DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Priority
The instant application claims priority to provisional application 63/452,310 filed 15 March 2023. The priority claim complies with all applicable rules and regulations. Therefore, the effective filing date of the claims will be 15 March 2023.
Response to Arguments
Applicant's arguments filed 31 March 2026 have been fully considered but they are not persuasive.
In response to applicant’s arguments that the cited prior art does not clearly teach “wherein the instructions of the personal computer utility, when executed by the personal computer controller, cause the personal computer utility to retrieve a first index value by identifying a uniform resource locator of an internet resource requesting a password in the non-volatile index table of the personal computer utility” starting on page 11 and continuing on page 12, the examiner respectfully disagrees.
Gonzalez discloses a system that includes host computing device 110 (Figs. 1, 2, el. 110) and mass storage device (MSD) 100 (Figs, 1, 2, el. 100), where MSD 100 takes the form of a USB drive (Para. 52).
Gonzalez further discloses the client may be active on the host computer and detect when the user accesses a web page within the list of enrolled institutions in order to activate the log on sequence, and the user identity and credentials, and the institution Uniform Resource Locator ("URL") or other form of web address are also ideally already stored on the removable storage authentication mass storage device, and are retrieved for the authentication, wherein if the device supports a number of independent OTP seeds, or even if it supports a number of independent institutions using the same OTP seeds, then the user identity, credentials, and URL are ideally selected from a list stored on the device according to the particular institution to which the person is authenticating (Para. 16).
Gonzalez also discloses that Figure 5B indicates that “GenerateOTP<slotID>”—first index value and request for the password-- is sent from the client executing on the host computer to the MSD (Fig. 5B). This process is further shown in paragraph 74 and figure 10C--The institution then needs to associate the device and its contents to the user name and password so that it can authenticate the user with device presented information plus the user specific information (user identifying information and secret). In step 960, the MSD is connected to the host if it is not already connected. Next in step 962, the client is launched if it is not open and running, and in step 964 the user enters in his identifying information (e.g. user name, account number etc.) and his secret (e.g. password or PIN). Next, in step 966 the OTP generator of MSD 100 generates an OTP value for a particular slot. In step 968, the OTP value, user identifying information and user secret are submitted to the institution.
Bansal discloses a system that includes user equipment (UE) 101 101 (Fig. 1, el. 101), wherein the UE may be a computer, tablet, mobile device, or the like (Para. 15).
Bansal further discloses UE 101 may further store (at 510) mapping 503 of an identifier (e.g., URL) of application server 103-3 to the received Block ID, in Block ID-application server mapping store 501, which may be a discrete portion of storage resources associated with UE 101, and thus, when receiving authorized requests for cookie information associated with application server 103-3, UE 101 may identify a block, of blockchain system 105, based on mapping information 503 that correlates application server 103-3 to a particular Block ID (Fig. 5, el. 501, 503, 510; Para. 37).
Gonzalez shows that the host device detects when the user accesses an institution’s web page activating the logon sequence and the user identity, credentials, and the institution’s URL are retrieved from the MSD for authentication. The host device determines the slot ID for the institution and sends an OTP generation request to the MSD, where the request includes the slot ID that identifies the slot in the MSD memory that includes information necessary to log the user into the institution.
Bansal shows that the UE stores a mapping of a URL of an application server and a block ID. The UE then uses the block ID to identify the corresponding block in a blockchain.
The combination of Gonzalez and Bansal discloses that Gonzalez’s host device would be modified to include Bansal’s URL mapping to the block ID so that Gonzalez’s host device is able to use the URL of the detected institution to retrieve the slot ID for the institution. Therefore, the aforementioned limitation is taught by the combination of the cited prior art.
Applicant, on page 11, refers to Gonzalez’s disclosure of the client retrieving the device ID from the MSD and relates this to the instructions of the personal computer utility of the claim. As stated above and in the 35 USC 103 section below, the instructions are executed on the host device to determine the slot ID, where the slot ID is sent with the OTP generation request to the MSD.
Applicant, on page 12, argues that Bansal’s “locally stored mapping is fundamentally different in structure and purpose”. Bansal discloses the locally stored mapping between the URL and an identifier and using the URL and the mapping to retrieve the identifier. This URL-mapping is used to modify Gonzalez’s host device so that the institution URL may be used to determine the slot ID since Gonzalez does not explicitly state how the slot ID is determined at the host device.
It should be noted that independent claim 16 has a different scope than independent claim 1. Claim 16 indicates that the first seed value is retrieved from a non-volatile seed table using the first index value received from the personal computer utility. However, claim 16 does not indicate that the non-volatile seed table is located within the dongle. Therefore, the arguments associated with claim 1 do not apply to claim 16.
In response to applicant’s argument that the “motivation…is insufficient under KRS/In re Kahn” and “there is not articulated reason with a rational underpinning” on page 12, the examiner recognizes that obviousness may be established by combining or modifying the teachings of the prior art to produce the claimed invention where there is some teaching, suggestion, or motivation to do so found either in the references themselves or in the knowledge generally available to one of ordinary skill in the art. See In re Fine, 837 F.2d 1071, 5 USPQ2d 1596 (Fed. Cir. 1988), In re Jones, 958 F.2d 347, 21 USPQ2d 1941 (Fed. Cir. 1992), and KSR International Co. v. Teleflex, Inc., 550 U.S. 398, 82 USPQ2d 1385 (2007).
In this case, as stated above, the combination of Gonzalez and Bansal discloses that Gonzalez’s host device is modified to include Bansal’s URL mapping to the block ID so that Gonzalez’s host device is able to use the URL of the detected institution to retrieve the slot ID for the institution using a mapping stored at the host device. The stated motivation to combine Bansal with Gonzalez is “for the purpose of maintaining a copy of the index table local to the computer device so as to reduce the amount of processing that would be required at the dongle device”. Another benefit of the combination would be to provide a more efficient way of associating Gonzalez’s institution URL with the slot ID.
Applicant, on page 12, states that “[m]oving the sensitive indexing that drives seed selection to the host would undermine that model and change the way Gonzalez’s system operates”. However, this would not be the case. Gonzalez already has some type of mapping present at the host device in order to determine the slot ID for the OTP generation request or at least has the slot ID information already at the host device. The mapping scheme of Bansal merely provides an explicit URL to identifier mapping at the host device.
