DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application is being examined under the pre-AIA first to invent provisions.
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 07/13/2026 has been entered.
Status of Claims
Claims 21 and 36 are currently amended.
Claims 1-20, 24, 30-32, 39, 45-47 and 50-58 are canceled.
Claims 59-60 are newly added.
Claims 21-23, 25-29, 33-38, 40-44, 48-49 and 59-60 are pending.
Response to Remarks
35 U.S.C. § 101
Remark 1: Applicant contends that Examiner's characterization of the claims as merely reciting "payment card transaction authorization" evaluates the claims at an impermissibly high level of abstraction. Claim 21 does not recite a human-driven commercial interaction. Rather, it recites highly specific protocol- and cryptography-level operations executed within a mobile device and point-of-sale (POS) terminal stack.
Response to Remark 1: Applicant's argument is not persuasive because these features are part of the additional elements discussed in Step 2A, Prong Two.
Remark 2: Applicant contends that even if the claims were deemed to recite an abstract idea under Prong One, the claims are patent-eligible under Step 2A, Prong Two because they integrate the alleged judicial exception into a practical application by providing a specific improvement to the underlying technology, because the claims improve security, reduce key exposure, and maintain interoperability with card specifications.
Response to Remark 2: What applicant contends is an improvement is merely an improvement in the recited abstract idea, and not an improvement in the functioning of computers, nor technology, nor a technical field. Moreover, a general-purpose computer would be capable of performing these same operations of a mere improvement in the abstract idea. Here, the additional elements individually and in combination, are recited at a high level of generality as generic and conventional computers and components merely serving as a tool to perform the abstract idea (MPEP § 2106.05(f)) and generally linking the use of the abstract idea to a particular technological environment (MPEP § 2106.05(h)).
Remark 3: Applicant contends that regarding Step 2B, the Office's analysis continues to fail to meet the evidentiary burden required to establish that the additional elements are "well-understood, routine, and conventional
Response to Remark 3: Individually, the additional elements do not amount to significantly more than the abstract idea. Here, the additional elements simply append well-understood, routine, conventional activities previously known to the industry, specified at a high level of generality, to the judicial exception, e.g., a claim to an abstract idea requiring no more than a generic computer to perform generic computer functions that are well-understood, routine and conventional activities previously known to the industry. A factual determination is required to support a conclusion that an additional element (or combination of additional elements) is well-understood, routine, conventional activity. Here, the specification of the application indicates that additional elements are well-known or conventional (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). There is nothing in the specification to indicate that the operations recited in the claims require any specialized hardware or inventive computer components or that the claimed invention is implemented using other than generic computer components to perform generic computer functions. The ordered combination recites no more than the individual elements do. Thus, the additional elements are not significantly more than the abstract idea. Accordingly, the claims are directed to the abstract idea identified above without significantly more.
35 U.S.C. § 103
Applicant’s remarks have been found persuasive. Accordingly, the previous rejections are withdrawn.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 21-23, 25-29, 33-38, 40-44, 48-49 and 59-60 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1
Step 1 of the eligibility analysis asks is the claim to a process, machine, manufacture or composition of matter (See MPEP § 2106.03, subsections I and II). Claims 21-23, 25-29, 33-35 and 59-60 are directed to a computer-implemented method (i.e., process). Claims 36-38, 40-44 and 48-49 are directed to a computer-implemented system (i.e., machine, and manufacture). Therefore, these claims fall within the four statutory categories of invention.
Step 2A, Prong One
Prong One asks does the claim recite an abstract idea, law of nature, or natural phenomenon (MPEP § 2106.04(II)(A)(1)). Claims 21 and 36 under a broadest reasonable interpretation recite an abstract idea because the claims describe payment card transaction authorization, grouped within the “certain methods of organizing human activity” grouping of abstract ideas (MPEP § 2106.04(a)(2), subsection II). The claim limitations reciting the abstract idea are grouped within the “certain methods of organizing human activity” grouping of abstract ideas because the limitations describe fundamental economic principles or practices, including mitigating risk, and describe commercial or legal interactions, including advertising, marketing or sales activities or behaviors. The following underlined claim limitations recite the abstract idea.
