Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
1. This action is in response to application amendments filed on 5-12-2026.
2. Claims 6 - 17 are pending. Claims 6 - 17 have been amended. Claim 6 is independent. This application was filed on 11-25-2022.
Response to Arguments
3. Applicant's arguments have been fully considered, however upon further consideration of the prior art and the claimed limitation, they were not persuasive.
A. The 101 Rejection for Claims 6 - 17 is withdrawn due to claim amendments.
B. Applicant argues on page 9 of Remarks: ... integrating an input module on the IC card itself, allowing the user to input a first password directly on the IC card, ... .
The Examiner respectfully disagrees. The claim language states: “the IC card is provided with an input module for inputting a first password; when the first password is inputted to the input module”. There is no indication of integrating an input module of an IC card in the claimed invention. There is no indication of a built-in capability in the claim invention. Kim discloses the electronic device includes an ICC card and an input unit. (Kim paragraph [0199]: the electronic device is capable of including a processor (e.g., an AP) 1200, a Universal IC Card (UICC) 1202, a memory 1204, an input unit 1206,)
Kim discloses the capability to input a password and to make it available (provided) to an IC card. (see Kim paragraph [0199]: the electronic device is capable of including a processor (e.g., an AP) 1200, a Universal IC Card (UICC) 1202, a memory 1204, an input unit 1206, a display module 1208, a baseband module 1214, an RF module 1216, a first communication module 1210, and a second communication module 1212.; paragraph [0294]: Examples of the user inputs are card information required for payment, and added verification information other than the card information, (e.g., a PIN, a user's unique pattern-related data, fingerprint recognition-related data, a wearable device bezel, a touch value input to the display 160, etc.).; paragraph [0262]: The payment management module 1831 is capable of receiving information related to card information (e.g., password, home address, email address, phone number, account ID, etc.) from the user or a payment server 720), the cloud end processes a transaction message forwarded by the payment terminal and complete the fund transaction; paragraph [0088]: the devices may employ cloud computing, distribution computing or client-server computing technology; paragraph [0143]: the payment application 612 is capable of performing a payment transaction, using the payment application 612. For example, the payment application 612 may provide the user with a payment function by executing a preset application, Simple Pay or Quick Pay. The user runs the payment application 612 to make a payment function and is provided with information related to the payment function. (password, credential type information); (integrated circuit (hardware) card))
C. Applicant argues on page 9 of Remarks: ... digitally signing the first password using a first private key by the crypto-key unit inside the IC card, then sending both the first password and the signature to the cloud end, ... .
The Examiner respectfully disagrees. Kim discloses an IC card as stated above. Mones discloses the utilization of credentials such as a password and the generation of a digital signature from the credential (i.e. password) information. (see Mones paragraph [0094]: The system may authenticate with the data source by providing proof of possession of credentials to the data source. For example, the system may supply, as proof of possession of credentials corresponding to the system, information sufficient to prove access to the credentials, such as a password, a cryptographic hash/digest of the password, cryptographic digital signature generated by a signing encryption key, or other secret key verifiable by the data source for authorizing the identity of the system.; paragraph [0028]: cloud-based data storage (such as Amazon Web Services or Google Cloud) holographic data storage, and other like storage media.; (storing credentials, passwords))
D. Applicant argues on page 9 of Remarks: ... which first verifies the authenticity of the digital signature and then verifies the correctness of the password ... .
The Examiner respectfully disagrees. Seita discloses a determination of the correctness of an input password via comparison to a baseline password. (see Seita paragraph [0011]: there is provided a portable terminal apparatus having a contactless IC card function provided with a storage unit that stores and registers a password required when utilizing the contactless IC card function; a reception unit that receives inputting operation of a password from a user before utilizing the IC card function; a comparison unit that compares the registered password with the inputted password; and a control unit in which the IC card function is made available or enabled for use when the inputted password matches the registered password and is unavailable or disabled for use under other conditions.)
And, Mones discloses the utilization of credentials such as a password and the generation of a digital signature from the credential (i.e. password) information. (see Mones paragraph [0094]: The system may authenticate with the data source by providing proof of possession of credentials to the data source. For example, the system may supply, as proof of possession of credentials corresponding to the system, information sufficient to prove access to the credentials, such as a password, a cryptographic hash/digest of the password, cryptographic digital signature generated by a signing encryption key, or other secret key verifiable by the data source for authorizing the identity of the system.; paragraph [0028]: cloud-based data storage (such as Amazon Web Services or Google Cloud) holographic data storage, and other like storage media. ; (storing credentials, passwords))
E. Applicant argues on page 10 of Remarks: ... would not have been motivated to combine the above prior art references to arrive at the technical solution of the present invention ... .
