DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This action is responsive to RCE communication filed on 2/19/2026.
Claims 1-17 are subject to examination.
This amendment and applicant’s arguments have been fully considered and entered by the Examiner.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-6, 8-17 is/are rejected under 35 U.S.C. 103 as being unpatentable over Kale et al. U.S. Patent Publication # 2019/0394192 (hereinafter Kale) in view of Yang et al. U.S. Patent Publication # 2015/0089239 (hereinafter Yang) further in view of Xavier et al. U.S. Patent Publication # 2015/0128234 (hereinafter Xavier)
With respect to claim 1, Kale teaches a password authentication system comprising an authentication server provided on a website for performing personal authentication using an authentication password, and terminal devices through which users operate, wherein
said terminal device comprises an input device (Fig. 1 element 111) for inputting a user password (i.e. client device 111 wherein prompting user to input credentials)(Paragraph 67), a unique code storage for storing a unique code set (i.e. authentication code) for each user (i.e. receiving one time key that is communicated to the client device via a text message and also receiving authentication code. Since this received via a message, hence it is stored on the device with the message) (Paragraph 68, 70, 79), logically operate by use of the unique code stored in the unique code storage and the user password inputted by the user and for output an operation result as the authentication password (i.e. result being user inputted password with using authentication code for each individual transaction) (Paragraph 67-71), and transmit the generated authentication password together with user identification information to the authentication server (Paragraph 67-71, 78-79), and
wherein said authentication server (Fig. 1 element 104) comprises a password storage for storing the authentication password (i.e. authentication code along with user credentials) (paragraph 79) included in a password registration request (i.e. single authentication message) sent from the terminal device together with the user identification information (i.e. identity of the user/individual as well as user credentials) as a registration password which functions as a reference for authentication (Paragraph 61, 67) and
wherein when setting up, the terminal device logically operates using the user password inputted by the user and the unique code stored in the unique code storage to generate the authentication password (Paragraph 67-71) and transmits the password registration request which includes the generated authentication password to the authentication server (Paragraph 67-71), and the authentication server stores the authentication password included in the password registration request together with the user identification information in the password storage means as the registration password (Paragraph 79, 67-71).
Kale does not explicitly state an authentication server processor configured to verify the matching between the authentication password included in a password authentication request sent from the terminal device and the registration password which is stored in the password storage and is specified by the user identification information included in the password authentication request, and wherein when performing the personal authentication, the terminal device logically operates using the user password inputted by the user and the unique code stored in the unique code storage means to generate the authentication password and transmits the password authentication request including the generated authentication password to the authentication server, and the authentication server verifies the matching between the authentication password included in the received password authentication request and the registration password which is stored in the password storage and is specified by the user identification information included in the received password authentication request.
Yang teaches an authentication server processor configured to verify the matching between the authentication password included in a password authentication request sent from the terminal device and the registration password which is stored in the password storage and is specified by the user identification information included in the password authentication request (Paragraph 94-95), and wherein when performing the personal authentication, the terminal device logically operates using the user password inputted by the user and the unique code stored in the unique code storage means to generate the authentication password (Paragraph 84-85, 92) and transmits the password authentication request including the generated authentication password to the authentication server (paragraph 88-89, 95-97), and the authentication server verifies the matching between the authentication password included in the received password authentication request and the registration password which is stored in the password storage means and is specified by the user identification information included in the received password authentication request (Paragraphs 94-97).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to implement Yang’s teaching in Kale’s teaching to come up with verifying matching between the authentication password and registration password and using the user password inputted by the user and the unique code stored in the unique code storage means to generate the authentication password, and transmits a password authentication request including the generated authentication password to the authentication server. The motivation for doing so would be to provide multi-factor authentication to provide super security and prevent against hackers and protecting user authentication information.
Kale and Yang does not explicitly teaches performing a hash operation by use of the unique code which has more digits than the user password and to generate a hash value with more digits than the user password inputted by the user and output the generated operation result as the authentication password, and generate the authentication password with more digits than the user password inputted by the user.
