DETAILED ACTION
A response to the notice of non-compliant amendment was received on 07 January 2026. By this response, Claims 1-30 have been amended. No claims have been added or canceled. Claims 1-30 are currently pending in the present application.
Response to Arguments
Applicant's arguments filed 07 January 2026 have been fully considered but they are not persuasive.
Regarding the objection to Figures 7-14 as requiring a prior art label, Applicant states that Figures 7-14 are not prior art but are schematic diagrams of apparatus corresponding to disclosed embodiments (page 12 of the present response). However, Applicant provides no evidence or explanation in support of this assertion. It is noted that all of the elements depicted in Figures 7-14 (apparatus having processors or processing units, communications units, and memory) are all shown in a generic manner and appear to only illustrate generic and well-known computer components. Therefore, only that which is old is illustrated.
Regarding the rejection of Claims 1-30 under 35 U.S.C. 101 as directed to abstract ideas without significantly more, with particular reference to amended independent Claim 1 and referring to Step 2A, Prong One, Applicant argues that the new recitation that the shared key is used to encrypt data ties the claimed steps directly to data protection and secure information exchange (pages 13-14 of the present response). However, the recitation that the key “is used for” encrypting data is merely a recitation of intended use of the key and not a positive or active step of the method to be performed. There is no encryption that actually occurs in the claim. Therefore, the nexus between the claimed invention and the asserted improvement is not clear. Further, Applicant argues that although mathematical calculations are involved in the claims, the operations of generating identity authentication information and performing verification “are technical in nature and cannot be practically performed in the human mind” (page 14 of the present response). However, the steps of generating the first identity authentication information and performing verification on the second identity authentication information were not considered to be mental processes; rather, they were considered to constitute mathematical concepts, which is a separate category from mental processes. Whether the mathematics involved is too complicated for a person to perform without assistance is not a consideration made with respect to the mathematical concept grouping. Applicant has not persuasively shown that the identified abstract ideas would not fall into the identified groupings, and therefore, the claims are still considered to recite abstract ideas in the Prong One analysis.
Referring to Step 2A, Prong Two, Applicant asserts that Claim 1 as amended is directed to a “specific and structured process” enabling nodes to securely exchange information and authenticate and is therefore a concrete and practical implementation “suitable for real-world communication systems” and that the claimed invention provides practical advantages as described in the specification (page 15 of the present response, citing paragraphs 0004, 0005, 0013, and 0672 of the published application). However, Applicant has not explained what “specific and structured process” provides the asserted advantages. Applicant merely provides the conclusory statement that the cited paragraphs describe improvements to data security and the claims reflect these improvements (pages 15-16 of the present response). However, Applicant has not provided any explanation of the nexus between particular elements of the claims that are asserted to provide the alleged advantages.
Referring to Step 2B, Applicant merely alleges that Claim 1 as amended recites unconventional features (page 16 of the present response). However, Applicant has not cited any particular features that are considered to be unconventional. It is maintained that the abstract ideas are not integrated into a practical application and the claims do not include additional elements that amount to significantly more than the abstract ideas.
Regarding the rejection of Claims 1-30 under 35 U.S.C. 112(b) as indefinite, and with respect to the term “trusted”, Applicant argues that a “trusted entity” or “trusted node” is a concept that would be understood by one of ordinary skill in the art (page 16 of the present response). However, the claims do not recite a trusted entity or a trusted node; rather, the claims recite that various identities are trusted, which is distinct from the concept of a trusted entity. It is not clear from the claims by whom or by what the identities are trusted.
Applicant further argues that amended Claim 1 specifies that a shared key is used for encrypting data and the verification of the second identity authentication information and that these features are described and supported in the specification including the manner in which the key is derived and used (pages 16-17 of the present response). However, the claim merely states that the shared key “is used for encrypting data for communication between the first node and the second node” which does not relate to the verification, and the verification is only described as being performed “based on the shared key” which provides no implementation detail. Although Applicant asserts that these features are supported in the specification, Applicant has not pointed out where in the specification these features are supported, nor has Applicant attempted to explain how the shared key is derived or used.
Therefore, for the reasons detailed above, the Examiner maintains the rejections as set forth below.
Drawings
The objection to Figures 7-14 as requiring a prior art label is NOT withdrawn, for the reasons detailed above.