The Examiner respectfully disagrees. A 103 rejection based on multiple references is a legitimate technique according to the MPEP. The 103 rejection allows portions of the rejection citations for a claimed invention to come from different prior art references. The rejection to each independent and dependent claim includes a citation from the referenced prior art that discloses the basis for the rejection. Each obviousness combination clearly indicates the claim limitation(s) the combined referenced prior art teaches. In addition, a cited passage from the referenced prior art indicates the motivation for the obviousness combination. Each obviousness combination’s disclosure is equivalent to the Applicant’s claim limitation(s) for the claimed invention. Achieved advantage is a valid motivation for the combination of referenced prior art. The rejection of each referenced prior art combination states a motivation for the combination, which translates to an achieved advantage for the combination.
F. Applicant argues on page 10 of Remarks: ... None of the prior art teaches or suggests that a password input module can be integrated into the IC card itself.
The Examiner respectfully disagrees. The claim language states: “the IC card is provided with an input module for inputting a first password; when the first password is inputted to the input module”. There is no indication of a built-in capability in the claim invention. Kim discloses the electronic device includes an IC card and an input unit. (Kim paragraph [0199]: the electronic device is capable of including a processor (e.g., an AP) 1200, a Universal IC Card (UICC) 1202, a memory 1204, an input unit 1206,)
Kim discloses the capability to input a password to make if available to an ICC card. (see Kim paragraph [0199]: the electronic device is capable of including a processor (e.g., an AP) 1200, a Universal IC Card (UICC) 1202, a memory 1204, an input unit 1206, a display module 1208, a baseband module 1214, an RF module 1216, a first communication module 1210, and a second communication module 1212.; paragraph [0294]: Examples of the user inputs are card information required for payment, and added verification information other than the card information, (e.g., a PIN, a user's unique pattern-related data, fingerprint recognition-related data, a wearable device bezel, a touch value input to the display 160, etc.).;
G. Applicant argues on page 11 of Remarks: ... Kim does not disclose a built-in input module on the IC card, and neither Mones nor Seita disclose this feature ... .
The Examiner respectfully disagrees. The claim language states: “the IC card is provided with an input module for inputting a first password; when the first password is inputted to the input module”. There is no indication of a built-in capability for input with an IC card in the claim invention. There is no indication of an integrated input module in the claim invention. Kim discloses the electronic device includes an IC card and an input unit. (Kim paragraph [0199]: the electronic device is capable of including a processor (e.g., an AP) 1200, a Universal IC Card (UICC) 1202, a memory 1204, an input unit 1206,)
Kim discloses the capability to input a password and to make it available to an IC card. (see Kim paragraph [0199]: the electronic device is capable of including a processor (e.g., an AP) 1200, a Universal IC Card (UICC) 1202, a memory 1204, an input unit 1206, a display module 1208, a baseband module 1214, an RF module 1216, a first communication module 1210, and a second communication module 1212.; paragraph [0294]: Examples of the user inputs are card information required for payment, and added verification information other than the card information, (e.g., a PIN, a user's unique pattern-related data, fingerprint recognition-related data, a wearable device bezel, a touch value input to the display 160, etc.).)
F. Applicant argues on page 11 of Remarks: ... Claims 7-17: These dependent claims all depend on claim 6. Since claim 6 is non-obvious over the prior art, these dependent claims are also non-obvious.
Responses to arguments against the independent claims also answer arguments against the associated dependent claims.
Note: Examiner suggests amending the claim to capture the inventive concept by reciting the structural/ functional limitation of the IC card the external elements (cloud and payment terminal) do not add meaningful structure to the IC card.
Claim Objections
Claim 6 is objected to because of the following informalities: the limitation “IC card asymmetric labelling system” is not commonly recognized technical phrase not clear if it intends asymmetric cryptography, asymmetric key labeling or something else. The limitation “cloud end” needs further clarification not clear if it intends to cover cloud server or just remote cloud system. The limitation “password inputtable IC card” needs clarity as the term “inputtable” referring to an input mechanism or interface. The term “the crypto-unit” in line 5 lacks antecedent basis. Appropriate correction is required.
