Notice of Pre-AIA or AIA Status
The present application is being examined under the pre-AIA first to invent provisions.
DETAILED ACTION
1. This action is in response to application amendments filed 8-6-2026.
2. Claims 1 - 20 are pending. Claims 1, 8, 10, 17, 19 have been amended. Claims 1, 10, 19 are independent. This application was filed on 5-30-2024.
Response to Arguments
3. Applicant’s arguments, see Arguments/Remarks Made in an Amendment, filed 8-6-2026, with respect to the rejection(s) of claim(s) under Bagga in view of Schrix have been fully considered and are persuasive. Therefore, the rejection has been withdrawn. However, upon further consideration, a new ground(s) of rejection is made in view of Bagga in view of Schrix and further in view of Groenjes.
A. The Double Patenting Rejection is maintained due to lack of filing and approval of a Terminal Disclaimer (TD).
B. The Specification Objection is withdrawn due to modification to the title of the invention.
C. Applicant argues on page 11 of Remarks: … do not disclose, teach, or suggest a method including "has requested to perform an activity requiring authorization after the user enters a predetermined location," … .
The Examiner respectfully disagrees. Groenjes discloses user authentication associated with a specific or predetermined location. A user must be within a predetermined location or area and requiring an authentication procedure associated with the location. Groenjes discloses enabling the user to perform the designated activities requiring authorization while the user is within the predetermined location and disabling designated activities when the user is outside of the predetermined location. (see Groenjes col 5: data retrieval engine 310 may retrieve the user location information and the data authentication engine 320 may authenticate the information by correlating the user's mobile device position with the location … . The data reporting engine 330 may provide a confirmation or authorization based on the results of the location correlation. The current user location may be determined by GPS, triangulation or any other known mobile device position determination algorithm. The current user location may be performed after the user authentication information is received in response to the initiation of a new transaction. Alternatively, the current user location may be determined prior to the user authentication information being received. … . One or more of the user location positions may be identified and compared to the known location of the entity associated with the user transaction. The transaction may be authenticated if at least one of the plurality of location positions is within a predetermined distance of the known location of the entity associated with the user transaction (e.g., 100 feet or less) and/or within a predetermined amount of time lapse (e.g., recent time window of 10 minutes or less). In the event that the current user location is not within a predetermined distance of the known location of the entity associated with the user transaction, then certain predefined functions specified by a user application operating on the user's mobile device may be disabled.)
D. Applicant argues on page 11 of Remarks: … the user to perform the activity requiring authorization while the user is within the predetermined location," and "responsive to determining that the user is outside the predetermined location, revoking, by the one or more processors, the authorization," … .
The Examiner respectfully disagrees. Groenjes discloses user authentication associated with a specific or predetermined location. A user must be within a predetermined location or area and requiring authentication procedure associated with the location. Groenjes discloses enabling the user to perform designated activities requiring authorization while the user is within the predetermined location and disabling designated activities when the user is outside of the predetermined location. (see Groenjes col 5: data retrieval engine 310 may retrieve the user location information and the data authentication engine 320 may authenticate the information by correlating the user's mobile device position with the location … . The data reporting engine 330 may provide a confirmation or authorization based on the results of the location correlation. The current user location may be determined by GPS, triangulation or any other known mobile device position determination algorithm. The current user location may be performed after the user authentication information is received in response to the initiation of a new transaction. Alternatively, the current user location may be determined prior to the user authentication information being received. … . One or more of the user location positions may be identified and compared to the known location of the entity associated with the user transaction. The transaction may be authenticated if at least one of the plurality of location positions is within a predetermined distance of the known location of the entity associated with the user transaction (e.g., 100 feet or less) and/or within a predetermined amount of time lapse (e.g., recent time window of 10 minutes or less). In the event that the current user location is not within a predetermined distance of the known location of the entity associated with the user transaction, then certain predefined functions specified by a user application operating on the user's mobile device may be disabled.)
E. Applicant argues on pages 11-12 of Remarks: … Applicant has amended independent claims 10 and 19 to recite features analogous to those discussed above with respect to claim 1. Therefore, claims 10 and 19 are patentable for at least analogous reasons to claim 1.
Independent claims 10 and 19 have similar limitations as independent claim 1. Responses to arguments against independent claim 1 also answer arguments against independent claims 10 and 19.