Xavier teaches performing a hash operation by use of the unique code which has more digits than the user password (Paragraph 55) and to generate a hash value with more digits than the user password inputted by the user and output the generated operation result as the authentication password (Paragraph 53-56), and generate the authentication password (i.e. password generator to convert the key into an authentication password) with more digits than the user password inputted by the user (Paragraph 15, 55), when performing the personal authentication, the terminal device performs the hash operation using the user password inputted by the user (Paragraph 55) and the unique code (i.e. key code) stored in the unique code storage (Paragraph 53) to generate the authentication password with more digits than the user password inputted by the user (Paragraph 53-56). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to implement Xavier’s teaching in Kale and Yang’s teaching to come up with performing hash operation using the user password inputted by the user and the unique code stored in the unique code storage to generate authentication password with more digits than the user password inputted by the user. The motivation for doing so would be to provide secure access to the content by either granting and denying the access (Paragraph 101-102)
With respect to claim 2, Kale, Yang and Xavier teaches the password authentication system of claim 1, but Yang further teaches wherein said unique code storage stores a different unique code for each website on which the authentication server is installed (Paragraph 75, 88, 93-94) and wherein when performing the personal authentication, the user enter his or her user password into the terminal device (Paragraph 86) specifies the target website, and the terminal device performs the hash operation using the inputted user password and the unique code of the designated website (Paragraph 113-114, 119-120) to output a different authentication password for each website using one and the same user password (Paragraphs 113-114, 119-120, 74-76, 88, 93-94).
With respect to claim 3, Kale, Yang and Xavier teaches the password authentication system of claim 1, but Yang further teaches wherein a hash operation or an encryption operation is performed as the logical operation, and an outputted hash value or encryption data is used as the authentication password (Paragraph 67-68, 113-114)
With respect to claim 4, Kale, Yang and Xavier g teaches the password authentication system of claim 1, but Yang further teaches wherein said unique code includes the address information or domain information of the website (Paragraph 86)
With respect to claim 5, Kale, Yang and Xavier teaches the password authentication system of claim 1, but Yang further teaches wherein said unique code includes code information given to the user by the authentication server, the unique code set by the user himself or the combination of these code information (Paragraph 84-87)
With respect to claim 6, Kale, Yang and Xavier teaches the password authentication system of claim 1, but Yang further teaches wherein said authentication server processor is further configured to generate the unique code in response to the unique code generation request sent from the terminal device (Paragraph 62, 66) , and transmit the generated unique code to the corresponding terminal device, and wherein the terminal device stores the received unique code in the unique code storage means (Paragraph 88-89, 95-97)
With respect to claim 8, Kale, Yang and Xavier teaches the password authentication system of claim 1, but Yang further teaches wherein said authentication server is further configured to replace the registration password stored in the registration password storage with a new authentication password (Paragraph 83, 135), and wherein when changing the password, the user inputs the changed user password into the terminal device (Paragraph 84-85), the terminal device logically operates using the changed user password inputted by the user and the unique code stored in the storage to generate a new authentication password (Paragraph 83, 85-88) and transmits a password change request including the generated authentication password to the authentication server (Paragraphs 83, 85-88, 135), and authentication server processor replaces the registration password stored in the registration password storage means with the authentication password included in the received password change request (paragraphs 83, 85-88, 135)
With respect to claim 9, Kale teaches a password authentication system comprising an authentication server provided on a website for performing personal authentication using an authentication password, and terminal devices through which users operate,
wherein said terminal device comprises an input device (Fig. 1 element 111) for inputting a user password (i.e. client device 111 wherein prompting user to input credentials)(Paragraph 67), and a terminal device processor configured to acquire address information of a website being accessed (i.e. merchant website)(Paragraph 67), logically operate by use of the address information that is acquired (i.e. website using authentication code for each merchant) and the user password inputted by the user to output an operation result as the authentication password (Paragraph 67-71), and transmit the generated authentication password together with user identification information to the authentication server (Paragraph 67-71), and
wherein said authentication server comprises a password storage for storing the authentication password (paragraph 79) included in a password registration request (i.e. single authentication message) sent from the terminal device together with the user identification information (i.e. identity of the user) as a registration password which functions as a reference for authentication (paragraphs 61, 67),
wherein when setting up, the user accesses the target website, the terminal device acquires the address information of the website being accessed, logically operates using the acquired address information and the user password inputted by the user to generate the authentication password (Paragraph 67-71), and transmits the password registration request which includes the generated authentication password to the authentication server (Paragraph 67-71), and the authentication server stores the authentication password included in the password registration request together with the user identification information in the password storage as the registration password (Paragraph 79, 67-71)
Kale does not explicitly teach an authentication server processor configured to verify the matching between the authentication password included in a password authentication request sent from the terminal device and the registration password which is stored in the password storage and is specified by the user identification information included in the password authentication request, and wherein when performing the personal authentication, the user accesses the target website, the terminal device acquires the address information of the website being accessed, logically operates using the acquired address and the user password to generate the authentication password, and transmits the password authentication request including the generated authentication password and user identification information to the authentication server, and wherein the authentication server verifies the matching between the authentication password included in the received password authentication request and the registration password which is stored in the password storage and is specified by the user identification information included in the received password authentication request.
