Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
Response to Amendment
This is a reply to the application filed on 3/29/2026, in which, claim(s) 1-21 is/are pending.
Response to Arguments
Claim Rejections - 35 U.S.C. § 112:
Applicants’ arguments with respect to 112 2nd paragraph with rejection of claim(s) 1-6 and 20-21 have been fully considered and are persuasive. The rejection of 112 2nd paragraph have been withdrawn in view of the amendment to claim.
Claim Rejections - 35 U.S.C. § 102 and 35 U.S.C. § 103:
Applicants’ arguments with respect to claims rejected under prior art have been fully considered but they are not persuasive.
Applicant’s arguments with respect to claim(s) 1-21 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claim(s) 1-8 and 10-21 is/are rejected under 35 U.S.C. 103 as being unpatentable over Gallant et al. (US 20160352702 A1; hereinafter Gallant) in view of Zhou et al. (US 20230171248 A1; hereinafter Zhou).
Regarding claim 1, Gallant discloses a computer server for providing secure password reset functionality for a password protected device having a unique identifier (reset server resetting password for secure device [Gallant; ¶21-27; Fig. 1 and associated text]), comprising:
a memory configured to store instructions; a processor disposed in communication with said memory [Gallant; Fig. 1 and associated text], wherein said processor upon execution of the instructions is configured to:
receive a request code for enabling password reset functionality for the password protected device (password reset service received request for password reset, the device support service connects to the password reset service and the password reset service enables a connection thereto, e.g., via a login mechanism or other provision of credentials [Gallant; ¶30-31, 38-42; Figs. 2-3, 5C and associated text]);
parse the request code to identify [[metadata]] and a unique identifier associated with the password protected device within the request code (obtaining a device ID corresponding to the secured device that is the subject of the present request and a new password, and optional the CTR value and the RNG value [Gallant; ¶30-31, 38-42; Figs. 2-3, 5C and associated text]). Gallant teaches method are provided for enabling a password reset mechanism for a secured device that verifies a digital signature on a password reset message. Gallant does not explicilty discloses parsing the code to get metadata related to the device; however, in a related and analogous art, Zhou teaches this feature.
In particular, Zhou discloses receiving the password recovery request, and parsing the content of the QR code carried in the request to obtain the device serial number and the encryption challenge string [Zhou; ¶105; Fig. 5 and associated texts]. It would have been obvious before the effective filing date of the claimed invention to modify Gallant in view of Zhou parsing of the code to obtain device serial number and other information with the motivation to better validate the client device;
generate a recovery string including at least the unique identifier and the metadata (generating a string of information from the new password, the device ID (shown as ID for brevity), the CTR value, and the RND value, with the device serial number and the encryption challenge string [Gallant; ¶43-45; Figs. 6-7 and associated text] [Zhou; ¶105; Fig. 5 and associated texts]);
generate a first hash value representation of the recovery string for the password protected device (password reset service accepts the device ID and new password at and generates a password reset message, which includes a hash is generated using the new password, the device ID (shown as ID for brevity), the CTR value, and the RND value, with the device serial number and the encryption challenge string [Gallant; ¶43-45; Figs. 6-7 and associated text] [Zhou; ¶105; Fig. 5 and associated texts]);
send the first hash value to a separate computer device (provide the message, which include the CTR, RND, device ID and hash, with the device serial number and the encryption challenge string [Gallant; ¶38-45; Figs. 5C, 6-7 and associated text] [Zhou; ¶105; Fig. 5 and associated texts]), comparing the first hash value to a second hash value wherein the second hash value is representative of a second recovery string including at least the metadata and the unique identifier associated with the password protected device whereby password reset functionality for the password protected device is enabled when determined the first and second hash values match (the secure device received the message and use the new password with CTR, RND and device ID to generate its own hash’, then compared hash with hash’ to determine match. If matched, enable password reset [Gallant; ¶49-52; Fig. 8 and associated text]). Also, the claims ended at when the first hash send. The comparing function is performed by another device that is not part of this claimed invention.
Regarding claim 2, Gallant-Zhou combination discloses the computer server as recited in claim 1, wherein the separate computer device is operatively coupled to the password protected device and is remotely located from the computer server (the devices are of different entities [Gallant; Fig. 1 and associated text]).
