DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendment / Arguments
Regarding claims rejected under 35 USC 112(a):
Applicant’s amendment is considered to have overcome the applied rejection. As such, the rejection has been withdrawn.
Regarding claims rejected under 35 USC 112(b):
Applicant’s amendment is considered to have overcome the applied rejection. As such, the rejection has been withdrawn.
Regarding claims rejected under 35 USC 103:
Applicant's arguments against the Azema-Doyle combination have been fully considered but they are not persuasive.
With respect to Azema, Applicant argues that “A manufacturer certificate signature (SIG CERT) is generated by hashing the other fields of the manufacturer certificate (including the DIE ID) and encrypting the hashed code with the MAN PRI KEY (see paragraph [00541 of Azema). In Fig. 5 of Azema above, the public key MAN_PUB KEY is used to decrypt the certificate signature (SIGCERT) for hash comparison verification, rather than to obtain the DIE ID (alleged as the claimed "predetermined hardware information"). In particular, as the SIG CERT is generated by encrypting a hashed value, the decrypted SIG CERT is merely a hashed value, which represents all of the fields of the manufacturer certificate 36. In other words, the process of decrypting the SIG CERT in Azema would not obtain any hardware information DIE ID to be used for hardware verification.” In response, it is noted that the DIE_ID is part of the manufacturer certificate as in TABLE 1 of Azema, and that it is in fact encrypted in its hashed form using the manufacturer’s private key. As per the comparison step in the abstract, FIG. 5, [0064], and [0077]-[0078] of Azema, the decrypted hashed form is compared against expected values of the certificate fields. If the DIE_ID is not the correct DIE_ID, then the comparison would fail because the decrypted hash would be different. This is considered to disclose the claim limitations of “wherein the certificate is formed by encrypting the predetermined hardware information and the service information of the service using a private key (i.e., encrypting the DIE_ID hash); determine whether the predetermined hardware information matches device hardware information of the electronic device (i.e., determining whether the hashes match).”
Although Azema discloses a SW_SIG field as part of its certificate fields, it does not explicitly disclose further obtaining and service information of the service from the decrypted certificate; the certificate further formed by encrypting the service information of the service; wherein the service information of the service indicates that the electronic device is authorized to use the service. However, Doyle has been relied upon for these teachings. For instance, [0033]-[00337] of Doyle.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-8 and 17-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention. Independent claim 8 is drawn to “A storage device… configured to” perform steps, but further recites “such that the storage device causes the electronic device to decrypt the certificate using the public key to obtain predetermined hardware information and service information of the service from the decrypted certificate” and “such that the storage device causes the electronic device to run the at least one image file to access the service.” The claim limitations at issue are drawn to steps performed by the electronic device rather than the storage device. Although the electronic device’s functionality and acts may be responsive to receiving certain data from the storage device, the storage device does not “cause” anything to occur at the electronic device. Specifically, the electronic device decrypts the certificate using the public key to obtain predetermined hardware information and service information of the service from the decrypted certificate; and it also runs the at least one image file to access the service. This does not appear to affect the scope of the claimed “storage device” to which the claim is drawn. These limitations are drawn to actions taken outside of the scope of the storage device. As such, a person of ordinary skill in the art could not interpret the metes and bounds of the claim so as to understand how to avoid infringement.
Independent claim 17 is also rejected under this analysis because it recites substantially similar claim limitations (“such that the storage device causes the electronic device to” language) under “wherein the storage device is configured to execute.” In claim 17, the steps performed by the electronic device are under the “wherein the storage device is configured to execute” limitation, which causes the same issues as discussed in the analysis of claim 1 above.
The dependent claims do not rectify this issue and are therefore likewise rejected.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-2, 4-10, and 12-15 is/are rejected under 35 U.S.C. 103 as being unpatentable over Azema (US 2004/0025010 A1) in view of Doyle (US 2009/0063849 A1).
