DETAILED ACTION
Election/Restrictions
Applicant's election with traverse of Group II in the reply filed on 2/25/26 is acknowledged. The traversal is on the ground(s) that examining both groups would NOT cause a serious burden.. This is not found persuasive because the restriction is maintained because the inventions are distinct as noted previously, and an additional serious burden is present because the groups require separate search strategies and classification fields.
Group I is directed to a server-side computer network initialization method involving database storage management and remote application delivery. Conversely, Group II is directed to a localized physical access control environment involving short-range, bidirectional radiofrequency data exchanges between a localized access controller node and a mobile device.
A search of one group does not provide a baseline search for the other, and requiring a combined search would necessitate distinct fields of search and dual search strategies.
The requirement is still deemed proper and is therefore made FINAL.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 7-11, 13, and 14 is/are rejected under 35 U.S.C. 103 as being unpatentable over Everson (US 20200100108 A1) in view of Micali (US 7353396 B2).
Re Claim 7: Everson disclose a method for controlling access to an area of a site by a user, the site comprising at least one area and each area of the site being associated with a controller of access to said area,
the user carrying a mobile communication device on which an access control application dedicated to the implementation of the access control method has been installed,
each access controller storing at least one encryption private key (PK), an encryption shared key (SK) and an identification number (IDA) of the access controller,
the mobile communication device storing a first random key (MK) previously generated by said access control application and at least one access right (ACCESS) of the user to an area of the site, each access right (ACCESS) comprising at least:
i. an encryption key (BMK), the encryption key (BMK) having been generated by encrypting the first random key (MK) with the encryption private key (PK),
ii. the encryption shared key (SK),
iii. the identification number (IDA) of the access controller associated with said area,
iv. a validity end date of the access right, and
the access control method comprising the following steps ("An access control system and methods... leverage wireless access credentials to allow a user to securely gain access to a secured area using his or her mobile device.", "...using a symmetric cryptographic key stored by the server system and the access control edge device..." "...the mobile device 114 stores the encrypted credential blob ($E_K(nonce \parallel C \parallel credential)$) and the keyed hash of the encrypted credential blob ($HMAC_K$) to a memory of the mobile device 114... the data 910 indicates an expiration time of the credential."):
a) by each access controller of the site, repeatedly emitting its identification number (IDA), according to a telecommunication standard enabling the short-distance bidirectional exchange of data using radiofrequency waves between the access controller and the mobile communication device ("transmit, via the BLE communication circuitry, a BLE advertisement to remote devices in a vicinity of the access control edge device"),
b) by the mobile communication device, receiving an identification number (IDA) emitted by an access controller located at a short range and comparing the received identification number (IDA) with the identification number (IDA) comprised in each access right (ACCESS) stored in the mobile communication device to recognise, in case of a positive comparison, the access controller having emitted the received identification number (IDA) as being associated with an area to which the user has an access right (ACCESS) ("The mobile device 114 scans (e.g., via Bluetooth) for edge devices 118 within communication range of the mobile device 114 to determine whether the mobile device 114 is within communication range of an edge device 118 for which the mobile device 114 has received updated access control data." "When the mobile device 114 is within the relevant communication range... the mobile device 114 and the edge device 118 may establish a Bluetooth communication session/connection..." "...a new BLE generic attribute (GATT) service may be defined such that the mobile application of the mobile device 114 can identify via the advertising data of the nearby BLE devices whether each nearby device supports the BLE access credential."),
c) by the mobile communication device, generating and transmitting, to the recognised access controller, a second random key (K1) ("The mobile device 114 and the edge device 118 perform a secure key exchange to generate a shared cryptographic session key, s, separately at each of the mobile device 114 and the edge device 118. In the illustrative embodiment, the session key, s, is generated based on Elliptical Curve Diffie-Hellman (ECDH)." "...the mobile device 114 and the edge device 118 are able to generate the same shared cryptographic session key, s, based on the corresponding public/private ephemeral keys described above..."),
d) by the recognised access controller, receiving the second random key (K1),then generating and transmitting, to the mobile communication device, a third random key (K2) ("The mobile device 114 and the edge device 118 perform a secure key exchange to generate a shared cryptographic session key, s, separately at each of the mobile device 114 and the edge device 118. In the illustrative embodiment, the session key, s, is generated based on Elliptical Curve Diffie-Hellman (ECDH)." "...the mobile device 114 and the edge device 118 are able to generate the same shared cryptographic session key, s, based on the corresponding public/private ephemeral keys described above..."),
e) by the mobile communication device, receiving the third random key (K2),then generating and transmitting, to the recognised access controller, an encrypted message (MSG) generated according to at least:
i. the second random key (K1),
ii. the third random key (K2),
iii. the encryption key (BMK) at the area associated with the recognised access controller,
iv. the first random key (MK),
v. the validity end date of the access right, and
vi. the encryption shared key (SK) ("...the mobile device 114 encrypts the credential message with the shared cryptographic session key, s, and... the mobile device 114 cryptographically signs the encrypted credential message using the private key, c... The mobile device 114 transmits the signed and encrypted credential message to the edge device 118." "encrypting, by the mobile device and using the shared cryptographic key, a credential message including the encrypted credential blob... the credential message further includes the challenge data... cryptographically signing, by the mobile device... the encrypted credential message, transmitting... the encrypted and signed credential message" "...credential message including... the encrypted credential blob...". 1 The session key s is derived directly from the ECDH ephemeral keys (K1, K2 equivalents).),
f) by the recognised access controller, receiving and decrypting the encrypted message (MSG) using:
i. the second random key (K1),
ii. the third random key (K2),
iii. the encryption key (BMK),
iv. the encryption shared key (SK) of the recognised access controller, and
v. the encryption private key (PK), so as to extract therefrom at least the validity end date of the access right ("...decrypting, by the access control edge device and using the shared cryptographic key, the encrypted and signed credential message to extract the encrypted credential blob, decrypting, by the access control edge device and using the symmetric cryptographic key, the encrypted credential blob to extract the wireless access credential..."), and
g) in case of a positive verification of the validity of the access right, issuing, by the recognised access controller, an access authorisation for the user to the area associated with the recognised access controller ("unlocking a lock mechanism of an electronic lock associated with the access control edge device in response to successful authentication of the wireless access credential").
