DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This Office Action is in response to the Amendment filed on 01/02/2026.
In the instant Amendment, claims 1, 6, 14-17, 19-24, and 27 have been amended; and claims 1 and 14 are independent claims. Claims 1-3, 6-17, 19-24, 27, and 29 have been examined and are pending. This Action is made FINAL.
Response to Arguments
The rejections of claims 14-17, 19-23, 27, and 29 under 35 U.S.C. § 101 are withdrawn as the claims have been amended.
Applicants’ arguments in the instant Amendment, filed on 01/02/2026, with respect to limitations listed below, have been fully considered but they are not persuasive.
Applicant’s arguments: “that the cited references fail to disclose receive a verification request to verify the source of a communication between a source computing device and a recipient computing device, the verification request comprising a second source identifier, wherein the second source identifier is not a digital certificate.”
The Examiner disagrees with the Applicants. The Examiner respectfully submits that Rai discloses receive a verification request to verify the source of a communication between a source computing device and a recipient computing device, the verification request comprising a second source identifier, wherein the second source identifier is not a digital certificate (Rai: par. 0052 in 416, certificate authority 121 can authenticate client device 110 based on the PKI operation request [] the authentication 416 can include checking information associated with client device 110 and/or a user of client device 110 to determine whether client device 110 is authorized to receive a certificate [] the information associated with client device 110 and/or a user of client device 110 can include usernames, passwords, identification numbers, email addresses, client device's addresses, and any other information that can be used to authenticate client device 110 and/or a user of client device 110). More specifically, Rai discloses certificate manager 121 can receive a request from a client device to access a resource [] the client device, such as client device 110 can request access to one or more resources on enterprise 140. Additionally or alternatively, the request from the client device can include a certificate service request from client device 110. The certificate service request can be issued by client device 110 when client device 110 wants to have a certificate [par. 0067] and certificate manager 121 can receive and validate the certificate of client device 110 for accessing the one or more resources and/or for the certificate service request. In one example, the certificate can be issued using/through certificate manager 121. Additionally or alternatively, the certificate can be issued by certificate authority 141 with or without involvement of certificate manager 121 [] the validation 544 can include checking information associated with client device 110 and/or a user of client device 110 to determine whether client device 110 is authorized to receive a certificate [par. 0068]. Therefore, the examiner finds this argument not persuasive.
The amended claims 1 and 14 have been addressed in rejection below.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-3, 11, 13-17, and 24 are rejected under 35 U.S.C. 103 as being unpatentable over RAI et al. (“Rai,” US 2018/0316510) in view of Montgomery et al. (“Montgomery,” US 2022/0060467).
Regarding claim 1: Rai discloses a system comprising:
one or more processors coupled to memory (Rai: fig. 6 item 604 Processor), the one or more processors configured to:
receive a verification request to verify the source of a communication between a source computing device and a recipient computing device, the verification request comprising a second source identifier, wherein the second source identifier is not a digital certificate (Rai: par. 0052 in 416, certificate authority 121 can authenticate client device 110 based on the PKI operation request [] the authentication 416 can include checking information associated with client device 110 and/or a user of client device 110 to determine whether client device 110 is authorized to receive a certificate [] the information associated with client device 110 and/or a user of client device 110 can include usernames, passwords, identification numbers, email addresses, client device's addresses, and any other information that can be used to authenticate client device 110 and/or a user of client device 110);
determine, through accessing of a database, whether the database includes a first source identifier from among one or more user source identifiers stored in the database, the first source identifier matching the second source identifier (Rai: par. 0061 certificate manager 121 can store a mapping between the client devices and/or users of the client devices and the certificates in, for example, database 127 [] client manager 121 can determine, using the mapping, one or more certificates associated with the user and/or user's client device(s)); and
after determining the database includes the first source identifier (Rai: par. 0022 certificate manager 121 can store a mapping between the client devices and/or users of the client device and the certificates in, for example, database 127):
identify a user mapped to the first source identifier, wherein the first source identifier and the user are mapped using a digital certificate associated by the system with the user (Rai: par. 0022 by storing the mapping, certificate manager 121 can be configured to track the certificates and the client devices using the certificates [] certificate manager 121 can use the stored mapping (e.g., stored in database 127) to determine the certificate and to revoke the determined certificate).
