DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendment
The Amendment filed 07/07/2026 has been entered.
Claims 1-4, 9, 12-17 and 23 remain pending in the application.
Response to Arguments
Applicant’s arguments with respect to claims 1-4, 9, 12-17 and 23 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claims 12-13, 15-17 and 23 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Peng et al. (US 20230413055 A1).
Regarding claim 12, Peng teaches a method performed by a network node implementing an Application Function, AF, for enabling Authentication and Key Management for Applications, AKMA, key diversity for multiple wireless device applications (method of Fig. 7), the method comprising:
receiving, from an application of a wireless device, a session establishment request comprising an AKMA key identifier, A-KID, and an encrypted application identifier, APP-ID, of the application (the UE sends a discovery request message to the 5GDDNMF. The discovery request message can include the A-KID as clear text. Other contents of the message can be encrypted, [0079]), wherein the APP-ID is encrypted using one of the following: an AF key, KAF, associated with the AF, or an AKMA key, KAKMA, associated with the A-KID (UE encrypts the messages to be sent and calculates the MAC for the messages with the KAF, [0078]);
obtaining an application key, KAPP, based on a decrypted APP-ID and one of the following: the KAKMA, or the KAF (5GDDNMF derives the Kenc and the Kint from the KAF using the key derivation function (KDF) of Kenc∥Kint discussed above. The 5GDDNMF checks the MAC of the discovery request message by using the Kint. If it succeeds, the 5GDDNMF decrypts the discovery request message by using the Kenc. If the Discovery request message is protected with the KAF by the UE, the 5GDDNMF checks the MAC and decrypts the discovery request message by using the KAF, [0084]); and
executing an authentication protocol for the application using the KAPP (The 5GDDNMF checks the integrity and decrypts the received discovery request message. The 5GDDNMF encrypts and integrity-protects the discovery response message before sending it to the UE, [0085]).
Regarding claim 13, Peng teaches the method of claim 12, wherein: the APP-ID is encrypted using the an AF key, KAF (If the Discovery request message is protected with the KAF by the UE, [0084]); and the method further comprises: sending, to the telecommunications network, a request for an AF key, KAF (if the 5GDDNMF does not have an active context associated with the A-KID, then the 5GDDNMF sends a Naanf_AKMA_ApplicationKey_Get request to AAnF with the A-KID to request the K.sub.AF for the UE, [0080]); obtaining, from the telecommunications network, KAF (AAnF sends Naanf_AKMA_ApplicationKey_Get response to the AF with K.sub.AF, [0083]); and decrypting the encrypted APP-ID using the KAF, thereby obtaining the decrypted APP-ID (5GDDNMF derives the Kenc and the Kint from the KAF using the key derivation function (KDF) of Kenc∥Kint discussed above. The 5GDDNMF checks the MAC of the discovery request message by using the Kint. If it succeeds, the 5GDDNMF decrypts the discovery request message by using the Kenc. If the Discovery request message is protected with the KAF by the UE, the 5GDDNMF checks the MAC and decrypts the discovery request message by using the KAF, [0084]).
Regarding claim 15, Peng teaches the method of claim 13, wherein obtaining the Karp based on the APP-ID comprises deriving, by the AF, the Karp based the decrypted APP-ID (AAnF derives the AKMA Application Key (K.sub.AF) from K.sub.AKMA if it does not already have K.sub.AF, [0082]).
Regarding claim 16, Peng teaches the method of claim 13, wherein obtaining the Karp based on the APP-ID comprises receiving, by the AF from the telecommunications network, the KApp calculated by the telecommunications network based on the following: the KAKMA, and the decrypted APP-ID, and an AF identifier, AF-ID, associated with the AF (5GDDNMF derives the Kenc and the Kint from the KAF using the key derivation function (KDF) of Kenc∥Kint discussed above. The 5GDDNMF checks the MAC of the discovery request message by using the Kint. If it succeeds, the 5GDDNMF decrypts the discovery request message by using the Kenc. If the Discovery request message is protected with the KAF by the UE, the 5GDDNMF checks the MAC and decrypts the discovery request message by using the KAF, [0084]).