However, Everson does not disclose that this verification depending on the time point at which access is requested relative to the validity end date of the access right.
Micali however discloses that this verification depending on the time point at which access is requested relative to the validity end date of the access right ("Device D may consult its own clock to ensure that the n-th proof value corresponds to the current date.").
Therefore, it would have been obvious before the effective filing date of the claimed invention to a person having ordinarily skill in the art to incorporate Micali’s teaching in the method of Everson for the purpose of resolving critical vulnerabilities associated with static key storage, protecting physical hardware against insider threats, and establishing robust, offline key synchronization.
Re Claim 8: Everson modified by Micali disclose the access control method according to claim 7,wherein decrypting the encrypted message (MSG) is carried out so as to extract therefrom the random key (MK), then using the extracted random key (MK) to decrypt a still undecrypted portion of the message (MSG) so as to extract therefrom at least the validity end date of the access right ("In flow 1626, the edge device 118 decrypts the encrypted credential blob using the symmetric cryptographic key, K... and, in block 1628, the edge device 118 extracts the credential and the public cryptographic key, C, from the decrypted credential blob... In flow 1630, the edge device 118 verifies the signature of the encrypted credential message using the public cryptographic key, C, extracted from the decrypted credential blob.").
Re Claim 9: Everson modified by Micali disclose the access control method according to claim 7, wherein, each access right (ACCESS) further comprising at least one amongst an identifier of the site (SID) and an identifier of the user (UID), generating by the mobile communication device the encrypted message (MSG) is further based on at least one amongst the identifier of the site (SID) and the identifier of the user (UID),respectively ("The credential value may be composed of the facility/site code and a unique credential/badge value." "...the mobile device 114 (e.g., using the mobile application) builds a credential message including... the encrypted credential blob retrieved from the memory of the mobile device 114... In flow 2014, the mobile device 114 encrypts the credential message...").
Re Claim 10: Everson modified by Micali disclose the access control method according to claim 9, wherein decrypting the encrypted message (MSG) is carried out so as to further extract at least one amongst an identifier of the site (SID) and an identifier of the user (UID) ("...decrypting, by the access control edge device and using the symmetric cryptographic key, the encrypted credential blob to extract the wireless access credential..." "The credential value may be composed of the facility/site code and a unique credential/badge value.").
Re Claim 11: Everson modified by Micali disclose the access control method according to claim 10, further comprising, with the access controller further storing the identifier of the site (SID), comparing the identifier of the site (SID) as previously extracted with the identifier of the site (SID) stored in the access controller, access being denied in case of a negative comparison ("In flow 2032, the edge device 118 processes the credential extracted from the credential blob... the edge device 118 and/or other device(s) in the edge system 116 may make an access control decision based on the extracted credential and an access control database.").
Re Claim 13: Everson modified by Micali disclose the computer program product comprising instructions, which when they are performed by at least one processor of an access controller, executes at least steps a), d), f) and g) of the access control method according to claim 7 ("...a plurality of instructions stored thereon that, in response to execution by an access control edge device, causes the access control edge device to establish a first persistent communication connection... The edge device 118 may include a main/primary processor...").
Re Claim 14: Everson modified by Micali disclose the computer program product comprising instructions, which when they are performed by at least one processor of a mobile communication device (4), executes at least steps b), c) and e) of the access control method according to claim 7 ("The mobile device 114 may execute a mobile application to deliver the wireless access credential to a lock device 132... The mobile device 114 (e.g., using the mobile application) builds a credential message...").
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to TAE W KIM whose telephone number is (571)272-5971. The examiner can normally be reached M-F 9:30AM-5:30PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Steven S Paik can be reached at 5712722404. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/TAE W KIM/ Examiner, Art Unit 2876
/THIEN M LE/Primary Examiner, Art Unit 2876
Prosecution Insights