Claim 21:
A method for secure application-based participation in a payment card transaction authorization process by a mobile device, the method comprising:
at a mobile device, executing an application in an operating system of the mobile device;
receiving by the application over a wireless network from a remote computer system, a first set of data associated with an account,
wherein the account is associated with an original account number, and
wherein the first set of data comprises (1) a first substituted account number that is associated with but is distinct from the original account number, and (2) a first non-permanent cryptographic key associated with the account, the first non-permanent cryptographic key being different from a permanent cryptographic key associated with the account;
locally storing the first substituted account number and the first non-permanent cryptographic key at the mobile device as a local cryptographic key associated with the account; and
sending information to a point-of-sale (POS) terminal from the mobile device,
wherein the POS terminal is configured to implement an interrogation defined by a card specification that indicates a receipt, by the POS terminal, of a cryptogram calculated using unpredictable data passed to the mobile device from the POS terminal, and
wherein sending information to the POS terminal comprises:
generating, by the application, a response cryptogram (1) using the local cryptographic key associated with the account for encryption, and (2) without using the permanent cryptographic key associated with the account; and
sending a device response communication from the mobile device to an electronic reader through a first communications channel, the device response communication comprising an application data protocol unit (APDU) containing the response cryptogram and the first substituted account number,
wherein the payment card transaction initiated by the mobile device is authorized based on authentication of the APDU by the remote computer system.
Claim 36:
A system for secure application-based participation by a mobile device in a payment card transaction authorization process, the system comprising:
a mobile device comprising:
a wireless interface to connect to a wireless network that is separate from a communications channel over which communications are received by the mobile device;
one or more processors; and
a non-transitory computer readable storage medium accessible by the one or more processors, the computer readable storage medium storing an application executable in an operating system of the mobile device to:
receive over the wireless network from a remote computer system, a first set of data associated with an account,
wherein the account is associated with an original account number, and
wherein the first set of data comprises (1) a first substituted account number that is associated with but is distinct from the original account number, and (2) a first non- permanent cryptographic key associated with the account, the first non-permanent cryptographic key being different from a permanent cryptographic key associated with the account;
store the first substituted account number and the first non-permanent cryptographic key at the mobile device as a local cryptographic key associated with the account;
generate a response cryptogram (1) using the local cryptographic key associated with the account for encryption, and (2) without accessing the permanent cryptographic key associated with the account; and
send a device response communication from the mobile device to an electronic reader of a point-of-sale (POS) terminal through the communications channel,
wherein the POS terminal is configured to implement an interrogation defined by a card specification that indicates a receipt, by the POS terminal, of a cryptogram calculated using unpredictable data passed to the mobile device from the POS terminal, and
wherein the device response communication comprises an application data protocol unit (APDU) containing the response cryptogram and the first substituted account number,
wherein the payment card transaction initiated by the mobile device is authorized based on authentication of the APDU by the remote computer system.
Step 2A, Prong Two
Prong Two asks does the claim recite additional elements that integrate the judicial exception into a practical application (MPEP § 2106.04(II)(A)(2)). Examiners evaluate integration into a practical application by: (1) identifying whether there are any additional elements recited in the claim beyond the judicial exception(s); and (2) evaluating those additional elements individually and in combination to determine whether they integrate the exception into a practical application, using one or more of the considerations discussed in more detail in MPEP §§ 2106.04(d)(1), 2106.04(d)(2), 2106.05(a) through (c) and 2106.05(e) through (h). Here, the non-underlined claim limitations above recite additional elements. The additional elements do not improve the functioning of computers, another technology, or a technical field (MPEP §§ 2106.04(d)(1) and 2106.05(a)). The Specification does not assert that the invention improves upon conventional functioning of a computer, or upon conventional technology or technological processes. The claim does not purport to improve computer capabilities, but rather invokes computers merely as a tool by adding general purpose computers post-hoc to an abstract idea. A commonplace business method being applied on a general-purpose computer is not sufficient to show an improvement to technology. The claim must include more than mere instructions to perform the method on a generic component or machinery to qualify as an improvement to an existing technology. The Specification and the claim language provide evidence that the focus of the claim