue a new TLS certificate to the UE 140 . Alternatively, the metadata tag from the image file provided by the UE 140 in the request message (or associated message) is checked so that the date/time of this file can be verified so that the original TLS certificate for this UE 140 is still there. An automated process can be performed to see if it matches the date/time when it was valid. If so, the controller 130 can reasonably conclude that the rescue request from the UE 140 signed by the key from the TLS expired from the UE 140 is a valid request, last para, page 8
Since the controller 130 has the public key of the expired certificate, it can use it to verify the signature of the request message and determine whether the request message is valid.1st para, page 10).
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing ignoring that the certificate has expired. After the connection providing channel is dropped the server would no longer be able to send information to the controller. Hence, until the new certificate is available, allowing communication even when the certificate is expired would reenable the server to continue sending information to the controller/device. The information received by the controller/device for configuration would enable controller to carry out command operations even when the new certificate is not available.
Poluri, Magnus and Shin do not specifically mention about to use expired certificate for sometime until new certificate is available. And official notice is taken than such concept is well-known and excepted in the art. Until the new certificate is available, informing to use the expired certificate is not novel, rather had been used by many prior to the effective filling date of this application.
LEPESKA et al., CN 108476201 A in the frame 950, indicating the service 140 can process the expired certificate. For example, a cache entry may be associated based on maturity dates in the certificate and the certificate has expired. The service 140 can contact remote computing device to obtain a new certificate. For example, information of a computing device providing certificate expired certificate may include identification. Prompting service 140 can extract this information and attempt to establish secure communications with the computing device. 1st para, page 16.
TANIMOTO et al., JP 2006222535 A, It is possible to make a reservation for transmission until the expired certificate is updated, so that the message can be transmitted using the expired certificate, 1st para, page 6
Ponnuswamy et al., 20200235907
[0020] After establiShing the initial trust, the initial shared secret may be used later for re-establiShing the trust whenever the VCM's certificate expires
Koster et al, 20170104748 [0053] “Soft Expiration”—also referred to as a Soft Expiration Date, is an adjustable/resettable date of expiration for accepting the certificate. This date is intended to be different from the true expiration date that is encoded or embedded into the Certificate when provided. In varying embodiments the Certificate may be accepted on/through the Soft Expiration Date, or up to the Soft Expiration Date.
[0059] managing network access based on a Certificate with a Soft Expiration. In general a User is provided with a Certificate that he or she will use for access to a secured network access to one or more systems and sources. When a User holding such a Certificate makes a request for network access, the Authentication System receives the Certificate and rather than the traditional approach of determining validity based on the Certificate's expiration date, the Soft Expiration is evaluated. More specifically, the Certificate may be established with a very long life span such that it is very likely that the Certificate is technically valid, however the decision to accept the certificate as valid is not based on the actual expiration date but the Soft Expiration associated therewith. And, as will be discussed below, the Soft Expiration can be reset, thereby permitting continued use of the Certificate and managed network access for the User.
PHILIPS et al., GB 2530040 A
Furthermore, all certificates may be provided with an expiration duration, such that, for example, if a certificate received from a device has expired, the device can verify with the database server as to whether an updated device certificate is available. In such a scenario, the device is operable to control (e.g. allow) communication between the device and the service until the expiration issue is addressed, 4th para, page 10
Leblang et al., 11240043 (83) The device certificate 120 that may need renewal may still be used for the purposes of communications with the IoT device 106, until the new device certificate is issued, col., 16, lines 22-28.
HOU et al, CN 105723374 B
The user equipment can be configured to continue allowing a previous certificate is used, or can be arranged to prevent any certificate is input, until the new password on the user apparatus is determined to have "active" life, 7th para, page 5.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing use of expired certificate for sometime until new certificate is available. After the connection providing secure channel is dropped the server would no longer be able to send information to the controller. Hence, until the new certificate is available, allowing communication even when the certificate is expired would reenable the server to continue sending information to the controller/device. The information received by the controller/device for configuration would enable controller to carry out command operations even when the new certificate is not available.
Claim(s) 9, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri et al., US 20210247731 in view of Shin, WO 2021158020 A1, Fredriksson and Official Notice.
Referring to claim 9, Poluri substantially discloses, A BMS comprising: a first device comprising a device operational certificate; and a second device comprising one or more hardware processors and one or more computer-readable storage media having instructions stored thereon that, when executed by the one or more hardware processors, cause the one or more hardware processors to implement operations comprising: (para 40, 41),
[0034] generating a plurality of certificates for a plurality of client devices (such as the controllers 14 and/or clients 16 shown in FIG. 1) within a Building Management System (BMS) such as the BMS 12 using an application executing on a certificate management device. The certificate management device may include a user interface, and may be in communication with a remote server. The client management device, which in some cases may be a mobile device such as the mobile device 22, receives client device information. The client management device may transmit the received client device information to the remote server 20, as indicated at block 54. The remote server 20 may generate certificates for each of the client devices and download the certificates to the client management device. The client management device may receive the certificates and download certificates to the appropriate client device, which are then used for subsequent secure communication in the BMS. In some cases, as optionally indicated at block 60, the method 60 may further include tracking the expiration date of each of the certificates.
identifying that the first device operational certificate of the first device has expired, wherein authentication of the first device operational certificate enables communication between the first device and other devices over a network (para 39, 29, 30): receiving, via the network, an instruction regarding the first device operational certificate (from the user interface, para 39, 29, 30),
[0029] the remote server 20 may transmit all of the generated controller certificates to the mobile device 22, and the mobile device 22 may distribute the generated controller certificates to the appropriate controllers. In some cases, the remote server 20 may transmit the generated controller certificates directly to the appropriate controllers.
[0030] tracking the expiration date of each of the generated controller certificates and allowing automatic renewal of the generated controller certificates. In some cases, the mobile device 22 may receive a renewed controller certificates for each of the expiring certificates from the remote server 20, and the mobile device 22 may then download each of the renewed certificates to the corresponding one of the plurality of controllers of the BMS, optionally in response to a single click on a user interface of the mobile device.
authenticating, in response to receiving the instruction, the expired first device operational certificate to reestablish communication between the first device and other devices in the BMS (para 39, 29, 30); and delivering, over the network and upon communication with the first device, a replacement first device operational certificate to the first device to replace the expired first device operational certificate (para 39, 29, 30)
[0039] The screen 100 can be seen as including a Download Controller Certificates button 106, a Download Client Certificates button 108, a BACnet port button 110 and a Cancel button 112. It will be appreciated that the Download Controller Certificates button 106 may be used to initiate a download of the controller certificates from the remote server 20 so that the mobile device 22 can subsequently download the controller certificates to each of the controllers 14 of the BMS 12. Similarly, the Download Client Certificates button 108 may be used to initiate a download of the client certificates from the remote server 20 so that the mobile device 22 can subsequently download the client certificates to each of the clients 16 of BMS 12. The BACnet port button 110 may be used to set the BACnet port number for each controller
[0041] a building management system, other systems such as industrial process control systems and/or any other suitable system that uses security certificates.
PNG
media_image2.png
504
578
media_image2.png
Greyscale
PNG
media_image3.png
518
466
media_image3.png
Greyscale
In addition, Poluri also discloses a user interface of the client management device for sending information to other devices /server / the controllers for the controlled devices, para 35, which is similar to the claimed instruction that is sent.
Poluri specifically teaches, device certificate for each of the plurality of devices of the BMS
[0012] FIG. 5 providing device certificates to a plurality of devices of a building management system; [0026] Certificates are used by the controllers 14 and the clients 16 for providing secure communication between individual components of the BMS 12, such as communication between two or more different controllers 14, or between a controller 14 and a client 16, or between two or more different clients 16. [0042] Having thus described several illustrative embodiments of the present disclosure, those of skill in the art will readily appreciate that yet other embodiments may be made and used within the scope of the claims hereto attached. It will be understood, however, that this disclosure is, in many respects, only illustrative. Changes may be made in details, particularly in matters of shape, size, arrangement of parts, and exclusion and order of steps, without exceeding the scope of the disclosure. [0004] In another example, a plurality of client certificates for a plurality of client devices within a Building Management System (BMS) may be provided using an application executing on a certificate management device. The certificate management device may include a user interface and may be in communication with a remote server. One or more of the clients 16 may, for example, be involved in providing instructions to one or more of the controllers 14. These are just examples, as it will be appreciated that there are a number of different ways in which the controllers 14 and the clients 16 may be interconnected within the BMS 12. It is contemplated that the phrase “client device” may refer to the controllers 14 and/or other client devices (e.g. clients 16) within a building management system.