Regarding claim 1, Azema discloses: A storage device (external memory 14 in FIG. 1 of Azema), storing a public key (public keys stored in certificate in TABLE 1 and FIG. 1-2 of Azema—e.g., manufacturer’s public key), a certificate (certificates stored in the external memory as in FIG. 1 of Azema—e.g., manufacturer’s certificate), and at least one image file corresponding to a service (system boot firmware stored in the external memory as in FIG. 1 of Azema—also see application software in FIG. 1), the storage device is configured to:
in response to determining that the storage device is connected (e.g., 54 in FIG. 3 and [0054] of Azema concerning power-on and connection) to an electronic device (particular computing device in Azema—e.g., FIG. 1), provide the public key to the electronic device (e.g., [0058] of Azema) such that the storage device causes the electronic device to decrypt the certificate using the public key to obtain predetermined hardware information (e.g., DIE_ID in TABLE 1 of Azema),
Refer to at least [0051]-[0053], [0063], and [0066] of Azema with respect to decrypting the manufacturer’s certificate as part of the process of verifying integrity.
Refer to at least [0074]-[0077] of Azema with respect to obtaining the DIE_ID after the decryption step as part of the process of verifying integrity.
wherein the certificate is formed by encrypting the predetermined hardware information using a private key;
Refer to at least FIG. 2 and TABLE 1 of Azema with respect to encrypting certificate fields using the manufacturer’s private key.
determine whether the predetermined hardware information matches device hardware information of the electronic device; in response to determining that the predetermined hardware information matches the device hardware information of the electronic device, provide the at least one image file to the electronic device such that the storage device causes the electronic device to run the at least one image file to access the service,
Refer to at least the abstract, [0064], and [0077]-[0078] of Azema with respect to only ensuring only valid firmware is loaded to the particular electronic device based on the process of verifying integrity (i.e., including matching the DIE_ID as in [0077] of Azema).
Azema does not specify: further obtaining and service information of the service from the decrypted certificate (the manufacturer certificate); the certificate further formed by encrypting the service information of the service; wherein the service information of the service indicates that the electronic device is authorized to use the service. However, Azema in view of Doyle discloses: further obtaining and service information of the service from the certificate (the manufacturer certificate); wherein the service information of the service indicates that the electronic device is authorized to use the service;
Refer to at least 160 in FIG. 1, 190 in FIG. 2, [0011]-[0012], and [0026]-[0028] of Doyle with respect to an encrypted certificate (e.g., manufacturer certificate) and extensions generated for a specific distribution of a virtual appliance to a specific customer. The extensions comprise configuration parameters and constraints, including for licensure control.
the certificate further formed by encrypting the service information of the service;
Refer to at least [0033]-[0034] of Doyle with respect to encrypting the configuration parameters and constraints.
The teachings of both Azema and Doyle concern secure software installation using certificate-based verification, and are considered to be within the same field of endeavor and combinable as such.
Therefore it would have been obvious to one of ordinary skill in the art before the filing date of Applicant’s invention to modify the teachings of Azema to further implement the device certificate and extensions of Doyle to allow for more granular software distribution rights (e.g., [0032] of Doyle with respect to a specific customer and configuration associated with a given virtual appliance).
Regarding claim 2, Azema-Doyle discloses: The storage device according to claim 1, wherein the at least one image file comprises a product image file (firmware 30 in Azema) corresponding to an operating environment of the service (virtual environment 230 in Doyle), and the storage device is further configured to: in response to determining that the storage device is connected to the electronic device, provide the product image file to cause the electronic device to run the product image file to operate the operating environment of the service (e.g., virtual environment / OS 230 for virtual applicant 240 in FIG> 2 of Doyle).
Refer to at least FIG. 1 and [0035] of Azema with respect to system boot firmware 30 (i.e., for booting an OS).
Refer to at least the abstract, [0035]-[0036], and [0080] of Azema with respect to additionally verifying integrity for application software and data files.
This claim would have been obvious for substantially the same reasons as claim 1 above.
Regarding claim 4, it is rejected for substantially the same reasons as claim 1 above (i.e., the citations and obviousness rationale).