Claim Interpretation
This application includes one or more claim limitations that do not use the word “means,” but are nonetheless being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because the claim limitation(s) uses a generic placeholder that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. Such claim limitation(s) is/are: “input module” and “crypto-key unit” in claim 6.
Because this/these claim limitation(s) is/are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, it/they is/are being interpreted to cover the corresponding structure described in the specification as performing the claimed function, and equivalents thereof.
If applicant does not intend to have this/these limitation(s) interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, applicant may: (1) amend the claim limitation(s) to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph (e.g., by reciting sufficient structure to perform the claimed function); or (2) present a sufficient showing that the claim limitation(s) recite(s) sufficient structure to perform the claimed function so as to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph.
Claim Rejections - 35 USC § 103
4. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
5. Claims 6, 7, 12 - 17 are rejected under 35 U.S.C. 103 as being unpatentable over Kim et al. (US PGPUB No. 20170068953) in view of Mones et al. (US PGPUB No. 20170154314) and further in view of Seita et al. (US PGPUB No. 20030006280).
Regarding Claim 6, Kim discloses a password-inputtable IC card in an IC card asymmetric labelling system, wherein
the IC card is provided with an input module for inputting a first password; when the first password is inputted to the input module, (see Kim paragraph [0199]: the electronic device is capable of including a processor (e.g., an AP) 1200, a Universal IC Card (UICC) 1202, a memory 1204, an input unit 1206, a display module 1208, a baseband module 1214, an RF module 1216, a first communication module 1210, and a second communication module 1212.; paragraph [0294]: Examples of the user inputs are card information required for payment, and added verification information other than the card information, (e.g., a PIN, a user's unique pattern-related data, fingerprint recognition-related data, a wearable device bezel, a touch value input to the display 160, etc.).; paragraph [0262]: The payment management module 1831 is capable of receiving information related to card information (e.g., password, home address, email address, phone number, account ID, etc.) from the user or a payment server 720), the cloud end processes a transaction message forwarded by the payment terminal and complete the fund transaction; (see paragraph [0088]: the devices may employ cloud computing, distribution computing or client-server computing technology; paragraph [0143]: the payment application 612 is capable of performing a payment transaction, using the payment application 612. For example, the payment application 612 may provide the user with a payment function by executing a preset application, Simple Pay or Quick Pay. The user runs the payment application 612 to make a payment function and is provided with information related to the payment function.; (integrated circuit (hardware) card))
Kim does not specifically disclose digital signature of the first password is calculated and the cloud end first authenticates the digital signature by the first public key.
However, Mones discloses wherein a digital signature of the first password is calculated by the crypto-key unit with the first private key, then both the first password and the signature of the first password are sent to the cloud end; the cloud end first authenticates the digital signature by the first public key, if both signature authentication and password authentication are passed, and if at least one of the signature authentication and the password authentication is failed, the cloud end terminates the transaction process. (see Mones paragraph [0094]: The system may authenticate with the data source by providing proof of possession of credentials to the data source. For example, the system may supply, as proof of possession of credentials corresponding to the system, information sufficient to prove access to the credentials, such as a password, a cryptographic hash/digest of the password, cryptographic digital signature generated by a signing encryption key, or other secret key verifiable by the data source for authorizing the identity of the system.)
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify Kim for digital signature of the first password is calculated and the cloud end first authenticates the digital signature by the first public key as taught by Mones. One of ordinary skill in the art would have been motivated to employ the teachings of Mones for the flexibility of a system that enables utilization of multiple types of authentications such as signatures and hashes. (see Mones paragraph [0094])
Kim does not disclose compares the first password with a third password stored in the cloud end and then compares the first password with a third password stored.
However, Seita discloses wherein compares the first password with a third password stored in the cloud end and then compares the first password with a third password stored, and wherein if at least one of the signature authentication and the password authentication is failed, the cloud end terminates the transaction process. (see Seita paragraph [0011]: there is provided a portable terminal apparatus having a contactless IC card function provided with a storage unit that stores and registers a password required when utilizing the contactless IC card function; a reception unit that receives inputting operation of a password from a user before utilizing the IC card function; a comparison unit that compares the registered password with the inputted password; and a control unit in which the IC card function is made available or enabled for use when the inputted password matches the registered password and is unavailable or disabled for use under other conditions.)