F. Applicant argues on page 12 of Remarks: … All of the dependent claims depend variously from independent claims 1, 10, and 19 and are, therefore, patentable at least by virtue of their dependence on patentable claims, … .
Responses to arguments against the independent claims also answer arguments against the associated dependent claims.
Double Patenting
4. The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the "right to exclude" granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory obviousness-type double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Omum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); and In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on a nonstatutory double patenting ground provided the conflicting application or patent either is shown to be commonly owned with this application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement.
Effective January 1, 1994, a registered attorney or agent of record may sign a terminal disclaimer. A terminal disclaimer signed by the assignee must fully comply with 37 CFR 3.73(b).
5. Initially it should be noted that the present application is a continuation application of application 17/061968, now Patent No. 12,002,048, having the same inventive entity. The Assignee in both applications is the same. The entire disclosures of the instant application and the patent are identical.
Claims 1 - 20 are rejected under the judicially created doctrine of nonstatutory obviousness-type double patenting as being unpatentable over Claims 1 - 20 of U.S. Patent No. 12,002,048. Although the conflicting claims are not identical, they are not patentably distinct from each other.
Claims 1, 10, 19 of the instant application (18/679333) are almost the same as Patent (12,002,048) Claims 1, 11. Claim 1 of the 12,002,048 Patent as shown in the table below contains every element of Claim 1 of the instant application and as such the difference is not enough to distinguish the two claims. Claims 1, 10, 19 of the instant application therefore are not patently distinct from the earlier patent claims and as such are unpatentable over obvious-type double patenting. A later patent/application claim is not patentably distinct from an earlier claim, if the later claim is unpatentable over the earlier claim.
Application 18/679333
Claim 1
Patent (12,002,048)
Claim 1
“receiving, by one or more processors, an indication that a user has requested to
perform an activity requiring authorization”
“receiving, by one or more processors, an indication that a user has requested to perform an activity requiring authorization”
“generating, by the one or more processors, an authentication path for presentation to the user, the authentication path comprising a first portion and a second portion”
“generating, by the one or more processors, an authentication path for presentation to the user, the authentication path comprising a first portion and a second portion”
“the first portion of the authentication path comprises at least one first
authentication challenge of a plurality of authentication challenges determined and presented to the user responsive to the indication that the user has requested to perform the activity”
“the first portion of the authentication path comprises at least one authentication challenge of a plurality of authentication challenges determined and presented to the user responsive to the indication that the user has requested to perform the activity and prior to the user specifying parameters of the activity”
“the second portion of the authentication path comprises at least one second
authentication challenge of the plurality of authentication challenges, the second portion being determined based on parameters of the activity and a type of the activity, wherein the second portion of the authentication path is presented on a user interface after a first valid response to the at least one first authentication challenge of the first portion has been provided”
“the second portion of the authentication path comprises two or more authentication challenges of the plurality of authentication challenges determined and presented to the user after the user specifies the parameters of the activity, an order of the second portion being pseudo-randomly determined responsive to the parameters of the activity being specified by the user and based on a type of the activity being specified by the user, wherein the second portion of the authentication path is presented to the user after valid responses to the at least one authentication challenge of the first portion have been provided”
“determining, by the one or more processors, that the user provided a second valid response to the second portion of the authentication path”
“determining, by the one or more processors, that the user presented valid responses to the second portion of the authentication path”
“responsive to determining that the user provided the second valid response to the
second portion of the authentication path, authorizing, by the one or more processors, the user to perform the activity requiring authorization”
“authorizing, by the one or more processors, responsive to determining that the user presented valid responses to the second portion of the authentication path, the user to perform the activity requiring authorization”
6. Initially it should be noted that the present application is a continuation application of application 15/694066, now Patent No. 10,796,307, having the same inventive entity. The Assignee in both applications is the same. The entire disclosures of the instant application and the patent are identical.
Claims 1 - 20 are rejected under the judicially created doctrine of nonstatutory obviousness-type double patenting as being unpatentable over Claims 1 - 29 of U.S. Patent No. 10,796,307. Although the conflicting claims are not identical, they are not patentably distinct from each other.