Yang teaches an authentication server processor to verify the matching between the authentication password included in a password authentication request sent from the terminal device and the registration password which is stored in the password storage means and is specified by the user identification information included in the password authentication request (Paragraph 94-95), and wherein when performing the personal authentication, the user accesses the target website, the terminal device acquires the address information of the website being accessed, logically operates using the acquired address and the user password to generate the authentication password (Paragraph 84-85, 92), and transmits the password authentication request including the generated authentication password, and user identification information to the authentication server (paragraph 88-89, 95-97), and wherein the authentication server verifies the matching between the authentication password included in the received password authentication request and the registration password which is stored in the password storage and is specified by the user identification information included in the received password authentication request (Paragraphs 94-97).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to implement Yang’s teaching in Kale’s teaching to come up with verifying matching between the authentication password and registration password and using the user password inputted by the user and the unique code stored in the unique code storage means to generate the authentication password, and transmits a password authentication request including the generated authentication password to the authentication server. The motivation for doing so would be to provide multi-factor authentication to provide super security and prevent against hackers and protecting user authentication information.
Kale and Yang does not explicitly teaches performing a hash operation by use of the unique code which has more digits than the user password and to generate a hash value with more digits than the user password inputted by the user and output the generated operation result as the authentication password, and generate the authentication password with more digits than the user password inputted by the user.
Xavier teaches performing a hash operation by use of the unique code which has more digits than the user password (Paragraph 55) and to generate a hash value with more digits than the user password inputted by the user and output the generated operation result as the authentication password (Paragraph 53-56), and generate the authentication password (i.e. password generator to convert the key into an authentication password) with more digits than the user password inputted by the user (Paragraph 15, 55), when performing the personal authentication, the terminal device performs the hash operation using the user password inputted by the user (Paragraph 55) and the unique code (i.e. key code) stored in the unique code storage (Paragraph 53) to generate the authentication password with more digits than the user password inputted by the user (Paragraph 53-56). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to implement Xavier’s teaching in Kale and Yang’s teaching to come up with performing hash operation using the user password inputted by the user and the unique code stored in the unique code storage to generate authentication password with more digits than the user password inputted by the user. The motivation for doing so would be to provide secure access to the content by either granting and denying the access (Paragraph 101-102)
With respect to claim 10, Kale, Yang and Xavier teaches the password authentication system of claim 9, but Yang further teaches wherein when performing the personal authentication, said terminal device transmits a wrong authentication password which is composed of the code strings different from the registration password to a phishing website (Paragraph 95, 137, 142-143, 22)
With respect to claim 11, Kale, Yang and Xavier teaches the password authentication system of claim 9, but Yang further teaches wherein said terminal device comprises a unique code storage for storing a unique code set for each user (Paragraph 62, 66), and said terminal device processor is further configured to perform the hash operation (Paragraph 113-114, 119-20) using the user password inputted by the user, the unique code stored in the unique code storage and the address information of the website being accessed to output the authentication password (Paragraph 88-89, 95-97)
With respect to claim 12, Kale, Yang and Xavier teaches the password authentication system of claim 9, but Yang further teaches wherein said terminal device generates a different authentication password for each website using one user password (Paragraph 75, 88, 93-94)
With respect to claim 13, Kale, Yang and Xavier teaches the password authentication system of claim 9, but Yang further teaches wherein as the address information of the website, a URL or a part of the URL of the website, or a domain of the website is used (Paragraph 75-76, 86)
With respect to claim 14, Kale, Yang and Xavier teaches the password authentication system of claim 9, but Yang further teaches wherein said authentication server processor installed on the website comprises is further configured to replace the registration password stored in the password storage with a new authentication password (Paragraph 83, 135), and wherein when changing the password, the user accesses the website subject to the password change and inputs the changed user password (Paragraph 84-85), said terminal device acquires the address of the website being accessed, performs the hash operation (Paragraph 113-114, 119-20) using the acquired address information of the website and the inputted user password to generate the new authentication password (Paragraph 83, 85-88) and transmits a password change request including the generated new authentication password to the authentication server on the website (Paragraphs 83, 85-88, 135), and the authentication server processor replaces the registration password specified by the user identification information included in the password change request with the new authentication password included in the received password change request (Paragraphs 83, 85-88, 135)