Figures 7-14 should be designated by a legend such as --Prior Art-- because only that which is old is illustrated. The drawing figures only depict generic and well-known components. See MPEP § 608.02(g). Corrected drawings in compliance with 37 CFR 1.121(d) are required in reply to the Office action to avoid abandonment of the application. The replacement sheet(s) should be labeled “Replacement Sheet” in the page header (as per 37 CFR 1.84(c)) so as not to obstruct any portion of the drawing figures. If the changes are not accepted by the examiner, the applicant will be notified and informed of any required corrective action in the next Office action. The objection to the drawings will not be held in abeyance.
Claim Rejections - 35 USC § 101
The rejection of Claims 1-30 under 35 U.S.C. 101 as directed to abstract ideas without significantly more is NOT withdrawn for the reasons detailed above.
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-30 are rejected under 35 U.S.C. 101 because the claimed invention is directed to abstract ideas without significantly more.
Claim 1 recites a method that includes receiving a first association request message; determining that a second node is trusted; generating first identity authentication information derived from a shared key; sending a first authentication request message that includes the first identity authentication information; receiving a first authentication response including second identity authentication information; and performing verification on the second identity authentication information. The steps of generating the first identity authentication information and performing the verification are mathematical calculations, which constitute mathematical concepts, which are one of the groupings of abstract ideas set forth in MPEP § 2106.04(a)(2). Further, the step of determining that the second node is trusted encompasses mental processes (for example, see Claim 3, where it could simply entail checking for an identifier in a list, which only requires simple data comparisons). Mental processes are also one of the groupings of abstract ideas set forth in MPEP § 2106.04(a)(2). Abstract ideas are judicial exceptions as per MPEP § 2106.04(I). See also Alice Corporation Pty. Ltd. v. CLS Bank, International, et al, 573 U.S. 208, 110 USPQ2d 1976 (2014).
This judicial exception is not integrated into a practical application because the claim does not recite a clear use or substantial further action for the result of the verification. The steps of receiving the first association request and first authentication response constitute data gathering, which is insignificant extra-solution activity as per MPEP § 2106.05(g). Similarly, the step of sending the request is also insignificant extra-solution activity, e.g. necessary output of the mathematical operations, as per MPEP § 2106.05(g). The recitation that the shared key is used for encryption is merely an intended use of the key and is not a positive or active recitation of any step of encryption that is performed by the method. There is nothing that would result in a particular transformation, as per MPEP § 2106.05(c), nor does the claim require the use of the abstract ideas in conjunction with a particular machine or article of manufacture, as per MPEP § 2106.05(b). At most, the recitations of the nodes constitute nothing more than mere instructions to implement the abstract idea on a computer, as per MPEP § 2106.05(f), or a recitation of a field or use or technological environment for the abstract idea as per MPEP § 2106.05(h). There are no additional elements that apply or use the abstract ideas in a meaningful way beyond merely linking the use of the judicial exceptions to a particular technological environment. Therefore, the claim is not directed to a practical application of the abstract ideas.
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exceptions for similar reasons as detailed above with respect to the question of a practical application of the judicial exception. The steps of receiving and sending the requests and response constitute receiving or sending data over a network, which have been recognized by the courts as well-understood, routine, and conventional functions. See MPEP § 2106.05(d)(II), citing Symantec, TLI, OIP Techs., and buySAFE. Therefore, the claim as a whole, whether the steps are considered individually or as an ordered combination, is not directed to significantly more than the abstract idea.
Similarly, Claim 8 recites a method that includes determining that a first node is trusted and sending a first association request; receiving a first authentication request that includes first identity authentication information derived from a shared key; performing verification on the first identity authentication information based on a shared key; and sending a first authentication response that includes second identity authentication information generated based on the shared key. The steps of performing the verification and generating the second identity authentication information are mathematical calculations, which constitute mathematical concepts, which are one of the groupings of abstract ideas set forth in MPEP § 2106.04(a)(2). Deriving the first authentication information from the shared key is not a positively recited step of the method, but would also be a mathematical calculation if it were positively recited. Further, the step of determining that the first node is trusted encompasses mental processes (for example, see Claim 9, where it could simply entail checking for an identifier in a list, which only requires simple data comparisons). Mental processes are also one of the groupings of abstract ideas set forth in MPEP § 2106.04(a)(2). Abstract ideas are judicial exceptions as per MPEP § 2106.04(I). See also Alice Corporation Pty. Ltd. v. CLS Bank, International, et al, 573 U.S. 208, 110 USPQ2d 1976 (2014).
