DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Status of Claims
This action is in response to the amendment filed on December 10, 2025.
Claims 1-12 are pending.
Claims 1, 5 and 9 have been amended.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on January 6, 2026 has been considered by the Examiner.
Response to Arguments
Applicant’s arguments, filed December 10, 2025, with respect to the rejections under 35 USC 101 and 35 USC 103 have been fully considered.
Applicant argues the rejection of claims 1-12 under 35 U.S.C. § 101 on pages 9-10. Applicant argues that amended claim 1 “plainly does not require that both of the aforementioned recitations be performed at the same time,” and therefore the recitations are “not conditional statements.” Examiner disagrees. The claim language expressly recites two alternative actions performed in response to determining different conditions:
in response to determining that a data amount of the user information stored in the central database is small, executing the first biometrics authentication using biometrics information registered in the central database, rather than the biometrics information included in the visitor registration registered in the guest database; and
in response to determining that the data amount of the user information stored in the central database is large, executing the first biometrics authentication using the biometrics information included in the visitor registration information stored in the guest database.
Thus, the claim still recites a decision-making process based on a condition (small or large data amount) and selection of one of two known authentication data sources based on that condition. Merely labeling the claim language as “not conditional” does not change the substance of the recitation. The claim continues to set forth a generic comparison/determination and a corresponding choice between data sources, which is properly characterized as method of organizing human activity.
The amendment does not add significantly more. Applicant’s amendment does not integrate the abstract idea into a practical application or recite a technological improvement to the functioning of a computer, database, or biometrics authentication system. The claim still uses conventional components at a high level of generality, including:
at least one processor;
a central database;
a guest database; and
biometrics authentication.
The claim does not recite any particular improvement in computer performance, database architecture, biometric matching technique, network operation, or security mechanism. Instead, it recites using one data source when one condition is met and another data source when another condition is met. Such conditional selection of information for authentication is an abstract implementation of a business or administrative rule, not “significantly more.”
Applicant’s arguments regarding claims 5 and 9 are not persuasive for the same reasons discussed above with respect to claim 1. The cited claims recite similar conditional use of biometrics information and therefore do not add meaningful limitations that amount to significantly more.
Claims 2–4, 6–8, and 10–12 depend from claims 1, 5, and/or 9 and include additional limitations. However, the additional limitations do not overcome the underlying abstract nature of the independent claims and do not add an inventive concept sufficient to transform the abstract idea into patent-eligible subject matter. The dependent claims are likewise directed to the same abstract concept implemented with generic computer functionality.
Applicant argues the rejection of claims 1-12 under 35 U.S.C. § 103 on pages 11-12. Applicant’s arguments are not persuasive. Applicant argues that the cited references do not teach or suggest the recited features of claim 1, specifically:
“in response to determining that a data amount of the user information stored in the central database is small, executing the first biometrics authentication using biometrics information registered in the central database, rather than the biometrics information included in the visitor registration information registered in the guest database”; and
“in response to determining that the data amount of the user information stored in the central database is large, executing the first biometrics authentication using the biometrics information included in the visitor registration information stored in the guest database.”
Applicant further argues that these recitations are “not conditional statements,” but instead require that both recitations be performed, though not at the same time.
Examiner disagrees. The claim expressly recites two alternative authentication pathways dependent on a determination of the amount of user information stored in the central database. The fact that the claim recites the alternatives in the same claim does not mean both alternatives must occur simultaneously. Rather, the claim is reasonably interpreted as requiring that the claimed system be capable of performing the recited authentication operation under either of the stated conditions.
As such, the claim merely recites a conditional selection between two known data sources for biometrics authentication. This is a functional recitation of a choice based on data availability or data volume, not a structural limitation that distinguishes over the prior art.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-12 rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being incomplete for omitting essential steps, such omission amounting to a gap between the steps. See MPEP § 2172.01. The omitted steps are: a determining step. Newly amended claims 1, 5 and 9 recite in response to determining…however there is no previous step of determining anything.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-12 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1
In Step 1 of the test, the claims were found to be directed to one of the four statutory categories, which is a process. Claims 1-4 are directed to an apparatus comprising a memory with instructions, and at least one processor that executes the instructions to perform the process; claims 5-8 are directed to a method of executing the process; claims 9-12 are directed to a non-transitory storage medium including a program performing the process. Therefore, the result of Step 1 is the claims are directed to at least one statutory category.