Claims 1, 10, 19 of the instant application (18/679333) are anticipated by Patent (10,796,307) Claims 1, 17. Claim 1 of the 10,796,307 Patent contains every element of Claim 1 of the instant application and as such the difference is not enough to distinguish the two claims. Claims 1, 10, 19 of the instant application therefore are not patently distinct from the earlier patent claims and as such are unpatentable over obvious-type double patenting. A later patent/application claim is not patentably distinct from an earlier claim, if the later claim is unpatentable over the earlier claim.
7. Initially it should be noted that the present application is a continuation application of application 14/659136, now Patent No. 9,754,257, having the same inventive entity. The Assignee in both applications is the same. The entire disclosures of the instant application and the patent are identical.
Claims 1 - 20 are rejected under the judicially created doctrine of nonstatutory obviousness-type double patenting as being unpatentable over Claims 1 - 27 of U.S. Patent No. 9,754,257. Although the conflicting claims are not identical, they are not patentably distinct from each other.
Claims 1, 10, 19 of the instant application (18/679333) are anticipated by Patent (9,754,257) Claims 1, 15. Claim 1 of the 9,754,257 Patent contains every element of Claim 1 of the instant application and as such the difference is not enough to distinguish the two claims. Claims 1, 10, 19 of the instant application therefore are not patently distinct from the earlier patent claims and as such are unpatentable over obvious-type double patenting. A later patent/application claim is not patentably distinct from an earlier claim, if the later claim is unpatentable over the earlier claim.
8. Initially it should be noted that the present application is a continuation application of application 13/452326, now Patent No. 8,984,697, having the same inventive entity. The Assignee in both applications is the same. The entire disclosures of the instant application and the patent are identical.
Claims 1 - 20 are rejected under the judicially created doctrine of nonstatutory obviousness-type double patenting as being unpatentable over Claims 1 - 27 of U.S. Patent No. 12,002,048. Although the conflicting claims are not identical, they are not patentably distinct from each other.
Claims 1, 10, 19 of the instant application (18/679333) are anticipated by the Patent (12,002,048) Claims 1, 11. Claim 1 of the 12,002,048 Patent contains every element of Claim 1 of the instant application and as such the difference is not enough to distinguish the two claims. Claims 1, 10, 19 of the instant application therefore are not patently distinct from the earlier patent claims and as such are unpatentable over obvious-type double patenting. A later patent/application claim is not patentably distinct from an earlier claim, if the later claim is unpatentable over the earlier claim.
Claim Rejections - 35 USC § 103
9. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
10. Claims 1, 2, 4 - 6, 10, 11, 13 - 15, 19 are rejected under 35 U.S.C. 103 as being unpatentable over Bagga et al. (US PGPUB No. 20050039057) in view of Schrix et al. (US PGPUB No. 20130160083) and further in view of Groenjes et al. (US Patent No. 10,373,246).
Regarding Claims 1, 10, 19, Bagga discloses a method and a system, comprising:
a) receiving, by one or more processors, an indication that a user has requested to perform an activity requiring authorization; and d) determined based on parameters of the activity and a type of the activity. (see Bagga paragraph [0024], lines 1-10: during a verification phase, when a user attempts to access a protected resource (i.e. an indication a user wishes to conduct a resource access type transaction, activity requiring authentication), the user is challenged with a random subset, of N questions that the user has previously answered; (verification procedure required in order to enable a resource access type transaction); paragraph [0054], lines 6-12: random subset of M questions are presented to user until a level of security is exceeded (predetermined parameter) based on the number of correctly answered questions (grant access by user to protected resources based on correct answers or valid responses to challenges)), and
d) presented on a user interface. (see Bagga paragraph [0054]: The random subset of M questions are presented (via user interface) to the user during step 630 until a level of security for the application is exceeded during step 640 (to grant access during step 660) based on the sum of security weights of correctly answered questions, or until a predefined threshold is exceeded during step 650 for incorrect answers (to deny access during step 670).)
Babba does not explicitly disclose for b) generating an authentication path for presentation to user, authentication path comprising a first portion and a second portion.