With respect to claim 15, Kale teaches a terminal device (Fig. 1 element 112) used in a password authentication system (Fig. 1 element 104) comprising an authentication server (Fig. 1 element 104) for performing personal authentication using an authentication password (Paragraph 67), and terminal devices (Fig. 1 element 112) through which users operate, wherein said terminal device comprises an input device (Fig. 1 element 111) for inputting a user password (Paragraph 67), wherein unique code storage for storing a unique code set (i.e. authentication code) for each user (Paragraph 70), and a terminal device processor configured to logically operate by use of the unique code stored in the unique code storage and the user password inputted by the user to output an operation result as the authentication password (Paragraph 67-71); transmit the generated authentication password together with user identification information to the authentication server (Paragraph 67-71).
Kale does not explicitly teach when performing the personal authentication, the terminal device logically operates using the user password inputted by the user and the unique code stored in the unique code storage to generate the authentication password, and transmits a password authentication request including the generated authentication password to the authentication server.
Yang teaches wherein said terminal device comprises an input device (Fig. 2 element 21) for inputting a user password (Paragraph 59),a unique code storage (i.e. data safekeeping module) for storing a unique code set for each user (i.e. seed passcode) (Paragraph 62, 66), and a terminal device processor configured to logically operate by use of the unique code stored in the unique code storage and the user password inputted by the user (i.e. passcode) to output an operation result as the authentication password (i.e. user passcode)(Paragraph 83-89), and transmit the generated authentication password together with user identification information to the authentication server (i.e. web server authenticates the user based on super-code received from passcode apparatus)(Paragraph79-80), and wherein when performing the personal authentication, the terminal device logically operates using the user password inputted by the user and the unique code stored in the unique code storage to generate the authentication password (Paragraph 84-89), and transmits a password authentication request including the generated authentication password to the authentication server (Paragraph 88-89, 95-97). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to implement Yang’s teaching in Kale’s teaching to come up with having using the user password inputted by the user and the unique code stored in the unique code storage means to generate the authentication password, and transmits a password authentication request including the generated authentication password to the authentication server. The motivation for doing so would be to provide multi-factor authentication to provide super security and prevent against hackers and protecting user authentication information.
Kale and Yang does not explicitly teaches performing a hash operation by use of the unique code which has more digits than the user password and to generate a hash value with more digits than the user password inputted by the user and output the generated operation result as the authentication password, and generate the authentication password with more digits than the user password inputted by the user.
Xavier teaches performing a hash operation by use of the unique code which has more digits than the user password (Paragraph 55) and to generate a hash value with more digits than the user password inputted by the user and output the generated operation result as the authentication password (Paragraph 53-56), and generate the authentication password (i.e. password generator to convert the key into an authentication password) with more digits than the user password inputted by the user (Paragraph 15, 55), when performing the personal authentication, the terminal device performs the hash operation using the user password inputted by the user (Paragraph 55) and the unique code (i.e. key code) stored in the unique code storage (Paragraph 53) to generate the authentication password with more digits than the user password inputted by the user (Paragraph 53-56). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to implement Xavier’s teaching in Kale and Yang’s teaching to come up with performing hash operation using the user password inputted by the user and the unique code stored in the unique code storage to generate authentication password with more digits than the user password inputted by the user. The motivation for doing so would be to provide secure access to the content by either granting and denying the access (Paragraph 101-102)
With respect to claim 16, Kale teaches a terminal device (Fig. 1 element 112) used in a password authentication system (Fig. 1 element 104) in which personal authentication is performed using an authentication password, wherein said terminal device comprises an input device (Fig. 1 element 111) for inputting a user password (Paragraph 67), and a terminal device processor configured to acquire an address of a website being accessed (Paragraph 67), logically operate by use of the address (i.e. website using authentication code for each merchant) that is acquired and the user password inputted by the user to output an operation result as the authentication password (Paragraph 67-71), and transmit the generated authentication password together with user identification information to the authentication server (Paragraph 67-71), and wherein when performing the password authentication, said terminal device acquires the address information of the website being accessed (Paragraph 67-71), logically operates using the acquired address information and the inputted user password to generate the authentication password (Paragraph 67-71) transmits the generated authentication password to the authentication server on the website (Paragraph 67-71)
Kale does not explicitly teach wherein said terminal device transmits a wrong authentication password which is composed of a code string different from the registration password which is the reference of authentication to a phishing website.