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify Kim for compares the first password with a third password stored in the cloud end and then compares the first password with a third password stored as taught by Seita. One of ordinary skill in the art would have been motivated to employ the teachings of Seita for the additional security of a system that enables input security information to match baseline security information for authentication. (see Seita paragraph [0011])
Regarding Claim 7, Kim-Mones-Seita discloses the password-inputtable IC card according to claim 6.
Kim does not specifically disclose if a second password inputted to the APP matches with a fourth password stored in the cloud end (password matching for authentication).
However, Seita discloses wherein further comprising an APP connecting with the cloud end through a mobile terminal; the APP is operable if a second password inputted to the APP matches with a fourth password stored in the cloud end or if the APP is in a password initialization mode or a password resetting mode. (see Seita paragraph [0011]: there is provided a portable terminal apparatus having a contactless IC card function provided with a storage unit that stores and registers a password required when utilizing the contactless IC card function; a reception unit that receives inputting operation of a password from a user before utilizing the IC card function; a comparison unit that compares the registered password with the inputted password; and a control unit in which the IC card function is made available or enabled for use when the inputted password matches the registered password and is unavailable or disabled for use under other conditions.)
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify Kim for if a second password inputted to the APP matches with a fourth password stored in the cloud end as taught by Seita. One of ordinary skill in the art would have been motivated to employ the teachings of Seita for the additional security of a system that enables input security information to match baseline security information for authentication. (see Seita paragraph [0011])
Regarding Claim 12, Kim-Mones-Seita discloses the password-inputtable IC card according to claim 6, wherein the input module comprises N touch pads or keys formed as an array, or a touch screen on a surface of the IC card, where N is a natural number greater than or equal to 4, a sequence of touching or pressing these points is used as the first password; the signature of the recorded sequence by the first private key is the signature of the first password. (see Kim paragraph [0101]: The input unit 250 is capable of including a touch panel 252, a digital stylus or (digital) pen sensor 254, a key 256, or an ultrasonic input module 258. The touch panel 252 may be implemented with at least one of a capacitive touch system, a resistive touch system, an infrared touch system, and an ultrasonic touch system. The touch panel 252 may further include a control circuit. The touch panel 252 may also further include a tactile layer to provide a tactile response to the user.; paragraph [0159]: a user may directly input card information (input a password) to his/her electronic device, using an input unit of the electronic device, e.g., a touch panel, a pen sensor, keys, an ultrasonic input system, a microphone, etc.; (touch panel utilized to input data such as a password))
Regarding Claim 13, Kim-Mones-Seita discloses the password-inputtable IC card according to claim 6, wherein N is equal to 9, a nine-square grid is formed on the surface of the IC card, to form a pattern locker be inputted to a device, with the pattern locker as the first password. (see Kim paragraph [0101]: The input unit 250 is capable of including a touch panel 252, a digital stylus or (digital) pen sensor 254, a key 256, or an ultrasonic input module 258. The touch panel 252 may be implemented with at least one of a capacitive touch system, a resistive touch system, an infrared touch system, and an ultrasonic touch system. The touch panel 252 may further include a control circuit. The touch panel 252 may also further include a tactile layer to provide a tactile response to the user.; paragraph [0159]: a user may directly input card information (input a password) to his/her electronic device, using an input unit of the electronic device, e.g., a touch panel, a pen sensor, keys, an ultrasonic input system, a microphone, etc.; (touch panel utilized to input data such as a password))
Regarding Claim 14, Kim-Mones-Seita discloses the password-inputtable IC card according to claim 6, wherein the IC card is further provided with a battery for supplying power to the crypto-key unit, the input module and the communication module. (see Kim paragraph [0107]: The power management module 295 is capable of managing the power of the electronic device 201. According to an embodiment, the power management module 295 is capable of including a power management integrated circuit (PMIC), a charger integrated circuit (IC), or a battery or fuel gauge.; The battery gauge is capable of measuring the residual capacity, voltage, current, or temperature of the battery 296, during the charging. The battery 296 may include a rechargeable battery or a solar battery.; (battery utilized to supply power))
Regarding Claim 15, Kim-Mones-Seita discloses the password-inputtable IC card according to claim 6, wherein the IC card is further provided with a solar charging panel or a solar charging film for charging the battery. (see Kim paragraph [0107]: The power management module 295 is capable of managing the power of the electronic device 201. According to an embodiment, the power management module 295 is capable of including a power management integrated circuit (PMIC), a charger integrated circuit (IC), or a battery or fuel gauge.; The battery gauge is capable of measuring the residual capacity, voltage, current, or temperature of the battery 296, during the charging. The battery 296 may include a rechargeable battery or a solar battery.; (battery utilized to supply power, solar powered battery))
Regarding Claim 16, Kim-Mones-Seita discloses the password-inputtable IC card according to claim 7.
