Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This is the initial office action that has been issued in response to patent application, 18/752,280, filed on 09/19/2025. Claims 21-41 are currently pending and have been considered below. Claims 21, 33 and 37 are independent claims.
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 09/19/2025 has been entered.
Response to Arguments
Applicant’s arguments with respect to claims 21-41 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims are 21-27 and 30-36 are rejected under 35 U.S.C. 103 as being unpatentable over Guillory(US Publication No. 2018/0183777 A1) in view of Ligatti (US Patent No. 9659160 B2) in further view of Steffey(US Publication No. 2016/0277923 A1)
Regarding Claim 21:
Guillory discloses:
A method for authenticating a user for use of a secure application, the method comprising: transmitting an authentication challenge from an authentication service to a computing device(Guillory, [0002],The most common way to authenticate a user for access to a digital service is to use a login and a password that the user has to enter every time he opens a session. The user authentication involves a user entering the user's login and password on a user device, which is then transmitted over a communication network to a server. [0019], Computing device 102 further includes an authentication application 109 (also referred to as automatic authentication application).);
…
signing, at the mobile device, the authentication challenge(Guillory, [0032], authentication application 109 is activated in response to receiving the sign-in request. In examples, authentication application 109 is activated automatically in response to user 110 signing into a computing device hosting authentication application 109);
Guillory does not disclose:
forwarding the authentication challenge from the computing device to the mobile device
and validating the signed authentication challenge at the authentication service
Ligatti teaches:
forwarding the authentication challenge from the computing device to the mobile device(Ligatti, Col. 2, lines, 10-14, a forwarding policy for the authenticator computing device and a forwarding policy for each of the plurality of user devices can be used to determine the subset of user devices that will receive the authentication challenge.);
and validating the signed authentication challenge at the authentication service(Ligatti, Col. 11, lines 16-26, Alternatively, the smart ring can transmit a signed version of the authentication challenge data to the smart phone, which then forwards the signed authentication challenge data to the authenticator computing device 103. The authenticator computing device 103 can compare the authentication challenge sent to the mobile telephone to the response received from the smart ring and/or smart phone. If the response is valid for the authentication challenge (e.g., the response is determined to be an appropriately signed version of the authentication challenge data)).
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Guillory’s methods and systems for user authentication by enhancing Guillory’s authentication challenge by enhancing and validating the computing device within the cryptographic information as taught by Ligatti in order to enhance security by requiring authentication factors and reducing unauthorized access.
The motivation is to ensure forwarding the authentication challenge to the mobile device and signing significantly strengthens the security authentication and secures the validation of the authentication challenge within the services. Furthermore, requiring more than one device for user authentication provides increased security by eliminating the possibility of unauthorized access through the use of a single registered user device.[Ligatti, Col. 1, lines 41-44]
Guillory and Ligatti do not disclose:
exchanging cryptographic data between the computing device and a mobile device, wherein the cryptographic information is used by the mobile device to validate the computing device
Steffey teaches:
exchanging cryptographic data between the computing device and a mobile device, wherein the cryptographic information is used by the mobile device to validate the computing device(Steffey, [0036-0037]The validation unit 120 may validate a vehicle terminal inverse certificate received from the user terminal 300 in exchange for the user terminal inverse certificate. According to embodiments, the validation unit 120 may validate the received vehicle terminal inverse certificate using the vehicle terminal private key. Furthermore, according to embodiments, the validation unit 120 may obtain a user terminal public key through decryption of the received vehicle terminal inverse certificate. The validation unit 120 may receive a server public key from the authority server 200 through the communication unit 150 during setup of a telematics service on the vehicle terminal 100…).
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Guillory and Ligatti’s methods and systems for user authentication by enhancing Guillory and Ligatti’s authentication challenge by enhancing and validating the computing device within the cryptographic information to communicate security information to a user entering content into the device as taught by Steffey in order to improve the security of proximity based device pairing and prevent impersonation attacks.
The motivation is to ensure that the mobile device can verify the authenticity of the computing device before establishing a trusted wireless connection, thereby preventing spoofing or impersonation. Furthermore, the vehicle terminal 100 may transmit an encrypted message requesting the user terminal inverse certificate to the authority server 200 for security[Steffey, 0025].