is on a scheme. An improvement in the abstract idea itself is not an improvement in technology. Even if the Specification describes technical improvements, they are not claimed. The additional elements do not apply the abstract idea to effect a particular treatment or prophylaxis for a disease or medical condition (MPEP § 2106.04(d)(2)). The additional elements do not implement the abstract idea with a particular machine or manufacture that is integral to the claim (MPEP § 2106.05(b)). A general-purpose computer that applies a judicial exception, such as an abstract idea, by use of conventional computer functions does not qualify as a particular machine. The additional elements do not transform or reduce a particular article to a different state or thing (MPEP § 2106.05(c)). The claim does not recite any transformation of an article where the article changes to a different state or thing. Nor do the additional elements apply the abstract idea in a meaningful way or impose a meaningful limit on it beyond linking its use to a particular technological environment, such that the claim as a whole is more than a drafting effort designed to monopolize the exception (MPEP § 2106.05(e)). The additional elements generally link the use of the judicial exception to a particular technological environment. A wholly generic computer implementation is not generally the sort of additional feature that provides any practical assurance that the process is more than a drafting effort designed to monopolize the abstract idea itself. The additional elements individually and in combination, merely serve as a tool to perform the abstract idea (MPEP § 2106.05(f)). Implementing an abstract idea on a generic computer, does not integrate the abstract idea into a practical application, similar to how the recitation of the computer in the claim in Alice amounted to mere instructions to apply the abstract idea of intermediated settlement on a generic computer. Use of a computer or other machinery in its ordinary capacity for economic or other tasks or simply adding a general-purpose computer or computer components after the fact to an abstract idea does not integrate a judicial exception into a practical application. The additional elements are being used in their ordinary capacity. The additional elements do no more than merely invoke computers or machinery as a tool to perform an existing process. The additional elements generally link the use of the abstract idea to a particular technological environment or field of use (MPEP § 2106.05(h)). Limitations that amount to merely indicating a field of use or technological environment in which to apply a judicial exception cannot integrate a judicial exception into a practical application. Thus, the additional elements do not integrate the abstract idea into a practical application. Accordingly, the claims are directed to the abstract idea identified above.
Step 2B
Step 2B determines whether the claim as a whole amount to significantly more than the abstract idea itself (MPEP § 2106.05). In Step 2B examiners carry over their identification of the additional element(s) in the claim from Step 2A Prong Two; carry over their conclusions from Step 2A Prong Two on the considerations discussed in MPEP §§ 2106.05(a)-(c), (e), (f) and (h); re-evaluate any additional element or combination of elements that was considered to be insignificant extra-solution activity per MPEP § 2106.05(g), because if such re-evaluation finds that the element is unconventional or otherwise more than what is well-understood, routine, conventional activity in the field, this finding may indicate that the additional element is no longer considered to be insignificant; and evaluate whether any additional element or combination of elements are other than what is well-understood, routine, conventional activity in the field, or simply append well-understood, routine, conventional activities previously known to the industry, specified at a high level of generality, to the judicial exception, per MPEP § 2106.05(d). The additional elements individually and in combination, merely serve as a tool to perform the abstract idea (MPEP § 2106.05(f)). The additional elements generally link the use of the abstract idea to a particular technological environment or field of use (MPEP § 2106.05(h)). Individually, the additional elements do not amount to significantly more than the abstract idea. Here, the additional elements simply append well-understood, routine, conventional activities previously known to the industry, specified at a high level of generality, to the judicial exception, e.g., a claim to an abstract idea requiring no more than a generic computer to perform generic computer functions that are well-understood, routine and conventional activities previously known to the industry. A factual determination is required to support a conclusion that an additional element (or combination of additional elements) is well-understood, routine, conventional activity. Here, the specification of the application indicates that additional elements are well-known or conventional (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). There is nothing in the specification to indicate that the operations recited in the claims require any specialized hardware or inventive computer components or that the claimed invention is implemented using other than generic computer components to perform generic computer functions. The ordered combination recites no more than the individual elements do. Thus, the additional elements are not significantly more than the abstract idea. Accordingly, the claims are directed to the abstract idea identified above without significantly more. The claims are not eligible, warranting a rejection for lack of subject matter eligibility and concluding the eligibility analysis.