Regarding claim 3, Gallant-Zhou combination discloses the computer server as recited in claim 2, wherein the processor is further configured to:
receive a registration code for the password protected device including at least metadata associated with certain attributes of the password protected device and the unique identifier associated with the password protected device (the public key, device ID and RND during stor
registration message [Gallant; ¶36-38; Figs. 5C, 6-7 and associated text]); and
parse the registration code to separately identify at least the metadata and unique identifier associated with the password protected device (the message includes the public key, device ID and RND [Gallant; ¶36-38; Figs. 5C, 6-7 and associated text]); and
store the metadata and unique identifier associated with the password protected device in memory associated with the computer server for registering the password protected device with the computer server (the device ID and public keys are stored at the password reset server support database [Gallant; ¶30-33; Figs. 3, 6-7 and associated text], receiving the password recovery request, and parsing the content of the QR code carried in the request to obtain the device serial number and the encryption challenge string [Zhou; ¶105; Fig. 5 and associated texts]. The motivation to better validate the client device.
Regarding claim 4, Gallant-Zhou combination discloses the computer server as recited in claim 3, wherein the computer server receives, from the separate computer device, the request code and the registration code over a communications network, and wherein the computer server sends the first hash value to the separate computer device over the communications network (communication is send over network 15 [Gallant; ¶21-26; Fig. 1 and associated text]).
Regarding claim 5, Gallant-Zhou combination discloses the computer server as recited in claim 1, wherein the unique identifier is a cryptographically complaint random string (the RNG may also be integral to the password reset message generator, e.g., as part of a cryptographic toolkit, cryptographic hardware, or other cryptographic functionality [Gallant; ¶30; Fig. 3 and associated text]).
Regarding claim 6, Gallant-Zhou combination discloses the computer server as recited in claim 1, wherein the password protected device determines whether the first and second hash values match (the secure device received the message and use the new password with CTR, RND and device ID to generate its own hash’, then compared hash with hash’ to determine match. If matched, enable password reset [Gallant; ¶49-52; Fig. 8 and associated text]).
Regarding claim 7, Gallant discloses a computer-implemented method for enabling secure password reset functionality for a password protected device having a unique identifier, comprising:
receiving, in a password reset server, a request code from a computer device operatively coupled to the password protected device for enabling password reset functionality for the password protected device, wherein the request code includes a one time use Request ID associated with the password protected device and metadata associated with certain attributes of the password protected device whereby the request code does not include the unique identifier associated with the password protected device (password reset service received request for password reset, the device support service connects to the password reset service and the password reset service enables a connection thereto, e.g., via a login mechanism or other provision of credentials, the CTR and the RNG value is one time use [Gallant; ¶31-32, 38-42; Figs. 2-3, 5C, 6-7 and associated text]);
parsing the request code, in the password reset server, to identify a password protected device associated with the request code based on [[the metadata]] retrieved from the parsed request code, and to retrieve a unique identifier associated with the identified password protected device stored in memory coupled to the password reset server (obtaining a device ID corresponding to the secured device that is the subject of the present request and a new password, and optional the RNG value [Gallant; ¶30-31, 38-42; Figs. 2-3, 5C and associated text]). Gallant teaches method are provided for enabling a password reset mechanism for a secured device that verifies a digital signature on a password reset message. Gallant does not explicilty discloses parsing the code to get metadata related to the device; however, in a related and analogous art, Zhou teaches this feature.
In particular, Zhou discloses receiving the password recovery request, and parsing the content of the QR code carried in the request to obtain the device serial number and the encryption challenge string [Zhou; ¶105; Fig. 5 and associated texts]. It would have been obvious before the effective filing date of the claimed invention to modify Gallant in view of Zhou parsing of the code to obtain device serial number and other information with the motivation to better validate the client device;
generating, in the password reset server, responsive to receiving the request code, a first recovery string including at least the [1) the metadata,] 2) the Request ID and 3) the retrieved unique identifier associated with the identified password protected device to generate a first hash value for the first recovery string (generating a string of information from the new password, the device ID (shown as ID for brevity), the CTR value, and the RND value, with the device serial number and the encryption challenge string [Gallant; ¶43-45; Figs. 6-7 and associated text] [Zhou; ¶105; Fig. 5 and associated texts], password reset service accepts the device ID and new password at and generates a password reset message, which includes a hash is generated using the new password, the device ID (shown as ID for brevity), the CTR value, and the RND value, with the device serial number and the encryption challenge string [Gallant; ¶43-45; Figs. 6-7 and associated text] [Zhou; ¶105; Fig. 5 and associated texts]);
send, from the password reset server to the computer device, the first hash value such that the password protected device (provide the message, which include the CTR, RND, device ID and hash, with the device serial number and the encryption challenge string [Gallant; ¶38-45; Figs. 5C, 6-7 and associated text] [Zhou; ¶105; Fig. 5 and associated texts]), compares the first hash value to a second hash value for enabling password reset functionality for the password protected device when the first hash value matches the second hash value, wherein the second hash value is associated with a second recovery string including at least the [1) the metadata,] 2) the Request ID and 3) the unique identifier associated with the password protected device wherein the second recovery string is determined by a device other than the password reset server (the secure device received the message and use the new password with CTR, RND and device ID to generate its own hash’, then compared hash with hash’ to determine match. If matched, enable password reset [Gallant; ¶49-52; Fig. 8 and associated text]). Also, the claims ended at when the first hash send. The comparing function is performed by another device that is not part of this claimed invention.