Rai does not explicitly disclose send a response to the verification request to the recipient computing device, the response identifying the source of the communication as the user.
However, Montgomery discloses send a response to the verification request to the recipient computing device, the response identifying the source of the communication as the user (Montgomery: par. 0120 at step 804, responsive to receiving a response to the verification message specifying that the incoming phone call originated from the extracted phone number, a first notification is caused to be outputted by the client).
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of Montgomery with the system/method of Rai to include send a response to the verification request to the recipient computing device, the response identifying the source of the communication as the user. One would have been motivated for issuing digital certificates to phone numbers and verifying phone numbers based on the digital certificates to determine whether a phone number provided is accurate or inaccurate (Montgomery: par. 0004).
Regarding claim 2: Rai in view of Montgomery discloses the system of claim 1.
Montgomery further discloses wherein the first source identifier comprises a first name mapped to the user (Montgomery: par. 0070 a request is received from a client [] specifying the phone number associated with the client);
wherein the second source identifier comprises a second name (Montgomery: par. 0099 at step 502, in which a phone number is extracted from an incoming phone call); and
wherein in determining whether the database comprises a first source identifier matching the second source identifier, the one or more processors are further configured to determine whether the second name of the second source identifier matches the first name mapped to the user (Montgomery: par. 0101 at step 506, a determination is made as to whether the extracted phone number matches a phone number included in the message. If a determination is made that the extracted phone number does not match the phone number in the message (or if no message is pending or received), flow continues to step 508. Otherwise, flow continues to step 510).
The motivation is the same that of claim 1 above.
Regarding claim 3: Rai in view of Montgomery discloses the system of claim 2.
Montgomery further discloses wherein the second source identifier comprises a phone number (Montgomery: par. 0099 at step 502, in which a phone number is extracted from an incoming phone call); and
wherein to determine whether the database comprises a first source identifier matching the second source identifier, the one or more processors are further configured to determine whether the one or more user source identifiers comprise a phone number matching the phone number of the second source identifier (Montgomery: par. 0101 at step 506, a determination is made as to whether the extracted phone number matches a phone number included in the message. If a determination is made that the extracted phone number does not match the phone number in the message (or if no message is pending or received), flow continues to step 508. Otherwise, flow continues to step 510).
The motivation is the same that of claim 1 above.
Regarding claim 11: Rai in view of Montgomery discloses the system of claim 1.
Rai further discloses wherein the second source identifier comprises at least one of: a phone number, an email address, a user account of an online platform, or an internal network identifier for a device in a network of plurality of devices (Rai: par. 0068 the information associated with client device 110 and/or a user of client device 110 can include usernames, passwords, identification numbers, email addresses, client device's addresses, and any other information that can be used to authenticate client device 110 and/or a user of client device 110).
Regarding claim 13: Rai in view of Montgomery discloses the system of claim 1.
Rai further discloses wherein the digital certificate comprises one or more third source identifiers, and wherein the first source identifier is different from the one or more third source identifiers (Rai: par. 0031 the certificate chain can include one or more of the root certificate, real certificates, public information regarding the authority of certificate manager 121, etc.).