Dependent Claims
Claim 22 recites an abstract idea because the claim describes payment card transaction authorization, grouped within the “certain methods of organizing human activity”grouping of abstract ideas. The following underlined claim limitations recite the abstract idea. The non-underlined claim limitations recite additional elements. The additional elements do not integrate the abstract idea into a practical application and are not significantly more than the abstract idea because the additional elements individually and in combination, merely serve as a tool to perform the abstract idea and generally link the use of the abstract idea to a particular technological environment or field of use. The additional elements, individually and in combination, are well-understood, routine, conventional activity (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). Therefore, the claim is not eligible.
wherein sending information to the POS terminal comprises
generating, by the application, the response cryptogram without using the unpredictable data passed to the mobile device from the POS terminal.
Claim 23 recites an abstract idea because the claim describes payment card transaction authorization, grouped within the “certain methods of organizing human activity”grouping of abstract ideas. The following underlined claim limitations recite the abstract idea. The non-underlined claim limitations recite additional elements. The additional elements do not integrate the abstract idea into a practical application and are not significantly more than the abstract idea because the additional elements individually and in combination, merely serve as a tool to perform the abstract idea and generally link the use of the abstract idea to a particular technological environment or field of use. The additional elements, individually and in combination, are well-understood, routine, conventional activity (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). Therefore, the claim is not eligible.
wherein the original account number is an original account number embedded in track data of a payment card issued to a user of the mobile device, and wherein the first substituted account number is associated with or derived from the original account number.
Claim 25 recites an abstract idea because the claim describes payment card transaction authorization, grouped within the “certain methods of organizing human activity”grouping of abstract ideas. The following underlined claim limitations recite the abstract idea. The non-underlined claim limitations recite additional elements. The additional elements do not integrate the abstract idea into a practical application and are not significantly more than the abstract idea because the additional elements individually and in combination, merely serve as a tool to perform the abstract idea and generally link the use of the abstract idea to a particular technological environment or field of use. The additional elements, individually and in combination, are well-understood, routine, conventional activity (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). Therefore, the claim is not eligible.
wherein the device response communication does not include the original account number.
Claim 26 recites an abstract idea because the claim describes payment card transaction authorization, grouped within the “certain methods of organizing human activity”grouping of abstract ideas. The following underlined claim limitations recite the abstract idea. The non-underlined claim limitations recite additional elements. The additional elements do not integrate the abstract idea into a practical application and are not significantly more than the abstract idea because the additional elements individually and in combination, merely serve as a tool to perform the abstract idea and generally link the use of the abstract idea to a particular technological environment or field of use. The additional elements, individually and in combination, are well-understood, routine, conventional activity (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). Therefore, the claim is not eligible.
wherein the first substituted account number is configured to be used for a single transaction.
Claim 27 recites an abstract idea because the claim describes payment card transaction authorization, grouped within the “certain methods of organizing human activity”grouping of abstract ideas. The following underlined claim limitations recite the abstract idea. The non-underlined claim limitations recite additional elements. The additional elements do not integrate the abstract idea into a practical application and are not significantly more than the abstract idea because the additional elements individually and in combination, merely serve as a tool to perform the abstract idea and generally link the use of the abstract idea to a particular technological environment or field of use. The additional elements, individually and in combination, are well-understood, routine, conventional activity (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). Therefore, the claim is not eligible.
wherein the original account number is unidentifiable from the device response communication.
Claim 28 recites an abstract idea because the claim describes payment card transaction authorization, grouped within the “certain methods of organizing human activity”grouping of abstract ideas. The following underlined claim limitations recite the abstract idea. The non-underlined claim limitations recite additional elements. The additional elements do not integrate the abstract idea into a practical application and are not significantly more than the abstract idea because the additional elements individually and in combination, merely serve as a tool to perform the abstract idea and generally link the use of the abstract idea to a particular technological environment or field of use. The additional elements, individually and in combination, are well-understood, routine, conventional activity (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). Therefore, the claim is not eligible.
wherein the device response communication comprises dynamically generated Track 1 and/or Track 2 data comprising the first substituted account number.