Applicant, on page 12, states that “Bansal addresses a different problem…rather than two-factor hardware token workflows”. The test for obviousness is what the combined teachings of the references would have suggested to those of ordinary skill in the art. The fact that Bansal does not expressly address the same stated problem of the instant application or Gonzalez is not an issue since one of ordinary skill in the art could have analyzed Bansal’s URL mapping scheme, combined it with Gonzalez’s host device processes, and arrived at the claimed invention.
Therefore, the combination is valid.
Claim Objections
Claims 1, 2, 4, 9, 16, 17, 19-21, 24, and 25 are objected to because of the following informalities:
Regarding claim 1, line 17—“a password” appears to be referring to “a password” of lines 15-16. This objection may be overcome by amending line 17 to state --the password--, for example.
Regarding claim 2, line 4—“a sequence” appears to be referring to “a sequence” of line 2. This objection may be overcome by amending line 4 to state --the sequence--, for example.
Claim 17 includes similar language and is similarly analyzed.
Regarding claim 4, line 5—“a password” appears to be referring to “a password” of lines 15-16 of claim 1. This objection may be overcome by amending line 5 to state --the password--, for example.
Regarding claim 9, line 5—“a password” appears to be referring to “a password” of lines 15-16 of claim 1. This objection may be overcome by amending line 5 to state --the password--, for example.
Regarding claim 16, line 8—“a password” appears to be referring to “a password” of line 6. This objection may be overcome by amending line 8 to state --the password--, for example.
Regarding claim 19, line 4—“a password” appears to be referring to “a password” of line 6 of claim 16. This objection may be overcome by amending line 4 to state --the password--, for example.
Regarding claim 20, line 2—“a password” appears to be referring to “a password” of line 6 of claim 16. This objection may be overcome by amending line 2 to state --the password--, for example.
Regarding claim 21, line 2—“a password” appears to be referring to “a password” of line 6 of claim 16. This objection may be overcome by amending line 2 to state --the password--, for example.
Regarding claim 24, line 5—“a password” appears to be referring to “a password” of line 6 of claim 16. This objection may be overcome by amending line 5 to state --the password--, for example.
Regarding claim 25, line 5—“a password” appears to be referring to “a password” of line 6 of claim 16. This objection may be overcome by amending line 5 to state --the password--, for example.
Appropriate correction is required.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 5-9, 16, 20-22, and 24 are rejected under 35 U.S.C. 103 as being unpatentable over Gonzalez et al. (US 2007/0011724 A1) in view of Bansal (US 2021/0344740 A1).
Regarding claim 1, Gonzalez teaches a system, (Fig. 1), comprising:
a personal computer utility, e.g., host computing device 110 (Figs. 1, 2, el. 110), comprising a personal computer controller, e.g., a processor of host 110 (Para. 54), and a non-transitory computer readable storage medium storing…instructions, e.g., the program monitors the browser installed on the host, and monitoring would automatically take place any time the host device is utilized, and would maintain a file of all web sites being visited (Para. 19); and
a universal serial bus dongle, e.g., mass storage device 100 (Figs, 1, 2, el. 100); MSD 100 takes the form of a USB drive (Para. 52), to generate and retrieve passwords, e.g., in step 966 the OTP generator of MSD 100 generates an OTP value for a particular slot, and in step 968, the OTP value, user identifying information and user secret are submitted to the institution (Fig. 10C, el. 966, 968; Para. 74); client 320 will request and subsequently fetch the OTP value generated by OTP generator 330 (Fig. 3C, el. 320, 330; Para. 62),
the universal serial bus dongle comprising:
a universal serial bus interface, e.g., interface 304 (Fig. 3A, el. 304); MSD 100 takes the form of a USB drive (Para. 52), and
non-transitory computer readable storage medium, e.g., mass storage flash memory 308 (Fig. 3A, el. 308; Fig. 3B, el. 308A, 308B), storing a non-volatile seed table, e.g., logical slots 310A, 310B . . . 310x are located in the secure area 308A, wherein these slots can also be in the file storage area 308B, wherein a slot is a protected logical memory area that is used to store the information necessary to log a user into an institution, wherein this can include the information necessary to generate OTP values, including the algorithms and seed values for each institution (Fig. 3B, el. 310A, 310B, 310x; Para. 58), and instructions, e.g., the controller executes firmware in order to run MSD 100, and this firmware can be stored in the flash memory 308 (Para. 56),
that, when executed by a controller, e.g., controller 306 (Fig. 3A, el. 306), cause the universal serial bus dongle to generate pseudo-random strings of characters via a pseudo-random character generator, e.g., OTP generator 330 (Fig. 3C, el. 330), to be used as the passwords, e.g., in step 966 the OTP generator of MSD 100 generates an OTP value for a particular slot, and in step 968, the OTP value, user identifying information and user secret are submitted to the institution (Fig. 10C, el. 966, 968; Para. 74);
this can include the information necessary to generate OTP values, including the algorithms and seed values for each institution (Para. 58);
the user is unaware that the device is seeded for each institution selected, that the seed is used by a complex algorithm to generate a new (OTP) value for each login that is validated along with the user's other information automatically (Para. 80),
wherein the instructions of the personal computer utility, when executed by the personal computer controller, cause the personal computer utility to retrieve a first index value by identifying a uniform resource locator of an internet resource requesting a password in…the personal computer utility, e.g., in step 924, a slot within MSD 100 is then allocated for the selected institution or account, and in step 926 the clients retrieves the device ID from MSD 100, and then in step 928, a unique identifier, which is referred to as the token ID is created from the device ID and the slot ID—first index value-- (Fig. 10A, el. 924, 926, 928; Para. 72);
Figure 5B indicates that the client executing on the host computer receives the <FID> of the selected Financial Institution (FI) and then “GenerateOTP<slotID>”—first index value-- is sent from the client executing on the host computer to the MSD (Fig. 5B);
the client may be active on the host computer and detect when the user accesses a web page within the list of enrolled institutions in order to activate the log on sequence, and the user identity and credentials, and the institution Uniform Resource Locator ("URL") or other form of web address are also ideally already stored on the removable storage authentication mass storage device, and are retrieved for the authentication, wherein if the device supports a number of independent OTP seeds, or even if it supports a number of independent institutions using the same OTP seeds, then the user identity, credentials, and URL are ideally selected from a list stored on the device according to the particular institution to which the person is authenticating (Para. 16), and
send the first index value and a first request for a password to the universal serial bus dongle, e.g., Figure 5B indicates that “GenerateOTP<slotID>”—first index value and request for the password-- is sent from the client executing on the host computer to the MSD (Fig. 5B);
wherein the instructions of the universal serial bus dongle, when executed by the dongle controller, cause the universal serial bus dongle to: retrieve a first seed value from its non-volatile seed table using the first index value received from the personal computer utility, e.g., logical slots 310A, 310B . . . 310x are located in the secure area 308A, wherein these slots can also be in the file storage area 308B, wherein a slot is a protected logical memory area that is used to store the information necessary to log a user into an institution, wherein this can include the information necessary to generate OTP values, including the algorithms and seed values for each institution (Fig. 3B, el. 310A, 310B, 310x; Para. 58);
in step 712, MSD 100 generates an OTP value for each of the selected institutions, wherein each institution may have a unique seed and algorithm for OTP generation (Fig. 7, el. 712; Para. 69), and
generate a first pseudo-random number password via the pseudo-random character generator using the first seed value, e.g., in step 712, MSD 100 generates an OTP value for each of the selected institutions, wherein each institution may have a unique seed and algorithm for OTP generation (Fig. 7, el. 712; Para. 69);
in step 966 the OTP generator of MSD 100 generates an OTP value for a particular slot (Fig. 10C, el. 966; Para. 74).