Step 2A- Prong 1
In Step 2A(1), the claims were found to recite an abstract idea. Claims 1, 5 and 9 recite similar limitations as follows:
executing a first biometrics authentication using:
first biometrics information acquired from a person at an entrance of a management area; and
all of registered biometrics information of the person included in visitor registration information, which is stored in a guest database, that pertains to a list of persons who are allowed to enter the management area;
distributing a part of the registered biometrics information as a watch list to terminals in the management area when the first biometrics authentication is successful, which indicates that the person is allowed to enter the management area;
acquiring second biometrics information of the person who is allowed to enter the management area; and
executing, with reference to the watch list, a second biometrics authentication using the second biometrics information and the part of the registered biometrics information when the person performs transactions in the management area,
wherein the visitor registration information is a portion of user information stored in a central database, and includes the user information of just the persons who are allowed to enter the management area, and
wherein the information processing method further comprises:
in response to determining that a data amount of the user information stored in the central database is small, executing the first biometrics authentication using biometrics information registered in the central database, rather than the biometrics information included in the visitor registration information registered in the guest database; and
in response to determining that the data amount of the user information stored in the central database is large, executing the first biometrics authentication using the biometrics information included in the visitor registration information stored in the guest database.
The emphasized limitations are elements that describe an abstract idea. The concepts of primary authentication for access using credentials (biometrics are used for identification), registration of the credentials, distribution of the credentials to other locations, and the secondary authentication for transactions, are all considered elements of commercial and legal interactions. The use of biometric information is a known method of personal identification, as shown in the art of record, is part of the abstract idea of gathering identification information for registration and authentication. The method of authentication based on data amount is also part of the abstract idea because it does not change the process due to the conditions of the stored data. The process of registration and authentication can be determined as a legal interaction, one of certain methods of organizing human activity.
The dependent claims 2-4, 6-8 and 10-12 further support the interpretation of the abstract idea. Therefore, the result of Step 2A(1) is the claims recite an abstract idea.
Step 2A- Prong 2
In Step 2A(2), the claims that recite the abstract idea do not integrate the abstract idea into a practical application. The use of the guest database and central database does not improve how the process of authentication is improved by the technology. How the information is registered and stored does not improve or change what is known as Credential Authentication. The apparatus performing the authentication does not provide an improvement to the technology known to gather biometric information and authenticating for access or action. The process does not show the use of a particular machine or computer that is an improvement to the technology used and thus the claims are not implementing the abstract idea into a practical application.
The dependent claims attempt to generally link the use of the abstract idea to a particular technological environment or field of use. Therefore, the result of Step 2A(2) is the claims do not integrate the abstract idea into a practical application.
Step 2B
In Step 2B, the claims do not include additional elements that are sufficient to amount to significantly more than the abstract idea. The claims recite information processing apparatus comprising a memory storing instructions and at least one processor configured to execute the instructions; and non-transitory storage medium storing a program executable by a computer. The claims further include terminals in the management area interpreted to scan and receive the biometric information from the users. The claims as recited do not improve on the concept of using biometric information to provide authentication and access in a broad number of terminals. While the additional elements limit the abstract idea to a specific field of technology, there is no improvement to the functions of the recited technology, nor is there an improvement to another technology or technical field. Thus, the additional elements merely recite instructions to execute the abstract idea. Considering the additional elements individually, the claims do not include elements that are sufficient to amount to significantly more than the abstract idea. Considering the additional elements in combination, the steps do not add any meaningful limits on practicing the abstract idea more than the elements analyzed individually and thus do not add significantly more to the claimed invention. Therefore, the result of Step 2B is the claims do not add significantly more to the abstract idea. The test concludes the claims 1-12 are patent ineligible.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 1-12 are rejected under 35 U.S.C. 103 as being unpatentable over US_9,727,862 (hereinafter "O'Connell"), in view of US_2014/0337930 (hereinafter "Hoyos"), in view of US_2024/0106823 (hereinafter “Ricchuiti”).
Regarding Claims 1, 5 and 9, O’Connell teaches
a memory storing instructions; and at least one processor configured to execute the instructions to perform: ("The relying party's computer 206 runs software from a broker service to manage user records and user access. The relying party's computer 206 sends message 216 to third party aggregator /acquirer 208 with the authentication data. Either the reader 202, relying party's computer 206 or third party aggregator /acquirer 208 formats the message so that it is in a format that is the same as a format for a payment authorization request message for a payment transaction" See O'Connell in Col 5 Ln 9-16).