Kim does not specifically disclose password stored in the cloud end is replaced by the one-way hash value of the third password, during a process of password update and the signature of the first password by the first private key is replaced by the signature of the hash value of the first password (update security information to utilize hash and signature based security information).
However, Mones discloses wherein the third password stored in the cloud end is replaced by the one-way hash value of the third password, during a process of password update, the IC card calculates the one-way hash value of the first password, which is sent it to the cloud end and to replace the historic third password hash value; during a transaction, the first password inputted on the IC card is sent to the cloud end, is made a hash-comparison against the hash value of the third password, and the signature of the first password by the first private key is replaced by the signature of the hash value of the first password by the first private key. (see Mones paragraph [0094]: The system may authenticate with the data source by providing proof of possession of credentials to the data source. For example, the system may supply, as proof of possession of credentials corresponding to the system, information sufficient to prove access to the credentials, such as a password, a cryptographic hash/digest of the password, cryptographic digital signature generated by a signing encryption key, or other secret key verifiable by the data source for authorizing the identity of the system.; (hash parameters and signature parameters utilized for authentication))
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify Kim for password stored in the cloud end is replaced by the one-way hash value of the third password, during a process of password update and the signature of the first password by the first private key is replaced by the signature of the hash value of the first password as taught by Mones. One of ordinary skill in the art would have been motivated to employ the teachings of Mones for the flexibility of a system that enables utilization of multiple types of authentications such as signatures and hashes. (see Mones paragraph [0094])
Regarding Claim 17, Kim-Mones-Seita discloses the password-inputtable IC card according to claim 7.
Kim does not specifically disclose during the process of password update, the APP on the mobile terminal calculates the one-way hash value of the second password, which is sent to the cloud end and to replace the historic third password hash value (update security information to utilize hash and signature based security information).
However, Mones discloses wherein the fourth password stored in the cloud end is replaced by the one-way hash value of the fourth password; during the process of password update, the APP on the mobile terminal calculates the one-way hash value of the second password, which is sent to the cloud end and to replace the historic third password hash value; to start the APP, the second password inputted on the APP of the mobile terminal is sent to the cloud end, and is made a hash-comparison against the hash value of the fourth password. (see Mones paragraph [0094]: The system may authenticate with the data source by providing proof of possession of credentials to the data source. For example, the system may supply, as proof of possession of credentials corresponding to the system, information sufficient to prove access to the credentials, such as a password, a cryptographic hash/digest of the password, cryptographic digital signature generated by a signing encryption key, or other secret key verifiable by the data source for authorizing the identity of the system.; (hash parameters and signature parameters utilized for authentication))
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify Kim for password stored in the cloud end is replaced by the one-way hash value of the third password, during a process of password update and the signature of the first password by the first private key is replaced by the signature of the hash value of the first password as taught by Mones. One of ordinary skill in the art would have been motivated to employ the teachings of Mones for the flexibility of a system that enables utilization of multiple types of authentications such as signatures and hashes. (see Mones paragraph [0094])
6. Claims 8 - 10 are rejected under 35 U.S.C. 103 as being unpatentable over Kim in view of Mones and further in view of Seita and Childress et al. (US PGPUB No. 20170180129).
Regarding Claim 8, Kim-Mones-Seita discloses the password-inputtable IC card according to claim 7, wherein the APP of the mobile terminal, with support of the cloud end, performs the password initialization mode in following ways:
i) establishing a communication connection between the IC card and the mobile terminal; (see Kim paragraph [0084]: The communication interface 170 is capable of establishing a communication channel between the electronic device 101 and an external device (e.g., a first external device 102, a second electronic device 104, or a server 106). For example, the communication interface 170 is capable of communicating with an external device (e.g., a second external device 104 or a server 106) connected to the network 162 via wired or wireless communication.)