Gonzalez does not clearly teach a personal computer utility comprising a personal computer controller and a non-transitory computer readable storage medium storing a non-volatile index table and instructions; and
wherein the instructions of the personal computer utility, when executed by the personal computer controller, cause the personal computer utility to retrieve a first index value by identifying a uniform resource locator of an internet resource requesting a password in the non-volatile index table of the personal computer utility.
Bansal teaches a personal computer utility, e.g., UE 101 (Fig. 1, el. 101), wherein the UE may be a computer, tablet, mobile device, or the like (Para. 15), comprising a personal computer controller, e.g., processor 1320 (Fig. 13, el. 1320), and a non-transitory computer readable storage medium, e.g., memory 1330 (Fig. 13, el. 1330), storing a non-volatile index table and instructions, e.g., memory 1330 may include any type of dynamic storage device that may store information and instructions for execution by processor 1320 (Para. 80);
UE 101 may further store (at 510) mapping 503 of an identifier (e.g., URL) of application server 103-3 to the received Block ID, in Block ID-application server mapping store 501, which may be a discrete portion of storage resources associated with UE 101, and thus, when receiving authorized requests for cookie information associated with application server 103-3, UE 101 may identify a block, of blockchain system 105, based on mapping information 503 that correlates application server 103-3 to a particular Block ID (Fig. 5, el. 501, 503, 510; Para. 37); and
wherein the instructions of the personal computer utility, e.g., memory 1330 may include any type of dynamic storage device that may store information and instructions for execution by processor 1320 (Para. 80), when executed by the personal computer controller, cause the personal computer utility to retrieve a first index value by identifying a uniform resource locator of an internet resource…in the non-volatile index table of the personal computer utility, e.g., UE 101 may further store (at 510) mapping 503 of an identifier (e.g., URL) of application server 103-3 to the received Block ID, in Block ID-application server mapping store 501, which may be a discrete portion of storage resources associated with UE 101, and thus, when receiving authorized requests for cookie information associated with application server 103-3, UE 101 may identify a block, of blockchain system 105, based on mapping information 503 that correlates application server 103-3 to a particular Block ID (Fig. 5, el. 501, 503, 510; Para. 37).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Gonzalez to include a personal computer utility comprising a personal computer controller and a non-transitory computer readable storage medium storing a non-volatile index table and instructions; and wherein the instructions of the personal computer utility, when executed by the personal computer controller, cause the personal computer utility to retrieve a first index value by identifying a uniform resource locator of an internet resource requesting a password in the non-volatile index table of the personal computer utility, using the known method of maintaining mapping information at the UE, wherein the mapping information maps the URL to a block ID, as taught by Bansal, in combination with the association of the financial institution with the slot ID of Gonzalez, for the purpose of maintaining a copy of the index table local to the computer device so as to reduce the amount of processing that would be required at the dongle device.
Regarding claim 5, Gonzalez in view of Bansal teaches the system as in claim 1.
Gonzalez further teaches wherein the instructions of the personal computer utility, when executed by the personal computer controller, cause the personal computer utility to…the uniform resource locator of the internet resource requesting the password…, e.g., the client may be active on the host computer and detect when the user accesses a web page within the list of enrolled institutions in order to activate the log on sequence, and the user identity and credentials, and the institution Uniform Resource Locator ("URL") or other form of web address are also ideally already stored on the removable storage authentication mass storage device, and are retrieved for the authentication, wherein if the device supports a number of independent OTP seeds, or even if it supports a number of independent institutions using the same OTP seeds, then the user identity, credentials, and URL are ideally selected from a list stored on the device according to the particular institution to which the person is authenticating (Para. 16).
Gonzalez does not clearly teach wherein the instructions of the personal computer utility, when executed by the personal computer controller, cause the personal computer utility to store the uniform resource locator of the internet resource requesting the password in the non-volatile index table of the personal computer utility.
Bansal further teaches wherein the instructions of the personal computer utility, when executed by the personal computer controller, cause the personal computer utility to store the uniform resource locator of the internet resource…in the non-volatile index table of the personal computer utility, e.g., UE 101 may further store (at 510) mapping 503 of an identifier (e.g., URL) of application server 103-3 to the received Block ID, in Block ID-application server mapping store 501, which may be a discrete portion of storage resources associated with UE 101, and thus, when receiving authorized requests for cookie information associated with application server 103-3, UE 101 may identify a block, of blockchain system 105, based on mapping information 503 that correlates application server 103-3 to a particular Block ID (Fig. 5, el. 501, 503, 510; Para. 37).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Gonzalez to include wherein the instructions of the personal computer utility, when executed by the personal computer controller, cause the personal computer utility to store the uniform resource locator of the internet resource requesting the password in the non-volatile index table of the personal computer utility, using the known method of maintaining mapping information at the UE, wherein the mapping information maps the URL to a block ID, as taught by Bansal, in combination with the association of the financial institution with the slot ID of Gonzalez, using the same motivation as in claim 1.