Regarding claim 5, Azema-Doyle discloses: The storage device according to claim 1, wherein the predetermined hardware information comprises a predetermined hardware manufacturing serial number, and the device hardware information comprises a device hardware manufacturing serial number, wherein in response to determining that the predetermined hardware manufacturing serial number matches the device hardware manufacturing serial number, it is determined that the predetermined hardware information matches the device hardware information of the electronic device.
Refer to at least TABLE 1, [0051]-[0053], and [0077] of Azema with respect to matching the DIE_ID as part of verifying integrity. It is noted that the cited portions also concern additional values such as an IMEI.
Regarding claim 6, it is rejected for substantially the same reasons as claim 5 above.
Regarding claim 7, Azema-Doyle discloses: The storage device according to claim 1, wherein the service information of the service comprises an authorization period of the service, and in response to determining that a system time of the electronic device is within the authorization period, it is determined that the service information of the service indicates that the electronic device is authorized to use the service.
Refer to at least [0040] of Azema with respect to expiration dates for certificates as they are known in the art.
Therefore it would have been obvious to one of ordinary skill in the art before the filing date of Applicant’s invention to modify the teachings of Azema-Doyle to additionally implement expiration dates as part the certificate-based verification because design incentives or market forces provided a reason to make an adaptation (i.e., renting or leasing rights for a time; preventing use of expired software products), and the invention resulted from application of the prior knowledge in a predictable manner (checking certificate expiration date).
Regarding claim 8, Azema-Doyle discloses: The storage device according to claim 1, wherein the storage device is a portable storage device.
Refer to at least 14 in FIG. 1 of Azema with respect to external non-volatile memory.
Refer to at least [0010] and [0013] of Doyle with respect to known in the art memory devices, including flash memory cards/sticks.
The claim would have been obvious because the particular known technique of using a portable storage device as external memory was recognized as part of the ordinary capabilities of one skilled in the art.
Regarding independent claim 9, it is substantially similar to independent claim 1 above, and is therefore likewise rejected (i.e., the citations and obviousness rationale).
Regarding dependent claims 10 and 12-15, they are substantially similar to claims 2 and 4-7 above, and are therefore likewise rejected.
Claim(s) 3 and 11 is/are rejected under 35 U.S.C. 103 as being unpatentable over Azema-Doyle as applied to claims 1-2, 4-10, and 12-15 above, and further in view of Sapuntzakis (US 8,527,982 B1).
Regarding claim 3, Azema-Doyle does not specify: in response to determining that the predetermined hardware information matches the device hardware information of the electronic device, cause the electronic device to provide a user interface in the operating environment, wherein the user interface has a service menu, and the service menu comprises a service option corresponding to the service; and in response to determining that the service option is selected, cause the electronic device to determine whether the service information of the service indicates that the electronic device is authorized to use the service. However, Azema-Doyle in view of Sapuntzakis discloses: in response to determining that the predetermined hardware information matches the device hardware information of the electronic device, cause the electronic device to provide a user interface in the operating environment, wherein the user interface has a service menu, and the service menu comprises a service option corresponding to the service; and in response to determining that the service option is selected, cause the electronic device to determine whether the service information of the service indicates that the electronic device is authorized to use the service.
Refer to at least Col. 6, LI. 37-67, Col. 7, LI. 4-10, and Col. 9, LI. 5-14 of Sapuntzakis with respect to access controls associated with a user interface that allows selection of relevant software associated with a peripheral.
The teachings of Sapuntzakis likewise concern secure software installation using certificate-based verification, and are considered to be within the same field of endeavor and combinable as such.
Therefore it would have been obvious to one of ordinary skill in the art before the filing date of Applicant's invention to modify the teachings of Azema-Doyle to further implement a user interface and associated access controls for at least the purpose of providing support for having multiple host devices' software installed on a single peripheral. In that way, a single peripheral can conveniently be used to work with multiple host devices.