Claim 29 recites an abstract idea because the claim describes payment card transaction authorization, grouped within the “certain methods of organizing human activity”grouping of abstract ideas. The following underlined claim limitations recite the abstract idea. The non-underlined claim limitations recite additional elements. The additional elements do not integrate the abstract idea into a practical application and are not significantly more than the abstract idea because the additional elements individually and in combination, merely serve as a tool to perform the abstract idea and generally link the use of the abstract idea to a particular technological environment or field of use. The additional elements, individually and in combination, are well-understood, routine, conventional activity (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). Therefore, the claim is not eligible.
receiving by the application over the wireless network from the remote computer system, a second set of data associated with the account, the second set of data comprising (1) a second substituted account number that is associated with but is distinct from the original account number, and (2) a second non-permanent cryptographic key associated with the account; and
storing the received second non-permanent cryptographic key as the local cryptographic key associated with the account.
Claim 33 recites an abstract idea because the claim describes payment card transaction authorization, grouped within the “certain methods of organizing human activity”grouping of abstract ideas. The following underlined claim limitations recite the abstract idea. The non-underlined claim limitations recite additional elements. The additional elements do not integrate the abstract idea into a practical application and are not significantly more than the abstract idea because the additional elements individually and in combination, merely serve as a tool to perform the abstract idea and generally link the use of the abstract idea to a particular technological environment or field of use. The additional elements, individually and in combination, are well-understood, routine, conventional activity (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). Therefore, the claim is not eligible.
wherein the first non-permanent cryptographic key and second non-permanent cryptographic key are associated with a remote payment authorization process.
Claim 34 recites an abstract idea because the claim describes payment card transaction authorization, grouped within the “certain methods of organizing human activity”grouping of abstract ideas. The following underlined claim limitations recite the abstract idea. The non-underlined claim limitations recite additional elements. The additional elements do not integrate the abstract idea into a practical application and are not significantly more than the abstract idea because the additional elements individually and in combination, merely serve as a tool to perform the abstract idea and generally link the use of the abstract idea to a particular technological environment or field of use. The additional elements, individually and in combination, are well-understood, routine, conventional activity (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). Therefore, the claim is not eligible.
in which the first non-permanent cryptographic key and the second non-permanent cryptographic key are generated based on an issuer master key.
Claim 35 recites an abstract idea because the claim describes payment card transaction authorization, grouped within the “certain methods of organizing human activity”grouping of abstract ideas. The following underlined claim limitations recite the abstract idea. The non-underlined claim limitations recite additional elements. The additional elements do not integrate the abstract idea into a practical application and are not significantly more than the abstract idea because the additional elements individually and in combination, merely serve as a tool to perform the abstract idea and generally link the use of the abstract idea to a particular technological environment or field of use. The additional elements, individually and in combination, are well-understood, routine, conventional activity (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). Therefore, the claim is not eligible.
at the remote computer system:
upon request by an end user authenticated to the account and prior to the mobile device sending the response cryptogram to the POS terminal,
generating the first substituted account number and the first non-permanent cryptographic key,
associating the first substituted account number and the first non-permanent cryptographic key with the account, and
sending the first substituted account number and the first non-permanent cryptographic key to the mobile device over the wireless network; and
subsequent to the mobile device sending the response cryptogram to the POS terminal, or at a later specified by the remote computer system, or at a time initiated by the end user,
generating a second substituted account number and a second non-permanent cryptographic key,
associating the second substituted account number and the second non-permanent cryptographic key with the account and
sending the second substituted account number and the second non-permanent cryptographic key to the mobile device over the wireless network.
Claim 37 recites an abstract idea because the claim describes payment card transaction authorization, grouped within the “certain methods of organizing human activity”grouping of abstract ideas. The following underlined claim limitations recite the abstract idea. The non-underlined claim limitations recite additional elements. The additional elements do not integrate the abstract idea into a practical application and are not significantly more than the abstract idea because the additional elements individually and in combination, merely serve as a tool to perform the abstract idea and generally link the use of the abstract idea to a particular technological environment or field of use. The additional elements, individually and in combination, are well-understood, routine, conventional activity (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). Therefore, the claim is not eligible.
wherein the application is executable in the operating system of the mobile device to generate the response cryptogram without using the unpredictable data passed to the mobile device from the POS terminal.
