DETAILED ACTION
The following FINAL Office action is in response to Supplemental Amendment filed on August 26, 2026 for 18/515,632.
Acknowledgements
Claims 5-9 are canceled.
Claims 1-4 and 10-23 are pending.
Claims 1-4 and 10-23 have been examined.
Notice of Pre-AIA or AIA Status
The present application, filed on or after December 13, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
In response to the Applicant’s amendments and arguments, the rejection under 35 USC § 103 has been withdrawn.
In response to the Applicant’s arguments under 35 USC § 101, Applicant argues that amended claim 1 is not directed to a mere abstract idea such as generic authentication or signing, but instead recites a specific technological implementation for generating and verifying a cryptographically bound data structure using hardware-based security components. Applicant argues that the limitations impose a particular manner of organizing, combining, and transforming data within a defined hardware-backed environment and the resulting signed digital object is therefore not merely "data that has been signed," but a specifically structured cryptographic construct that binds application-level content with device-level characteristics providing a concrete technological improvement because it enables a relying party to verify not only the integrity of application data, but also the provenance and capabilities of the authenticator that participated in generating the signature. Lastly, Applicant argues that the claim is tied to a particular hardware configuration including an authenticator, an attestation module, and secure storage of private keys ensuring that the claim does not preempt all forms of authentication or signing but is limited to a particular implementation that yields concrete security benefits.
Examiner respectfully disagrees as after careful reconsideration and consultation with SPE and further analysis of the amended claims, claims 1-4 and 10-23 are still reciting authenticating users by allowing them to generate signatures. The amended claim limitations “securely authenticate a user via biometric input, manual user input and/or detecting current conditions;…, a digital signature is computed to sign over an object that includes one or more attributes and application data wherein the object comprises a structured data object including the application data and metadata, wherein the digital signature is generated by signing a concatenation of the application data and the metadata … on condition that the user has been authenticated; the signed object being transmitted from the client to a relying party; upon receiving the signed digital object from the client, to verify the signed digital object through determining that the digital signature corresponds to the application data and the metadata included in the signed object” are placed within the “certain methods of organizing human activity” classified under “fundamental economic principles or practices”, specifically “mitigating risk” as part of a transaction because the amended claims are still reciting a series of transactions with the relying party to remotely authenticate each user by generating signatures using various information (see Specification paragraph 0377). Also, paragraphs 0627-0628 from Specification further disclose implementation of protecting against misuse of key from malware attacks and to make authentication secure. Additionally, paragraph 0630 discloses using an effective user verification method to prevent misuse of a key and protect against attacks. Also, the judicial exception is not integrated into a practical application because the additional elements of the claims such as the use of an authenticator, a first circuit on a client device that comprises a second circuit to maintain a secure store of private keys, digital object, a pair of the public key and the first private key, attestation module and a server device are being used as tools to implement the abstract idea and does not render the claim patent eligible because it still requires no more than a computer performing functions that correspond to acts required to carry out the abstract idea. Examiner does not see an improvement to the technology and the use of an authenticator, a first circuit on a client device that comprises a second circuit to maintain a secure store of private keys, digital object, a pair of the public key and the first private key, attestation module and a server device to merely automate or implement the abstract idea cannot provide significantly more than the abstract idea itself. Hence, the claim is not patent eligible. Examiner believes that even though there is a clear separation of roles in the client-server system, however the user authentication and authorization are being implemented or performed using the additional elements or the client-server system.The process of organizing, combining, and transforming data is very much abstract implemented within a defined hardware-backed environment using the recited technology.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-4 and 10-23 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
In the instant case, claims 1-4, 13-19 and 20-23 are directed to a system and 10-12 are directed to a method. Therefore, these claims fall within the four statutory categories of invention.
The claims recite authenticating users which is an abstract idea. Specifically, the claim recites “securely authenticate a user via biometric input, manual user input and/or detecting current conditions;…, a digital signature is computed to sign over an object that includes one or more attributes and application data wherein the object comprises a structured data object including the application data and metadata, wherein the digital signature is generated by signing a concatenation of the application data and the metadata … on condition that the user has been authenticated; the signed object being transmitted from the client to a relying party; upon receiving the signed digital object from the client, to verify the signed digital object through determining that the digital signature corresponds to the application data and the metadata included in the signed object” which is grouped within the “certain methods of organizing human activity” grouping of abstract ideas in prong one of step 2A of the Alice/Mayo test, classified under “fundamental economic principles or practices”, specifically “mitigating risk” as part of a transaction (See MPEP 2106, specifically 2106.04(a)) because – for example, in this case, the claims involve a series of steps for authenticating users, allowing them to generate digital signatures and being remotely authenticated by a relying party through determining that the digital signature corresponds to the application data and the metadata included in the signed digital object (see ¶00377 Specification). Accordingly, the claim recites an abstract idea (See MPEP 2106, specifically 2106.04(a)).