Poluri, do not specifically mention about, which is well-known in the art, which Shin discloses,
reconnecting, reestablishing communication (
This procedure is also necessary when the device wants to reconnect when the credential is lost due to certificate expiration, 3rd last para, page 2.
The controller 500 may include at least one processor 520 , a memory 540 , and a storage device 560 , and controls the overall operation of the CS 102 . In particular, the controller 500 performs a process in charge of the CS 102 during the operation, 1st para, page 12
In general, the methods are preferably performed by some hardware device.
The device includes a processor and a memory for storing program instructions executed by the processor, when the program instructions are executed by the processor: Storing at least some information in the memory to store the information A command for performing an operation of configuring , connecting to the CSMS by establishing a secure channel between the CSMS for maintaining registration information for the device, and registering the device with the CSMS, abstract
The information may include connection information for the CSMS in charge of the device, credential information for establishing a secure channel with the CSMS, and registration information of the device, 3rd last para, page 9
those skilled in the art can variously modify and change the present invention without departing from the spirit and scope of the present invention.
The connection information may include at least one of an IP address and a port number of the CSMS and information necessary to communicate with the CSMS by a predetermined communication protocol, 3rd para, page 3
a remote configuration mode in which the information is stored in the device through a predetermined communication network from a server located at a remote location, claim 16
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing reconnecting / reestablishing communication. After the connection providing secure channel is dropped the server would no longer be able to send information to the controller. Hence, the reconnecting / reestablishing communication between the devices would reenable the server to send information to the controller. The information received by the controller for configuration would enable controller to carry out command operations.
Poluri, and Shin do not specifically mention about, which Fredriksson discloses ignore that the certificate has expired and accept the expired certificate as valid, receipt of the instruction causing the second device to authenticate the expired certificate for communication between the first device and other devices (Command/instruction to ignore cert-expiry (certificate expiry), 3 rd last para, page 6, 2nd last para, page 14)
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing ignoring that the certificate has expired. After the connection providing channel is dropped the server would no longer be able to send information to the controller. Hence, until the new certificate is available, allowing communication even when the certificate is expired would reenable the server to continue sending information to the controller/device. The information received by the controller/device for configuration would enable controller to carry out command operations even when the new certificate is not available.
Poluri, Fredriksson and Shin do not specifically mention about to use expired certificate for sometime until new certificate is available. And official notice is taken than such concept is well-known and excepted in the art. Until the new certificate is available, informing to use the expired certificate is not novel, rather had been used by many prior to the effective filling date of this application.
LEPESKA et al., CN 108476201 A in the frame 950, indicating the service 140 can process the expired certificate. For example, a cache entry may be associated based on maturity dates in the certificate and the certificate has expired. The service 140 can contact remote computing device to obtain a new certificate. For example, information of a computing device providing certificate expired certificate may include identification. Prompting service 140 can extract this information and attempt to establish secure communications with the computing device. 1st para, page 16.
TANIMOTO et al., JP 2006222535 A, It is possible to make a reservation for transmission until the expired certificate is updated, so that the message can be transmitted using the expired certificate, 1st para, page 6
Ponnuswamy et al., 20200235907
[0020] After establiShing the initial trust, the initial shared secret may be used later for re-establiShing the trust whenever the VCM's certificate expires
Koster et al, 20170104748 [0053] “Soft Expiration”—also referred to as a Soft Expiration Date, is an adjustable/resettable date of expiration for accepting the certificate. This date is intended to be different from the true expiration date that is encoded or embedded into the Certificate when provided. In varying embodiments the Certificate may be accepted on/through the Soft Expiration Date, or up to the Soft Expiration Date.
[0059] managing network access based on a Certificate with a Soft Expiration. In general a User is provided with a Certificate that he or she will use for access to a secured network access to one or more systems and sources. When a User holding such a Certificate makes a request for network access, the Authentication System receives the Certificate and rather than the traditional approach of determining validity based on the Certificate's expiration date, the Soft Expiration is evaluated. More specifically, the Certificate may be established with a very long life span such that it is very likely that the Certificate is technically valid, however the decision to accept the certificate as valid is not based on the actual expiration date but the Soft Expiration associated therewith. And, as will be discussed below, the Soft Expiration can be reset, thereby permitting continued use of the Certificate and managed network access for the User.
PHILIPS et al., GB 2530040 A
Furthermore, all certificates may be provided with an expiration duration, such that, for example, if a certificate received from a device has expired, the device can verify with the database server as to whether an updated device certificate is available. In such a scenario, the device is operable to control (e.g. allow) communication between the device and the service until the expiration issue is addressed, 4th para, page 10
Leblang et al., 11240043 (83) The device certificate 120 that may need renewal may still be used for the purposes of communications with the IoT device 106, until the new device certificate is issued, col., 16, lines 22-28.
HOU et al, CN 105723374 B
The user equipment can be configured to continue allowing a previous certificate is used, or can be arranged to prevent any certificate is input, until the new password on the user apparatus is determined to have "active" life, 7th para, page 5.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing use of expired certificate for sometime until new certificate is available. After the connection providing secure channel is dropped the server would no longer be able to send information to the controller. Hence, until the new certificate is available, allowing communication even when the certificate is expired would reenable the server to continue sending information to the controller/device. The information received by the controller/device for configuration would enable controller to carry out command operations even when the new certificate is not available.
Claim(s) 10, 11, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri in view of Shin, Magnus, Official Notice and Koster et al, 20170104748.
Referring to claim 10, Poluri in view of Shin, Magnus do not disclose which Koster discloses confirming that other attribute of the first device operational certificate indicate that the first device operational certificate is valid (valid beyond expired), wherein accepting the expired first device operational certificate as valid is performed in response to determining that the other attribute indicate that the first device operational certificate is valid, valid beyond expired, invalidity (
[0053] “Soft Expiration”—also referred to as a Soft Expiration Date, is an adjustable/resettable date of expiration for accepting the certificate. This date is intended to be different from the true expiration date that is encoded or embedded into the Certificate when provided. In varying embodiments the Certificate may be accepted on/through the Soft Expiration Date, or up to the Soft Expiration Date.
[0059] managing network access based on a Certificate with a Soft Expiration. In general a User is provided with a Certificate that he or she will use for access to a secured network access to one or more systems and sources. When a User holding such a Certificate makes a request for network access, the Authentication System receives the Certificate and rather than the traditional approach of determining validity based on the Certificate's expiration date, the Soft Expiration is evaluated. More specifically, the Certificate may be established with a very long life span such that it is very likely that the Certificate is technically valid, however the decision to accept the certificate as valid is not based on the actual expiration date but the Soft Expiration associated therewith. And, as will be discussed below, the Soft Expiration can be reset, thereby permitting continued use of the Certificate and managed network access for the User.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing use of expired certificate for sometime until new certificate is available. Hence, until the new certificate is available, allowing communication even when the certificate is expired would reenable the server to continue sending information to the controller/device. The information received by the controller/device for configuration would enable controller to carry out command operations even when the new certificate is not available.
Referring to claim 11, Koster discloses the first device operational certificate being well formed, the first device operational certificate not having been revoked, or the first device operational certificate having been signed by a locally configured certificate authority (CA). (not revoked or not renewed, but expired, para 33, 23, valid beyond expired, invalidity, para 30, 4, CA, 6, valid after expiration, para 53, 59).
Claim(s) 12, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri in view of Shin, Magnus, Official Notice, Koster and Shohat et al., 9735970.
Referring to claim(s) 12, Poluri in view of Shin, Magnus, Koster does not specifically mention about, which is well-known in the art, which Shohat discloses, receiving, from the first device, a fingerprint of the first device operational certificate (
expired certificates can be handled, Col., 10, lines 14-19,
Claim 18. receiving a remote certificate fingerprint from the remote SAA; obtaining a verified certificate based on the remote certificate fingerprint
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide receiving, from the first device, a fingerprint of the device operational certificate. The device would know the current status of the fingerprint certificate. Based on the status the device would be able to determine on further steps for handling the fingerprint/certificate for securing the traffic even when the certificate is expired, The received fingerprint of the certificate would enable securing the traffic by the device even after the certificate is expired, Col., 10, lines 14-19, claim 18.