However, Schrix discloses:
b) generating, by the one or more processors, an authentication path for presentation to the user, the authentication path comprising a first portion and a second portion (see Schrix paragraphs [0011]; [0012]; [0013]; [0014]: performing a challenge-response process: providing a first challenge-response pair assigned to a responding device, performing the challenge-response process, loading a second challenge-response pair for challenging a device for processing; (a first CRP assigned to a specific device and a second CRP selected from the set of CRP pairs, predetermined order for two CRP pairs); (prior to the user specifying parameters of the activity); Figure 2 (130; 140); paragraph [0018], lines 1-8: CRP (challenge-response pairs) are generated and/or loaded, individually as part of a group, to a challenging device operable to perform a challenge-response process; (the set of challenge questions are setup prior to initiation of an authentication or verification process); paragraph [0021], lines 1-8: if challenge device is provided with 10 CRPs (challenge-response pairs), it can perform ten challenge-response processes before it runs out of CRPs; a plurality of CRPs are assigned to the same responding device; (device is setup with CRPs before a transaction is initiated (prior to indication a user wishes to conduct a transaction, provide parameters)), wherein:
Furthermore, Bagga does not explicitly disclose for c) the first portion of authentication path comprises at least one first authentication challenge determined and presented to user, and for d) second portion of authentication path comprises at least one second authentication challenge, the second portion of authentication path presented on an interface, and for e) determining that the user provided a second valid response to second portion of authentication path, and for f) responsive to determining that user provided second valid response to second portion of authentication path, authorizing user to perform activity requiring authorization.
However, Schrix discloses:
c) the first portion of the authentication path comprises at least one first authentication challenge of a plurality of authentication challenges determined and presented to the user responsive to the indication that the user has requested to perform the activity; (see Schrix paragraphs [0011]; [0012]; [0013]; [0014]: performing a challenge-response process (authentication request): providing a first challenge-response pair assigned to a responding device, performing the challenge-response process) and
d) the second portion of the authentication path comprises at least one second authentication challenge of the plurality of authentication challenges, the second portion, wherein the second portion of the authentication path is presented on an interface after a first valid response to the at least one first authentication challenge of the first portion has been provided; (see Schrix paragraphs [0011]; [0012]; [0013]; [0014]: performing a challenge-response process: providing a first challenge-response pair assigned to a responding device, performing the challenge-response process, loading a second challenge-response pair for challenging a device for processing; (a first CRP assigned to a specific device and a second CRP selected from the set of CRP pairs, predetermined order for two CRP pairs); (prior to the user specifying parameters of the activity). (see Schrix Figure 2 (130; 140); paragraph [0018], lines 1-8: CRP (challenge-response pairs) are generated and/or loaded, individually as part of a group, to a challenging device operable to perform a challenge-response process; (the set of challenge questions are setup prior to initiation of an authentication or verification process); paragraph [0021], lines 1-8: if challenge device is provided with 10 CRPs (challenge-response pairs), it can perform ten challenge-response processes before it runs out of CRPs; a plurality of CRPs are assigned to the same responding device; (device is setup with CRPs before a transaction is initiated (prior to indication a user wishes to conduct a transaction, provide parameters)) and
e) determining, by the one or more processors, that the user provided a second valid response to the second portion of the authentication path; (see Schrix paragraph [0066]: Once the newly established responding device 30 has received the challenge 60 in step 210, it computes in step 220 a response 90 from the challenge 60 and the secret key 80' that is stored on the responding device 30. The responding device 30 transmits the computed response 90 to the challenging device 20 in step 230.; paragraph [0067]: The challenging device 20 receives the transmitted response 90 in step 240 and compares, in step 250, the received transmitted response 90 with the expected response 70, which had been extracted from the CRP 50 in step 160. If the received response 90 matches the expected response 70, the newly established responding device 30 has successfully authenticated itself to the challenging device 20, as is shown in step 260.; (responses to first, second CRPs); (first, second challenges responses)) and
f) responsive to determining that the user provided the second valid response to the second portion of the authentication path, authorizing, by the one or more processors, the user to perform the activity requiring authorization. (Schrix paragraph [0067]: The challenging device 20 receives the transmitted response 90 in step 240 and compares, in step 250, the received transmitted response 90 with the expected response 70, which had been extracted from the CRP 50 in step 160. If the received response 90 matches the expected response 70, the newly established responding device 30 has successfully authenticated itself to the challenging device 20, as is shown in step 260; (user given access to requested resource))
It would have been obvious to one of ordinary skill in the art to modify Bagga for b) generating an authentication path for presentation to user, authentication path comprising a first portion and a second portion, and for c) the first portion of authentication path comprises at least one first authentication challenge of a plurality of authentication challenges determined and presented to the user, and for d) second portion of authentication path comprises at least one second authentication challenge, the second portion being the second portion of the authentication path presented on an interface, and for e) determining that the user provided a second valid response to the second portion of the authentication path, and for f) responsive to determining that user provided second valid response to second portion of authentication path, authorizing user to perform activity requiring authorization as taught by Schrix. One of ordinary skill in the art would have been motivated to employ the teachings of Schrix for the benefits achieved from the flexibility of a system that enables the capability for the authentication process comprising a first portion and a second portion. (see Schrix paragraph [0031], lines 1-5)
Bagga in view of Schrix does not specifically disclose for a) requiring authorization after user enters a predetermined location, and for g) responsive to determining that user is outside predetermined location, revoke the authorization.