Claim 38 recites an abstract idea because the claim describes payment card transaction authorization, grouped within the “certain methods of organizing human activity”grouping of abstract ideas. The following underlined claim limitations recite the abstract idea. The non-underlined claim limitations recite additional elements. The additional elements do not integrate the abstract idea into a practical application and are not significantly more than the abstract idea because the additional elements individually and in combination, merely serve as a tool to perform the abstract idea and generally link the use of the abstract idea to a particular technological environment or field of use. The additional elements, individually and in combination, are well-understood, routine, conventional activity (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). Therefore, the claim is not eligible.
wherein the original account number is an original account number embedded in track data of a payment card issued to a user of the mobile device, and wherein the first substituted account number is associated with or derived from the original account number.
Claim 40 recites an abstract idea because the claim describes payment card transaction authorization, grouped within the “certain methods of organizing human activity”grouping of abstract ideas. The following underlined claim limitations recite the abstract idea. The non-underlined claim limitations recite additional elements. The additional elements do not integrate the abstract idea into a practical application and are not significantly more than the abstract idea because the additional elements individually and in combination, merely serve as a tool to perform the abstract idea and generally link the use of the abstract idea to a particular technological environment or field of use. The additional elements, individually and in combination, are well-understood, routine, conventional activity (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). Therefore, the claim is not eligible.
wherein the device response communication does not include the original account number.
Claim 41 recites an abstract idea because the claim describes payment card transaction authorization, grouped within the “certain methods of organizing human activity”grouping of abstract ideas. The following underlined claim limitations recite the abstract idea. The non-underlined claim limitations recite additional elements. The additional elements do not integrate the abstract idea into a practical application and are not significantly more than the abstract idea because the additional elements individually and in combination, merely serve as a tool to perform the abstract idea and generally link the use of the abstract idea to a particular technological environment or field of use. The additional elements, individually and in combination, are well-understood, routine, conventional activity (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). Therefore, the claim is not eligible.
wherein the first substituted account number is configured to be used for a single transaction.
Claim 42 recites an abstract idea because the claim describes payment card transaction authorization, grouped within the “certain methods of organizing human activity”grouping of abstract ideas. The following underlined claim limitations recite the abstract idea. The non-underlined claim limitations recite additional elements. The additional elements do not integrate the abstract idea into a practical application and are not significantly more than the abstract idea because the additional elements individually and in combination, merely serve as a tool to perform the abstract idea and generally link the use of the abstract idea to a particular technological environment or field of use. The additional elements, individually and in combination, are well-understood, routine, conventional activity (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). Therefore, the claim is not eligible.
wherein the original account number is unidentifiable from the device response communication.
Claim 43 recites an abstract idea because the claim describes payment card transaction authorization, grouped within the “certain methods of organizing human activity”grouping of abstract ideas. The following underlined claim limitations recite the abstract idea. The non-underlined claim limitations recite additional elements. The additional elements do not integrate the abstract idea into a practical application and are not significantly more than the abstract idea because the additional elements individually and in combination, merely serve as a tool to perform the abstract idea and generally link the use of the abstract idea to a particular technological environment or field of use. The additional elements, individually and in combination, are well-understood, routine, conventional activity (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). Therefore, the claim is not eligible.
wherein the device response communication comprises dynamically generated Track 1 and/or Track 2 data comprising the first substituted account number.
Claim 44 recites an abstract idea because the claim describes payment card transaction authorization, grouped within the “certain methods of organizing human activity”grouping of abstract ideas. The following underlined claim limitations recite the abstract idea. The non-underlined claim limitations recite additional elements. The additional elements do not integrate the abstract idea into a practical application and are not significantly more than the abstract idea because the additional elements individually and in combination, merely serve as a tool to perform the abstract idea and generally link the use of the abstract idea to a particular technological environment or field of use. The additional elements, individually and in combination, are well-understood, routine, conventional activity (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). Therefore, the claim is not eligible.
wherein the application is further executable to:
receive over the wireless network from the remote computer system, a second set of data associated with the account, the second set of data comprising (1) a second substituted account number that is associated with but is distinct from the original account number, and (2) a second non-permanent cryptographic key associated with the account; and
store the received second non-permanent cryptographic key at the mobile device as the local cryptographic key associated with the account to change the local cryptographic key associated with the account.