Claim(s) 14, 15, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri in view of Shin, Magnus, Official Notice, Koster and MIAO et al., CN 107077270 A.
Referring to claim 14, Poluri in view of Shin, Magnus, Official Notice, Koster do not disclose which Miao discloses a user interface device comprising a user interface configured to display a plurality of icons, corresponding to a device and configured to indicate a connection status of the device(
obtaining the connection state corresponding to the connection status icon 104 and the device information corresponding to the device icon 105. the fifth control module 123 for controlling a display 101 display device icon 105 and the connection status icon 104, connection status icon 104 the icon 103 between the device icon 105, para 4-6, page 9,
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide displaying well-known plurality of icons on the screen. The icons would enable a user to interact with the screen in order to operate the associated devices.
Referring to claim 15,
Miao discloses user interface, para 4-6,
Poluri discloses BMS para 30
Koster discloses wherein the device is configured to send an instruction to a device to accept the expired first device operational certificate as valid, para 53, 59.
Claim(s) 10, 11, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri in view of Shin, Fredriksson, Official Notice and Koster et al, 20170104748.
Referring to claim 10, Poluri in view of Shin, Fredriksson do not disclose which Koster discloses confirming that other attribute of the first device operational certificate indicate that the first device operational certificate is valid (valid beyond expired), wherein accepting the expired first device operational certificate as valid is performed in response to determining that the other attribute indicate that the first device operational certificate is valid, valid beyond expired, invalidity (
[0053] “Soft Expiration”—also referred to as a Soft Expiration Date, is an adjustable/resettable date of expiration for accepting the certificate. This date is intended to be different from the true expiration date that is encoded or embedded into the Certificate when provided. In varying embodiments the Certificate may be accepted on/through the Soft Expiration Date, or up to the Soft Expiration Date.
[0059] managing network access based on a Certificate with a Soft Expiration. In general a User is provided with a Certificate that he or she will use for access to a secured network access to one or more systems and sources. When a User holding such a Certificate makes a request for network access, the Authentication System receives the Certificate and rather than the traditional approach of determining validity based on the Certificate's expiration date, the Soft Expiration is evaluated. More specifically, the Certificate may be established with a very long life span such that it is very likely that the Certificate is technically valid, however the decision to accept the certificate as valid is not based on the actual expiration date but the Soft Expiration associated therewith. And, as will be discussed below, the Soft Expiration can be reset, thereby permitting continued use of the Certificate and managed network access for the User.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing use of expired certificate for sometime until new certificate is available. Hence, until the new certificate is available, allowing communication even when the certificate is expired would reenable the server to continue sending information to the controller/device. The information received by the controller/device for configuration would enable controller to carry out command operations even when the new certificate is not available.
Referring to claim 11, Koster discloses the first device operational certificate being well formed, the first device operational certificate not having been revoked, or the first device operational certificate having been signed by a locally configured certificate authority (CA). (not revoked or not renewed, but expired, para 33, 23, valid beyond expired, invalidity, para 30, 4, CA, 6, valid after expiration, para 53, 59).
Claim(s) 12, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri in view of Shin, Fredriksson, Official Notice, Koster and Shohat et al., 9735970.
Referring to claim(s) 12, Poluri in view of Shin, Fredriksson, Koster does not specifically mention about, which is well-known in the art, which Shohat discloses, receiving, from the first device, a fingerprint of the first device operational certificate(
expired certificates can be handled, Col., 10, lines 14-19,
Claim 18. receiving a remote certificate fingerprint from the remote SAA; obtaining a verified certificate based on the remote certificate fingerprint
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide receiving, from the first device, a fingerprint of the device operational certificate. The device would know the current status of the fingerprint certificate. Based on the status the device would be able to determine on further steps for handling the fingerprint/certificate for securing the traffic even when the certificate is expired, The received fingerprint of the certificate would enable securing the traffic by the device even after the certificate is expired, Col., 10, lines 14-19, claim 18.
Claim(s) 14, 15, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri in view of Shin, Fredriksson, Official Notice, Koster and MIAO et al., CN 107077270 A.
Referring to claim 14, Poluri in view of Shin, Fredriksson, Official Notice, Koster do not disclose which Miao discloses a user interface device comprising a user interface configured to display a plurality of icons, corresponding to a device and configured to indicate a connection status of the device(
obtaining the connection state corresponding to the connection status icon 104 and the device information corresponding to the device icon 105. the fifth control module 123 for controlling a display 101 display device icon 105 and the connection status icon 104, connection status icon 104 the icon 103 between the device icon 105, para 4-6, page 9,
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide displaying well-known plurality of icons on the screen. The icons would enable a user to interact with the screen in order to operate the associated devices.
Referring to claim 15,
Miao discloses user interface is to send the list, para 4-6,
Poluri discloses BMS para 30
Koster discloses wherein the device is configured to send an instruction to a device to accept the expired first device operational certificate as valid, para 53, 59.
Claim(s) 17, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri in view of Shin, Magnus, Official Notice, Koster and Anderson, 20080086633.
Referring to claim 17, Poluri substantially discloses, a method of replacing an expired device operational certificate, the method comprising: identifying that a first device operational certificate of a first device has expired; delivering the replacement first device operational certificate to the first device, receiving a replacement device operational certificate, A BMS comprising: a first device comprising a device operational certificate; and a second device comprising one or more hardware processors and one or more computer-readable storage media having instructions stored thereon that, when executed by the one or more hardware processors, cause the one or more hardware processors to implement operations comprising: (para 40, 41),
[0034] generating a plurality of certificates for a plurality of client devices (such as the controllers 14 and/or clients 16 shown in FIG. 1) within a Building Management System (BMS) such as the BMS 12 using an application executing on a certificate management device. The certificate management device may include a user interface, and may be in communication with a remote server. The client management device, which in some cases may be a mobile device such as the mobile device 22, receives client device information. The client management device may transmit the received client device information to the remote server 20, as indicated at block 54. The remote server 20 may generate certificates for each of the client devices and download the certificates to the client management device. The client management device may receive the certificates and download certificates to the appropriate client device, which are then used for subsequent secure communication in the BMS. In some cases, as optionally indicated at block 60, the method 60 may further include tracking the expiration date of each of the certificates.
wherein authentication of the device operating certificate enable communication between the first device and other devices over a network (para 34) delivering over the network and upon communication between the first device and other devices, a replacement first device operational certificate to the first device to replace the expired first device operational certificate having (para 34)
identifying that the first device operational certificate of the first device has expired, wherein authentication of the first device operational certificate enables communication between the first device and other devices over a network (para 39, 29, 30): receiving, via the network, an instruction regarding the first device operational certificate(from the user interface, para 39, 29, 30),
[0029] the remote server 20 may transmit all of the generated controller certificates to the mobile device 22, and the mobile device 22 may distribute the generated controller certificates to the appropriate controllers. In some cases, the remote server 20 may transmit the generated controller certificates directly to the appropriate controllers.
[0030] tracking the expiration date of each of the generated controller certificates and allowing automatic renewal of the generated controller certificates. In some cases, the mobile device 22 may receive a renewed controller certificates for each of the expiring certificates from the remote server 20, and the mobile device 22 may then download each of the renewed certificates to the corresponding one of the plurality of controllers of the BMS, optionally in response to a single click on a user interface of the mobile device.
authenticating, in response to receiving the instruction, the expired first device operational certificateto reestablish communication between the first device and other devices in the BMS (para 39, 29, 30); and delivering, over the network and upon communication with the first device, a replacement first device operational certificateto the first device to replace the expired first device operational certificate(para 39, 29, 30)
[0039] The screen 100 can be seen as including a Download Controller Certificates button 106, a Download Client Certificates button 108, a BACnet port button 110 and a Cancel button 112. It will be appreciated that the Download Controller Certificates button 106 may be used to initiate a download of the controller certificates from the remote server 20 so that the mobile device 22 can subsequently download the controller certificates to each of the controllers 14 of the BMS 12. Similarly, the Download Client Certificates button 108 may be used to initiate a download of the client certificates from the remote server 20 so that the mobile device 22 can subsequently download the client certificates to each of the clients 16 of BMS 12. The BACnet port button 110 may be used to set the BACnet port number for each controller
[0041] a building management system, other systems such as industrial process control systems and/or any other suitable system that uses security certificates.
PNG
media_image2.png
504
578
media_image2.png
Greyscale
PNG
media_image3.png
518
466
media_image3.png
Greyscale
In addition, Poluri also discloses a user interface of the client management device for sending information to other devices /server / the controllers for the controlled devices, para 35, which is similar to the claimed instruction that is sent.