Regarding Claim 22:
The method of claim 21, Guillory in view of Ligatti in further view of Steffey teaches wherein exchanging cryptographic data between the computing device and a mobile device includes:
transmitting a mobile challenge from the mobile device to the computing device(Guillory, [0002],The most common way to authenticate a user for access to a digital service is to use a login and a password that the user has to enter every time he opens a session. The user authentication involves a user entering the user's login and password on a user device, which is then transmitted over a communication network to a server. [0019], Computing device 102 further includes an authentication application 109 (also referred to as automatic authentication application).);
signing the mobile challenge at the computing device(Ligatti, Col. 11, lines 16-20, Alternatively, the smart ring can transmit a signed version of the authentication challenge data to the smart phone, which then forwards the signed authentication challenge data to the authenticator computing device 103. );
transmitting the signed mobile challenge from the computing device to the mobile device(Ligatti, Col. 11, lines 13-20, The authentication application on the smart ring can automatically transmit the authentication challenge data received in the smart ring to the authenticator computing device 103. Alternatively, the smart ring can transmit a signed version of the authentication challenge data to the smart phone, which then forwards the signed authentication challenge data to the authenticator computing device 103.);
and validating the signed mobile challenge at the mobile device(Ligatti, Col. 11, lines 13-20, The authentication application on the smart ring can automatically transmit the authentication challenge data received in the smart ring to the authenticator computing device 103. Alternatively, the smart ring can transmit a signed version of the authentication challenge data to the smart phone, which then forwards the signed authentication challenge data to the authenticator computing device 103.).
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Guillory’s methods and systems for user authentication by enhancing Guillory’s authentication challenge by enhancing and validating the computing device within the cryptographic information as taught by Ligatti in order validate and transmit the signed mobile challenge to enhance security systems.
The motivation is to ensure the security mechanisms process helps ensure the mobile device is secure and prevents attacks within the signing process.
Regarding Claim 23:
The method of claim 22, Guillory in view of Ligatti in further view of Steffey teaches wherein the mobile challenge is signed by the computing device with a private key of a public-private key pair(Guillory, [0038], Authentication application 109 is operative to access the private key from key database 112. Authentication application 109 is then operative to resolve the challenge using the private key. For example, authentication application 109 is operative to solve the challenge programmatically without further input from the user 110. For example, the challenge is solved by signing the challenge data with the private key of the public/private pair);
and wherein mobile device validates the signed mobile challenge using a public key of the public-private key pair(Guillory, [0041], The webpage backend then is operative to retrieve the public key of the public/private key pair for the user and the associated web service from public key database 114. The webpage backend is then operative to verify the challenge response. In some examples, the webpage backend is operative to verify the challenge response using a combination of challenge response, the public key, and the challenge. For example, server authentication application 116 may use the public key to verify the signature in the challenge response. Server authentication application 116 can verify the signature using the one or more algorithms used to sign the challenge response.).
Regarding Claim 24:
The method of claim 23, Guillory in view of Ligatti in further view of Steffey teaches further comprising retrieving the public-private key pair from storage at the computing device(Guillory, [0025], key database 112 may be operative to store merely private keys of the public private pair keys pairs and a user identifier corresponding to user 110. In other examples, key database 112 is operative to store online service identifier along with the private keys and the user identifier).
Regarding Claim 25:
The method of claim 23, Guillory in view of Ligatti in further view of Steffey teaches comprising generating the public-private key pair at the computing device(Guillory, Claim 15, generating, by a computing device, a registration request for a first user to access a web service; generating a public/private key pair for the combination of the first user and the web service.).
Regarding Claim 26:
The method of claim 21, Guillory in view of Ligatti in further view of Steffey teaches further comprising: transmitting an authentication result from the authentication service to the computing device(Ligatti, Col. 7, lines 13-19, the validator 115 can be configured to determine whether an authentication challenge sent to the requesting client device 105A matches a response received from the verifying client device 105B. Based on the result of that determination, the validator 115 can determine whether or not to authenticate the requesting client device 105A.);
and based on receiving the authentication result from the authentication service, granting access at the computing device to a remote secure application(Ligatti, Col. 15, lines 58-64, In addition, the authenticator computing device may utilize a validation policy to determine which responses are required to be valid to grant access to the user devices. As such, the validation policy of the authenticator computing device may determine which responses from the subset of user devices are required to be valid to constitute a valid response to the authentication challenge.).