However, Groenjes discloses wherein for a) requiring authorization after the user enters a predetermined location; for g) responsive to determining that the user is outside the predetermined location, revoke, by the processors, the authorization. (see Groenjes col 5: data retrieval engine 310 may retrieve the user location information and the data authentication engine 320 may authenticate the information by correlating the user's mobile device position with the location … . The data reporting engine 330 may provide a confirmation or authorization based on the results of the location correlation. The current user location may be determined by GPS, triangulation or any other known mobile device position determination algorithm. The current user location may be performed after the user authentication information is received in response to the initiation of a new transaction. Alternatively, the current user location may be determined prior to the user authentication information being received. … . One or more of the user location positions may be identified and compared to the known location of the entity associated with the user transaction. The transaction may be authenticated if at least one of the plurality of location positions is within a predetermined distance of the known location of the entity associated with the user transaction (e.g., 100 feet or less) and/or within a predetermined amount of time lapse (e.g., recent time window of 10 minutes or less). In the event that the current user location is not within a predetermined distance of the known location of the entity associated with the user transaction, then certain predefined functions specified by a user application operating on the user's mobile device may be disabled.)
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify Bagga in view of Schrix for a) requiring authorization after user enters a predetermined location, and for g) responsive to determining that user is outside predetermined location, revoke the authorization as taught by Groenjes. One of ordinary skill in the art would have been motivated to employ the teachings of Groenjes for the benefits achieved from the flexibility of a system that enables enhanced authentication techniques such as requiring user location for transaction must be within a predetermined location (authenticated within predetermined location)). (see Groenjes col 5)
Furthermore, for Claim 10, Bagga discloses wherein a processor and non-transitory machine-readable storage media having instructions stored thereon that, when executed by the processor, cause the processor to perform operations. (see Bagga paragraph [0055], lines 1-8: methods and apparatus distributed as an article of manufacture that itself comprises a computer readable medium having computer readable code (instructions) means embodied thereon; computer readable program code is operable, in conjunction with a computer system, to carry out all or some of the steps to perform the methods or create the apparatuses discussed herein; paragraph [0056], lines 1-4: computer systems and servers described herein each contain a memory that configures associated processors to implement the methods, steps, and functions disclosed herein)
Furthermore, for Claim 19, Bagga discloses one or more non-transitory machine-readable storage media having instructions stored thereon that, when executed by one or more processors, cause the one or more processors to perform operations. (see Bagga paragraph [0055], lines 1-8: methods and apparatus distributed as an article of manufacture that itself comprises a computer readable medium having computer readable code (instructions) means embodied thereon; computer readable program code is operable, in conjunction with a computer system, to carry out all or some of the steps to perform the methods or create the apparatuses discussed herein; paragraph [0056], lines 1-4: computer systems and servers described herein each contain a memory that configures associated processors to implement the methods, steps, and functions disclosed herein)
Regarding Claims 2, 11, Bagga-Schrix-Groenjes discloses the method of claim 1 and the system of claim 10,
a) wherein at least one authentication challenge of the plurality of authentication challenges is an authentication question. (see Bagga paragraph [0024], lines 1-10: during a verification phase, when a user attempts to access a protected resource (i.e. an indication a user wishes to conduct a resource access type transaction), the user is challenged with a random subset, of N questions that the user has previously answered; (user makes a request to perform a transaction, in response a verification procedure is required in order to enable a resource access type transaction))
Furthermore, Bagga discloses wherein for b) generating authentication path comprises pseudo-randomly selecting authentication questions. (Bagga paragraph [0009]: During a verification phase, when the user attempts to access a protected resource, the user is challenged with a random subset of the questions that the user has previously answered. The user answers questions until a level of security for a given application is exceeded, for example, based on a sum of security weights of correctly answered questions. The random selection of questions for a verification session defends against a replay attack such that an attacker cannot repeat a single session's authentication response verbatim between different sessions. The security of the authentication scheme of the present invention may be further improved by combining the query directed password protocol with one or more additional factors to which the questions are sent to the user, such as the required possession of a communication device, such as a given cellular telephone or personal digital assistant, a codebook, or a personal identification number (PIN).)