Poluri specifically teaches, device certificate for each of the plurality of devices of the BMS
[0012] FIG. 5 providing device certificates to a plurality of devices of a building management system; [0026] Certificates are used by the controllers 14 and the clients 16 for providing secure communication between individual components of the BMS 12, such as communication between two or more different controllers 14, or between a controller 14 and a client 16, or between two or more different clients 16. [0042] Having thus described several illustrative embodiments of the present disclosure, those of skill in the art will readily appreciate that yet other embodiments may be made and used within the scope of the claims hereto attached. It will be understood, however, that this disclosure is, in many respects, only illustrative. Changes may be made in details, particularly in matters of shape, size, arrangement of parts, and exclusion and order of steps, without exceeding the scope of the disclosure. [0004] In another example, a plurality of client certificates for a plurality of client devices within a Building Management System (BMS) may be provided using an application executing on a certificate management device. The certificate management device may include a user interface and may be in communication with a remote server. One or more of the clients 16 may, for example, be involved in providing instructions to one or more of the controllers 14. These are just examples, as it will be appreciated that there are a number of different ways in which the controllers 14 and the clients 16 may be interconnected within the BMS 12. It is contemplated that the phrase “client device” may refer to the controllers 14 and/or other client devices (e.g. clients 16) within a building management system.
Poluri, do not specifically mention about, which is well-known in the art, which Shin discloses,
reconnecting, reestablishing communication (
This procedure is also necessary when the device wants to reconnect when the credential is lost due to certificate expiration, 3rd last para, page 2.
The controller 500 may include at least one processor 520 , a memory 540 , and a storage device 560 , and controls the overall operation of the CS 102 . In particular, the controller 500 performs a process in charge of the CS 102 during the operation, 1st para, page 12
In general, the methods are preferably performed by some hardware device.
The device includes a processor and a memory for storing program instructions executed by the processor, when the program instructions are executed by the processor: Storing at least some information in the memory to store the information A command for performing an operation of configuring , connecting to the CSMS by establishing a secure channel between the CSMS for maintaining registration information for the device, and registering the device with the CSMS, abstract
The information may include connection information for the CSMS in charge of the device, credential information for establishing a secure channel with the CSMS, and registration information of the device, 3rd last para, page 9
those skilled in the art can variously modify and change the present invention without departing from the spirit and scope of the present invention.
The connection information may include at least one of an IP address and a port number of the CSMS and information necessary to communicate with the CSMS by a predetermined communication protocol, 3rd para, page 3
a remote configuration mode in which the information is stored in the device through a predetermined communication network from a server located at a remote location, claim 16
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing reconnecting / reestablishing communication. After the connection providing secure channel is dropped the server would no longer be able to send information to the controller. Hence, the reconnecting / reestablishing communication between the devices would reenable the server to send information to the controller. The information received by the controller for configuration would enable controller to carry out command operations.
Poluri, and Shin do not specifically mention about, which Magnus discloses authenticating in response to receiving the instruction the expired first device operational certificateto establish communication between the first device and other devices, receiving over a network an instruction from a device to ignore that the certificate has expired and accept the first device operational certificatethat has expired as valid, ignore that the certificate has expired and accept the expired certificate as valid, receipt of the instruction causing the second device to authenticate the expired certificate for communication between the first device and other devices (
As shown in FIG. 1 , environment 100 includes UE device 110 (or “UE 110”), any one of which may be described in the singular in FIG. 1 , “UE 140”). , a network 120 and a controller 130 , 3rd para, page 4
If the message is authenticated by the controller 130 , the controller identifies the state of the UE 140 as being in a rescue state. The controller 130 tracks the expiration status of the TLS certificates for the various UEs served by the controller 130, so the controller 130 expects a rescue request from a specific UE based on whether the UE's certificate has expired or not. You can recognize whether it is reasonable to do so. If so, the controller 130 may prompt the administrator to verify whether the administrator wishes to issue a new TLS certificate to the UE 140, last para, page 8
reauthorize an already expired certificate by modifying the key from the expired certificate. The second private/public key pair is not used until the certificate has already expired (eg in a rescue situation). Thus, when the UE recognizes that the certificate has expired, the UE signs a rescue request message using the private key of the expired certificate, and sends this request to the controller (or other " device with "rescue address"). When a request is made by the UE, the controller verifies the request through the application of this public key held by the controller despite the fact that the certificate associated with the UE's public key has already expired, last para, page 3
If attempted, the officer can simply re-establish the secure connection by sending a certificate request message signed with the UE's private key on the expired TLS certificate, 2nd para, page 5
The controller 130 maintains public keys for the various UEs with currently active TLS certificates, as well as other private keys for the various UEs that will be used to re-authorize the certificates in a rescue situation where the TLS certificates of the UEs have already expired.. In addition, the controller 130 verifies the certificate provisioning request message with the controller's paired public key of the expired certificate for the terminal 140, and then the UE 140 stores it in memory for ultimate use in a rescue situation, 3rd para page 5
UE 110 optionally includes a display such as an LCD screen or an LED screen. Further, the display is configured to indicate an expiration status of a Transport Layer Security (TLS) certificate. As discussed with respect to FIG. 2 , UE 110 includes an interface (eg, 2140 ), which interface may be physically, or such as Bluetooth or near-field connection (NFC). Through a paired wireless connection, it allows the UE 110 to connect to external computer resources that facilitates communication exchanges with the controller 130, 2nd last para, page 5
The controller 130 tracks the expiration status of the TLS certificates for the various UEs served by the controller 130, so the controller 130 expects a rescue request from a specific UE based on whether the UE's certificate has expired or not, last para, page 8
If so, the controller 130 may prompt the administrator to verify whether the administrator wishes to issue a new TLS certificate to the UE 140 . Alternatively, the metadata tag from the image file provided by the UE 140 in the request message (or associated message) is checked so that the date/time of this file can be verified so that the original TLS certificate for this UE 140 is still there. An automated process can be performed to see if it matches the date/time when it was valid. If so, the controller 130 can reasonably conclude that the rescue request from the UE 140 signed by the key from the TLS expired from the UE 140 is a valid request, last para, page 8
Since the controller 130 has the public key of the expired certificate, it can use it to verify the signature of the request message and determine whether the request message is valid.1st para, page 10).
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing ignoring that the certificate has expired. After the connection providing channel is dropped the server would no longer be able to send information to the controller. Hence, until the new certificate is available, allowing communication even when the certificate is expired would reenable the server to continue sending information to the controller/device. The information received by the controller/device for configuration would enable controller to carry out command operations even when the new certificate is not available.
Poluri, Magnus and Shin do not specifically mention about to use expired certificate for sometime until new certificate is available. And official notice is taken than such concept is well-known and excepted in the art. Until the new certificate is available, informing to use the expired certificate is not novel, rather had been used by many prior to the effective filling date of this application.
LEPESKA et al., CN 108476201 A in the frame 950, indicating the service 140 can process the expired certificate. For example, a cache entry may be associated based on maturity dates in the certificate and the certificate has expired. The service 140 can contact remote computing device to obtain a new certificate. For example, information of a computing device providing certificate expired certificate may include identification. Prompting service 140 can extract this information and attempt to establish secure communications with the computing device. 1st para, page 16.
TANIMOTO et al., JP 2006222535 A, It is possible to make a reservation for transmission until the expired certificate is updated, so that the message can be transmitted using the expired certificate, 1st para, page 6
Ponnuswamy et al., 20200235907
[0020] After establiShing the initial trust, the initial shared secret may be used later for re-establiShing the trust whenever the VCM's certificate expires
Koster et al, 20170104748 [0053] “Soft Expiration”—also referred to as a Soft Expiration Date, is an adjustable/resettable date of expiration for accepting the certificate. This date is intended to be different from the true expiration date that is encoded or embedded into the Certificate when provided. In varying embodiments the Certificate may be accepted on/through the Soft Expiration Date, or up to the Soft Expiration Date.
[0059] managing network access based on a Certificate with a Soft Expiration. In general a User is provided with a Certificate that he or she will use for access to a secured network access to one or more systems and sources. When a User holding such a Certificate makes a request for network access, the Authentication System receives the Certificate and rather than the traditional approach of determining validity based on the Certificate's expiration date, the Soft Expiration is evaluated. More specifically, the Certificate may be established with a very long life span such that it is very likely that the Certificate is technically valid, however the decision to accept the certificate as valid is not based on the actual expiration date but the Soft Expiration associated therewith. And, as will be discussed below, the Soft Expiration can be reset, thereby permitting continued use of the Certificate and managed network access for the User.