executing a first biometrics authentication using first biometrics information acquired from a person at an entrance of a management area and all of registered biometrics information of the person, [...]; ("In operation 1001, an access request message comprising authentication data having a format that is the same as a format for a payment authorization request message for a payment transaction is received from an access terminal by one or more server computers in a payment processing network." See O'Connell in Col 21 Ln 5 7-62)
acquiring second biometrics information of the person who is allowed to enter the management area; ("A physical card or other portable consumer device is not necessary in some embodiments, such as those using biometrics. For example, a student may press his finger on a pad, or look through a viewfinder to initiate a retinal scan, in order to enter a building." See O'Connell in Col 4 Ln 3 9-43) for recording the visitor registration information of the person permitted to enter the management area (this limitation is interpreted as non-functional and given less patentable weight: "The relying party's computer 206 runs software from a broker service to manage user records and user access. The relying party's computer 206 sends message 216 to third party aggregator /acquirer 208 with the authentication data. Either the reader 202, relying party's computer 206 or third party aggregator/acquirer 208 formats the message so that it is in a format that is the same as a format for a payment authorization request message for a payment transaction." See 0' Connell in Col 5 Ln 9-16) and
executing, with reference to the watch list, a second biometrics authentication using the second biometrics information and the part of the registered biometrics information when the person performs transactions in the management area, (interpreting sending instructions to allow the gate to open: "Once the student's data is validated as authorized by the payment processor, a signal can be sent to lock 103 to unlock door 101. A signal may also be sent to reader 102 to display that access is approved." See O'Connell in Col 4 Ln 35-38)
O'Connell briefly teaches biometrics authentication ("A physical card or other portable consumer device is not necessary in some embodiments, such as those using biometrics. For example, a student may press his finger on a pad, or look through a viewfinder to initiate a retinal scan, in order to enter a building." See in Col 4 Ln 39-43; "The authentication information may involve sending a subset of the biometric data, such as fingerprint ridge, loop, lake, delta, and fork features, to a server. "Authentication data" include data, digital or analog, for determining whether a user or an associated device is what he, she, or it claims to be, or as otherwise known in the art. Authentication data can include biometric data associated with a user who is authorized to enter a secure area. It can also include an account number or identifier of an accountholder and a personal identification number (PIN), card verification value (CW), cryptogram generated from a seed, or other confidential code nominally known by no one else except the accountholder and the entity relying upon the authentication." See in Col 4 Ln 43-57).
O’Connell does not expressly teach data for biometrics authentication.
However, Hoyos does teach authentication using biometrics ("In addition, the step of authorizing the user can also include determining, by the system server, whether the transaction request indicates that the user has been biometrically authenticated. In some implementations, verifying biometric authentication can include determining whether the transaction request conforms to a predetermined configuration. For example, the transaction request can be generated by the mobile device only upon successful biometric authentication of the user by the mobile device. Accordingly, receipt of the transaction request provides confirmation that the user has been biometrically authenticated. By way of further example, the transaction request can be generated to include the key that is useable to identify the user and/or mobile device only upon successful biometric authentication. By way of further example, the transaction request can include additional indicators, flags, session information and the like which indicate that the user has been biometrically authenticated and can also provide additional security to the authenticity of the transmission." See Hoyos in [0135]).
It would have been obvious to a person having ordinary skill in the art, before the effective filing date of the claimed invention, to modify the teachings of O'Connell to include "authentication by biometrics" and "duplication of authentication", as taught by Hoyos, to improve the security of the verification information at the time of authentication.
O'Connell, in view of Hoyos, briefly discuss a list of persons who are allowed to enter the management area. The limitation is tied to the description that the biometric authentication is associated to a list of users pre-approved ("Authentication data can include biometric data associated with a user who is authorized to enter a secure area. It can also include an account number or identifier of an accountholder and a personal identification number (PIN), card verification value (CW), cryptogram generated from a seed, or other confidential code nominally known by no one else except the accountholder and the entity relying upon the authentication." See O'Connell in Col 4 Ln 50-57; "Accordingly, user authorization by the system server 105 can include further authorizing access and/or authorizing the particular transaction. More specifically, the system server 105 can query one or more defined data stores to gather any access rules (e.g., access permissions, roles, settings etc.) associated with one or more of the user's transaction accounts and which govern access using the one or more transaction accounts. Likewise, the system server can also gather access rules which govern access to the ACE. Based on the so gathered access rules and transaction details, the system server can determine whether the user is authorized to access the ACE and/or perform the requested transaction." See Hoyos in [0138]).
O’Connell, in view of Hoyos, does not expressly teach wherein the at least one processor is configured to execute the instructions to perform:
in response to determining that a data amount of the user information stored in the central database is small, executing the first biometrics authentication using biometrics information registered in the central database, rather than the biometrics information included in the visitor registration information registered in the guest database; and
in response to determining that the data amount of the user information stored in the central database is large, executing the first biometrics authentication using the biometrics information included in the visitor registration information stored in the guest database. This limitation shows a conditional element that is dependent on the size of the stored data. The conditions are non-functional.