Regarding claim 6, Gonzalez in view of Bansal teaches the system as in claim 1, wherein the instructions of the personal computer utility, when executed by the personal computer controller, cause the personal computer utility to send a second index value and a second request for a second password to the universal serial bus dongle, e.g., Figure 5B indicates that “GenerateOTP<slotID>”—first index value and request for the password-- is sent from the client executing on the host computer to the MSD (Gonzalez-Fig. 5B).
Regarding claim 7, Gonzalez in view of Bansal teaches the system as in claim 1, wherein the instructions of the universal serial bus dongle, when executed by the controller, cause the universal serial bus dongle to: store the first seed value in the non-volatile seed table using the first index value received from the personal computer utility, e.g., logical slots 310A, 310B . . . 310x are located in the secure area 308A, wherein these slots can also be in the file storage area 308B, wherein a slot is a protected logical memory area that is used to store the information necessary to log a user into an institution, wherein this can include the information necessary to generate OTP values, including the algorithms and seed values for each institution (Gonzalez-Fig. 3B, el. 310A, 310B, 310x; Para. 58);
In step 932, an OTP seed is received for the selected institution, and it is then assigned to the allocated slot in step 934 (Gonzalez-Fig. 10A, el. 932; Para. 72).
Regarding claim 8, Gonzalez in view of Bansal teaches the system as in claim 1, wherein the instructions of the universal serial bus dongle, when executed by the controller, cause the universal serial bus dongle to: generate a second pseudo-random number password via the pseudo-random character generator using a second seed value, e.g., in step 712, MSD 100 generates an OTP value for each of the selected institutions, wherein each institution may have a unique seed and algorithm for OTP generation (Gonzalez-Fig. 7, el. 712; Para. 69);
in step 966 the OTP generator of MSD 100 generates an OTP value for a particular slot (Gonzalez-Fig. 10C, el. 966; Para. 74).
Regarding claim 9, Gonzalez in view of Bansal teaches the system as in claim 1, wherein the instructions of the universal serial bus dongle, when executed by the controller, cause the universal serial bus dongle to: transmit the first pseudo-random number password to the personal computer utility, e.g., See Figure 5B—The MSD 100 sends the OTP to the client (Gonzalez-Fig. 5B);
Client 320 will request and subsequently fetch the OTP value generated by OTP generator 330 (Gonzalez-Para. 62);
in step 966 the OTP generator of MSD 100 generates an OTP value for a particular slot In step 968, the OTP value, user identifying information and user secret are submitted to the institution (Gonzalez-Fig. 10C, el. 966, 968; Para. 74),
wherein the personal computer utility is to decode the first pseudo-random number password, e.g., MSD 100 takes the form of a USB drive (Gonzalez-Para. 52);
Client 320 will request and subsequently fetch the OTP value generated by OTP generator 330 (Gonzalez-Para. 62);
Examiner note: Gonzalez discloses sending data over a USB connection. The data has to be decoded from the USB frame in order to be used; and
transmit the first pseudo-random number password to the uniform resource locator of the internet resource requesting a password, e.g., the client may be active on the host computer and detect when the user accesses a web page within the list of enrolled institutions in order to activate the log on sequence, and the user identity and credentials, and the institution Uniform Resource Locator ("URL") or other form of web address are also ideally already stored on the removable storage authentication mass storage device, and are retrieved for the authentication, wherein if the device supports a number of independent OTP seeds, or even if it supports a number of independent institutions using the same OTP seeds, then the user identity, credentials, and URL are ideally selected from a list stored on the device according to the particular institution to which the person is authenticating (Gonzalez-Para. 16);
in step 716, the client connects to the selected institutions, and once connected, the client then presents the information necessary to log the user into the selected institutions, wherein this information comprises the user's identifying information such as his name, account number, or user ID, the user's secret information such as his password or PIN, and the OTP value for the particular institution if the institution is of the type that requires an OTP value for log in (Gonzalez-Fig. 7, el. 716; Para. 69).
Regarding claim 16, Gonzalez teaches a method comprising:
providing a personal computer utility, e.g., host computing device 110 (Figs. 1, 2, el. 110);
providing a universal serial bus dongle, e.g., mass storage device 100 (Figs, 1, 2, el. 100); MSD 100 takes the form of a USB drive (Para. 52), to generate pseudo-random strings of characters via a pseudo-random character generator, e.g., OTP generator 330 (Fig. 3C, el. 330), to be used as passwords, e.g., in step 966 the OTP generator of MSD 100 generates an OTP value for a particular slot, and in step 968, the OTP value, user identifying information and user secret are submitted to the institution (Fig. 10C, el. 966, 968; Para. 74);
this can include the information necessary to generate OTP values, including the algorithms and seed values for each institution (Para. 58);
the user is unaware that the device is seeded for each institution selected, that the seed is used by a complex algorithm to generate a new (OTP) value for each login that is validated along with the user's other information automatically (Para. 80),
retrieving a first index value by identifying a uniform resource locator of an internet resource requesting a password from…the personal computer utility, e.g., in step 924, a slot within MSD 100 is then allocated for the selected institution or account, and in step 926 the clients retrieves the device ID from MSD 100, and then in step 928, a unique identifier, which is referred to as the token ID is created from the device ID and the slot ID—first index value-- (Fig. 10A, el. 924, 926, 928; Para. 72);
Figure 5B indicates that the client executing on the host computer receives the <FID> of the selected Financial Institution (FI) and then “GenerateOTP<slotID>”—first index value-- is sent from the client executing on the host computer to the MSD (Fig. 5B);
the client may be active on the host computer and detect when the user accesses a web page within the list of enrolled institutions in order to activate the log on sequence, and the user identity and credentials, and the institution Uniform Resource Locator ("URL") or other form of web address are also ideally already stored on the removable storage authentication mass storage device, and are retrieved for the authentication, wherein if the device supports a number of independent OTP seeds, or even if it supports a number of independent institutions using the same OTP seeds, then the user identity, credentials, and URL are ideally selected from a list stored on the device according to the particular institution to which the person is authenticating (Para. 16);
sending the first index value and a first request for a password from the personal computer utility to the universal serial bus dongle, e.g., Figure 5B indicates that “GenerateOTP<slotID>”—first index value and request for the password-- is sent from the client executing on the host computer to the MSD (Fig. 5B);
retrieving a first seed value from a non-volatile seed table using the first index value received from the personal computer utility, e.g., logical slots 310A, 310B . . . 310x are located in the secure area 308A, wherein these slots can also be in the file storage area 308B, wherein a slot is a protected logical memory area that is used to store the information necessary to log a user into an institution, wherein this can include the information necessary to generate OTP values, including the algorithms and seed values for each institution (Fig. 3B, el. 310A, 310B, 310x; Para. 58);
in step 712, MSD 100 generates an OTP value for each of the selected institutions, wherein each institution may have a unique seed and algorithm for OTP generation (Fig. 7, el. 712; Para. 69); and
generating a first pseudo-random number password via the pseudo-random character generator using the first seed value, e.g., in step 712, MSD 100 generates an OTP value for each of the selected institutions, wherein each institution may have a unique seed and algorithm for OTP generation (Fig. 7, el. 712; Para. 69);
in step 966 the OTP generator of MSD 100 generates an OTP value for a particular slot (Fig. 10C, el. 966; Para. 74).