Regarding claim 17, Peng teaches the method of claim 14, wherein obtaining the Karp based on the APP-ID comprises: sending the decrypted APP-ID to the telecommunications network (5GDDNMF sends a Naanf_AKMA_ApplicationKey_Get request to AAnF with the A-KID to request the K.sub.AF for the UE, [0080]); and receiving, by the AF from the telecommunications network, KArp calculated by the telecommunications network based on the KAKMA, the AF-ID, and the decrypted APP-ID (AAnF sends Naanf_AKMA_ApplicationKey_Get response to the AF with K.sub.AF and the K.sub.AF expiration time, [0083]).
Regarding claim 23, Peng teaches a network node(device of Fig. 10) implementing an Application Function, AF, for enabling Authentication and Key Management for Applications, AKMA, key diversity for multiple wireless device applications, the network node comprising: one or more transmitters (transceiver 1015); one or more receivers (transceiver 1015); and processing circuitry (processor 1010) associated with the one or more transmitters and the one or more receivers, the processing circuitry configured to cause the network node to:
receive, from an application of a wireless device, a session establishment request comprising an AKMA key identifier, A-KID, and an encrypted application identifier, APP-ID, of the application(the UE sends a discovery request message to the 5GDDNMF. The discovery request message can include the A-KID as clear text. Other contents of the message can be encrypted, [0079]), wherein the APP-ID is encrypted using one of the following: an AF key, KAF, associated with the AF, or an AKMA key, KAKMA, associated with the A-KID (UE encrypts the messages to be sent and calculates the MAC for the messages with the KAF, [0078]);
obtain an application key, Karp, based on the K and the a decrypted APP-ID and one of the following: the KAKMA, or the KAF (5GDDNMF derives the Kenc and the Kint from the KAF using the key derivation function (KDF) of Kenc∥Kint discussed above. The 5GDDNMF checks the MAC of the discovery request message by using the Kint. If it succeeds, the 5GDDNMF decrypts the discovery request message by using the Kenc. If the Discovery request message is protected with the KAF by the UE, the 5GDDNMF checks the MAC and decrypts the discovery request message by using the KAF, [0084]); and execute an authentication protocol for the application using the KaPP (The 5GDDNMF checks the integrity and decrypts the received discovery request message. The 5GDDNMF encrypts and integrity-protects the discovery response message before sending it to the UE, [0085]).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-4 and 9 are rejected under 35 U.S.C. 103 as being unpatentable over Guo et al. (US 20240251238 A1) in view of Li et al. (US 20230019089 A1).
Regarding claim 1, Guo teaches a method performed by a wireless device for enabling Authentication and Key Management for Applications, AKMA, key diversity for multiple applications (method of Fig. 4 using Akma engine 245 of UE 110), the method comprising:
determining, by an AKMA client (AKMA engine 245) of the wireless device, a root key, KAKMA, and an AKMA key identifier, A-KID, based on primary authentication with a telecommunications network (the AKMA engine 245 generates the KARMA and an AKMA key identifier (A-KID) using, for example, the AKMA procedure as described in 3GPP TS 33.535. As described above, the KARMA is generated based on the K.sub.AUSF, [0054]; UE 110 performs primary authentication with the network, the procedure may result in the credential (K.sub.AUSF) being shared between the UE 110 and the AUSF, [0053]);
receiving, by the AKMA client from an application of the wireless device, an application identifier, APP-ID, of the application (when the EEC 240 is requesting K.sub.AKMA from the AKMA engine 245 using a key request, the certificate of the AC/EEC may be carried in this request, [0073]; For example, a certificate may be stored in an application client 235 or in an EEC 240 for the authentication to be performed in subsequent operations, [0072]);
verifying, by the AKMA client, the APP-ID (the AKMA engine 245 may check this certificate first, before the AKMA engine 245 sends the K.sub.AKMA to the EEC 240, [0073]).