Bagga does not specifically disclose for b) selecting authentication questions as the at least one second authentication challenge of the second portion.
However, Schrix discloses wherein for b) selecting authentication questions as the at least one second authentication challenge of the second portion. (see Schrix paragraphs [0011]; [0012]; [0013]; [0014]: performing a challenge-response process: providing a first challenge-response pair assigned to a responding device, performing the challenge-response process, loading a second challenge-response pair for challenging a device for processing; (a first CRP assigned to a specific device and a second CRP selected from the set of CRP pairs, predetermined order for two CRP pairs))
It would have been obvious to one of ordinary skill in the art to modify Bagga for b) selecting authentication questions as the at least one second authentication challenge of the second portion as taught by Schrix. One of ordinary skill in the art would have been motivated to employ the teachings of Schrix for the benefits achieved from the flexibility of a system that enables the capability for the authentication process comprising a first portion and a second portion. (see Schrix paragraph [0031], lines 1-5)
Regarding Claims 4, 13, Bagga-Schrix-Groenjes discloses the method of claim 1 and the system of claim 10, wherein generating the authentication path further comprises pseudo-randomly determining, by the one or more processors, multiple authentication challenges in the authentication path. (see Bagga paragraph [0029], lines 5-11: during a verification phase for a user's attempt to access a resource (a protected resource), the server challenges the user with a random subset of (M) of the N questions the user setup as part of a registration (enrollment); paragraph [0005], lines 15-19: security supplemented by requiring user to enter a memorized PIN or password; paragraph [0054], lines 6-12: random subset of M questions are presented to user until a level of security is exceeded (predetermined parameter) based on the number of correctly answered questions (grant access by user to protected resources based on correct answers or valid responses to challenges); (the M quantity of questions is a randomly determined number for the number of questions requiring responses); (determine number of challenges to present))
Bagga does not specifically disclose a second portion of an authentication path.
However, Schrix discloses the second portion of the authentication path. (see Schrix paragraphs [0011]; [0012]; [0013]; [0014]: performing a challenge-response process: providing a first challenge-response pair assigned to a responding device, performing the challenge-response process, loading a second challenge-response pair for challenging a device for processing; (a first CRP assigned to a specific device and a second CRP selected from the set of CRP pairs, predetermined order for two CRP pairs); (prior to the user specifying parameters of the activity). (see Schrix Figure 2 (130; 140); paragraph [0018], lines 1-8: CRP (challenge-response pairs) are generated and/or loaded, individually as part of a group, to a challenging device operable to perform a challenge-response process; (the set of challenge questions are setup prior to initiation of an authentication or verification process); paragraph [0021], lines 1-8: if challenge device is provided with 10 CRPs (challenge-response pairs), it can perform ten challenge-response processes before it runs out of CRPs; a plurality of CRPs are assigned to the same responding device; (device is setup with CRPs before a transaction is initiated (prior to indication a user wishes to conduct a transaction, provide parameters))
It would have been obvious to one of ordinary skill in the art to modify Bagga for the second portion of the authentication path as taught by Schrix. One of ordinary skill in the art would have been motivated to employ the teachings of Schrix for the benefits achieved from the flexibility of a system that enables the capability for the authentication process comprising a first portion and a second portion. (see Schrix paragraph [0031], lines 1-5)
Regarding Claims 5, 14, Bagga-Schrix-Groenjes discloses the method of claim 1 and the system of claim 1, including an authentication challenge of the first portion is pseudo-randomly selected. (see Bagga paragraph [0029], lines 5-11: during a verification phase for a user's attempt to access a resource (a protected resource), the server challenges the user with a random subset of (M) of the N questions the user setup as part of a registration (enrollment); paragraph [0005], lines 15-19: security supplemented by requiring user to enter a memorized PIN or password; paragraph [0054], lines 6-12: random subset of M questions are presented to user until a level of security is exceeded (predetermined parameter) based on the number of correctly answered questions (grant access by user to protected resources based on correct answers or valid responses to challenges); (the M quantity of questions is a randomly determined number for the number of questions requiring responses); (determine number of challenges to present))
Bagga does not specifically disclose an authentication challenge of the first portion is selected prior to the user specifying parameters of the activity.