Gonzalez does not clearly teach retrieving a first index value by identifying a uniform resource locator of an internet resource requesting a password from a non-volatile index table of the personal computer utility.
Bansal teaches retrieving a first index value by identifying a uniform resource locator of an internet resource…from a non-volatile index table of the personal computer utility, e.g., UE 101 (Fig. 1, el. 101), wherein the UE may be a computer, tablet, mobile device, or the like (Para. 15);
UE 101 may further store (at 510) mapping 503 of an identifier (e.g., URL) of application server 103-3 to the received Block ID, in Block ID-application server mapping store 501, which may be a discrete portion of storage resources associated with UE 101, and thus, when receiving authorized requests for cookie information associated with application server 103-3, UE 101 may identify a block, of blockchain system 105, based on mapping information 503 that correlates application server 103-3 to a particular Block ID (Fig. 5, el. 501, 503, 510; Para. 37).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Gonzalez to include a personal computer utility comprising a personal computer controller and a non-transitory computer readable storage medium storing a non-volatile index table and instructions; and wherein the instructions of the personal computer utility, when executed by the personal computer controller, cause the personal computer utility to retrieve a first index value by identifying a uniform resource locator of an internet resource requesting a password in the non-volatile index table of the personal computer utility, using the known method of maintaining mapping information at the UE, wherein the mapping information maps the URL to a block ID, as taught by Bansal, in combination with the association of the financial institution with the slot ID of Gonzalez, for the purpose of maintaining a copy of the index table local to the computer device so as to reduce the amount of processing that would be required at the dongle device.
Regarding claim 20, Gonzalez in view of Bansal teaches the method as in claim 16.
Gonzalez further teaches …the uniform resource locator of the internet resource requesting a password…, the client may be active on the host computer and detect when the user accesses a web page within the list of enrolled institutions in order to activate the log on sequence, and the user identity and credentials, and the institution Uniform Resource Locator ("URL") or other form of web address are also ideally already stored on the removable storage authentication mass storage device, and are retrieved for the authentication, wherein if the device supports a number of independent OTP seeds, or even if it supports a number of independent institutions using the same OTP seeds, then the user identity, credentials, and URL are ideally selected from a list stored on the device according to the particular institution to which the person is authenticating (Para. 16).
Gonzalez does not clearly teach storing the uniform resource locator of the internet resource requesting a password in the non-volatile index table of the personal computer utility.
Bansal further teaches storing the uniform resource locator of the internet resource…in the non-volatile index table of the personal computer utility, e.g., UE 101 may further store (at 510) mapping 503 of an identifier (e.g., URL) of application server 103-3 to the received Block ID, in Block ID-application server mapping store 501, which may be a discrete portion of storage resources associated with UE 101, and thus, when receiving authorized requests for cookie information associated with application server 103-3, UE 101 may identify a block, of blockchain system 105, based on mapping information 503 that correlates application server 103-3 to a particular Block ID (Fig. 5, el. 501, 503, 510; Para. 37).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Gonzalez to include storing the uniform resource locator of the internet resource requesting a password in the non-volatile index table of the personal computer utility, using the known method of maintaining mapping information at the UE, wherein the mapping information maps the URL to a block ID, as taught by Bansal, in combination with the association of the financial institution with the slot ID of Gonzalez, using the same motivation as in claim 16.
Regarding claim 21, Gonzalez in view of Bansal teaches the method as in claim 16, comprising: sending a second index value and a second request for a password from the personal computer utility to the universal serial bus dongle, e.g., Figure 5B indicates that “GenerateOTP<slotID>”—first index value and request for the password-- is sent from the client executing on the host computer to the MSD (Gonzalez-Fig. 5B).
Regarding claim 22, Gonzalez in view of Bansal teaches the method as in claim 16, comprising: storing the first seed value in the non-volatile seed table of the universal serial bus dongle using the first index value received from the personal computer utility, e.g., logical slots 310A, 310B . . . 310x are located in the secure area 308A, wherein these slots can also be in the file storage area 308B, wherein a slot is a protected logical memory area that is used to store the information necessary to log a user into an institution, wherein this can include the information necessary to generate OTP values, including the algorithms and seed values for each institution (Gonzalez-Fig. 3B, el. 310A, 310B, 310x; Para. 58);
In step 932, an OTP seed is received for the selected institution, and it is then assigned to the allocated slot in step 934 (Gonzalez-Fig. 10A, el. 932; Para. 72).
Regarding claim 24, Gonzalez in view of Bansal teaches the method as in claim 16, transmitting the first pseudo-random number password from the universal serial bus dongle to the personal computer utility, e.g., See Figure 5B—The MSD 100 sends the OTP to the client (Gonzalez-Fig. 5B);
Client 320 will request and subsequently fetch the OTP value generated by OTP generator 330 (Gonzalez-Para. 62);
in step 966 the OTP generator of MSD 100 generates an OTP value for a particular slot In step 968, the OTP value, user identifying information and user secret are submitted to the institution (Gonzalez-Fig. 10C, el. 966, 968; Para. 74), and
transmitting the first pseudo-random number password from the personal computer utility to the uniform resource locator of the internet resource requesting a password, e.g., the client may be active on the host computer and detect when the user accesses a web page within the list of enrolled institutions in order to activate the log on sequence, and the user identity and credentials, and the institution Uniform Resource Locator ("URL") or other form of web address are also ideally already stored on the removable storage authentication mass storage device, and are retrieved for the authentication, wherein if the device supports a number of independent OTP seeds, or even if it supports a number of independent institutions using the same OTP seeds, then the user identity, credentials, and URL are ideally selected from a list stored on the device according to the particular institution to which the person is authenticating (Gonzalez-Para. 16);
in step 716, the client connects to the selected institutions, and once connected, the client then presents the information necessary to log the user into the selected institutions, wherein this information comprises the user's identifying information such as his name, account number, or user ID, the user's secret information such as his password or PIN, and the OTP value for the particular institution if the institution is of the type that requires an OTP value for log in (Gonzalez-Fig. 7, el. 716; Para. 69).