Regarding claim 8, Gallant-Zhou combination discloses the computer-implemented method as recited in claim 7, wherein the second recovery string is generated by the computer device operatively coupled to the password protected device (the devices are of different entities and are connected over the network [Gallant; Fig. 1 and associated text]).
Regarding claim 10, Gallant-Zhou combination discloses the computer-implemented method as recited in claim 7, wherein the unique identifier is a cryptographically secure complaint string (the RNG may also be integral to the password reset message generator, e.g., as part of a cryptographic toolkit, cryptographic hardware, or other cryptographic functionality [Gallant; ¶30; Fig. 3 and associated text]).
Regarding claim 11, Gallant-Zhou combination discloses the computer-implemented method as recited in claim 10, wherein the password protected device is operative to generate the cryptographically secure complaint string as a SALT (the RN value generated by the RNG [Gallant; ¶30; Fig. 3 and associated text]).
Regarding claim 12, Gallant-Zhou combination discloses the computer-implemented method as recited in claim 7, wherein the request code and the recovery string each include a Cyclic Redundancy Check (CRC) checksum (hash [Gallant; ¶45; Fig. 7 and associated text]).
Regarding claim 13, Gallant-Zhou combination discloses the computer-implemented method as recited in claim 7, wherein the metadata includes one or more of information descriptive of: 1) a serial number; 2) a device type; and 3) firmware version associated with the password protected device (parsing the content of the QR code carried in the request to obtain the device serial number and the encryption challenge string [Zhou; ¶105; Fig. 5 and associated texts]. The motivation to better validate the client device.
Regarding claim 14, Gallant-Zhou combination discloses the computer-implemented method as recited in claim 7, wherein the computer device is separate from the password protected device (the devices are of different entities [Gallant; Fig. 1 and associated text]).
Regarding claim 15, Gallant-Zhou combination discloses the computer-implemented method as recited in claim 14, wherein the computer device is a laptop computer device (various computing device such as a laptop, tablet, smart phone, or other device having a user interface [Gallant; ¶21]).
Regarding claim 16, Gallant-Zhou combination discloses the computer-implemented method as recited in claim 7, wherein the password reset server is operatively associated with other password protected devices (the password reset server connected to the secure device [Gallant; ¶21; Fig. 1 and associated text]).
Regarding claim 17, Gallant-Zhou combination discloses the computer-implemented method as recited in claim 7, wherein enabling password reset functionality for the password protected device does not include changing the unique identifier of the password protected device (the password reset functionality required match of hash and hash’ [Gallant; ¶49-52; Fig. 8 and associated text]).
Regarding claim 18, Gallant-Zhou combination discloses the computer-implemented method as recited in claim 7, further including:
receiving, in a password reset server, a request code from a computer device operatively coupled to the password protected device for enabling password reset functionality for the password protected device, wherein the request code includes a one time use Request ID associated with the password protected device and metadata associated with certain attributes of the password protected device whereby the request code does not include the unique identifier associated with the password protected device (password reset service received request for password reset, the device support service connects to the password reset service and the password reset service enables a connection thereto, e.g., via a login mechanism or other provision of credentials, the CTR and the RNG value is one time use [Gallant; ¶31-32, 38-42; Figs. 2-3, 5C, 6-7 and associated text]);
registration message [Gallant; ¶36-38; Figs. 5C, 6-7 and associated text]); and
parsing, in the password reset server, the registration code to separately identify at least the metadata and unique identifier associated with the password protected device (the message includes the public key, device ID and RND [Gallant; ¶36-38; Figs. 5C, 6-7 and associated text]); and
storing, in the password reset server, the metadata and unique identifier associated with the password protected device in memory for registering the password protected device with the password reset computer (the device ID and public keys are stored at the password reset server support database [Gallant; ¶30-33; Figs. 3, 6-7 and associated text], parsing the content of the QR code carried in the request to obtain the device serial number and the encryption challenge string [Zhou; ¶105; Fig. 5 and associated texts]. The motivation to better validate the client device.
Regarding claim 19, Gallant-Zhou combination discloses the computer-implemented method as recited in claim 18, wherein the registration code is sent from the computer device to the password reset server (communication is send over network 15 [Gallant; ¶21-26; Fig. 1 and associated text]).