However, Ricchuiti does teach performing authentication as a match on the stored data. (“The system may cause an authentication challenge to be transmitted to the authentication device based on determining that the biometric token is stored in the database. The authentication challenge may cause the authentication device to obtain biometric data from a user. The authentication device and/or the system (e.g., a server device) may determine if there is a sufficient match between the biometric data collected and the biometric token. If the authentication device and/or the system determines that there is a sufficient match, then the system may authenticate the login request for the second platform and/or the second service. For example, the authentication device may transmit an authentication assertion based on determining that there is a sufficient match.” See Ricchuiti in [0016]).
It would have been obvious to a person having ordinary skill in the art, before the effective filing date of the claimed invention, to modify the teachings of O’Connell to include “matching authentication”, as taught by Ricchuiti, to secure the process of authentication.
Regarding Claims 2, 6 and 10, O’Connell, in view of Hoyos, in view of Ricchuiti, teaches the limitations of claims 1, 5 and 9. O'Connell, in view of Hoyos, further teaches acquiring the part of the registered biometrics information of the person satisfying a predetermined condition from a biometrics information database for recording the part of the registered biometrics information of the person permitted to enter the management area on the watch list ("In some implementations, the configured mobile device processor 110 can determine if the biometric information captured is sufficient to generate adequate biometric identifiers. If the biometric features are not identified with sufficient detail from the biometric information captured (e.g., imagery, audio data, etc.), the configured mobile device processor can prompt the user to repeat the biometric capture process via the display or other such output of the mobile device 101a. In addition, the configured mobile device processor 110 can provide feedback during and after capture thereby suggesting an "ideal scenario", for example and without limitation, a location with adequate visible light, the appropriate distance and orientation of the camera relative to the user's face and the like." See Hoyos in [0101]).
It would have been obvious to a person having ordinary skill in the art, before the effective filing date of the claimed invention, to modify the teachings of O'Connell to include "authentication by biometrics", as taught by Hoyos, to improve the security of the verification information at the time of authentication.
Regarding Claims 3, 7 and 11, O’Connell, in view of Hoyos, in view of Ricchuiti, teaches the limitations of claims 1, 5 and 9. O'Connell, in view of Hoyos, further teaches deleting registered biometrics information of the person from the watch list when the person has left the management area. (this limitation suggests visitor registration information is stored temporarily, which contradicts the recitations in the Specification of authorization for a transaction that would be secure in the user's account; interpreting the data is converted to a different format and sends the access/transaction request to a payment processing network, where it is known the received information has been transformed and exported out of the access device: "Some embodiments are related to a method for granting access to an area at an access terminal, the method including reading, at an access terminal, authentication data from a user, formatting, using a processor operatively coupled with a memory, the authentication data in a format that is the same as a format for a payment authorization request message for a payment transaction, sending the access request message to one or more servers of a payment processing network, receiving an access response message from the one or more servers of the payment processing network in response to the access request message, determining, using the processor, from the access response message whether the user is authentic, and unlocking a barrier based on an indication in the access response message that the user is authentic." See O'Connell in Col 2 Ln 64 - Col 3 Ln 11).
Regarding Claims 4, 8 and 12, O’Connell, in view of Hoyos, in view of Ricchuiti, teaches the limitations of claims 2, 6 and 10. O'Connell, in view of Hoyos, further teaches acquiring the registered biometrics information upon the success of the first biometrics authentication. ("Accordingly, receipt of the transaction request provides confirmation that the user has been biometrically authenticated. By way of further example, the transaction request can be generated to include the key that is useable to identify the user and/or mobile device only upon successful biometric authentication. By way of further example, the transaction request can include additional indicators, flags, session information and the like which indicate that the user has been biometrically authenticated and can also provide additional security to the authenticity of the transmission." See Hoyos in [0135]; "Then at step 445, an authorization notification is generated according to whether the user is authorized to access the ACE at step 440. In some implementation, the system server 105 can transmit the authorization notification directly to the ACE that the user is attempting to access or indirectly via one or more computing devices being used by the user to access the ACE (e.g., mobile device 101a or user computing device 101b). For example, the authorization notification can be transmitted to a remote computing device 102 that controls access to the ACE and therefore requires the user authorization (e.g., a networked computing device that controls an electronic door lock providing access to a restricted location, a server that requires user authorization prior to allowing the user to access a private website or a secure data-store, a ATM terminal requiring authorization prior to dispensing funds)." See Hoyos in [0139]).
It would have been obvious to a person having ordinary skill in the art, before the effective filing date of the claimed invention, to modify the teachings of O'Connell to include "receive registered biometrics authentication", as taught by Hoyos, to improve the security of the verification information at the time of authentication.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SHAHID R MERCHANT whose telephone number is (571)270-1360. The examiner can normally be reached M-F 7:30-5.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Namrata Boveja can be reached at 571-272-8105. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Shahid Merchant/Supervisory Patent Examiner, Art Unit 3684
Prosecution Insights