Claims 2, 17, and 23 are rejected under 35 U.S.C. 103 as being unpatentable over Gonzalez in view of Bansal and further in view of Dischler (US 10,332,171 B1).
Regarding claim 2, Gonzalez in view of Bansal teaches the system as in claim 1.
Gonzalez in view of Bansal does not clearly teach to: generate a second pseudo-random number password in a sequence using the first pseudo-random number password as a second seed value, and generate a third pseudo-random number password in a sequence using the second pseudo-random number password as a third seed value.
Dischler teaches to: generate a second pseudo-random number password in a sequence using the first pseudo-random number password as a second seed value, and generate a third pseudo-random number password in a sequence using the second pseudo-random number password as a third seed value, e.g., the process 300 can use a mathematical algorithm to generate a new password based on the previous password. For example, a one-way hash function (e.g., hash function f( )) can be used to generate a series of passwords starting with an initial seed password (e.g., f(s), f(f(s)), f(f(f(s))), . . . ) (Col. 8, lines 21-40).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Gonzalez in view of Bansal to include to: generate a second pseudo-random number password in a sequence using the first pseudo-random number password as a second seed value, and generate a third pseudo-random number password in a sequence using the second pseudo-random number password as a third seed value, using the known method of generating a series of passwords based on the respective previous password in the series, as taught by Dischler, in combination with the password generation system of Gonzalez in view of Bansal, for the purpose of enhancing the security of the system by increasing the difficulty of an attacker being able to reverse engineer the passwords (Dischler-Col. 8, lines 21-40).
Regarding claim 17, Gonzalez in view of Bansal teaches the method as in claim 16.
Gonzalez in view of Bansal does not clearly teach generating a second pseudo-random number password in a sequence using the first pseudo-random number password as a second seed value; and generating a third pseudo-random number password in a sequence using the second pseudo-random number password as a third seed value.
Dischler teaches generating a second pseudo-random number password in a sequence using the first pseudo-random number password as a second seed value; and generating a third pseudo-random number password in a sequence using the second pseudo-random number password as a third seed value, e.g., the process 300 can use a mathematical algorithm to generate a new password based on the previous password. For example, a one-way hash function (e.g., hash function f( )) can be used to generate a series of passwords starting with an initial seed password (e.g., f(s), f(f(s)), f(f(f(s))), . . . ) (Col. 8, lines 21-40).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Gonzalez in view of Bansal to include generating a second pseudo-random number password in a sequence using the first pseudo-random number password as a second seed value; and generating a third pseudo-random number password in a sequence using the second pseudo-random number password as a third seed value, using the known method of generating a series of passwords based on the respective previous password in the series, as taught by Dischler, in combination with the password generation system of Gonzalez in view of Bansal, for the purpose of enhancing the security of the system by increasing the difficulty of an attacker being able to reverse engineer the passwords (Dischler-Col. 8, lines 21-40).
Regarding claim 23, Gonzalez in view of Bansal in view of Dischler teaches the method as in claim 17, comprising: generating via the universal serial bus dongle the second pseudo-random number password via the pseudo-random character generator using the second seed value, e.g., in step 712, MSD 100 generates an OTP value for each of the selected institutions, wherein each institution may have a unique seed and algorithm for OTP generation (Gonzalez-Fig. 7, el. 712; Para. 69);
in step 966 the OTP generator of MSD 100 generates an OTP value for a particular slot (Gonzalez-Fig. 10C, el. 966; Para. 74).
Claims 4 and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Gonzalez in view of Bansal and further in view of Lin et al. (US 2012/0302169 A1).
Regarding claim 4, Gonzalez in view of Bansal teaches the system as in claim 1.
Gonzalez in view of Bansal further teaches …wherein the instructions of the universal serial bus dongle, when executed by the controller, cause the universal serial bus dongle to: send the first pseudo-random number password to the personal computer utility for transmission to the uniform resource locator of the internet resource requesting a password…, e.g., See Figure 5B—The MSD 100 sends the OTP to the client (Gonzalez-Fig. 5B);
Client 320 will request and subsequently fetch the OTP value generated by OTP generator 330 (Gonzalez-Para. 62);
in step 966 the OTP generator of MSD 100 generates an OTP value for a particular slot In step 968, the OTP value, user identifying information and user secret are submitted to the institution (Gonzalez-Fig. 10C, el. 966, 968; Para. 74).
Gonzalez in view of Bansal does not clearly teach a switch on the universal serial bus dongle, wherein the instructions of the universal serial bus dongle, when executed by the controller, cause the universal serial bus dongle to: send the first pseudo-random number password to the personal computer utility for transmission to the uniform resource locator of the internet resource requesting a password, if the switch on the universal serial bus dongle is activated.
Lin teaches a switch on the universal serial bus dongle, wherein the instructions of the universal serial bus dongle, when executed by the controller, cause the universal serial bus dongle to: direct data flow to the USB dongle or the laptop computer, if the switch on the universal serial bus dongle is activated, e.g., the switch 35 may directs data flow to the USB dongle 30 or the laptop computer 20 by determination, wherein the switch 35 may be a piece of hardware or implemented by firmware (Fig. 4, el. 20, 30, 35; Para. 28).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Gonzalez in view of Bansal to include a switch on the universal serial bus dongle, wherein the instructions of the universal serial bus dongle, when executed by the controller, cause the universal serial bus dongle to: send the first pseudo-random number password to the personal computer utility for transmission to the uniform resource locator of the internet resource requesting a password, if the switch on the universal serial bus dongle is activated, using the known method of enabling a switch on the USB dongle to direct the flow of data, as taught by Lin, in combination with the password generation system of Gonzalez in view of Bansal, for the purpose of providing the user with more control over when the USB dongle is being used.
Regarding claim 19, Gonzalez in view of Bansal teaches the method as in claim 16.