Regarding claim 11, it is substantially similar to claim 3 above, and is therefore likewise rejected.
Claim(s) 17 and 19-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Azema (US 2004/0025010 A1) in view of Doyle (US 2009/0063849 A1) and Hughes (US 2008/0319779 A1).
Regarding independent claim 17, it is substantially similar to independent claim 1 where it recites “A verification and authorization system, comprising: a storage device” and "wherein the storage device is configured to execute… wherein the service information of the service indicates that the electronic device is authorized to use the service." As such, these limitations are rejected under the same citations as in claim 1 above. Azema discloses the remaining limitations as follows: [the system being] configured to generate a public key and a private key (e.g., [0037] of Azema with respect to generating asymmetric keys), and generate at least one image file based on the service information of the service (e.g., [0035] of Azema with respect to storing firmware and software to the external non-volatile memory); and generate a certificate based on the private key, the predetermined hardware information (e.g., [0047]-[0054] of Azema with respect to generating the manufacturer’s certificate), and store the public key, the certificate, and the at least one image file in the storage device (e.g., 36 and TABLE 1 in Azema with respect to storing the manufacturer’s certificate in the external non-volatile memory).
Azema does not specify: a product server; in response to a service application request, obtain predetermined hardware information and service information of a service that is applied; generating the keys corresponding to the service application request; generating the manufacturer’s certificate further based on the service information of the service. However, Azema in view of Doyle discloses: generating the manufacturer’s certificate further based on the service information of the service.
Refer to at least FIG. 1 and [0023] of Doyle with respect to generating the device certificate at the manufacturer including its extensions. The extensions comprise configuration parameters and constraints, including for licensure control (e.g., [0028] of Doyle).
The teachings of both Azema and Doyle concern secure software installation using certificate-based verification, and are considered to be within the same field of endeavor and combinable as such.
Therefore it would have been obvious to one of ordinary skill in the art before the filing date of Applicant’s invention to modify the teachings of Azema to further implement generating and validating the device certificate and extensions of Doyle to allow for more granular software distribution rights (e.g., [0032] of Doyle with respect to a specific customer and configuration associated with a given virtual appliance).
Azema-Doyle does not specify: in response to a service application request, obtain predetermined hardware information and service information of a service that is applied; generating the keys corresponding to the service application request. However, Azema-Doyle in view of Hughes discloses: in response to a service application request, obtain predetermined hardware information and service information of a service that is applied;
Refer to at least [0034], [0039]-[0041], and [0046]-[0048] of Hughes with respect to a request to the server to associate hardware with a particular application program.
generating the keys corresponding to the service application request.
Refer to at least [0033], [0046], and [0061]-[0062] of Hughes with respect to generating keys associated with the application program.
The teachings of Hughes likewise concern secure software installation using certificate-based verification, and are considered to be within the same field of endeavor and combinable as such.
Therefore it would have been obvious to one of ordinary skill in the art before the filing date of Applicant’s invention to modify the teachings of Azema-Doyle to further implement generating the certificate and key pair responsive to a request because design incentives or market forces provided a reason to make an adaptation (i.e., providing software on-demand), and the invention resulted from application of the prior knowledge in a predictable manner (obtaining the input values for generation from a given source).
Regarding claims 19-20, they are substantially similar to claims 5-7 above, and are therefore likewise rejected.
Claim(s) 18 is/are rejected under 35 U.S.C. 103 as being unpatentable over Azema-Doyle-Hughes as applied to claims 17 and 19-20 above, and further in view of Sapuntzakis (US 8,527,982 B1).
Regarding claim 18, it is substantially similar to elements of claims 2-4, and is therefore rejected under the same analyses as claims 2-4 above.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to VADIM SAVENKOV whose telephone number is (571)270-5751. The examiner can normally be reached 12PM-8PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey L Nickerson can be reached at (469) 295-9235. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Jeffrey Nickerson/Supervisory Patent Examiner, Art Unit 2432
/V.S/Examiner, Art Unit 2432
Prosecution Insights