PHILIPS et al., GB 2530040 A
Furthermore, all certificates may be provided with an expiration duration, such that, for example, if a certificate received from a device has expired, the device can verify with the database server as to whether an updated device certificate is available. In such a scenario, the device is operable to control (e.g. allow) communication between the device and the service until the expiration issue is addressed, 4th para, page 10
Leblang et al., 11240043 (83) The device certificate 120 that may need renewal may still be used for the purposes of communications with the IoT device 106, until the new device certificate is issued, col., 16, lines 22-28.
HOU et al, CN 105723374 B
The user equipment can be configured to continue allowing a previous certificate is used, or can be arranged to prevent any certificate is input, until the new password on the user apparatus is determined to have "active" life, 7th para, page 5.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing use of expired certificate for sometime until new certificate is available. After the connection providing secure channel is dropped the server would no longer be able to send information to the controller. Hence, until the new certificate is available, allowing communication even when the certificate is expired would reenable the server to continue sending information to the controller/device. The information received by the controller/device for configuration would enable controller to carry out command operations even when the new certificate is not available.
Poluri in view of Shin, Magnus, Official Notice, Koster do not specifically mention about, which is well-known in the art, which Anderson discloses, receiving a replacement first device operational certificatefrom the user interface device (para 34, 35).
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide a user with an interface for providing a command to do the replacement of the certificate. The replaced certificate would be obtained, which would enable continue securing network traffic, para 34, 35.
Claim(s) 17, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri in view of Shin, Fredriksson, Official Notice, Koster and Anderson, 20080086633.
Referring to claim 17, Poluri substantially discloses, a method of replacing an expired device operational certificate, the method comprising: identifying that a first device operational certificateof a first device has expired; delivering the replacement first device operational certificateto the first device, receiving a replacement device operational certificate, A BMS comprising: a first device comprising a device operational certificate; and a second device comprising one or more hardware processors and one or more computer-readable storage media having instructions stored thereon that, when executed by the one or more hardware processors, cause the one or more hardware processors to implement operations comprising: (para 40, 41),
[0034] generating a plurality of certificates for a plurality of client devices (such as the controllers 14 and/or clients 16 shown in FIG. 1) within a Building Management System (BMS) such as the BMS 12 using an application executing on a certificate management device. The certificate management device may include a user interface, and may be in communication with a remote server. The client management device, which in some cases may be a mobile device such as the mobile device 22, receives client device information. The client management device may transmit the received client device information to the remote server 20, as indicated at block 54. The remote server 20 may generate certificates for each of the client devices and download the certificates to the client management device. The client management device may receive the certificates and download certificates to the appropriate client device, which are then used for subsequent secure communication in the BMS. In some cases, as optionally indicated at block 60, the method 60 may further include tracking the expiration date of each of the certificates.
wherein authentication of the device operating certificate enable communication between the first device and other devices over a network (para 34) delivering over the network and upon communication between the first device and other devices, a replacement first device operational certificateto the first device to replace the expired first device operational certificatehaving (para 34)
identifying that the first device operational certificateof the first device has expired, wherein authentication of the first device operational certificateenables communication between the first device and other devices over a network (para 39, 29, 30): receiving, via the network, an instruction regarding the first device operational certificate(from the user interface, para 39, 29, 30),
[0029] the remote server 20 may transmit all of the generated controller certificates to the mobile device 22, and the mobile device 22 may distribute the generated controller certificates to the appropriate controllers. In some cases, the remote server 20 may transmit the generated controller certificates directly to the appropriate controllers.
[0030] tracking the expiration date of each of the generated controller certificates and allowing automatic renewal of the generated controller certificates. In some cases, the mobile device 22 may receive a renewed controller certificates for each of the expiring certificates from the remote server 20, and the mobile device 22 may then download each of the renewed certificates to the corresponding one of the plurality of controllers of the BMS, optionally in response to a single click on a user interface of the mobile device.
authenticating, in response to receiving the instruction, the expired first device operational certificateto reestablish communication between the first device and other devices in the BMS (para 39, 29, 30); and delivering, over the network and upon communication with the first device, a replacement first device operational certificateto the first device to replace the expired first device operational certificate(para 39, 29, 30)
[0039] The screen 100 can be seen as including a Download Controller Certificates button 106, a Download Client Certificates button 108, a BACnet port button 110 and a Cancel button 112. It will be appreciated that the Download Controller Certificates button 106 may be used to initiate a download of the controller certificates from the remote server 20 so that the mobile device 22 can subsequently download the controller certificates to each of the controllers 14 of the BMS 12. Similarly, the Download Client Certificates button 108 may be used to initiate a download of the client certificates from the remote server 20 so that the mobile device 22 can subsequently download the client certificates to each of the clients 16 of BMS 12. The BACnet port button 110 may be used to set the BACnet port number for each controller
[0041] a building management system, other systems such as industrial process control systems and/or any other suitable system that uses security certificates.
PNG
media_image2.png
504
578
media_image2.png
Greyscale
PNG
media_image3.png
518
466
media_image3.png
Greyscale
In addition, Poluri also discloses a user interface of the client management device for sending information to other devices /server / the controllers for the controlled devices, para 35, which is similar to the claimed instruction that is sent.
Poluri specifically teaches, device certificate for each of the plurality of devices of the BMS
[0012] FIG. 5 providing device certificates to a plurality of devices of a building management system; [0026] Certificates are used by the controllers 14 and the clients 16 for providing secure communication between individual components of the BMS 12, such as communication between two or more different controllers 14, or between a controller 14 and a client 16, or between two or more different clients 16. [0042] Having thus described several illustrative embodiments of the present disclosure, those of skill in the art will readily appreciate that yet other embodiments may be made and used within the scope of the claims hereto attached. It will be understood, however, that this disclosure is, in many respects, only illustrative. Changes may be made in details, particularly in matters of shape, size, arrangement of parts, and exclusion and order of steps, without exceeding the scope of the disclosure. [0004] In another example, a plurality of client certificates for a plurality of client devices within a Building Management System (BMS) may be provided using an application executing on a certificate management device. The certificate management device may include a user interface and may be in communication with a remote server. One or more of the clients 16 may, for example, be involved in providing instructions to one or more of the controllers 14. These are just examples, as it will be appreciated that there are a number of different ways in which the controllers 14 and the clients 16 may be interconnected within the BMS 12. It is contemplated that the phrase “client device” may refer to the controllers 14 and/or other client devices (e.g. clients 16) within a building management system.
Poluri, do not specifically mention about, which is well-known in the art, which Shin discloses,
reconnecting, reestablishing communication (
This procedure is also necessary when the device wants to reconnect when the credential is lost due to certificate expiration, 3rd last para, page 2.
The controller 500 may include at least one processor 520 , a memory 540 , and a storage device 560 , and controls the overall operation of the CS 102 . In particular, the controller 500 performs a process in charge of the CS 102 during the operation, 1st para, page 12
In general, the methods are preferably performed by some hardware device.
The device includes a processor and a memory for storing program instructions executed by the processor, when the program instructions are executed by the processor: Storing at least some information in the memory to store the information A command for performing an operation of configuring , connecting to the CSMS by establishing a secure channel between the CSMS for maintaining registration information for the device, and registering the device with the CSMS, abstract
The information may include connection information for the CSMS in charge of the device, credential information for establishing a secure channel with the CSMS, and registration information of the device, 3rd last para, page 9
those skilled in the art can variously modify and change the present invention without departing from the spirit and scope of the present invention.
The connection information may include at least one of an IP address and a port number of the CSMS and information necessary to communicate with the CSMS by a predetermined communication protocol, 3rd para, page 3
a remote configuration mode in which the information is stored in the device through a predetermined communication network from a server located at a remote location, claim 16
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing reconnecting / reestablishing communication. After the connection providing secure channel is dropped the server would no longer be able to send information to the controller. Hence, the reconnecting / reestablishing communication between the devices would reenable the server to send information to the controller. The information received by the controller for configuration would enable controller to carry out command operations.