iii) entering following authentication information:
a) a mobile phone number and/or an email address; b) a background information quiz; (see Kim paragraph [0263]: the payment management module 1831 is capable of displaying a registered card on the display 160. The user may alter part of the information regarding the registered card (e.g., card name, home address, phone number, the number of payment attempts, a setting of a condition as to whether to receive payment notification information, etc.). The payment management module 1831 is capable of displaying transaction details of individual cards.; Background information, phone number))
c) a biological authentication feature; (see Kim paragraph [0335]: the biometric module 1825 is capable of storing an electronic device user's biometric information and comparing the stored biometric information with information detected by the biometric sensor to authenticate the user. Examples of the biometric module 1825 are a fingerprint information module, an iris information module, etc. The biometric module 1825 is capable of collecting information via a biometric sensor 2401. When the payment application shows a message requesting to authenticate a user's biometric information on the display 160, the user may input his/her biometric information to the biometric sensor. The authentication module of the payment application enables the biometric management module to transmit a command to collect biometric information to the biometric information driver module 1851.; (selected: biometric information))
Kim does not specifically disclose entering new user information, and determining whether the entered user information is indeed new, (i) in a case that the IC card is not a new card, exiting the password initialization mode and jumping to the password resetting mode, and (i) authenticating whether the IC card is a new card based on the open ID of the IC card in the cloud end.
However, Childress discloses:
ii) entering new user information, and determining whether the entered user information is indeed new through the cloud end; if the entered user information is not new, exiting the password initialization mode. (see Childress paragraph [0042]: The process determines as to whether the comparison at step 530 reveals that the possible new password has already been used before to control another resource (decision 550). If the possible new password has already been used before, then decision 550 branches to the ‘yes’ branch whereupon, at step 560, the process notifies user 300 (e.g., with an alert, warning, etc.) that this password has already been used before and the process recommends that the user uses a different password that has not yet been used.; paragraph [0043]: if the possible new password has not been used before, then decision 550 branches to the ‘no’ branch bypassing step 560. At step 570, the process stores the computed hash of the possible new password in data store 375 which is a hash table of previously used passwords by the user.)
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify Kim for entering new user information, and determining whether the entered user information is indeed new, (i) in a case that the IC card is not a new card, exiting the password initialization mode and jumping to the password resetting mode, and (i) authenticating whether the IC card is a new card based on the open ID of the IC card in the cloud end as taught by Childress. One of ordinary skill in the art would have been motivated to employ the teachings of Childress for the enhanced security of a system the enables a determination that a password has been used previously. (see Childress paragraph [0042]; paragraph [0043])
Kim does not specifically disclose the first password is transmitted to the cloud end by the APP, and is stored in the cloud end as the third password, and the second password is sent to the cloud end by the APP and is stored in the cloud end as the fourth password.
However, Seita discloses:
iv) under a system prompter, entering the first password into the APP, re-entering the same first password on the IC card; this process is repeated if necessary until the entries on the two devices are identical; then, the first password is transmitted to the cloud end by the APP, and is stored in the cloud end as the third password; (see Seita paragraph [0011]: there is provided a portable terminal apparatus having a contactless IC card function provided with a storage unit that stores and registers a password required when utilizing the contactless IC card function;) and
v) under a system prompter, entering the same second password twice on the APP of the mobile terminal; the second password is for running the APP; then, the second password is sent to the cloud end by the APP and is stored in the cloud end as the fourth password. (see Seita paragraph [0011]: there is provided a portable terminal apparatus having a contactless IC card function provided with a storage unit that stores and registers a password required when utilizing the contactless IC card function;)
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify Kim for the first password is transmitted to the cloud end by the APP, and is stored in the cloud end as the third password, and the second password is sent to the cloud end by the APP and is stored in the cloud end as the fourth password as taught by Seita. One of ordinary skill in the art would have been motivated to employ the teachings of Seita for the additional security of a system that enables input security information to match baseline security information for authentication. (see Seita paragraph [0011])
Regarding Claim 9, Kim-Mones-Seita-Childress discloses the password-inputtable IC card according to claim 8, wherein the APP of the mobile terminal, with support of the cloud end, performs the password resetting mode on the first password in following ways:
i) establishing a communication connection from the IC card to the mobile terminal, and then to the cloud end; searching for corresponding user information based on the open ID of IC Card, and confirming the user information by the user; (see Kim paragraph [0084]: The communication interface 170 is capable of establishing a communication channel between the electronic device 101 and an external device (e.g., a first external device 102, a second electronic device 104, or a server 106). For example, the communication interface 170 is capable of communicating with an external device (e.g., a second external device 104 or a server 106) connected to the network 162 via wired or wireless communication.)