Gonzalez in view of Bansal further teaches sending the first pseudo-random number password to the personal computer utility for transmission to the uniform resource locator of the internet resource requesting a password…, e.g., See Figure 5B—The MSD 100 sends the OTP to the client (Gonzalez-Fig. 5B);
Client 320 will request and subsequently fetch the OTP value generated by OTP generator 330 (Gonzalez-Para. 62);
in step 966 the OTP generator of MSD 100 generates an OTP value for a particular slot In step 968, the OTP value, user identifying information and user secret are submitted to the institution (Gonzalez-Fig. 10C, el. 966, 968; Para. 74).
Gonzalez in view of Bansal does not clearly teach sending the first pseudo-random number password to the personal computer utility for transmission to the uniform resource locator of the internet resource requesting a password, if a switch on the universal serial bus dongle is activated.
Lin teaches directing data flow to the USB dongle or the laptop computer, if a switch on the universal serial bus dongle is activated, e.g., the switch 35 may directs data flow to the USB dongle 30 or the laptop computer 20 by determination, wherein the switch 35 may be a piece of hardware or implemented by firmware (Fig. 4, el. 20, 30, 35; Para. 28).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Gonzalez in view of Bansal to include sending the first pseudo-random number password to the personal computer utility for transmission to the uniform resource locator of the internet resource requesting a password, if a switch on the universal serial bus dongle is activated, using the known method of enabling a switch on the USB dongle to direct the flow of data, as taught by Lin, in combination with the password generation system of Gonzalez in view of Bansal, for the purpose of providing the user with more control over when the USB dongle is being used.
Claims 10, 11, 25, and 26 are rejected under 35 U.S.C. 103 as being unpatentable over Gonzalez in view of Bansal and further in view of Cavanagh et al. (US 2017/0011214 A1).
Regarding claim 10, Gonzalez in view of Bansal teaches the system as in claim 1.
Gonzalez in view of Bansal further teaches a single connection utility between the universal serial bus interface and a personal computer browser…, e.g., the program monitors the browser installed on the host, and configures the browsers to carry out all data communications with the Internet/WWW through a specific port that it monitors (Gonzalez-Para. 19).
Gonzalez in view of Bansal does not clearly teach wherein the instructions of the personal computer utility are incorporated in a server hosting the internet resource requesting a password.
Cavanagh teaches a single connection utility between the universal serial bus interface and a personal computer browser, wherein the instructions of the personal computer utility are incorporated in a server hosting the internet resource requesting a password, e.g., a portable password manager device, which may be device comprising computing hardware capable of executing various tasks and processes of a password manager, wherein the terms “password manager device” and “client device” may be interchangeably used hereinafter, wherein the password manager device is a USB device (Para. 28);
the password manager server 102 may be any computing device comprising a processor that executes various software modules associated with the cloud based active password manager system 100 (Fig. 1, el. 102; Para. 35);
the password manager server 102 is configured to facilitate authentication services for authenticating users and devices attempting to access various resources of the cloud based active password manager system 100 (Para. 36);
in order to access the websites via the internet, the user will generally run a web browser software installed on the host computer 108 (Para. 40);
a portable client device 110a plug-in or a software based client device 110b browser plug-in on the host computer 108, the client device is configured to detect when the user has accessed a given website which is in the list of websites to be manager by the user (Fig. 1, el. 108, 110a, 110b; Para. 49).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Gonzalez in view of Bansal to include wherein the instructions of the personal computer utility are incorporated in a server hosting the internet resource requesting a password, using the known method of utilizing a USB device and a cloud-based password manager server, as taught by Cavanagh, in combination with the password generation system of Gonzalez in view of Bansal, for the purpose of offloading some of the password management tasks to a server, thereby reducing processing at the computer.
Regarding claim 11, Gonzalez in view of Bansal teaches the system as in claim 1.
Gonzalez in view of Bansal further teaches a single connection utility between the universal serial bus interface and a personal computer browser…, e.g., the program monitors the browser installed on the host, and configures the browsers to carry out all data communications with the Internet/WWW through a specific port that it monitors (Gonzalez-Para. 19).
Gonzalez in view of Bansal does not clearly teach wherein the instructions of the personal computer utility are incorporated in the operating instructions of the personal computer browser.
Cavanagh teaches a single connection utility between the universal serial bus interface and a personal computer browser, wherein the instructions of the personal computer utility are incorporated in the operating instructions of the personal computer browser, e.g., a portable password manager device, which may be device comprising computing hardware capable of executing various tasks and processes of a password manager, wherein the terms “password manager device” and “client device” may be interchangeably used hereinafter, wherein the password manager device is a USB device (Para. 28);
additionally or alternatively, embodiments of a cloud based active password manager system may comprise a password manager software module, which may be a software based password manager, wherein the software based password manager may comprise of programs and instructions executed by a host computer, such as a personal computer (Para. 29);
a portable client device 110a plug-in or a software based client device 110b browser plug-in on the host computer 108, the client device is configured to detect when the user has accessed a given website which is in the list of websites to be manager by the user (Fig. 1, el. 108, 110a, 110b; Para. 49).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Gonzalez in view of Bansal to include wherein the instructions of the personal computer utility are incorporated in the operating instructions of the personal computer browser, using the known method of utilizing a USB device and a browser plug-in password manager, as taught by Cavanagh, in combination with the password generation system of Gonzalez in view of Bansal, for the purpose of enabling the software to be integrated directly into the browser, thereby eliminating the need for a new program to be installed.
Regarding claim 25, Gonzalez in view of Bansal teaches the method as in claim 16.
Gonzalez in view of Bansal further teaches connecting a single utility between the universal serial bus interface and a personal computer browser…, e.g., the program monitors the browser installed on the host, and configures the browsers to carry out all data communications with the Internet/WWW through a specific port that it monitors (Gonzalez-Para. 19).
Gonzalez in view of Bansal does not clearly teach incorporating the instructions of the personal computer utility in a server hosting the internet resource requesting a password.