Poluri, and Shin do not specifically mention about, which Fredriksson discloses authenticating in response to receiving the instruction the expired first device operational certificateto establish communication between the first device and other devices, receiving over a network an instruction from a device to ignore that the certificate has expired and accept the first device operational certificatethat has expired as valid, ignore that the certificate has expired and accept the expired certificate as valid, receipt of the instruction causing the second device to authenticate the expired certificate for communication between the first device and other devices (Command/instruction to ignore cert-expiry (certificate expiry), 3 rd last para, page 6, 2nd last para, page 14)
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing ignoring that the certificate has expired. After the connection providing channel is dropped the server would no longer be able to send information to the controller. Hence, until the new certificate is available, allowing communication even when the certificate is expired would reenable the server to continue sending information to the controller/device. The information received by the controller/device for configuration would enable controller to carry out command operations even when the new certificate is not available.
Poluri, Fredriksson and Shin do not specifically mention about to use expired certificate for sometime until new certificate is available. And official notice is taken than such concept is well-known and excepted in the art. Until the new certificate is available, informing to use the expired certificate is not novel, rather had been used by many prior to the effective filling date of this application.
LEPESKA et al., CN 108476201 A in the frame 950, indicating the service 140 can process the expired certificate. For example, a cache entry may be associated based on maturity dates in the certificate and the certificate has expired. The service 140 can contact remote computing device to obtain a new certificate. For example, information of a computing device providing certificate expired certificate may include identification. Prompting service 140 can extract this information and attempt to establish secure communications with the computing device. 1st para, page 16.
TANIMOTO et al., JP 2006222535 A, It is possible to make a reservation for transmission until the expired certificate is updated, so that the message can be transmitted using the expired certificate, 1st para, page 6
Ponnuswamy et al., 20200235907
[0020] After establiShing the initial trust, the initial shared secret may be used later for re-establiShing the trust whenever the VCM's certificate expires
Koster et al, 20170104748 [0053] “Soft Expiration”—also referred to as a Soft Expiration Date, is an adjustable/resettable date of expiration for accepting the certificate. This date is intended to be different from the true expiration date that is encoded or embedded into the Certificate when provided. In varying embodiments the Certificate may be accepted on/through the Soft Expiration Date, or up to the Soft Expiration Date.
[0059] managing network access based on a Certificate with a Soft Expiration. In general a User is provided with a Certificate that he or she will use for access to a secured network access to one or more systems and sources. When a User holding such a Certificate makes a request for network access, the Authentication System receives the Certificate and rather than the traditional approach of determining validity based on the Certificate's expiration date, the Soft Expiration is evaluated. More specifically, the Certificate may be established with a very long life span such that it is very likely that the Certificate is technically valid, however the decision to accept the certificate as valid is not based on the actual expiration date but the Soft Expiration associated therewith. And, as will be discussed below, the Soft Expiration can be reset, thereby permitting continued use of the Certificate and managed network access for the User.
PHILIPS et al., GB 2530040 A
Furthermore, all certificates may be provided with an expiration duration, such that, for example, if a certificate received from a device has expired, the device can verify with the database server as to whether an updated device certificate is available. In such a scenario, the device is operable to control (e.g. allow) communication between the device and the service until the expiration issue is addressed, 4th para, page 10
Leblang et al., 11240043 (83) The device certificate 120 that may need renewal may still be used for the purposes of communications with the IoT device 106, until the new device certificate is issued, col., 16, lines 22-28.
HOU et al, CN 105723374 B
The user equipment can be configured to continue allowing a previous certificate is used, or can be arranged to prevent any certificate is input, until the new password on the user apparatus is determined to have "active" life, 7th para, page 5.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing use of expired certificate for sometime until new certificate is available. After the connection providing secure channel is dropped the server would no longer be able to send information to the controller. Hence, until the new certificate is available, allowing communication even when the certificate is expired would reenable the server to continue sending information to the controller/device. The information received by the controller/device for configuration would enable controller to carry out command operations even when the new certificate is not available.
Poluri in view of Shin, Fredriksson, Official Notice, Koster do not specifically mention about, which is well-known in the art, which Anderson discloses, receiving a replacement first device operational certificatefrom the user interface device (para 34, 35).
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide a user with an interface for providing a command to do the replacement of the certificate. The replaced certificate would be obtained, which would enable continue securing network traffic, para 34, 35.
Claim(s) 19-20, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri in view of Shin, Magnus, Official Notice, Koster, Anderson.
Referring to claim 19, Koster discloses confirming that the replacement first device operational certificate is valid (para 59, 53).
Referring to claim 20,
Koster discloses wherein the secure connection is established (para 53)
in response to confirming that the replacement first device operational certificateis valid, para 53, 59.
Claim(s) 21, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri in view of Shin, Magnus, Official Notice, Koster and Zhang, CA 2993032 C.
Referring to claim(s) 21, Poluri in view of Shin, Magnus, Koster do not mention about, a third device not capable of direct communication with the first device, wherein the operations further comprise: receive, from the third device, a replacement first device operational certificatefor the first device; and deliver the replacement first device operational certificateto the first device, which Zhang discloses, para 15, 84, 96.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide delivering the certificate. Devices not in direct communication with each other would be able to obtain information/certificate via other device, para 15, 84, 96.
Claim(s) 18-20, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri in view of Shin, Fredriksson, Official Notice, Koster, Anderson and Shohat et al., 9735970.
Referring to claim 18, Koster discloses that are acceptable even if expired, as per the citations in claim 17. Poluri in view of Shin, Fredriksson, Official Notice, Koster, Anderson does not specifically mention about, which is well-known in the art, which Shohat discloses, receiving, from the first device, a fingerprint of the device operational certificate, receiving an allowable expired list of first device operational certificatefingerprints (
expired certificates can be handled,. Col., 10, lines 14-19,
Claim 18. receiving a remote certificate fingerprint from the remote SAA; obtaining a verified certificate based on the remote certificate fingerprint
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide receiving, from the first device, a fingerprint of the device operational certificate. The device would know the current status of the fingerprint certificate. Based on the status the device would be able to determine on further steps for handling the fingerprint/certificate for securing the traffic even when the certificate is expired, The received fingerprint of the certificate would enable securing the traffic by the device even after the certificate is expired, Col., 10, lines 14-19, claim 18.
Referring to claim 19, Koster discloses confirming that the replacement first device operational certificateis valid (para 59, 53).
Referring to claim 20,
Koster discloses communicatively connecting to the first device (para 53)
in response to confirming that the replacement first device operational certificateis valid, para 53, 59.
Claim(s) 21, is/are rejected under 35 U.S.C. 103 as being unpatentable over Poluri in view of Shin, Fredriksson, Official Notice, Koster and Zhang, CA 2993032 C.
Referring to claim(s) 21, Poluri in view of Shin, Fredriksson, Koster do not mention about, a third device not capable of direct communication with the first device, wherein the operations further comprise: receive, from the third device, a replacement first device operational certificatefor the first device; and deliver the replacement first device operational certificateto the first device, which Zhang discloses, para 15, 84, 96.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide delivering the certificate. Devices not in direct communication with each other would be able to obtain information/certificate via other device, para 15, 84, 96.
Pertinent Prior arts:
KOTTAPALLI et al., 20200295951 Instruct (Administrator can use command-line interface (CLI) commands to interact with certificate management service 200. Para 56)
DOUGLAS et al., WO 2018157247 A1 [0012] The system is configured to utilize the custom certificates in combination with approaches for emergency certificate renewal. For example, one or both of the two different certificates may be pushed to the security device.
TOMOEDA et al., 20200204549 [0065] The certificate update unit 504 updates the certificate by setting a new validity period for the certificate whose validity period has expired. The certificate update unit 504 issues, for example, a certificate in which the validity period of the certificate issued to the communication control device 30 (31) is extended on the basis of an update request from the communication control device 30 (31) and transmits the issued certificate to the communication control device 30 (31).
Response to Arguments
Remarks/Arguments filed 3/10/26 have been fully considered but they are not persuasive. Therefore, rejection of claims 1-4,6-7,9-12,14-15,17 and 19-21 is maintained.
Regarding the concerns for the updated limitations, the rejections are updated accordingly. Please refer to the updated rejections.
The applicant’s remarks are noted, however, the sending step is merely sending of the list as rejected below. The identifying step mere accomplishes knowing of an expired certificate, as rejected below. The sending step is merely sending of the list as rejected below. The receipt of the list is as rejected below. Without the second device having the certificate it cannot authenticate the certificate. Delivering step can happen only if the second device having more than the list, i.e., the certificate itself, which is rejected below. Mainly, lots of prior arts disclose allowing the expired certificates for use after expiration, as rejected below.