Regarding claim 14: Rai discloses one or more non-transitory computer-readable storage media storing instructions that when executed by one or more processors, causes the one or more processors to perform operations comprising:
receiving a verification request to verify the source of a communication between a source computing device and a recipient computing device, the verification request comprising a second source identifier, wherein the second source identifier is not a digital certificate (Rai: par. 0052 in 416, certificate authority 121 can authenticate client device 110 based on the PKI operation request [] the authentication 416 can include checking information associated with client device 110 and/or a user of client device 110 to determine whether client device 110 is authorized to receive a certificate [] the information associated with client device 110 and/or a user of client device 110 can include usernames, passwords, identification numbers, email addresses, client device's addresses, and any other information that can be used to authenticate client device 110 and/or a user of client device 110);
determining, through accessing of a database, whether the database includes a first source identifier from among one or more user source identifiers stored in the database, the first source identifier matching the second source identifier (Rai: par. 0061 certificate manager 121 can store a mapping between the client devices and/or users of the client devices and the certificates in, for example, database 127 [] client manager 121 can determine, using the mapping, one or more certificates associated with the user and/or user's client device(s)); and
after determining the database includes the first source identifier (Rai: par. 0022 certificate manager 121 can store a mapping between the client devices and/or users of the client device and the certificates in, for example, database 127):
identifying a user mapped to the first source identifier, wherein the first source identifier and the user are mapped using a digital certificate associated by the system with the user (Rai: par. 0022 by storing the mapping, certificate manager 121 can be configured to track the certificates and the client devices using the certificates [] certificate manager 121 can use the stored mapping (e.g., stored in database 127) to determine the certificate and to revoke the determined certificate).
Rai does not explicitly disclose sending a response to the verification request to the recipient computing device, the response identifying the source of the communication as the user.
However, Montgomery discloses sending a response to the verification request to the recipient computing device, the response identifying the source of the communication as the user (Montgomery: par. 0101 at step 506, a determination is made as to whether the extracted phone number matches a phone number included in the message. If a determination is made that the extracted phone number does not match the phone number in the message (or if no message is pending or received), flow continues to step 508. Otherwise, flow continues to step 510).
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of Montgomery with the system/method of Rai to include sending a response to the verification request to the recipient computing device, the response identifying the source of the communication as the user. One would have been motivated for issuing digital certificates to phone numbers and verifying phone numbers based on the digital certificates to determine whether a phone number provided is accurate or inaccurate (Montgomery: par. 0004).
Regarding claims 15-16: Claims 15-16 are similar in scope to claims 2-3, respectively, and are therefore rejected under similar rationale.
Regarding claim 17: The computer-readable storage media of claim 16, wherein the operations further comprise maintaining, in memory, the database (Rai: fig. 1 items 115, 127 and 145).
Regarding claim 24: Claim 24 is similar in scope to claim 11, and is therefore rejected under similar rationale.
Claims 6-10, 19-23, 27, and 29 are rejected under 35 U.S.C. 103 as being unpatentable over RAI et al. (“Rai,” US 2018/0316510) in view of Montgomery et al. (“Montgomery,” US 2022/0060467) and GALVIN et al. (“Galvin,” US 2022/0210147).
Regarding claim 6: Rai in view of Montgomery discloses the system of claim 1.
Montgomery further discloses wherein the digital certificate is further associated with a domain of one or more computing devices (Montgomery: par. 0028 certification systems issue certificates to specific domains, users, servers, or email addresses).
The motivation is the same that of claim 1 above.
Rai in view of Montgomery does not explicitly disclose wherein the one or more processors are further configured to generate the mapping between the first source identifier and the user, wherein to generate the mapping, the one or more processors are further configured to: receive a registration request to register the user, the registration request comprising the digital certificate and data identifying the domain, and authenticate the user using the digital certificate and the domain.
However, Galvin discloses wherein the one or more processors are further configured to generate the mapping between the first source identifier and the user, wherein to generate the mapping (Galvin: par. 0042 a zone data (e.g. the DNS data 136) is organized in the form of resource records (RR) 26 and contains information that defines mappings between domain names 14 and IP addresses and other resources 31, as based upon registry data 27), the one or more processors are configured to:
receive a registration request to register the user, the registration request comprising the digital certificate and data identifying the domain (Galvin: par. 0022 the use of the designated DNS record 144, combined with a subject name 146 of the certificate 140 (see FIG. 3) being a unique identifier associated with the domain name 14' of the registrar 16 (e.g. the client 17 as an EPP client), the described system 10 provides a secure method to associate the certificate 140 that is obtained from the client 17 with a corresponding domain name 14' using DNS 130); and
authenticate the user using the digital certificate and the domain (Galvin: par. 0039 the DNS 130 can also be used by a registry server 21 (e.g. an EPP server 21) for validating/authenticating the self-signed certificate 140).