Regarding claim 20, Gallant discloses a computer-implemented method for providing secure password reset functionality for a password protected device having a unique identifier (reset server resetting password for secure device [Gallant; ¶21-27; Fig. 1 and associated text]), comprising:
receiving, in a password reset computer server, a request code for enabling password reset functionality for the password protected device (password reset service received request for password reset, the device support service connects to the password reset service and the password reset service enables a connection thereto, e.g., via a login mechanism or other provision of credentials [Gallant; ¶38-42; Figs. 5C, 6-7 and associated text]);
parse the request code to identify [[metadata]] and a unique identifier associated with the password protected device within the request code (obtaining a device ID corresponding to the secured device that is the subject of the present request and a new password, and optional the CTR value and the RNG value [Gallant; ¶30-31, 38-42; Figs. 2-3, 5C and associated text]). Gallant teaches method are provided for enabling a password reset mechanism for a secured device that verifies a digital signature on a password reset message. Gallant does not explicilty discloses parsing the code to get metadata related to the device; however, in a related and analogous art, Zhou teaches this feature.
In particular, Zhou discloses receiving the password recovery request, and parsing the content of the QR code carried in the request to obtain the device serial number and the encryption challenge string [Zhou; ¶105; Fig. 5 and associated texts]. It would have been obvious before the effective filing date of the claimed invention to modify Gallant in view of Zhou parsing of the code to obtain device serial number and other information with the motivation to better validate the client device;
generate a recovery string including at least the unique identifier and the metadata (generating a string of information from the new password, the device ID (shown as ID for brevity), the CTR value, and the RND value, with the device serial number and the encryption challenge string [Gallant; ¶43-45; Figs. 6-7 and associated text] [Zhou; ¶105; Fig. 5 and associated texts]);
generating, in the password reset computer server, a first hash value presentation of the recovery string for the password protected device (password reset service accepts the device ID and new password at and generates a password reset message, which includes a hash is generated using the new password, the device ID (shown as ID for brevity), the CTR value, and the RND value, with the device serial number and the encryption challenge string [Gallant; ¶43-45; Figs. 6-7 and associated text] [Zhou; ¶105; Fig. 5 and associated texts]); and
comparing the first hash value to a second hash value wherein the second hash value is generated by another computer device and is representative of a second recovery string including at least the metadata and the unique identifier associated with the password protected device whereby password reset functionality for the password protected device is enabled when the first and second hash values match (the secure device received the message and use the new password with CTR, RND and device ID, with the device serial number and the encryption challenge string to generate its own hash’, then compared hash with hash’ to determine match. If matched, enable password reset [Gallant; ¶49-52; Fig. 8 and associated text][Zhou; ¶105; Fig. 5 and associated texts]).
Regarding claim 21, Gallant-Zhou combination discloses the computer-implemented method as recited in claim 20, wherein the metadata includes one or more of information descriptive of: 1) a serial number; 2) a device type; and 3) firmware version associated with the password protected device (parsing the content of the QR code carried in the request to obtain the device serial number and the encryption challenge string [Zhou; ¶105; Fig. 5 and associated texts]). The motivation to better validate the client device;
Claim(s) 9 is/are rejected under 35 U.S.C. 103 as being unpatentable over Gallant-Zhou combination in view of Freeman et al. (US 20220109997 A1; hereinafter Freeman).
Regarding claim 9, Gallant-Zhou combination does not explicilty discloses the computer-implemented method as recited in claim 7, wherein the password protected device is a circuit breaker component; however, in a related and analogous art, Freeman teaches this feature.
In particular, Freeman teaches communication enabled circuit breaker over wireless communication, which would require secure communication and information element of the circuit breaker [Freeman; ¶75-78; Fig. 1, 5 and associated texts]. It would have been obvious before the effective filing date of the claimed invention to modify Gallant-Zhou combination in view of Freeman with the motivation to easier monitor fault conditions.
Internet Communications
Applicant is encouraged to submit a written authorization for Internet communications (PTO/SB/439, http://www.uspto.gov/sites/default/files/documents/sb0439.pdf) in the instant patent application to authorize the examiner to communicate with the applicant via email. The authorization will allow the examiner to better practice compact prosecution. The written authorization can be submitted via one of the following methods only: (1) Central Fax which can be found in the Conclusion section of this Office action; (2) regular postal mail; (3) EFS WEB; or (4) the service window on the Alexandria campus. EFS web is the recommended way to submit the form since this allows the form to be entered into the file wrapper within the same day (system dependent). Written authorization submitted via other methods, such as direct fax to the examiner or email, will not be accepted. See MPEP § 502.03.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to DAO Q HO whose telephone number is (571)270-5998. The examiner can normally be reached on 7:00am - 5:00pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Nickerson can be reached on (469) 295-9235. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/DAO Q HO/Primary Examiner, Art Unit 2432
Prosecution Insights