Poluri discloses, a method of a device with an first device operational certificatein a building management system (BMS) (para 41), the method comprising: identifying that of a first device operational certificateof a first device (para 40) ,
[0034] generating a plurality of certificates for a plurality of client devices (such as the controllers 14 and/or clients 16 shown in FIG. 1) within a Building Management System (BMS) such as the BMS 12 using an application executing on a certificate management device. The certificate management device may include a user interface, and may be in communication with a remote server. The client management device, which in some cases may be a mobile device such as the mobile device 22, receives client device information. The client management device may transmit the received client device information to the remote server 20, as indicated at block 54. The remote server 20 may generate certificates for each of the client devices and download the certificates to the client management device. The client management device may receive the certificates and download certificates to the appropriate client device, which are then used for subsequent secure communication in the BMS. In some cases, as optionally indicated at block 60, the method 60 may further include tracking the expiration date of each of the certificates.
wherein authentication of the first device operational certificateis configured to enable a secure communication between the first device and other devices over a network (para 39, 29, 30)
[0029] the remote server 20 may transmit all of the generated controller certificates to the mobile device 22, and the mobile device 22 may distribute the generated controller certificates to the appropriate controllers. In some cases, the remote server 20 may transmit the generated controller certificates directly to the appropriate controllers.
[0030] tracking the expiration date of each of the generated controller certificates and allowing automatic renewal of the generated controller certificates. In some cases, the mobile device 22 may receive a renewed controller certificates for each of the expiring certificates from the remote server 20, and the mobile device 22 may then download each of the renewed certificates to the corresponding one of the plurality of controllers of the BMS, optionally in response to a single click on a user interface of the mobile device.
sending, over the network to a second device operational certificates that are acceptable as valid, the one or more specific device operational certificates including the first device operating certificate
receipt of the list allowing the second device to authenticate the first device operational certificateto establish the secure connection between the first device and other devices in the BMS (para 39, 29, 30); and delivering, over the network and upon establishing the secure connection between the first device and other devices in the BMS, a replacement first device operational certificateto the first device to replace the first device operational certificate(para 39, 29, 30)
[0039] The screen 100 can be seen as including a Download Controller Certificates button 106, a Download Client Certificates button 108, a BACnet port button 110 and a Cancel button 112. It will be appreciated that the Download Controller Certificates button 106 may be used to initiate a download of the controller certificates from the remote server 20 so that the mobile device 22 can subsequently download the controller certificates to each of the controllers 14 of the BMS 12. Similarly, the Download Client Certificates button 108 may be used to initiate a download of the client certificates from the remote server 20 so that the mobile device 22 can subsequently download the client certificates to each of the clients 16 of BMS 12. The BACnet port button 110 may be used to set the BACnet port number for each controller
[0041] a building management system, other systems such as industrial process control systems and/or any other suitable system that uses security certificates.
PNG
media_image2.png
504
578
media_image2.png
Greyscale
PNG
media_image3.png
518
466
media_image3.png
Greyscale
In addition, Poluri also discloses a user interface of the client management device for sending information to other devices /server / the controllers for the controlled devices, para 35, which is similar to the claimed instruction that is sent.
Poluri specifically teaches, device certificate for each of the plurality of devices of the BMS
[0012] FIG. 5 providing device certificates to a plurality of devices of a building management system; [0026] Certificates are used by the controllers 14 and the clients 16 for providing secure communication between individual components of the BMS 12, such as communication between two or more different controllers 14, or between a controller 14 and a client 16, or between two or more different clients 16. [0042] Having thus described several illustrative embodiments of the present disclosure, those of skill in the art will readily appreciate that yet other embodiments may be made and used within the scope of the claims hereto attached. It will be understood, however, that this disclosure is, in many respects, only illustrative. Changes may be made in details, particularly in matters of shape, size, arrangement of parts, and exclusion and order of steps, without exceeding the scope of the disclosure. [0004] In another example, a plurality of client certificates for a plurality of client devices within a Building Management System (BMS) may be provided using an application executing on a certificate management device. The certificate management device may include a user interface and may be in communication with a remote server. One or more of the clients 16 may, for example, be involved in providing instructions to one or more of the controllers 14. These are just examples, as it will be appreciated that there are a number of different ways in which the controllers 14 and the clients 16 may be interconnected within the BMS 12. It is contemplated that the phrase “client device” may refer to the controllers 14 and/or other client devices (e.g. clients 16) within a building management system.
Poluri, do not specifically mention about, which is well-known in the art, which Shin discloses,
establishing communication after replacing of the certificate (
This procedure is also necessary when the device wants to reconnect when the credential is lost due to certificate expiration, 3rd last para, page 2.
The controller 500 may include at least one processor 520 , a memory 540 , and a storage device 560 , and controls the overall operation of the CS 102 . In particular, the controller 500 performs a process in charge of the CS 102 during the operation, 1st para, page 12
In general, the methods are preferably performed by some hardware device.
The device includes a processor and a memory for storing program instructions executed by the processor, when the program instructions are executed by the processor: Storing at least some information in the memory to store the information A command for performing an operation of configuring , connecting to the CSMS by establishing a secure channel between the CSMS for maintaining registration information for the device, and registering the device with the CSMS, abstract
The information may include connection information for the CSMS in charge of the device, credential information for establishing a secure channel with the CSMS, and registration information of the device, 3rd last para, page 9
those skilled in the art can variously modify and change the present invention without departing from the spirit and scope of the present invention.
The connection information may include at least one of an IP address and a port number of the CSMS and information necessary to communicate with the CSMS by a predetermined communication protocol, 3rd para, page 3
a remote configuration mode in which the information is stored in the device through a predetermined communication network from a server located at a remote location, claim 16
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing reconnecting / reestablishing communication. After the connection providing secure channel is dropped the server would no longer be able to send information to the controller. Hence, the reconnecting / reestablishing communication between the devices would reenable the server to send information to the controller. The information received by the controller for configuration would enable controller to carry out command operations.
Poluri, and Shin do not specifically mention about, which Magnus discloses, expired device operational certificate, the first device operational certificatehas expired, indicate that the certificate has expired and accept the expired certificate as valid, receipt allowing the second device to authenticate the expired certificate for communication between the first device and other devices (
As shown in FIG. 1 , environment 100 includes UE device 110 (or “UE 110”), any one of which may be described in the singular in FIG. 1 , “UE 140”). , a network 120 and a controller 130 , 3rd para, page 4
If the message is authenticated by the controller 130 , the controller identifies the state of the UE 140 as being in a rescue state. The controller 130 tracks the expiration status of the TLS certificates for the various UEs served by the controller 130, so the controller 130 expects a rescue request from a specific UE based on whether the UE's certificate has expired or not. You can recognize whether it is reasonable to do so. If so, the controller 130 may prompt the administrator to verify whether the administrator wishes to issue a new TLS certificate to the UE 140, last para, page 8
reauthorize an already expired certificate by modifying the key from the expired certificate. The second private/public key pair is not used until the certificate has already expired (eg in a rescue situation). Thus, when the UE recognizes that the certificate has expired, the UE signs a rescue request message using the private key of the expired certificate, and sends this request to the controller (or other " device with "rescue address"). When a request is made by the UE, the controller verifies the request through the application of this public key held by the controller despite the fact that the certificate associated with the UE's public key has already expired, last para, page 3
If attempted, the officer can simply re-establish the secure connection by sending a certificate request message signed with the UE's private key on the expired TLS certificate, 2nd para, page 5
The controller 130 maintains public keys for the various UEs with currently active TLS certificates, as well as other private keys for the various UEs that will be used to re-authorize the certificates in a rescue situation where the TLS certificates of the UEs have already expired.. In addition, the controller 130 verifies the certificate provisioning request message with the controller's paired public key of the expired certificate for the terminal 140, and then the UE 140 stores it in memory for ultimate use in a rescue situation, 3rd para page 5
UE 110 optionally includes a display such as an LCD screen or an LED screen. Further, the display is configured to indicate an expiration status of a Transport Layer Security (TLS) certificate. As discussed with respect to FIG. 2 , UE 110 includes an interface (eg, 2140 ), which interface may be physically, or such as Bluetooth or near-field connection (NFC). Through a paired wireless connection, it allows the UE 110 to connect to external computer resources that facilitates communication exchanges with the controller 130, 2nd last para, page 5
The controller 130 tracks the expiration status of the TLS certificates for the various UEs served by the controller 130, so the controller 130 expects a rescue request from a specific UE based on whether the UE's certificate has expired or not, last para, page 8
If so, the controller 130 may prompt the administrator to verify whether the administrator wishes to issue a new TLS certificate to the UE 140 . Alternatively, the metadata tag from the image file provided by the UE 140 in the request message (or associated message) is checked so that the date/time of this file can be verified so that the original TLS certificate for this UE 140 is still there. An automated process can be performed to see if it matches the date/time when it was valid. If so, the controller 130 can reasonably conclude that the rescue request from the UE 140 signed by the key from the TLS expired from the UE 140 is a valid request, last para, page 8
Since the controller 130 has the public key of the expired certificate, it can use it to verify the signature of the request message and determine whether the request message is valid.1st para, page 10).
