DETAILED ACTION
A response was received on 26 May 2026. By this response, Claims 1-8, 11, 13, 14, 23, 25, and 26 have been amended. No claims have been added or canceled. Claims 1-14 and 21-26 are currently pending in the present application.
Response to Amendment
The amendments to the abstract do not comply with the requirement of 37 CFR 1.52(b)(2)(i) that the specification (including the abstract and claims) and amendments thereto must have lines that are 1 1/2 or double spaced. Applicant is required to resubmit the amendments to the abstract with the required spacing. The amendments to the abstract have not been entered.
Response to Arguments
Applicant’s arguments with respect to the rejection of Claims 1-8 under 35 U.S.C. 103 have been considered but are moot in view of the new grounds of rejection set forth below.
Applicant's arguments filed 26 May 2026 have been fully considered but they are not persuasive.
Regarding the objection to the drawings for informalities, Applicant argues that the specification clearly outlines the decisions in Figures 3A-3C and 5A and therefore provide a proper understanding of the disclosed invention (page 1 of the present remarks). However, even with the branches of the decisions labeled (noting also that the text of those labels is very small), it is still not clear what decisions are made in the various decision diamonds. For example, the branches from 306A, 304B, and 304C each show “valid” or “else”, but the drawings do not make clear what is actually checked for validity in these decisions. Similarly, the decisions in Figure 5A are also not clearly shown in the flowchart itself. As per 37 CFR 1.84(o), descriptive legends may be required by the Examiner when necessary for understanding of the drawings. Here, the decision made in each decision diamond must be explicitly included in the drawing and not just the specification.
Regarding the rejection of Claims 1-14 and 21-26 under 35 U.S.C. 112(b), and with particular reference to independent Claims 1 and 9, Applicant argues that the terms “local” and “remote” are in the context of the recited computing device (pages 2-3 of the present remarks). However, it is noted that there are first and second computing devices in all of the claims, and Claim 1 further recites a system. It is not clear which of these plural entities the key management servers are intended to be local or remote to. Applicant also argues that the recitations of “a computing device” and “the computing device” in Claim 1 and its dependents have been amended to refer to a first computing device (page 2 of the present remarks). It is acknowledged that such amendments have been made in Claim 1 and its dependents; however, Claims 9, 21, and their dependents have not been amended in like manner.
Regarding the rejection of Claims 9-14 and 21-26 under 35 U.S.C. 103 as unpatentable over Lee et al, US Patent 10020939, in view of Gueron et al, US Patent 11184157, and with particular reference to independent Claims 9 and 21, Applicant argues that the cited prior art does not recite receiving a first public key from a local KMS or receiving a signed command that includes a second public key associated with a second computing device for “substantially the same reasons set forth with respect to Claim 1” (pages 5-6 of the present remarks, no particular evidence cited). However, the arguments relating to amended Claim 1 did not discuss these limitations (at least because Claim 1 does not recite such limitations) and instead focused on the lack of two key management servers (local and remote) in Lee and Gueron (see pages 3-5 of the present remarks). In response to applicant's argument that the references fail to show certain features of the invention, it is noted that the features upon which applicant relies (i.e., receiving a first public key and receiving a second command) are not recited in the rejected claims. Although the claims are interpreted in light of the specification, limitations from the specification are not read into the claims. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993).
Therefore, for the reasons detailed above, the Examiner maintains the rejections as set forth below.
Drawings
The objection to Figure 7 as requiring a prior art label is withdrawn in light of Applicant’s remarks (see page 1 of the present remarks). The objection to the drawings for informalities is NOT withdrawn for the reasons detailed above in the response to arguments.
The drawings are objected to because they include informalities. In particular, decision block 306A in Figure 3A, decision block 304B in Figure 3B, decision block 304C in Figure 3C, and decision blocks 508A, 512A, 514A, and 518A in Figure 5A are not clear as to what decisions are actually being made at these points of the flowcharts. Corrected drawing sheets in compliance with 37 CFR 1.121(d) are required in reply to the Office action to avoid abandonment of the application. Any amended replacement drawing sheet should include all of the figures appearing on the immediate prior version of the sheet, even if only one figure is being amended. The figure or figure number of an amended drawing should not be labeled as “amended.” If a drawing figure is to be canceled, the appropriate figure must be removed from the replacement sheet, and where necessary, the remaining figures must be renumbered and appropriate changes made to the brief description of the several views of the drawings for consistency. Additional replacement sheets may be necessary to show the renumbering of the remaining figures. Each drawing sheet submitted after the filing date of an application must be labeled in the top margin as either “Replacement Sheet” or “New Sheet” pursuant to 37 CFR 1.121(d). If the changes are not accepted by the examiner, the applicant will be notified and informed of any required corrective action in the next Office action. The objection to the drawings will not be held in abeyance.