Cavanagh teaches connecting a single utility between the universal serial bus interface and a personal computer browser; incorporating the instructions of the personal computer utility in a server hosting the internet resource requesting a password, e.g., a portable password manager device, which may be device comprising computing hardware capable of executing various tasks and processes of a password manager, wherein the terms “password manager device” and “client device” may be interchangeably used hereinafter, wherein the password manager device is a USB device (Para. 28);
the password manager server 102 may be any computing device comprising a processor that executes various software modules associated with the cloud based active password manager system 100 (Fig. 1, el. 102; Para. 35);
the password manager server 102 is configured to facilitate authentication services for authenticating users and devices attempting to access various resources of the cloud based active password manager system 100 (Para. 36);
in order to access the websites via the internet, the user will generally run a web browser software installed on the host computer 108 (Para. 40);
a portable client device 110a plug-in or a software based client device 110b browser plug-in on the host computer 108, the client device is configured to detect when the user has accessed a given website which is in the list of websites to be manager by the user (Fig. 1, el. 108, 110a, 110b; Para. 49).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Gonzalez in view of Bansal to include incorporating the instructions of the personal computer utility in a server hosting the internet resource requesting a password, using the known method of utilizing a USB device and a cloud-based password manager server, as taught by Cavanagh, in combination with the password generation system of Gonzalez in view of Bansal, for the purpose of offloading some of the password management tasks to a server, thereby reducing processing at the computer.
Regarding claim 26, Gonzalez in view of Bansal teaches the method as in claim 16.
Gonzalez in view of Bansal further teaches connecting a single utility between the universal serial bus interface and a personal computer browser…, e.g., the program monitors the browser installed on the host, and configures the browsers to carry out all data communications with the Internet/WWW through a specific port that it monitors (Gonzalez-Para. 19).
Gonzalez in view of Bansal does not clearly teach incorporating the instructions of the personal computer utility in operating instructions of the personal computer browser.
Cavanagh teaches connecting a single utility between the universal serial bus interface and a personal computer browser; and incorporating the instructions of the personal computer utility in operating instructions of the personal computer browser, e.g., a portable password manager device, which may be device comprising computing hardware capable of executing various tasks and processes of a password manager, wherein the terms “password manager device” and “client device” may be interchangeably used hereinafter, wherein the password manager device is a USB device (Para. 28);
additionally or alternatively, embodiments of a cloud based active password manager system may comprise a password manager software module, which may be a software based password manager, wherein the software based password manager may comprise of programs and instructions executed by a host computer, such as a personal computer (Para. 29);
a portable client device 110a plug-in or a software based client device 110b browser plug-in on the host computer 108, the client device is configured to detect when the user has accessed a given website which is in the list of websites to be manager by the user (Fig. 1, el. 108, 110a, 110b; Para. 49).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Gonzalez in view of Bansal to include incorporating the instructions of the personal computer utility in operating instructions of the personal computer browser, using the known method of utilizing a USB device and a browser plug-in password manager, as taught by Cavanagh, in combination with the password generation system of Gonzalez in view of Bansal, for the purpose of enabling the software to be integrated directly into the browser, thereby eliminating the need for a new program to be installed.
Allowable Subject Matter
Claims 3, 12-15, 18, and 27-30 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
As allowable subject matter has been indicated, applicant's reply must either comply with all formal requirements or specifically traverse each requirement not complied with. See 37 CFR 1.111(b) and MPEP § 707.07(a).
The following is a statement of reasons for the indication of allowable subject matter:
The prior art of record fails to disclose the combination of features as claimed and arranged by applicant when read in light of the specification. In this case, the allowance is based on the combination of the limitations in each claim and not on any single limitation.
Regarding claim 3, the cited references do not alone or in an obvious combination teach “wherein the first, second, and third pseudo-random number passwords are 32-bit pseudo-random numbers, respectively, wherein the first, second, and third pseudo-random numbers are respectively broken into 6-bit values and added to an offset value to generate a sequence of (American Standard Code for Information Interchange (ASCII) characters selected from: numbers, punctuation, upper case letters, and lower case letters” of claim 3 in combination with the remaining limitations claim 3.
Claim 18 includes similar limitations and is similarly analyzed.
Regarding claim 12, the cited references do not alone or in an obvious combination teach “wherein the personal computer utility comprises a pseudo-random number generator identical to the pseudo-random number generator of the universal serial bus dongle, wherein the pseudo-random number generators are synchronized, wherein the pseudo-random number generators both start generating numbers with an identical initial seed value, and wherein the instructions of the personal computer utility and the universal serial bus dongle, when executed by the respective controllers, cause the personal computer utility and the universal serial bus dongle to: encrypt and decrypt communications between the universal serial bus dongle and the personal computer utility using a single key cypher based on a rolling key generated by the synchronized pseudo-random number generators in the personal computer utility and the universal serial bus dongle” of claim 12 in combination with the remaining limitations claim 12.
Claim 27 includes similar limitations and is similarly analyzed.
Claims 13-15 and 28-30 are dependent on claims 12 and 27, respectively and therefore, also include allowable subject matter.
Additional relevant prior art:
Brown (US 2014/0298432 A1)—Brown discloses when a security credential is requested during a user's operation of the password vault device or some other computing/communication device, such as when the user is accessing an online site or service via a browser program, the request is passed to the password vault, and the appropriate security credential is retrieved, delivered, and entered into the requesting interface (Abstract).
Da Rocha (US 2023/0017314 A1)—Da Rocha discloses the hardware token 36 further comprises a processor 35′ running the same cryptographic algorithm as the processor 35 of the authentication server 34. The hardware token 36 includes an activation button 38 that, when pressed, causes the processor 35′ to generate a pseudorandom number by way of the cryptographic algorithm on the basis of the seed 32″ and to display the pseudorandom number on a display 37 (Para. 89).
Jass et al. (US 2022/0116390 A1)—Jass discloses the user's login information and public/private key pair may be stored by an authenticator (e.g., a hardware authenticator, such as a USB dongle; a software authenticator on the user's device, such as WebAuthnAPI). Further, when the user arrives at the login screen (e.g., login screen 950) for the service/website, the authenticator extracts the domain (e.g., URL or web address) from the web browser, signs the cryptographic challenge from the relaying party (e.g., server 940), and transmits the challenge response to the relaying party (Para. 68).
Francois et al. (US 2014/0168356 A1)—Francois discloses the steps of the method are stored on a computer-readable media (e.g., a thumb drive) as instructions for execution by the CPU 12 of the device 10 (Fig. 1, el. 10, 12; Para. 50).
The additional relevant prior art also do not alone or in an obvious combination teach the aforementioned limitations in combination with the remaining limitations of each respective independent claim.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JEREMY DUFFIELD whose telephone number is (571)270-1643. The examiner can normally be reached Monday - Friday, 7:00 AM - 3:00 PM (ET).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Yin-Chen Shaw can be reached at (571) 272-8878. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
16 July 2026
/Jeremy S Duffield/ Primary Examiner, Art Unit 2498
Prosecution Insights