However, Guo does not clearly teach receiving, by the AKMA client from an application of the an Application Function, AF, identifier, AF-ID, of an AF arranged to communicate with the application; verifying, by the AKMA client, that the application is entitled to use the AF-ID and responsive to successfully verifying the APP-ID and that the application is entitled to use the AF-ID: deriving an application key, KAPP, based on the KAKMA, the AF-ID, and the APP-ID.
In an analogous art, Li teaches receiving, by the AKMA client from an application of the wireless device an Application Function, AF, identifier, AF-ID, of an AF arranged to communicate with the application (NEF sends the first identification information to the AAnF, for example, sends the first identification information to the AAnF by using a submit Key Request message, [0144]; the submit Key Request message may further carry the identification information of the AF, for example, the AF ID, [0145]); verifying, by the AKMA client, that the application is entitled to use the AF-ID (AAnF may check and determine whether the UE can perform the AKMA service by using the AF indicated by the AF ID, [0157]); responsive to successfully verifying the APP-ID and verifying that the application is entitled to use the AF-ID: deriving an application key, KAPP, based on the KAKMA, the AF- ID, and the APP-ID (A method for generating a value may be: generated value=KDF(key, parameter 1, parameter 2). KDF is used by the UE and the AUSF to generate a key Kseaf. The key herein may be Kausf, or may be Kakma… The parameter 1 may alternatively indicate application (application, APP) information, for example, a character string “APP ID”, [0120]; The AAnF generates Kaf and the validity period of Kaf based on Kakma and the AF ID, [0170]; UE generates Kaf is similar to a process in which the AAnF generates Kaf, [0178]).
Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to have modified the key derivation of Guo with the key formula of Li to provide communication system wherein an AKMA anchor function network element can quickly and accurately determine an authentication server function network element corresponding to a terminal device as suggested, Li [0006].
Regarding claim 2, Guo as modified by Li teaches the method of claim 1. Li further teaches, responsive to successfully verifying the APP-ID and verifying that the application is entitled to use the AF-ID, further comprising: encrypting the APP-ID; outputting the A-KID, the KAPP, and the encrypted APP-ID to the application (AF may encrypt, within the validity period of Kaf by using Kaf, data sent by the AF to the UE, so that data transmission security can be improved, Li [0178]); and sending, by the application session establishment request to an AF, the session establishment request comprising the A-KID and the encrypted APP-ID (AF may encrypt, within the validity period of Kaf by using Kaf, data sent by the AF to the UE, so that data transmission security can be improved, Li [0178]).
Regarding claim 3, Guo as modified by Li teaches the method of claim 2, Li teaches wherein encrypting the APP-ID comprises encrypting APP-ID using one of the KAKMA and the Kaf (After step 615, the AF may encrypt, within the validity period of Kaf by using Kaf, data sent by the AF to the UE, so that data transmission security can be improved. Correspondingly, when receiving the data from the AF, the UE may decrypt the data by using Kaf, Li [0178]); deriving KAPP based on the KAKMA, the AF-ID, and the APP-ID comprises: deriving, using a key derivation function, KDF, an AF key, Ka, based on the KAKMA and the AF-ID (The AAnF generates Kaf and the validity period of Kaf based on Kakma and the AF ID, [0170]; UE generates Kaf is similar to a process in which the AAnF generates Kaf, [0178]); and deriving, using the KDF, the KAPP based on the KaF and the APP-ID (generated value=KDF(key, parameter 1, parameter 2). KDF is used by the UE and the AUSF to generate a key Kseaf. The key herein may be Kausf, or may be Kakma… The parameter 1 may alternatively indicate application (application, APP) information, for example, a character string “APP ID”, [0120]).
Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to have modified the key derivation of Guo with the key formula of Li to provide communication system wherein an AKMA anchor function network element can quickly and accurately determine an authentication server function network element corresponding to a terminal device as suggested, Li [0006].
Regarding claim 4, Guo as modified by Li teaches the method of claim 2, encrypting APP-ID comprises encrypting APP-ID using the KAKMA (After step 615, the AF may encrypt, within the validity period of Kaf by using Kaf, data sent by the AF to the UE, so that data transmission security can be improved. Correspondingly, when receiving the data from the AF, the UE may decrypt the data by using Kaf, Li [0178]): deriving the KAPP based on the KAKMA, the AF-ID, and the APP-ID comprises deriving, using a key derivation function, KDF, the KAPP based on the KAKMA, the AF-ID, and the APP-ID (generated value=KDF(key, parameter 1, parameter 2). KDF is used by the UE and the AUSF to generate a key Kseaf. The key herein may be Kausf, or may be Kakma… The parameter 1 may alternatively indicate application (application, APP) information, for example, a character string “APP ID”, [0120]; The AAnF generates Kaf and the validity period of Kaf based on Kakma and the AF ID, [0170]; UE generates Kaf is similar to a process in which the AAnF generates Kaf, [0178]).
Regarding claim 9, Guo teaches a method performed by a wireless device for enabling Authentication and Key Management for Applications, AKMA, key diversity for multiple applications (method of Fig. 4 using Akma engine 245 of UE 110), the method comprising:
determining, by an AKMA client of the wireless device, a root key, KAKMA, and an AKMA key identifier, A-KID, based on primary authentication with a telecommunications network (the AKMA engine 245 generates the KARMA and an AKMA key identifier (A-KID) using, for example, the AKMA procedure as described in 3GPP TS 33.535. As described above, the KARMA is generated based on the K.sub.AUSF, [0054]; UE 110 performs primary authentication with the network, the procedure may result in the credential (K.sub.AUSF) being shared between the UE 110 and the AUSF, [0053]);
receiving, by an Application Function, AF, client of the wireless device from an application of the wireless device, an application identifier, APP-ID of the application (when the EEC 240 is requesting K.sub.AKMA from the AKMA engine 245 using a key request, the certificate of the AC/EEC may be carried in this request, [0073]; For example, a certificate may be stored in an application client 235 or in an EEC 240 for the authentication to be performed in subsequent operations, [0072]);
verifying, by the AF client, APP-ID (the AKMA engine 245 may check this certificate first, before the AKMA engine 245 sends the K.sub.AKMA to the EEC 240, [0073]).
However, Guo does not teach receiving, by the AKMA client from the AF client, an application function, AF, identifier, AF-ID of an AF arranged to communicate with the application; verifying, by the AKMA client, that the AF client is entitled to use the AF-ID; responsive to verifying that the AF client is entitled to use AF-ID, deriving, by the AKMA client, an AF key, KaF, based on the KAKMA and the AF-ID; deriving, by the AF client, an application key, KAPP, based on the KaF and the APP-ID; encrypting, by the AF client, APP-ID using the Kaf; outputting KAPP, A-KID, and the encrypted APP-ID to the application; and sending, by the application, a session establishment request to an AF, the session establishment request comprising the A-KID and the encrypted APP-ID.