Specification
The objection to the abstract is NOT withdrawn because the abstract has not been entered, as detailed above. Applicant is required to resubmit the abstract in a manner compliant with 37 CFR 1.52, 1.72, and 1.121. The objection to the disclosure for informalities is NOT withdrawn, because it appears that Applicant has not acknowledged or addressed this objection.
The abstract of the disclosure is objected to because it includes legal phraseology of the type often used in patent claims (e.g. “wherein”) which is to be avoided in the abstract. Further, the abstract includes informalities such as minor grammatical errors. In particular, in line 3, a comma should be inserted after “a first computing device”. In line 6, the verb “writes” does not clearly follow “configured to” and is not properly in infinitive form. In line 7, it appears that a conjunction (e.g. “and” or “or”) should be inserted between writing the LKMS public key and writing the public key of the second computing device. A corrected abstract of the disclosure is required and must be presented on a separate sheet, apart from any other text. See MPEP § 608.01(b).
The disclosure is objected to because of the following informalities:
The specification does not include a brief summary of the invention as per 37 CFR 1.73. See also MPEP § 608.01(d). If a summary was intentionally omitted, Applicant is requested to make a statement on the record confirming this omission.
Appropriate correction is required. Applicant’s cooperation is again requested in correcting any errors of which applicant may become aware in the specification.
Claim Objections
The objection to Claims 1, 11, and 23 for informalities is withdrawn in light of the amendments to the claims.
Claim Rejections - 35 USC § 112
The rejection of Claims 1-14 and 21-26 under 35 U.S.C. 112(b) as indefinite is NOT withdrawn, because not all issues have been addressed and/or because the amendments have raised new issues, as detailed below.
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-14 and 21-26 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 1 recites “a local key management server” in line 3 and “a remote key management server” in line 5. It is not clear if these are remote from or local to the first computing device, the second computing device, or the overall system. The above ambiguities render the claim indefinite.
Claim 8 recites “wherein the second computing device is configured to receive the nonce and generate the digital signature…” in lines 1-2. However, because the second computing device is not clearly recited as an element of the claimed system, it is not clear how this portion of the claim is intended to limit the claimed system.
Claim 9 recites “a local key management server” in lines 2-3. It is not clear what this is local to (i.e. the computing device of line 2 or the second computing device). The claim further recites “the computing device” in lines 6 and 8. However, it is not clear whether this is intended to refer to the first computing device recited in line 2 or the second computing device. The above ambiguities render the claim indefinite.
Claim 11 recites “the computing device” in lines 2 and 3. It is not clear to which of the two computing devices this is intended to refer. Further, it is not clear what the phrase “and replacing…” is intended to modify or be coordinated with; that is, it is not clear whether the replacing is part of the validating or if it is an additional step.
Claim 13 recites “the computing device” in lines 1-2. It is not clear to which of the two computing devices this is intended to refer. The claim further recites “initiating a connection to the second computing device”. It is not clear which device or element performs this step.
Claim 14 recites “the computing device” in lines 1-2 and 3. It is not clear to which of the two computing devices this is intended to refer. The claim further recites “and validating” in line 3. It is not grammatically clear what this is intended to modify or be coordinated with, e.g. if it is another further step of the method. The claim additionally recites “before initiating a connection” in line 4. It is not clear which device or element performs this step.
Claim 21 recites “a computing device” in line 4. It is not clear whether the claimed processor is intended to be part of this computing device. The claim further recites “a local key management server” in lines 4-5. It is not clear what this is local to (i.e. the computing device of line 2 or the second computing device). The claim additionally recites “the computing device” in lines 8 and 10. However, it is not clear whether this s intended to refer to the first computing device recited in line 4 or the second computing device. The above ambiguities render the claim indefinite.
Claim 23 recites “and replacing the KMS public key with the first public key” in lines 3-4. It is not clear what this phrase is intended to modify or be coordinated with; that is, it is not clear whether the replacing is part of the validating or if it is an additional step.
Claim 25 recites “the computing device” in line 2. It is not clear to which of the two computing devices this is intended to refer. The claim further recites “initiating a connection to the second computing device”. It is not clear which other device is to be connected to the second computing device.
Claim 26 recites “the computing device” in lines 2 and 3-4. It is not clear to which of the two computing devices this is intended to refer. The claim further recites “and validating” in line 3. It is not grammatically clear what this is intended to modify or be coordinated with, e.g. if it is another further step. The claim also recites “before initiating a connection” in line 4. It is not clear which device or element performs this step.
Claims not explicitly referred to above are rejected due to their dependence on a rejected base claim.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-8 are rejected under 35 U.S.C. 103 as being unpatentable over Lee et al, US Patent 10020939, in view of Gueron et al, US Patent 11184157, and Egorov et al, US Patent 10691817 (cited in the previous Office action).