ii) authenticating at least one of items a), b) and c) defined in step iii), or authenticating at least two of items a), b) and c); (see Kim paragraph [0335]: the biometric module 1825 is capable of storing an electronic device user's biometric information and comparing the stored biometric information with information detected by the biometric sensor to authenticate the user. Examples of the biometric module 1825 are a fingerprint information module, an iris information module, etc. The biometric module 1825 is capable of collecting information via a biometric sensor 2401. When the payment application shows a message requesting to authenticate a user's biometric information on the display 160, the user may input his/her biometric information to the biometric sensor. The authentication module of the payment application enables the biometric management module to transmit a command to collect biometric information to the biometric information driver module 1851.; (selected: biometric information))
Furthermore, Kim discloses entering a new password. (Kim paragraph [0262]: the payment management module 1831 is capable of performing card registration, card authentication, card information deletion, and payment. The payment management module 1831 is capable of registering a user's cards. The electronic device (e.g., electronic device 101) is capable of receiving a card registration request from the user. The electronic device is capable of obtaining an image of a card via the camera module. The payment management module 1831 is capable of obtaining a card image via an OCR module. The payment management module 1831 is capable of receiving information related to card information (e.g., password, home address, email address, phone number, account ID, etc.) from the user or a payment server 720 (shown in FIG. 7).)
Kim does not specifically disclose entering a first password on the APP of the mobile terminal, and repeating the operation until the entries on the two devices are identical, then, sending the first password from the APP to the cloud end and store the first password as the third password (store baseline password).
iii) under a system prompter, entering a new first password on the APP of the mobile terminal, and then entering the same first password on the IC card according to the prompter, and repeating the operation until the entries on the two devices are identical; then, sending the first password from the APP to the cloud end and store the first password as the third password. (see Seita paragraph [0011]: (see Seita paragraph [0011]: there is provided a portable terminal apparatus having a contactless IC card function provided with a storage unit that stores and registers a password required when utilizing the contactless IC card function;)
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify Kim for entering the second password twice, repeating the operation if necessary; and then store the second password as the fourth password in the cloud end (store baseline password) as taught by Seita. One of ordinary skill in the art would have been motivated to employ the teachings of Seita for the additional security of a system that enables input security information to match baseline security information for authentication. (see Seita paragraph [0011])
Regarding Claim 10, Kim-Mones-Seita-Childress discloses the password-inputtable IC card according to claim 8, wherein the APP of the mobile terminal, with support of the cloud end, performs the password resetting mode on the second password in following ways:
i) establishing a communication connection from the IC card to the mobile terminal, and then to the cloud end; searching for corresponding user information based on the open ID of IC Card, and confirming the user information by the user; (see Kim paragraph [0084]: The communication interface 170 is capable of establishing a communication channel between the electronic device 101 and an external device (e.g., a first external device 102, a second electronic device 104, or a server 106). For example, the communication interface 170 is capable of communicating with an external device (e.g., a second external device 104 or a server 106) connected to the network 162 via wired or wireless communication.) and
ii) authenticating at least one of items a), b) and c) defined in step iii), or authenticating at least two of items a), b) and c). (see Kim paragraph [0335]: the biometric module 1825 is capable of storing an electronic device user's biometric information and comparing the stored biometric information with information detected by the biometric sensor to authenticate the user. Examples of the biometric module 1825 are a fingerprint information module, an iris information module, etc. The biometric module 1825 is capable of collecting information via a biometric sensor 2401. When the payment application shows a message requesting to authenticate a user's biometric information on the display 160, the user may input his/her biometric information to the biometric sensor. The authentication module of the payment application enables the biometric management module to transmit a command to collect biometric information to the biometric information driver module 1851.; (selected: biometric information))
Kim does not specifically disclose entering the second password twice, repeating the operation if necessary; and then store the second password as the fourth password in the cloud end (store baseline password).