Claim 48 recites an abstract idea because the claim describes payment card transaction authorization, grouped within the “certain methods of organizing human activity”grouping of abstract ideas. The following underlined claim limitations recite the abstract idea. The non-underlined claim limitations recite additional elements. The additional elements do not integrate the abstract idea into a practical application and are not significantly more than the abstract idea because the additional elements individually and in combination, merely serve as a tool to perform the abstract idea and generally link the use of the abstract idea to a particular technological environment or field of use. The additional elements, individually and in combination, are well-understood, routine, conventional activity (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). Therefore, the claim is not eligible.
wherein the first non-permanent cryptographic key and the second non-permanent cryptographic key are generated based on an issuer master key.
Claim 49 recites an abstract idea because the claim describes payment card transaction authorization, grouped within the “certain methods of organizing human activity”grouping of abstract ideas. The following underlined claim limitations recite the abstract idea. The non-underlined claim limitations recite additional elements. The additional elements do not integrate the abstract idea into a practical application and are not significantly more than the abstract idea because the additional elements individually and in combination, merely serve as a tool to perform the abstract idea and generally link the use of the abstract idea to a particular technological environment or field of use. The additional elements, individually and in combination, are well-understood, routine, conventional activity (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). Therefore, the claim is not eligible.
the remote computer system, the remote computer system configured to
generate non-permanent cryptographic keys associated with the account and
send the non-permanent cryptographic keys associated with the account to the mobile device over the wireless network.
Claim 59 recites an abstract idea because the claim describes payment card transaction authorization, grouped within the “certain methods of organizing human activity”grouping of abstract ideas. The following underlined claim limitations recite the abstract idea. The non-underlined claim limitations recite additional elements. The additional elements do not integrate the abstract idea into a practical application and are not significantly more than the abstract idea because the additional elements individually and in combination, merely serve as a tool to perform the abstract idea and generally link the use of the abstract idea to a particular technological environment or field of use. The additional elements, individually and in combination, are well-understood, routine, conventional activity (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). Therefore, the claim is not eligible.
wherein the first substituted account number is formatted as track data in place of the original account number.
Claim 60 recites an abstract idea because the claim describes payment card transaction authorization, grouped within the “certain methods of organizing human activity”grouping of abstract ideas. The following underlined claim limitations recite the abstract idea. The non-underlined claim limitations recite additional elements. The additional elements do not integrate the abstract idea into a practical application and are not significantly more than the abstract idea because the additional elements individually and in combination, merely serve as a tool to perform the abstract idea and generally link the use of the abstract idea to a particular technological environment or field of use. The additional elements, individually and in combination, are well-understood, routine, conventional activity (See Pre-Grant Publication 0047, 0049, 0051, 0067-0091, 0148-0168, 0241, 0274-0277, 0283-0287). Therefore, the claim is not eligible.
wherein the first substituted account number is generated by the remote computer system.