This judicial exception is not integrated into a practical application because the additional elements of the claims such as the use of an authenticator, a first circuit on a client device that comprises a second circuit to maintain a secure store of private keys, digital object, a pair of the public key and the first private key, attestation module and a server device as tools to perform an abstract idea and/or generally link the use of a judicial exception to a particular technological environment (See MPEP 2106, specifically 2106.04(d)). [The use of an authenticator, a first circuit on a client device that comprises a second circuit to maintain a secure store of private keys, digital object, a pair of the public key and the first private key, attestation module and a server device to implement the abstract idea and/or generally linking the use of the abstract idea to a particular technological environment] does not render the claim patent eligible because it requires no more than a computer performing functions that correspond to acts required to carry out the abstract idea. Specifically, the authenticator, a first circuit on a client device that comprises a second circuit to maintain a secure store of private keys, digital object, a pair of the public key and the first private key, attestation module and a server device perform the steps or functions of “securely authenticate a user via biometric input, manual user input and/or detecting current conditions;…, a digital signature is computed to sign over an object that includes one or more attributes and application data wherein the object comprises a structured data object including the application data and metadata, wherein the digital signature is generated by signing a concatenation of the application data and the metadata … on condition that the user has been authenticated; the signed object being transmitted from the client to a relying party; upon receiving the signed digital object from the client, to verify the signed digital object through determining that the digital signature corresponds to the application data and the metadata included in the signed object”. The additional claim elements are not indicative of integration into a practical application, because the claims do not involve improvements to the functioning of a computer, or to any other technology or technical field (MPEP 2106.05(a)), the claims do not apply the abstract idea with, or by use of, a particular machine (MPEP 2106.05(b)), the claims do not effect a transformation or reduction of a particular article to a different state or thing (MPEP 2106.05(c)), and the claims do not apply or use the abstract idea in some other meaningful way beyond generally linking the use of the abstract idea to a particular technological environment, such that the claim as a whole is more than a drafting effort designed to monopolize the exception (MPEP 2106.05(e) and Vanda Memo). Therefore, the claims do not, for example, purport to improve the functioning of a computer. Nor do they effect an improvement in any other technology or technical field. Accordingly, the additional elements do not impose any meaningful limits on practicing the abstract idea, and the claims are directed to an abstract idea.
The claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception because, when analyzed under step 2B of the Alice/Mayo test (See MPEP 2106, specifically 2106.05), the additional elements of authenticator, a first circuit on a client device that comprises a second circuit to maintain a secure store of private keys, digital object, a pair of the public key and the first private key, attestation module and a server device, to perform the steps amounts to no more than using an authenticator, a first circuit on a client device that comprises a second circuit to maintain a secure store of private keys, digital object, a pair of the public key and the first private key, attestation module and a server device to automate and/or implement the abstract idea of authenticating users. As discussed above, taking the claim elements separately, the authenticator, a first circuit on a client device that comprises a second circuit to maintain a secure store of private keys, digital object, a pair of the public key and the first private key, attestation module and a server device perform the steps of Claim 1. These functions correspond to the actions required to perform the abstract idea. Viewed as a whole, the combination of elements recited in the claims merely recite the concept of authenticating users. Therefore, the use of these additional elements does no more than employ the computer as a tool to automate and/or implement the abstract idea. The use of an authenticator, a first circuit on a client device that comprises a second circuit to maintain a secure store of private keys, digital object, a pair of the public key and the first private key, attestation module and a server device to merely automate and/or implement the abstract idea cannot provide significantly more than the abstract idea itself (MPEP 2106.05(I)(A)(f) & (h)). Therefore, the claim is not patent eligible.
Dependent claims further recite details of authenticating users before allowing them to compute digital signatures by processing input data and receiving authorization describing the abstract idea of authenticating users. The dependent claims recite additional elements such as “pluggable digest/hash circuitry/logic, secure transaction circuitry/logic, a blockchain, public key and server device”, however, they do not integrate the abstract idea into a practical application or that provide significantly more than the abstract idea. Therefore, the dependent claims are also not patent eligible.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ZEHRA RAZA whose telephone number is (571)272-8128. The examiner can normally be reached 10AM-6:30PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, John W Hayes can be reached at (571) 272-6708. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ZEHRA RAZA/Examiner, Art Unit 3697
/JOHN W HAYES/Supervisory Patent Examiner, Art Unit 3697
Prosecution Insights