This judicial exception is not integrated into a practical application because the claim does not recite a clear use or substantial further action for the result of the verification. The step of sending the response is insignificant post-solution activity, e.g. necessary output of the mathematical operations, as per MPEP § 2106.05(g). The recitation that the shared key is used for encryption is merely an intended use of the key and is not a positive or active recitation of any step of encryption that is performed by the method. There is nothing that would result in a particular transformation, as per MPEP § 2106.05(c), nor does the claim require the use of the abstract ideas in conjunction with a particular machine or article of manufacture, as per MPEP § 2106.05(b). At most, the recitations of the nodes constitute nothing more than mere instructions to implement the abstract idea on a computer, as per MPEP § 2106.05(f), or a recitation of a field or use or technological environment for the abstract idea as per MPEP § 2106.05(h). The step of receiving the first authentication request constitutes data gathering, which is insignificant extra-solution activity as per MPEP § 2106.05(g), and the step of sending the first association request is similarly insignificant extra-solution activity. There are no additional elements that apply or use the abstract ideas in a meaningful way beyond merely linking the use of the judicial exceptions to a particular technological environment. Therefore, the claim is not directed to a practical application of the abstract ideas.
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exceptions for similar reasons as detailed above with respect to the question of a practical application of the judicial exception. The steps of receiving and sending the requests and response constitute receiving or sending data over a network, which have been recognized by the courts as well-understood, routine, and conventional functions. See MPEP § 2106.05(d)(II), citing Symantec, TLI, OIP Techs., and buySAFE. Therefore, the claim as a whole, whether the steps are considered individually or as an ordered combination, is not directed to significantly more than the abstract idea.
Dependent Claims 2-7 and 9-14 only recite further detail of the abstract steps/functions of mathematical calculations by reciting additional calculations to compute or further details of the inputs to the functions, or additional abstract steps such as determining whether identifiers are in lists or computing a message integrity check, or comparing a quantity to a threshold. Therefore, the dependent claims do not provide a practical application or significantly more than the abstract ideas.
Claims 15-30 are directed to apparatus having functionality generally corresponding to the methods of Claims 1-14, and therefore, Claims 15-30 recite abstract ideas for similar reasons as detailed above with respect to Claims 1 and 8. The recitations of the memory and processor are at a generic level and constitute nothing more than mere instructions to implement the abstract ideas on a computer. See MPEP § 2106.05(f). Therefore, the apparatus claims are also not directed to significantly more than the abstract ideas.
Based upon consideration of all of the relevant factors with respect to the claims as an ordered combination and as a whole, Claims 1-30 are determined to be directed to abstract ideas without a practical application and without significantly more, as detailed above. Therefore, based on the above analysis, the claimed inventions are not directed to patent eligible subject matter.
Claim Rejections - 35 USC § 112
The rejection of Claims 1-30 under 35 U.S.C. 112(b) as indefinite is NOT withdrawn because not all issues have been addressed and/or because the amendments have raised new issues, as set forth below.
The following is a quotation of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 1-30 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the enablement requirement. The claims contain subject matter which was not described in the specification in such a way as to enable one skilled in the art to which it pertains, or with which it is most nearly connected, to make and/or use the invention.
A determination of a failure to comply with the enablement requirement is made considering the undue experimentation factors set forth in MPEP § 2164.01(a). In the present application, the factors which appear to weigh most heavily are the breadth of the claims (MPEP § 2164.08), the amount of direction provided by the inventor (MPEP § 2164.03), and the existence of working examples (MPEP § 2164.02). Independent Claims 1, 8, 15, and 23 broadly recite “the first identity authentication information is derived from a shared key”. The phrase “is derived from” is a broad recitation, and the claims do not recite any details of the algorithms or equations used to derive such first identity authentication information. Although the specification generally discusses that the first identity authentication information may be generated based on a pre-shared key using a key derivation function, there appears to be no detail provided in the specification of how to implement such a key derivation function. The specification appears to have no specific algorithm, equation, or other working example of how the information is to be generated. The lack of details or examples in any detail suggests that there is little direction provided by the inventor. Combined with the broad scope of the claims, this suggests that the enablement of the description is not commensurate in scope with the claims (MPEP § 2164.08) and that undue experimentation would be required to make or use the invention based on the disclosure (MPEP § 2164.06).