In reference to Claim 1, Lee discloses a system that includes a first computing device and a key management server (see Figure 3, device 300 and KMS 320) where the KMS is configured to write a public key to the first computing device using a first command and write a public key of a second computing device a second command (see column 9, lines 35-48, key substituted; see also column 10, lines 38-48, new public key encrypted). However, Lee does not explicitly disclose that the commands are signed.
Gueron discloses a system configured to write a public key using a signed command and replace the public key with a signed command from a local KMS (see Figure 4 and column 5, line 50-column 6, line 23, update signed by public key, noting also step 414, new public key acquired). Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Gueron to include signing the update commands, in order to allow verification or validation of the update/command (see Gueron, column 5, lines 40-49, for example).
However, neither Lee nor Gueron explicitly discloses both a local and remote key management server. Egorov discloses a system that includes a first computing device, a local KMS, and a remote KMS (see Figures 3, 5, and 6, LocalKMS 32 and remote KMS 18) in which a replacement public/private key pair is generated and transmitted between the key management servers (see column 4, lines 29-41, and column 12, lines 1-20). Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to further modify the system of Gueron and Lee to include local and remote key management servers in order to implement key rotation (see Egorov, column 4, lines 29-41).
In reference to Claims 2-4, Lee, Gueron, and Egorov further disclose requesting and receiving a command and validating a digital signature, where the public key is replaced if the signature is valid (see Lee, column 9, lines 35-48, key substituted; see also column 10, lines 38-48, new public key encrypted; see also Gueron, steps 408-410, update received and verified, steps 412-414, update applied and new public key acquired).
In reference to Claims 5 and 6, Lee, Gueron, and Egorov further disclose receiving the public key of the second device and confirming an identity of the second device, where the signature on the second command is validated using a public key (see Lee, column 10, lines 38-48, new public key encrypted; see also Gueron, steps 408-410, update received and verified, and column 12, lines 34-42, user identity verified).
In reference to Claims 7 and 8, Lee, Gueron, and Egorov further disclose transmitting and receiving a nonce and signing the nonce and an identifier to allow validation of the digital signature (see Gueron, column 17, lines 14-42, noting particularly lines 17-21, nonce included in signature).
Claims 9-14 and 21-26 are rejected under 35 U.S.C. 103 as being unpatentable over Lee et al, US Patent 10020939, in view of Gueron et al, US Patent 11184157.
In reference to Claim 9, Lee discloses a method that includes receiving, by a first computing device, a first public key from a local key management server and a command that includes a second public key associated with a second computing device, and writing the second public key to a secure storage area of the first computing device (see Figure 3, device 300 and KMS 320, and column 9, lines 35-48, key substituted; see also column 10, lines 38-48, new public key encrypted). However, Lee does not explicitly disclose that the command is signed.
Gueron discloses a method that includes receiving a public key from a local KMS and receiving a signed command that includes a second (replacement) public key replacing the public key with a signed command from a local KMS (see Figure 4 and column 5, line 50-column 6, line 23, update signed by public key, noting also step 414, new public key acquired) and validating the command using the first public key (steps 408-410, update received and verified, and column 12, lines 34-42, user identity verified). Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the method of Gueron to include signing the update command, in order to allow verification or validation of the update/command (see Gueron, column 5, lines 40-49, for example).
In reference to Claim 10, Lee and Gueron further disclose receiving a second signed command signed using a KMS private key (Figure 4 and column 5, line 50-column 6, line 23, update signed by public key).
In reference to Claim 11, Lee and Gueron further disclose validating a digital signature, where the public key is replaced if the signature is valid (see Lee, column 9, lines 35-48, key substituted; see also column 10, lines 38-48, new public key encrypted; see also Gueron, steps 408-410, update received and verified, steps 412-414, update applied and new public key acquired).
In reference to Claim 12, Lee and Gueron further disclose receiving the second public key and a digital signature, where the signature on the command is validated using the first public key (see Lee, column 10, lines 38-48, new public key encrypted; see also Gueron, steps 408-410, update received and verified, and column 12, lines 34-42, user identity verified).
In reference to Claims 13 and 14, Lee and Gueron further disclose transmitting and receiving a nonce and signing the nonce and an identifier to allow validation of the digital signature (see Gueron, column 17, lines 14-42, noting particularly lines 17-21, nonce included in signature).
Claims 21-26 are directed to software implementations of the methods of Claims 9-14, and are rejected by a similar rationale.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Zachary A Davis whose telephone number is (571)272-3870. The examiner can normally be reached Monday-Friday, 9:00am-5:30pm, Eastern Time.
Examiner interviews are available via telephone and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Rupal D Dharia can be reached at (571) 272-3880. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Zachary A. Davis/Primary Examiner, Art Unit 2492