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of Galvin with the system/method of Rai and Montgomery to include receive a registration request to register the user, the registration request comprising the digital certificate and data identifying the domain. One would have been motivated to provide a method for using a digital certificate for establishing a secure connection between a client and a server on a communications network (Galvin: par. 0012).
Regarding claim 7: Rai in view of Montgomery and Galvin discloses the system of claim 6.
Galvin further discloses wherein the one or more processors are further configured to:
send, in response to the registration request, a challenge string (Galvin: par. 0044 DNS syntax can be a string of characters used as commands, which instruct the DNS server 132 what to do upon receiving a DNS lookup request 147); and
determine that one or more domain name system (DNS) records of the domain have been updated with the challenge string (Galvin: par. 0070 the steps of obtaining an updated unique
identifier of the EPP client 17, accessing the designated DNS record 144 in the DNS 130 associated with the updated unique identifier, retrieving an updated copy 140' of the digital certificate from the designated DNS record 144).
The motivation is the same that of claim 6 above.
Regarding claim 8: Rai in view of Montgomery and Galvin discloses the system of claim 6.
Galvin further discloses wherein the one or more processors are further configured to:
receive a request to update the mapping to include one or more additional source identifiers, the request being associated with the user (Galvin: par. 0070 the updated copy 140' of the digital certificate containing a further public key PKBa bound to the domain name 14', and utilizing the further public key PKBa with an updated session key of a further secure connection 11a over the communications network 11 with the EPP client 17); and
determine that the request to update the mapping was received from a computing device corresponding to the user, and in response, update the mapping to include the one or more additional source identifiers (Galvin: par. 0084 the registration and/or maintenance information is considered data used to populate the objects 15 based on actions 142 (e.g. update, delete, transfer, renew, etc.) performed on the objects 15, as facilitated by the secure connection 11a for the communication of EPP requests 122 and corresponding responses 124 associated with the transactions 142).
The motivation is the same that of claim 6 above.
Regarding claim 9: Rai in view of Montgomery and Galvin discloses the system of claim 8.
Galvin further discloses wherein to determine that the request to update the mapping was received from a computing device corresponding to the user, the one or more processors are configured to determine whether the computing device corresponds to a user account for the user (Galvin: par. 0020 a domain name management system 10 providing for a domain name registrant 12 (e.g. domain owner) to manage over a communications network 11 (i.e. the Internet) their domain names 14, such that changes (e.g. updates, modifications, etc.) to the domain names 14 can be implemented via a domain name registrar 16 for multiple domain names 14 in a domain name registry database 18).
The motivation is the same that of claim 6 above.
Regarding claim 10: Rai in view of Montgomery and Galvin discloses the system of claim 6.
Galvin further discloses wherein the domain is a first domain (Galvin: par. 0020 a domain name), and
wherein the one or more first source identifiers mapped to the user comprise an email address corresponding to a second domain different from the first domain (Montgomery: par. 0028 at step 506, a determination is made as to whether the extracted phone number matches a phone number included in the message. If a determination is made that the extracted phone number does not match the phone number in the message (or if no message is pending or received), flow continues to step 508. Otherwise, flow continues to step 510).
The motivation is the same that of claim 6 above.
Regarding claims 19-23: Claims 19-23 are similar in scope to claims 6-10, respectively, and are therefore rejected under similar rationale.
Regarding claim 27: Rai in view of Montgomery discloses the system of claim 1.
Rai further discloses one or more processors are configured to:
one or more source identifiers identifying sources of communication from the user to one or more computing devices (Rai: par. 0052 the information associated with client device 110 and/or a user of client device 110 can include usernames, passwords, identification numbers, email addresses, client device's addresses, and any other information that can be used to authenticate client device 110 and/or a user of client device 110).
Rai does not explicitly disclose receive a registration request from the user to register the user, the registration request having first information including the digital certificate and a domain, send, in response to the registration request, a challenge string, determine, by the one or more processors, whether one or more domain name system (DNS) records of the domain have been updated with the challenge string and when the one or more domain name system (DNS) records of the domain have been updated with the challenge string: register the user as associated with the first information, and map the one or more source identifiers to the user.