Claims not explicitly referred to above are rejected due to their dependence on a rejected base claim.
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-30 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 1 recites “determining… that an identity of the second node is trusted” in line 3. The term “trusted” is a subjective or relative term, and the claim does not set forth by whom or by what the identity itself is trusted. See also MPEP § 2173.05(b). The claim additionally recites “the first identity authentication information is derived from a shared key” in lines 4-5. However, the claim does not clearly define an algorithm to be used to generate such identity authentication information. The claim also recites “performing… verification on the second identity authentication information based on the shared key” in lines 14-15. However, the claim does not clearly define an algorithm to be used to verify such identity authentication information. The above ambiguities render the claim indefinite.
Claim 3 recites “the identity of the second node is trusted” in lines 8, 11, and 15. The term “trusted” is a subjective or relative term, and the claim does not set forth by whom or by what the identity is trusted. The claim further recites “and an identifier of the second node is not in the first blacklist” in line 9. It is not grammatically clear what this phrase is intended to modify or be coordinated with. The claim additionally recites “and an identifier of the second node is neither in the first blacklist nor in the first whitelist” in lines 12-13. Again, it is not grammatically clear what this phrase is intended to modify or be coordinated with.
Claim 4 recites “determining… that the message integrity check on the first authentication response succeeds” in line 7. However, the claim does not recite what occurs when the message integrity check fails, which amounts to a gap in the claim.
Claim 8 recites “determining… that an identity of a first node is trusted” in line 2. The term “trusted” is a subjective or relative term, and the claim does not set forth by whom or by what the identity itself is trusted. See also MPEP § 2173.05(b). The claim further recites “the first identity authentication information is derived from a shared key” in lines 5-6. However, the claim does not clearly define an algorithm to be used to generate such identity authentication information. The claim additionally recites “performing… verification on the first identity authentication information based on a shared key” in lines 9-10. The claim does not clearly define an algorithm to be used to verify such identity authentication information. The claim also recites “the second identity authentication information is generated based on the shared key” in lines 13-14. The claim does not clearly define an algorithm to be used to generate such identity authentication information. The above ambiguities render the claim indefinite.
Claim 9 recites “the identity of the first node is trusted” in lines 8-9 and 11-12, as well as “the identity of the second node is trusted” in lines 15-16. First, the term “trusted” is a subjective or relative term, and the claim does not set forth by whom or by what the identity is trusted. Further, it is not clear how an indication that the identity of the second node is trusted would result in a determination that the first node is trusted as recited in line 2. The claim further recites “and an identifier of the first node is not in the second blacklist” in line 9. It is not grammatically clear what this phrase is intended to modify or be coordinated with. The claim additionally recites “and an identifier of the first node is neither in the second blacklist nor in the second whitelist” in lines 12-13. Again, it is not grammatically clear what this phrase is intended to modify or be coordinated with.
Claim 10 recites “determining that the message integrity check on the first authentication request succeeds” in line 7. However, the claim does not recite what occurs when the message integrity check fails, which amounts to a gap in the claim.
Claim 15 recites “determine that an identity of the second node is trusted” in line 5. The term “trusted” is a subjective or relative term, and the claim does not set forth by whom or by what the identity itself is trusted. See also MPEP § 2173.05(b). The claim additionally recites “the first identity authentication information is derived from a shared key” in lines 4-5. However, the claim does not clearly define an algorithm to be used to generate such identity authentication information. The claim also recites “perform verification on the second identity authentication information based on the shared key” in lines 11-12. However, the claim does not clearly define an algorithm to be used to verify such identity authentication information. The above ambiguities render the claim indefinite.