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Guillory’s methods and systems for user authentication by enhancing Guillory’s authentication challenge by enhancing and validating the computing device within the cryptographic information as taught by Ligatti in order to enhance security by requiring authentication services and ensuring access within the remote application
The motivation is to ensure that the authorized users or device gain access to computing device and transmitting the authentication result from the authentication service to validate the user or devices are granted access to the secure application.
Regarding Claim 27:
The method of claim 26, Guillory in view of Ligatti in further view of Steffey teaches wherein granting access at the computing device to the remote secure application occurs without requiring user re-entry of authentication credentials at either the mobile device or the computing device(Ligatti, Col. 5, lines 11-22, The authenticator can be, for example, a secure server comprising a data store configured to store the registration of multiple devices associated with multiple respective users. The verifier can be used to verify the identity of a user. In some embodiments, a user can register a first device by entering a user credential, such as an email address of the user, and a name for the first device. The user can also register a second device by entering the same user credential for the user and a name for the second device. To this end, the user can register multiple devices to be associated with the user credential. Each device registered with the user can be stored in the data store of the verifier.).
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Guillory’s methods and systems for user authentication by enhancing Guillory’s authentication challenge by enhancing and validating the computing device within the cryptographic information as taught by Ligatti in order to authenticate credentials with the mobile or computing device and to secure systems and minimize the risk associated with repeating authentication credentials.
The motivation is to ensure granting access to a remote application balance user convince and robust security by minimizing credential exposure and reducing the risk of attacks such as phishing and enhance user’s experience. It also ensures that access remains tightly controlled and traceable.
Regarding Claim 30:
The method of claim 21, Guillory in view of Ligatti in further view of Steffey teaches wherein the authentication challenge is signed with user credentials (Guillory, [0046], authentication application 109 is activated in response to receiving the sign-up request. In examples, after activation, authentication application 109 is operative to prompt user 110 to enter a master password.).
Regarding Claim 31:
The method of claim 21, Guillory in view of Ligatti in further view of Steffey teaches further comprising: authenticating, at the computing device, a user with a first secure application based on information received from the mobile device(Guillory, [0056], method 400 may enable a first user to be authenticated on both a first device (e.g., first computing device 102A).).
Regarding Claim 32:
The method of claim 21, Guillory in view of Ligatti in further view of Steffey teaches further comprising: transmitting the signed authentication challenge from the mobile device to the computing device(Ligatti, Col. 11, lines 13-20, The authentication application on the smart ring can automatically transmit the authentication challenge data received in the smart ring to the authenticator computing device 103. Alternatively, the smart ring can transmit a signed version of the authentication challenge data to the smart phone, which then forwards the signed authentication challenge data to the authenticator computing device 103.);
and transmitting the signed authentication challenge from the computing device to the authentication service(Ligatti, Col. 11, lines 13-20, The authentication application on the smart ring can automatically transmit the authentication challenge data received in the smart ring to the authenticator computing device 103. Alternatively, the smart ring can transmit a signed version of the authentication challenge data to the smart phone, which then forwards the signed authentication challenge data to the authenticator computing device 103).
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Guillory’s methods and systems for user authentication by enhancing Guillory’s authentication challenge by enhancing and validating the computing device within the cryptographic information as taught by Ligatti in order to ensure the integrity of the authentication process while establishing secure and trustable authentication data and protecting against various attacks with the system.
The motivation is to transmit signed authentication and the signed challenge from the computing device to the authentication service to secure security mechanism and prevents unauthorized access of sensitive data while maintaining high level security within the system.