In an analogous art, Li teaches receiving, by the AKMA client from an application of the wireless device an Application Function, AF, identifier, AF-ID, of an AF arranged to communicate with the application (NEF sends the first identification information to the AAnF, for example, sends the first identification information to the AAnF by using a submit Key Request message, [0144]; the submit Key Request message may further carry the identification information of the AF, for example, the AF ID, [0145]); verifying, by the AKMA client, that the application is entitled to use the AF-ID (AAnF may check and determine whether the UE can perform the AKMA service by using the AF indicated by the AF ID, [0157]); in responsive to verifying that the AF client is entitled to use AF-ID, deriving, by the AKMA client, an AF key, KaF, based on the KAKMA and the AF-ID (the AAnF directly generates Kaf and a validity period of Kaf based on Kakma and the AF ID, [0099]);
deriving, by the AF client, an application key, KAPP, based on the KaF and the APP-ID (A method for generating a value may be: generated value=KDF(key, parameter 1, parameter 2). KDF is used by the UE and the AUSF to generate a key Kseaf. The key herein may be Kausf, or may be Kakma… The parameter 1 may alternatively indicate application (application, APP) information, for example, a character string “APP ID”, [0120]; The AAnF generates Kaf and the validity period of Kaf based on Kakma and the AF ID, [0170]; UE generates Kaf is similar to a process in which the AAnF generates Kaf, [0178] and After step 615, the AF may encrypt, within the validity period of Kaf by using Kaf, data sent by the AF to the UE, so that data transmission security can be improved, [0178]);
outputting KAPP, A-KID, and the encrypted APP-ID to the application (generated value=KDF(key, parameter 1, parameter 2). KDF is used by the UE and the AUSF to generate a key Kseaf. The key herein may be Kausf, or may be Kakma… The parameter 1 may alternatively indicate application (application, APP) information, for example, a character string “APP ID”, [0120]; After step 615, the AF may encrypt, within the validity period of Kaf by using Kaf, data sent by the AF to the UE, so that data transmission security can be improved, [0178]); and
sending, by the application, a session establishment request to an AF, the session establishment request comprising the A-KID and the encrypted APP-ID (The UE sends, to the AF, an application session establishment request (for example, an application session establishment request) that carries the Kakma ID, [0099]),
encrypting, by the AF client, APP-ID using the Kaf (AF may encrypt, within the validity period of Kaf by using Kaf, data sent by the AF to the UE, so that data transmission security can be improved, [0178]).
Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to have modified the key derivation of Guo with the messages encryption of Li to provide communication system wherein an AKMA anchor function network element can quickly and accurately determine an authentication server function network element corresponding to a terminal device as suggested, Li [0006].
Claim 14 is rejected under 35 U.S.C. 103 as being unpatentable over Peng et al. (US 20230413055 A1) in view of Lee et al. (US 20200359218 A1).
Regarding claim 14, Peng teaches the method of claim 12, the method further comprises: sending the encrypted APP-ID to the telecommunications network (5GDDNMF sends a Naanf_AKMA_ApplicationKey_Get request to AAnF with the A-KID to request the K.sub.AF for the UE, [0080]); and receiving the decrypted APP-ID from the telecommunications network 9 AAnF sends Naanf_AKMA_ApplicationKey_Get response to the AF with K.sub.AF, [0083]).
However, Peng does not teach wherein the APP-ID is encrypted using the an AKMA key, KAKMA.
In an analogous art, Lee teaches wherein: the APP-ID is encrypted using the an AKMA key, KAKMA (The issued edge computing access token may be encrypted using the AKMA key, [0267]).
Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to have modified the key derivation of Peng with the messages encryption of Li to provide communication system for performing an authentication procedure for granting authorization for mobile edge computing services in a wireless communication system as suggested, Lee [0009].
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. Yu et al. (US 20210058780 A1): The present application discloses a method, device, and system for configuring a session for communication between electronic devices. The method includes sending, by a session management entity of a wireless network, a first request message to a policy control entity of the wireless network, the first request message comprising a key identifier, receiving, by the session management entity, a first response message from the policy control entity, wherein the first response message corresponds to a response to the first request message, and the first response message comprises a session policy for a communication session corresponding to the key identifier, and configuring, by the session management entity, the communication session based at least in part on the session policy.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to NICOLE M LOUIS-FILS whose telephone number is (571)270-0671. The examiner can normally be reached Monday-Friday.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Charles Appiah can be reached at 571-272-7904. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/NICOLE M LOUIS-FILS/ Examiner, Art Unit 2641
/CHARLES N APPIAH/Supervisory Patent Examiner, Art Unit 2641
Prosecution Insights