However, Schrix discloses wherein the at least one first authentication challenge of the first portion is selected from the plurality of authentication challenges prior to the user specifying the parameters of the activity. (see Schrix paragraph [0018], lines 1-8: CRP (challenge-response pairs) are generated and/or loaded, individually as part of a group, to a challenging device operable to perform a challenge-response process; (the set of challenge questions are setup prior to initiation of an authentication or verification process); paragraph [0021], lines 1-8: if challenge device is provided with 10 CRPs (challenge-response pairs), it can perform ten challenge-response processes before it runs out of CRPs; a plurality of CRPs are assigned to the same responding device; (device is setup with CRPs before a transaction is initiated (prior to indication a user wishes to conduct a transaction))
It would have been obvious to one of ordinary skill in the art to modify Bagga for an authentication challenge of the first portion is selected prior to the user specifying parameters of the activity as taught by Schrix. One of ordinary skill in the art would have been motivated to employ the teachings of Schrix for the benefits achieved from the flexibility of a system that enables the capability for the authentication process comprising a first portion and a second portion. (see Schrix paragraph [0031], lines 1-5)
Regarding Claims 6, 15, Bagga-Schrix-Groenjes discloses the method of claim 1 and the system of claim 10, wherein the plurality of authentication challenges comprises at least one of swiping a transaction card, providing photo identification, entering a personal identification number (PIN), or providing a valid signature. (see Bagga paragraph [0005], lines 15-19: security supplemented by requiring user to enter a memorized PIN (personal identification number) or password; (an authentication task (i.e. entering PIN) is required as part of the set of authentication steps); (selected: entering a personal identification number (PIN))
11. Claims 3, 12 are rejected under 35 U.S.C. 103 as being unpatentable over Bagga in view of Schrix and further in view of Groenjes and Mizrah (US PGPUB No. 20080098464).
Regarding Claims 3, 12, Bagga-Schrix-Groenjes discloses the method of claim 1 and the system of claim 10.
Bagga does not specifically disclose authentication challenge includes a request for a valid login identifier (ID) and password combination.
However, Mizrah discloses wherein the at least one first authentication challenge includes a request for a valid login identifier (ID) and password combination. (see Mizrah paragraph [0134], lines 3-17; paragraph [0135], lines 1-9: user enters user name and password (as first authentication credential), if server positively recognizes user name (user identifier) and password then screen is updated and OTAC challenge delivered, OTAC response generated and entered by user (as second authentication credential); (first authentication is a login request))
It would have been obvious to one of ordinary skill in the art to modify Bagga-Schrix for authentication challenge includes a request for a valid login identifier (ID) and password combination as taught by Mizrah. One of ordinary skill in the art would have been motivated to employ the teachings of Mizrah for the benefits achieved from the added security of a system that offers a multi-factor “strong” user-authentication system while enhancing password techniques. (see Mizrah paragraph [0028], lines 1-8)
12. Claims 7, 9, 16, 18, 20 are rejected under 35 U.S.C. 103 as being unpatentable over Bagga in view of Schrix and further in view of Groenjes and Lanc (US PGPUB No. 20080103972).
Regarding Claims 7, 16, 20, Bagga-Schrix-Groenjes discloses the method of claim 1 and the system of claim 10 and the one or more non-transitory machine-readable storage media of claim 19.
Bagga-Schrix does not specifically disclose receiving a transaction request that identifies a user and receiving parameters of activity, parameters identifying a transaction type comprising at least one of a withdrawal of funds, a purchase of a good or service, a transfer of funds from one account to another account, or a change in account information.