Claims Free of Art
Claims 21-23, 25-29, 33-38, 40-44, 48-49 and 59-60 are free of art. The closest prior art of record is US 2010/0185545 A1 to Royyuru et al. (hereinafter “Royyuru”). Royyuru teaches:
a mobile device comprising: a wireless interface to connect to a wireless network that is separate from a communications channel over which communications are received by the mobile device; one or more processors; and a non-transitory computer readable storage medium accessible by the one or more processors, the computer readable storage medium storing an application executable in an operating system of the mobile device to (Fig.3 item 305; paras 21, 35, 46, 51)
at a mobile device (Fig.3 item 305; paras 21, 35, 46, 51), executing an application (Fig.2 item 250; paras 43, 51) in an operating system of the mobile device (Fig.2 item 245; para 43)
locally storing the first substituted account number and the first non-permanent cryptographic key at the mobile device as a local cryptographic key associated with the account (paras 33, 46, 51)
sending information to a point-of-sale (POS) terminal from the mobile device (paras 47, 54)
wherein the POS terminal is configured to implement an interrogation defined by a card specification that indicates a receipt, by the POS terminal, of a cryptogram calculated using unpredictable data passed to the mobile device from the POS terminal, and (para 44)
wherein sending information to the POS terminal comprises: (paras 47, 54)
generating, by the application, a response cryptogram (1) using the local cryptographic key associated with the account for encryption, and (2) without using a permanent cryptographic key associated with the account (paras 33, 46-47, 51, 54)
sending a device response communication from the mobile device to an electronic reader through a first communications channel, the device response communication comprising an application data protocol unit (APDU) containing the response cryptogram and the first substituted account number, wherein the payment card transaction initiated by the mobile device is authorized based on authentication of the APDU by the remote computer system (paras 47, 54)
Therefore, the prior art does not teach, neither singly nor in combination the following:
receiving by the application over a wireless network from a remote computer system, a first set of data associated with an account, wherein the account is associated with an original account number, and wherein the first set of data comprises (1) a first substituted account number that is associated with but is distinct from the original account number, and (2) a first non-permanent cryptographic key associated with the account, the first non-permanent cryptographic key being different from a permanent cryptographic key associated with the account
Conclusion
The following prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
US 8,374,916 B2 to White discloses: Devices, systems and methods are disclosed which relate to securing payments from a mobile communications device. In exemplary embodiments, a mobile communications device communicates with a payment server via a point-of-sale device to conduct a transaction. The mobile communications device uses a client payment logic to send payment information to the point-of-sale device. The point-of-sale device uses a vendor payment logic to forward the payment information to the payment server. The payment server verifies the payment information and sends confirmation to the point-of-sale device.
US 2010/0153721 A1 to Mellqvist discloses: Portable electronic devices are provided including a virtual secure element module configured to access a remote secure element server. The virtual secure element module being configured to access the remote secure element server from the portable electronic device to provide a predetermined level of security for secure transactions. Related systems, methods and computer program products are also provided.
US 11,080,693 B2 to Fiske discloses: Methods, apparatus and computer software are provided for authorizing an EMV transaction between a user device and a point of sale terminal, particularly, but not exclusively, in situations where a secure element is not made available for the deployment of a payment application on the user device. The payment application is instead deployed to a processing environment that is outside of any secure element on the user device. An ICC Master Key corresponding to the payment application is held by a trusted authority, such as the issuing bank. The trusted authority is adapted generate time-limited session keys on the basis of the ICC Master Key and distribute session keys to the payment application. Receipt of a session key by the payment application enables the payment application to conduct an EMV payment transaction. The session key is used to authorize a single EMV payment transaction.
US 2011/0078245 A1 to Kiffer discloses: The invention relates to a method for transferring at least one piece of application data from a source device to a destination device. According to the invention, the source device including at least one piece of identification data, the piece of identification data identifying an account number and a medium storing at least one piece of application data, the method including a sending step in which the source device sends at least the piece of identification data to a transfer control device; a processing step in which the transfer control device and/or another device connected to the transfer control device processes at least the piece of identification data; according to a processing result, the transfer control device forbids or authorizes to transfer at least one piece of application data to the destination device by transferring, when authorized, to the destination device at least the piece of identification data. The invention also relates to a corresponding system for controlling a transfer of at least one piece of application data.
US 2012/0074219 A1 to Burdett discloses: A payment device—payment device reader combination obtains issuer token data that was generated by an issuer entity from: input data, and an issuer application cryptogram based on the input data and a session key. The issuer token data is disassembled by the payment device—payment device reader combination to obtain the input data and the issuer application cryptogram, and the payment device—payment device reader combination computes a payment device application cryptogram based on the input data and the session key. This is compared, by the payment device—payment device reader combination, to the issuer application cryptogram. If the payment device application cryptogram matches the issuer application cryptogram, at least one action is allowed to take place on the payment device.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Ari Shahabi whose telephone number is (571)272-2565. The examiner can normally be reached M-F: 8:00-5:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, John W Hayes can be reached at 571-272-6708. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ARI SHAHABI/Primary Examiner, Art Unit 3697
Prosecution Insights