Claim 17 recites “the identity of the second node is trusted” in lines 6, 9, and 12. The term “trusted” is a subjective or relative term, and the claim does not set forth by whom or by what the identity is trusted. The claim further recites “and an identifier of the second node is not in the first blacklist” in lines 6-7. It is not grammatically clear what this phrase is intended to modify or be coordinated with. The claim additionally recites “and an identifier of the second node is neither in the first blacklist nor in the first whitelist” in lines 9-10. Again, it is not grammatically clear what this phrase is intended to modify or be coordinated with.
Claim 18 recites “determine that the message integrity check on the first authentication response succeeds” in line 5. However, the claim does not recite what occurs when the message integrity check fails, which amounts to a gap in the claim.
Claim 21 recites “the first authentication failure counter” in line 3. There is insufficient antecedent basis for this limitation in the claims. Although Claim 16 recites an authentication failure counter, Claim 21 does not depend from Claim 16.
Claim 22 recites “the identifier of the second node” in line 3. There is not clear antecedent basis for this limitation in the claims, although it appears that this may be intended to refer to the identity of the second node.
Claim 23 recites “determine that an identity of a first node is trusted” in line 4. The term “trusted” is a subjective or relative term, and the claim does not set forth by whom or by what the identity is trusted. See also MPEP § 2173.05(b). The claim further recites “the first identity authentication information is derived from a shared key” in lines 5-6. However, the claim does not clearly define an algorithm to be used to generate such identity authentication information. The claim additionally recites “perform verification on the first identity authentication information based on a shared key” in lines 8-9. The claim does not clearly define an algorithm to be used to verify such identity authentication information. The claim also recites “the second identity authentication information is generated based on the shared key” in lines 12-13. The claim does not clearly define an algorithm to be used to generate such identity authentication information. The above ambiguities render the claim indefinite.
Claim 24 recites “the identity of the first node is trusted” in lines 6-7 and 9-10, as well as “the identity of the second node is trusted” in line 13. First, the term “trusted” is a subjective or relative term, and the claim does not set forth by whom or by what the identity is trusted. Further, it is not clear how an indication that the identity of the second node is trusted would result in a determination that the first node is trusted. The claim further recites “and an identifier of the first node is not in the second blacklist” in line 7. It is not grammatically clear what this phrase is intended to modify or be coordinated with. The claim additionally recites “and an identifier of the first node is neither in the second blacklist nor in the second whitelist” in lines 10-11. Again, it is not grammatically clear what this phrase is intended to modify or be coordinated with.
Claim 25 recites “determine that the message integrity check on the first authentication request succeeds” in line 5. However, the claim does not recite what occurs when the message integrity check fails, which amounts to a gap in the claim.
Claim 26 recites “the instructions further causes the apparatus is to” in lines 1-2. The phrase “is to” is grammatically unclear in this context.
Claim 29 recites “the identifier of the first node” in line 3. There is not clear antecedent basis for this limitation in the claims, although it appears that this may be intended to refer to the identity of the first node if the claim is intended to depend from Claim 23.
Claim 30 recites “send a second association request to the first node in response to a value of the second authentication failure counter being less than a second threshold” in lines 3-4. It is not clear when this is intended to occur in relation to the other functions of the apparatus or what would cause the counter to be greater than or less than the second threshold.
Claims not explicitly referred to above are rejected due to their dependence on a rejected base claim.
Examiner’s Note
Because the claims are rendered indefinite and not enabled due to the numerous issues as detailed above in reference to the rejections under 35 U.S.C. 112(a) and (b) and are also directed to non-eligible subject matter as detailed in the rejections under 35 U.S.C. 101, it has not been possible to fully construe pending Claims 1-30 in order to analyze the claims for novelty under 35 U.S.C. 102 and non-obviousness under 35 U.S.C. 103. As per MPEP § 2173.06 II, if there is uncertainty as to the proper interpretation of the limitations of the claim, it would not be proper to reject such a claim on the basis of prior art. See also In re Steele, 305 F.2d 859, 134 USPQ 292 (CCPA 1962). A search has been performed to the extent possible, and references that appear to be relevant are cited on the attached form PTOL-892.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Zachary A Davis whose telephone number is (571)272-3870. The examiner can normally be reached Monday-Friday, 9:00am-5:30pm, Eastern Time.
Examiner interviews are available via telephone and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Rupal D Dharia can be reached at (571) 272-3880. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Zachary A. Davis/Primary Examiner, Art Unit 2492
Prosecution Insights