However, Lanc discloses wherein the activity is a transaction, and wherein receiving the indication that the user has requested to perform the activity comprises:
a) receiving a transaction request that identifies the user and the transaction; and
b) receiving the parameters of the activity, the parameters identifying a transaction type comprising at least one of a withdrawal of funds, a purchase of a good or service, a transfer of funds from one account to another account, or a change in account information. (see Lanc paragraph [0085], lines 3-6: payment server arranged to process payment requests (transaction request) only when certain criteria have been met, such as authentication of both users (identification of user) by the authentication server; paragraph [0075], lines 3-8: communicate with systems of institutions that provide financial services such as banks (i.e. bank transactions); paragraph [0014], lines 1-6: authentication associated with a transaction; transaction may be a purchase or a cash withdrawn or money transfer; (selected: a withdrawal funds))
It would have been obvious to one of ordinary skill in the art to modify Bagga-Schrix for receiving a transaction request that identifies a user and receiving parameters of activity, parameters identifying a transaction type comprising at least one of a withdrawal of funds, a purchase of a good or service, a transfer of funds from one account to another account, or a change in account information as taught by Lanc. One of ordinary skill in the art would have been motivated to employ the teachings of Lanc for the benefits achieved from the added security of a system that after authentication has completed arranges for a transaction to be completed without revealing the users’ financial details and/or other personal details to the other party. (see Lanc paragraph [0006], lines 3-8)
Regarding Claims 9, 18, Bagga-Schrix-Groenjes discloses he method of claim 1 and the system of claim 10.
Bagga-Schrix does not specifically disclose modifying authentication path when user is in a location proximate to another user.
However, Lanc discloses wherein further comprising modifying, by the one or more processors, the authentication path when the user is in a location proximate to another user. (see Lanc paragraph [0122], lines 1-7: face-to-face transactions (actual store transaction, user proximate to other users): consumer authenticated using merchant (i.e. bank) authentication device; paragraph [0075], lines 3-8: communicate with systems of institutions that provide financial services such as banks (i.e. bank transactions))
It would have been obvious to one of ordinary skill in the art to modify Bagga- Bagga-Schrix for the indication that a user wishes to conduct a bank transaction is received via a store location as taught by Lanc. One of ordinary skill in the art would have been motivated to employ the teachings of Lanc for the benefits achieved from the added security of a system that after authentication has completed arranges for a transaction to be completed without revealing the users’ financial details and/or other personal details to the other party. (see Lanc paragraph [0006], lines 3-8)
13. Claims 8, 17 are rejected under 35 U.S.C. 103 as being unpatentable over Bagga in view of Schrix and further in view of Groenjes and Utsch et al. (US PGPUB No. 20090047928) .
Regarding Claims 8, 17, Bagga-Schrix-Groenjes discloses the method of claim 1 and the system of claim 10.
Bagga-Schrix does not specifically disclose a user has requested to perform an activity received via an online banking website.
However, Utsch discloses further comprising:
a) providing, by the one or more processors, an online banking website for display on a computing device; b) wherein the indication that the user has requested to perform the activity is received via the online banking website. (see Utsch paragraph [0023], lines 6-12: banking functions (i.e. user performing banking transaction via request for a service) utilized from a cellphone or any other messaging type system; (transaction type is a bank type transaction); paragraph [0024], lines 12-29: authentication system commences operation upon receipt of an initial request from a user (indication of a transaction), if a match is made (between challenges and responses) then authentication system formats and sends a new message to user initiating a session of access to information and functions that the user desires))
It would have been obvious to one of ordinary skill in the art to modify Bagga-Schrix for a user has requested to perform an activity received via an online banking website as taught by Utsch. One of ordinary skill in the art would have been motivated to employ the teachings of Utsch for the benefits achieved from the added security of a system that establishes beyond a reasonable doubt that the alleged user is in fact the actual user attempting to gain access to information. (see Utsch paragraph [0004], lines 14-17))
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to CARLTON JOHNSON whose telephone number is (571)270-1032. The examiner can normally be reached Work: 12-9PM (most days).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Shewaye Gelagay can be reached at 571-272-4219. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/CJ/
October 5, 2026
/SHEWAYE GELAGAY/Supervisory Patent Examiner, Art Unit 2436
Prosecution Insights