Regarding Claim 33:
Guillory discloses:
A system for authenticating a user for use of a secure application, the system comprising: a computing device(Guillory, FIG 1, [0014], As shown in FIG. 1, example operating environment includes a first computing device 102A);
a mobile device(Guillory, [0014], Computing device 102 may be one of various types of computing devices (e.g., a tablet computing device, a desktop computer, a mobile communication device);
and an authentication service(Guillory, [0011], the user device and an authentication server.);
wherein the system is configured to: transmit an authentication challenge from the authentication service to the computing device(Guillory, [0002],The most common way to authenticate a user for access to a digital service is to use a login and a password that the user has to enter every time he opens a session. The user authentication involves a user entering the user's login and password on a user device, which is then transmitted over a communication network to a server. [0019], Computing device 102 further includes an authentication application 109 (also referred to as automatic authentication application).);
sign, at the mobile device, the authentication challenge(Guillory, [0032], authentication application 109 is activated in response to receiving the sign-in request. In examples, authentication application 109 is activated automatically in response to user 110 signing into a computing device hosting authentication application 109);
Guillory does not disclose:
forward the authentication challenge from the computing device to the mobile device;
and validate the signed authentication challenge at the authentication service
Ligatti teaches:
forward the authentication challenge from the computing device to the mobile device(Ligatti, Col. 2, lines, 10-14, a forwarding policy for the authenticator computing device and a forwarding policy for each of the plurality of user devices can be used to determine the subset of user devices that will receive the authentication challenge.);
and validate the signed authentication challenge at the authentication service(Ligatti, Col. 11, lines 16-26, Alternatively, the smart ring can transmit a signed version of the authentication challenge data to the smart phone, which then forwards the signed authentication challenge data to the authenticator computing device 103. The authenticator computing device 103 can compare the authentication challenge sent to the mobile telephone to the response received from the smart ring and/or smart phone. If the response is valid for the authentication challenge (e.g., the response is determined to be an appropriately signed version of the authentication challenge data)).
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Guillory’s methods and systems for user authentication by enhancing Guillory’s authentication challenge by enhancing and validating the computing device within the cryptographic information as taught by Reimer in order to enhance security by requiring authentication factors and reducing unauthorized access.
The motivation is to ensure forwarding the authentication challenge to the mobile device and signing significantly strengthens the security authentication and secures the validation of the authentication challenge within the services. Furthermore, requiring more than one device for user authentication provides increased security by eliminating the possibility of unauthorized access through the use of a single registered user device.[Ligatti, Col. 1, lines 41-44]
Guillory and Ligatti do not disclose:
exchanging cryptographic data between the computing device and a mobile device, wherein the cryptographic information is used by the mobile device to validate the computing device
Steffey teaches:
exchanging cryptographic data between the computing device and a mobile device, wherein the cryptographic information is used by the mobile device to validate the computing device(Steffey, [0036-0037]The validation unit 120 may validate a vehicle terminal inverse certificate received from the user terminal 300 in exchange for the user terminal inverse certificate. According to embodiments, the validation unit 120 may validate the received vehicle terminal inverse certificate using the vehicle terminal private key. Furthermore, according to embodiments, the validation unit 120 may obtain a user terminal public key through decryption of the received vehicle terminal inverse certificate. The validation unit 120 may receive a server public key from the authority server 200 through the communication unit 150 during setup of a telematics service on the vehicle terminal 100…).
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Guillory and Ligatti’s methods and systems for user authentication by enhancing Guillory and Ligatti’s authentication challenge by enhancing and validating the computing device within the cryptographic information to communicate security information to a user entering content into the device as taught by Steffey in order to improve the security of proximity based device pairing and prevent impersonation attacks.
The motivation is to ensure that the mobile device can verify the authenticity of the computing device before establishing a trusted wireless connection, thereby preventing spoofing or impersonation. Furthermore, the vehicle terminal 100 may transmit an encrypted message requesting the user terminal inverse certificate to the authority server 200 for security[Steffey, 0025].