However, Galvin discloses receive a registration request from the user to register the user, the registration request having first information including the digital certificate and a domain (Galvin: par. 0022 the use of the designated DNS record 144, combined with a subject name 146 of the certificate 140 (see FIG. 3) being a unique identifier associated with the domain name 14' of the registrar 16 (e.g. the client 17 as an EPP client), the described system 10 provides a secure method to associate the certificate 140 that is obtained from the client 17 with a corresponding domain name 14' using DNS 130);
send, in response to the registration request, a challenge string (Galvin: par. 0044 DNS syntax can be a string of characters used as commands, which instruct the DNS server 132 what to do upon receiving a DNS lookup request 147);
determine, by the one or more processors, whether one or more domain name system (DNS) records of the domain have been updated with the challenge string (Galvin: par. 0070 the steps of obtaining an updated unique identifier of the EPP client 17, accessing the designated DNS record 144 in the DNS 130 associated with the updated unique identifier, retrieving an updated copy 140' of the digital certificate from the designated DNS record 144); and
when the one or more domain name system (DNS) records of the domain have been updated with the challenge string:
register the user as associated with the first information (Galvin: par. 0070 the further public key can be utilized with an updated session key (as received from the client 17) of a further secure connection 11a over the communications network 11 with the EPP client 17 [] and retrieve the further communicated digital certificate 140 from the storage 122, in order to validate and authenticate subsequent connection requests 123 (and correspondingly received certificates 140) from the client 17), and
map the one or more source identifiers to the user (Galvin: par. 0042 a zone data (e.g. the DNS data 136) is organized in the form of resource records (RR) 26 and contains information that defines mappings between domain names 14 and IP addresses and other resources 31, as based upon registry data 27).
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of Galvin with the system/method of Rai and Montgomery to include domain name system records of the domain have been updated with the challenge string and register the user as associated with the first information, and map the one or more source identifiers to the user. One would have been motivated to provide a method for using a digital certificate for establishing a secure connection between a client and a server on a communications network (Galvin: par. 0012).
Regarding claim 29: Rai in view of Montgomery and Galvin discloses the system of claim 27.
Galvin further discloses wherein the one or more processors are further configured to determine that the request to update the mapping was received from a computing device corresponding to the user, wherein to determine that the request to update was received from the computing device, the one or more processors are further configured to determine whether the computing device corresponds to a user account for the user (Galvin: par. 0020 a domain name management system 10 providing for a domain name registrant 12 (e.g. domain owner) to manage over a communications network 11 (i.e. the Internet) their domain names 14, such that changes (e.g. updates, modifications, etc.) to the domain names 14 can be implemented via a domain name registrar 16 for multiple domain names 14 in a domain name registry database 18).
The motivation is the same that of claim 27 above.
Claim 12 is rejected under 35 U.S.C. 103 as being unpatentable over RAI et al. (“Rai,” US 2018/0316510) in view of Montgomery et al. (“Montgomery,” US 2022/0060467) and KLIEMAN (“Klieman,” US 2015/0341342).
Regarding claim 12: Rai in view of Montgomery discloses the system of claim 1.
Rai in view of Montgomery does not explicitly disclose wherein the digital certificate is an Extended Validation (EV) digital certificate.
However, Klieman discloses wherein the digital certificate is an Extended Validation (EV) digital certificate (Klieman: par. 0023 an Extended Validation (EV) certificate 115).
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of Klieman with the system/method of Rai and Montgomery to include the digital certificate is an Extended Validation (EV) digital certificate. One would have been motivated to reduce the time needed to secure a server by serially installing multiple certificates while completing the identity verification and authentication required for the high-assurance certificate (Klieman: par. 0002).
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Fahimeh Mohammadi whose telephone number is (571)270-7857. The examiner can normally be reached Monday - Friday 9:00 - 5:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Luu Pham can be reached at 5712705002. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/FAHIMEH MOHAMMADI/ Examiner, Art Unit 2439
/LUU T PHAM/Supervisory Patent Examiner, Art Unit 2439
Prosecution Insights