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing ignoring that the certificate has expired. After the connection providing channel is dropped the server would no longer be able to send information to the controller. Hence, until the new certificate is available, allowing communication even when the certificate is expired would reenable the server to continue sending information to the controller/device. The information received by the controller/device for configuration would enable controller to carry out command operations even when the new certificate is not available.
Poluri, Magnus and Shin do not specifically mention about valid even if expired / to use expired certificate for sometime until new certificate is available. And official notice is taken than such concept is well-known and excepted in the art. Until the new certificate is available, informing to use the expired certificate is not novel, rather had been used by many prior to the effective filling date of this application.
LEPESKA et al., CN 108476201 A in the frame 950, indicating the service 140 can process the expired certificate. For example, a cache entry may be associated based on maturity dates in the certificate and the certificate has expired. The service 140 can contact remote computing device to obtain a new certificate. For example, information of a computing device providing certificate expired certificate may include identification. Prompting service 140 can extract this information and attempt to establish secure communications with the computing device. 1st para, page 16.
TANIMOTO et al., JP 2006222535 A, It is possible to make a reservation for transmission until the expired certificate is updated, so that the message can be transmitted using the expired certificate, 1st para, page 6
Ponnuswamy et al., 20200235907
[0020] After establiShing the initial trust, the initial shared secret may be used later for re-establiShing the trust whenever the VCM's certificate expires
Koster et al, 20170104748 [0053] “Soft Expiration”—also referred to as a Soft Expiration Date, is an adjustable/resettable date of expiration for accepting the certificate. This date is intended to be different from the true expiration date that is encoded or embedded into the Certificate when provided. In varying embodiments the Certificate may be accepted on/through the Soft Expiration Date, or up to the Soft Expiration Date.
[0059] managing network access based on a Certificate with a Soft Expiration. In general a User is provided with a Certificate that he or she will use for access to a secured network access to one or more systems and sources. When a User holding such a Certificate makes a request for network access, the Authentication System receives the Certificate and rather than the traditional approach of determining validity based on the Certificate's expiration date, the Soft Expiration is evaluated. More specifically, the Certificate may be established with a very long life span such that it is very likely that the Certificate is technically valid, however the decision to accept the certificate as valid is not based on the actual expiration date but the Soft Expiration associated therewith. And, as will be discussed below, the Soft Expiration can be reset, thereby permitting continued use of the Certificate and managed network access for the User.
PHILIPS et al., GB 2530040 A
Furthermore, all certificates may be provided with an expiration duration, such that, for example, if a certificate received from a device has expired, the device can verify with the database server as to whether an updated device certificate is available. In such a scenario, the device is operable to control (e.g. allow) communication between the device and the service until the expiration issue is addressed, 4th para, page 10
Leblang et al., 11240043 (83) The device certificate 120 that may need renewal may still be used for the purposes of communications with the IoT device 106, until the new device certificate is issued, col., 16, lines 22-28.
HOU et al, CN 105723374 B
The user equipment can be configured to continue allowing a previous certificate is used, or can be arranged to prevent any certificate is input, until the new password on the user apparatus is determined to have "active" life, 7th para, page 5.
Therefore, it would have been obvious to one of ordinary skill in the art at the time of the effective filing date of the claimed invention to modify the invention disclosed by Poluri to implement these limitations and also one of ordinary skill in the art would have been motivated to do so because it could provide utilizing use of expired certificate for sometime until new certificate is available. After the connection providing secure channel is dropped the server would no longer be able to send information to the controller. Hence, until the new certificate is available, allowing communication even when the certificate is expired would reenable the server to continue sending information to the controller/device. The information received by the controller/device for configuration would enable controller to carry out command operations even when the new certificate is not available.
Conclusion
The Claim Rejections - 35 USC § 112, which were also maintained in the Pre-appeal conference is further maintained in this office action. Since, the specification does not implement the rejected limitations, mere repetition of arguments would not overcome the rejections.
Whether BMS or not the certificates are handled in a same manner for the devices.
As per the cited prior arts the concept of using the expired certificate until new certificate is available is well-known in the art.
Suppose other devices are not informed that the “expired” certificate should be used (using well-known GUI, etc). Then the involved other devices would not be able to allow using of the expired certificate. The numerous cited arts allow using the certificate beyond “expired date” among all the involved devices, until the new certificate is available.
How another device that is not a slave (rather a server, etc.), which function on its own, can be caused to function as a slave and take instructions. Sending a message with information is not same as causing the slave to perform an action.
What is well-known Building Management System?
Hardware:
Includes workstations, servers, and networking components that collect data and execute functions.
Software:
It runs logic functions, and provides the interface for facility managers to control the system.
Centralized Control:
Allows facility managers to monitor and control systems from a single workstation or mobile device.
Remote Access:
Facility managers can access and control systems remotely, allowing for quick responses to alerts and operational adjustments
LEPESKA et al., CN 108476201 A in the frame 950, indicating the service 140 can process the expired certificate. For example, a cache entry may be associated based on maturity dates in the certificate and the certificate has expired. The service 140 can contact remote computing device to obtain a new certificate. For example, information of a computing device providing certificate expired certificate may include identification. Prompting service 140 can extract this information and attempt to establish secure communications with the computing device.
TANIMOTO et al., JP 2006222535 A As described above, according to the communication apparatus 10 of the present embodiment, it is possible to make a reservation for transmission until the expired certificate is updated, so that the message can be transmitted using the expired certificate.
Ponnuswamy et al., 20200235907
[0020] After establiShing the initial trust, the initial shared secret may be used later for re-establiShing the trust whenever the VCM's certificate expires
Koster et al, 20170104748 [0053] “Soft Expiration”—also referred to as a Soft Expiration Date, is an adjustable/resettable date of expiration for accepting the certificate. This date is intended to be different from the true expiration date that is encoded or embedded into the Certificate when provided. In varying embodiments the Certificate may be accepted on/through the Soft Expiration Date, or up to the Soft Expiration Date.
[0059] managing network access based on a Certificate with a Soft Expiration. In general a User is provided with a Certificate that he or she will use for access to a secured network access to one or more systems and sources. When a User holding such a Certificate makes a request for network access, the Authentication System receives the Certificate and rather than the traditional approach of determining validity based on the Certificate's expiration date, the Soft Expiration is evaluated. More specifically, the Certificate may be established with a very long life span such that it is very likely that the Certificate is technically valid, however the decision to accept the certificate as valid is not based on the actual expiration date but the Soft Expiration associated therewith. And, as will be discussed below, the Soft Expiration can be reset, thereby permitting continued use of the Certificate and managed network access for the User.
PHILIPS et al., GB 2530040 A
Furthermore, all certificates may be provided with an expiration duration, such that, for example, if a certificate received from a device has expired, the device can verify with the database server as to whether an updated device certificate is available. In such a scenario, the device is operable to control (e.g. allow) communication between the device and the service until the expiration issue is addressed.
Leblang et al., 11240043 (83) The device certificate 120 that may need renewal may still be used for the purposes of communications with the IoT device 106, until the new device certificate is issued.
HOU et al, CN 105723374 B
The user equipment can be configured to continue allowing a previous certificate is used, or can be arranged to prevent any certificate is input, until the new password on the user apparatus is determined to have "active" life.
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to HARESH PATEL whose telephone number is (571)272-3973. The examiner can normally be reached on M-F 9-5:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jorge L. Ortiz-Criado, can be reached at (571) 272-7624. The fax phone number for the organization where this application or proceeding is assigned is (571) 273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/HARESH N PATEL/Primary Examiner, Art Unit 2496
Prosecution Insights