Yang teaches wherein said terminal device transmits a wrong authentication password which is composed of a code string different from the registration password which is the reference of authentication to a phishing website (Paragraph 95, 137, 142-143, 22). Yang also teaches an operation means for logically operating by use of the address (i.e. site code mapped to address of a website) acquired by the address acquisition means (Paragraph 65) and the user password inputted by the user to output an operation result as the authentication password (Paragraphs 84-89, 65-67), and transmit the generated authentication password together with user identification information to the authentication server (Paragraph 88-89, 95-97), and wherein when performing the password authentication, said terminal device acquires the address information of the website being accessed (Paragraph 65), logically operates using the acquired address information and the inputted user password to generate the authentication password (Paragraph 84-89) transmits the generated authentication password to the authentication server on the website (Paragraph 65-67, 84-89). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to implement Yang’s teaching in Kale’s teaching to come up with having transmits a wrong authentication password which is composed of a code string different from the registration password which is the reference of authentication to a phishing website. The motivation for doing so would be to provide multi-factor authentication to provide super security and prevent against hackers and protecting user authentication information.
Kale and Yang does not explicitly teaches performing a hash operation by use of the unique code which has more digits than the user password and to generate a hash value with more digits than the user password inputted by the user and output the generated operation result as the authentication password, and generate the authentication password with more digits than the user password inputted by the user.
Xavier teaches performing a hash operation by use of the unique code which has more digits than the user password (Paragraph 55) and to generate a hash value with more digits than the user password inputted by the user and output the generated operation result as the authentication password (Paragraph 53-56), and generate the authentication password (i.e. password generator to convert the key into an authentication password) with more digits than the user password inputted by the user (Paragraph 15, 55), when performing the personal authentication, the terminal device performs the hash operation using the user password inputted by the user (Paragraph 55) and the unique code (i.e. key code) stored in the unique code storage (Paragraph 53) to generate the authentication password with more digits than the user password inputted by the user (Paragraph 53-56). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to implement Xavier’s teaching in Kale and Yang’s teaching to come up with performing hash operation using the user password inputted by the user and the unique code stored in the unique code storage to generate authentication password with more digits than the user password inputted by the user. The motivation for doing so would be to provide secure access to the content by either granting and denying the access (Paragraph 101-102)
With respect to claim 17, Kale, Yang and Xavier teaches terminal device of claim 16, but Yang further teaches wherein said terminal device comprises a unique code storage for storing a unique code acting as an operation code used in the hash operation (Paragraph 86-87, 113-114, 119-20), and said terminal device processor logically operates using the user password inputted by the user (Paragraph 84), the address information of the website being accessed and the unique code stored in the unique code storage (Paragraph 85-86, 87-88)
Response to Arguments
Applicant's arguments filed 2/19/2026 with respect to amended claim limitations have been fully considered but deemed moot in view of new grounds of rejection.
Allowable Subject Matter
Claim 7 is objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
A). Carlson et al. U.S. Patent Publication # 2008/270938 which in Paragraph 84 teaches about accessing the administrative website through an Internet browser and asking for the Site Administrator’s user name and password.
B). Fremberg et al. U.S. Patent Publication # 2005/022020
Any inquiry concerning this communication or earlier communications from the examiner should be directed to DHAIRYA A PATEL whose telephone number is (571)272-5809. The examiner can normally be reached M-F 7:30am-4:00pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Kamal B Divecha can be reached at 571-272-5863. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
DHAIRYA A. PATEL
Primary Examiner
Art Unit 2453
/DHAIRYA A PATEL/Primary Examiner, Art Unit 2453