However, Seita discloses:
iii) under a system prompter, continuously entering the second password twice, repeating the operation if necessary, until the last two entries are identical; then sending the second password to the cloud end, and store the second password as the fourth password in the cloud end. (see Seita paragraph [0011]: (see Seita paragraph [0011]: there is provided a portable terminal apparatus having a contactless IC card function provided with a storage unit that stores and registers a password required when utilizing the contactless IC card function;)
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify Kim for entering the second password twice, repeating the operation if necessary, and then store the second password as the fourth password in the cloud end (store baseline password) as taught by Seita. One of ordinary skill in the art would have been motivated to employ the teachings of Seita for the additional security of a system that enables input security information to match baseline security information for authentication. (see Seita paragraph [0011])
7. Claim 11 is rejected under 35 U.S.C. 103 as being unpatentable over Kim in view of Mones and further in view of Seita and Childress and Jamieson et al. (US PGPUB No. 20040260953).
Regarding Claim 11, Kim-Mones-Seita-Childress discloses password-inputtable IC card according to claim 8.
Kim does not specifically disclose selecting a function of modifying the first password for IC card on the APP and repeat the operation until the enteries on the APP and the IC card are identical.
However, Jamieson disclose wherein the APP of the mobile terminal, with support of the cloud end, has a password modification function; after selecting a function of modifying the first password for IC card on the APP, the system prompts the user to enter an original first password, after the system determines that the original first password is correct, a new first password is entered; then the system prompts the user to input the same first password on the IC card and repeat the operation until the enteries on the APP and the IC card are identical. (see Jamieson paragraph [0007]: If the user changes his password in the first domain, a component in the first domain detects that the password has been changed. This change is then reported to the database, and the appropriate table in the database is changed to reflect that the user's password in the first domain has been changed. After the database has received the change to the user's password, optionally the second domain may be notified of the change, so that the user's password in the second domain may be changed to match the user's password in the first domain.)
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify Kim for selecting a function of modifying the first password for IC card on the APP and repeat the operation until the enteries on the APP and the IC card are identical as taught by Jameison. One of ordinary skill in the art would have been motivated to employ the teachings of Jameison for the flexibility of a system that enables passwords to be synchronized between network-connected nodes. (see Jamieson paragraph [0007])
Kim does not specifically disclose calculates the signature of the new first password by the first private key, finally, the APP send both the new first password and its signature to the cloud end, and the third password is updated after the signature is authenticated in the cloud.
However, Mones discloses then the crypto-key unit of the IC card calculates the signature of the new first password by the first private key, finally, the APP send both the new first password and its signature to the cloud end, and the third password is updated after the signature is authenticated in the cloud. (see Mones paragraph [0094]: The system may authenticate with the data source by providing proof of possession of credentials to the data source. For example, the system may supply, as proof of possession of credentials corresponding to the system, information sufficient to prove access to the credentials, such as a password, a cryptographic hash/digest of the password, cryptographic digital signature generated by a signing encryption key, or other secret key verifiable by the data source for authorizing the identity of the system.)
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify Kim for digital signature of the first password is calculated and the cloud end first authenticates the digital signature by the first public key as taught by Mones. One of ordinary skill in the art would have been motivated to employ the teachings of Mones for the flexibility of a system that enables utilization of multiple types of authentications such as signatures and hashes. (see Mones paragraph [0094])
Kim does not specifically disclose the new second password is sent to the cloud end by the APP, and stored in the cloud as a new fourth password.
However, Seita discloses wherein after selecting a function of modifying the second password of the APP, the system prompts the user to enter an original second password, after the system determines that the original second password is correct, a same new second password is entered twice; repeating the operation, until the last two entries are identical; then, the new second password is sent to the cloud end by the APP, and stored in the cloud as a new fourth password. (see Seita paragraph [0011]: (see Seita paragraph [0011]: there is provided a portable terminal apparatus having a contactless IC card function provided with a storage unit that stores and registers a password required when utilizing the contactless IC card function;)
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify Kim for the new second password is sent to the cloud end by the APP, and stored in the cloud as a new fourth password (store baseline password) as taught by Seita. One of ordinary skill in the art would have been motivated to employ the teachings of Seita for the additional security of a system that enables input security information to match baseline security information for authentication. (see Seita paragraph [0011])
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to CARLTON JOHNSON whose telephone number is (571)270-1032. The examiner can normally be reached Work: 12-9PM (most days).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Shewaye Gelagay can be reached at 571-272-4219. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/CJ/
July 27, 2026
/SHEWAYE GELAGAY/Supervisory Patent Examiner, Art Unit 2436
Prosecution Insights