Regarding Claim 34:
The system of claim 33, Guillory in view of Ligatti teaches in further view of Steffey wherein to exchange cryptographic data between the computing device and the mobile device includes to: transmit a mobile challenge from the mobile device to the computing device(Guillory, [0002],The most common way to authenticate a user for access to a digital service is to use a login and a password that the user has to enter every time he opens a session. The user authentication involves a user entering the user's login and password on a user device, which is then transmitted over a communication network to a server. [0019], Computing device 102 further includes an authentication application 109 (also referred to as automatic authentication application).);
sign the mobile challenge at the computing device(Ligatti, Col. 11, lines 16-20, Alternatively, the smart ring can transmit a signed version of the authentication challenge data to the smart phone, which then forwards the signed authentication challenge data to the authenticator computing device 103. );
transmit the signed mobile challenge from the computing device to the mobile device(Ligatti, Col. 11, lines 13-20, The authentication application on the smart ring can automatically transmit the authentication challenge data received in the smart ring to the authenticator computing device 103. Alternatively, the smart ring can transmit a signed version of the authentication challenge data to the smart phone, which then forwards the signed authentication challenge data to the authenticator computing device 103.);
and validate the signed mobile challenge at the mobile device(Ligatti, Col. 11, lines 13-20, The authentication application on the smart ring can automatically transmit the authentication challenge data received in the smart ring to the authenticator computing device 103. Alternatively, the smart ring can transmit a signed version of the authentication challenge data to the smart phone, which then forwards the signed authentication challenge data to the authenticator computing device 103.).
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Guillory’s methods and systems for user authentication by enhancing Guillory’s authentication challenge by enhancing and validating the computing device within the cryptographic information as taught by Ligatti in order validate and transmit the signed mobile challenge to enhance security systems.
The motivation is to ensure the security mechanisms process helps ensure the mobile device is secure and prevents attacks within the signing process.
Regarding Claim 35:
The system of claim 33, Guillory in view of Ligatti in further view of Steffey teaches wherein the system is further configured to: transmit an authentication result from the authentication service to the computing device(Ligatti, Col. 7, lines 13-19, the validator 115 can be configured to determine whether an authentication challenge sent to the requesting client device 105A matches a response received from the verifying client device 105B. Based on the result of that determination, the validator 115 can determine whether or not to authenticate the requesting client device 105A.);
and based on receiving the authentication result from the authentication service, grant access at the computing device to a remote secure application(Ligatti, Col. 15, lines 58-64, In addition, the authenticator computing device may utilize a validation policy to determine which responses are required to be valid to grant access to the user devices. As such, the validation policy of the authenticator computing device may determine which responses from the subset of user devices are required to be valid to constitute a valid response to the authentication challenge.).
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Guillory’s methods and systems for user authentication by enhancing Guillory’s authentication challenge by enhancing and validating the computing device within the cryptographic information as taught by Ligatti in order to enhance security by requiring authentication services and ensuring access within the remote application
The motivation is to ensure that the authorized users or device gain access to computing device and transmitting the authentication result from the authentication service to validate the user or devices are granted access to the secure application.
Regarding Claim 36:
The system of claim 33, Guillory in view of Ligatti in further view of Steffey teaches wherein the system is further configured to: transmit the signed authentication challenge from the mobile device to the computing device(Ligatti, Col. 11, lines 13-20, The authentication application on the smart ring can automatically transmit the authentication challenge data received in the smart ring to the authenticator computing device 103. Alternatively, the smart ring can transmit a signed version of the authentication challenge data to the smart phone, which then forwards the signed authentication challenge data to the authenticator computing device 103.);
and transmit the signed authentication challenge from the computing device to the authentication service(Ligatti, Col. 11, lines 13-20, The authentication application on the smart ring can automatically transmit the authentication challenge data received in the smart ring to the authenticator computing device 103. Alternatively, the smart ring can transmit a signed version of the authentication challenge data to the smart phone, which then forwards the signed authentication challenge data to the authenticator computing device 103.).
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Guillory’s methods and systems for user authentication by enhancing Guillory’s authentication challenge by enhancing and validating the computing device within the cryptographic information as taught by Ligatti in order to ensure the integrity of the authentication process while establishing secure and trustable authentication data and protecting against various attacks with the system.
The motivation is to transmit signed authentication and the signed challenge from the computing device to the authentication service to secure security mechanism and prevents unauthorized access of sensitive data while maintaining high level security within the system.
Claims 28-29 and 37-40 are rejected under 35 U.S.C. 103 as being unpatentable over Guillory(US Publication No. 2018/0183777 A1) in view of Ligatti (US Patent No. 9659160 B2) in further view of Steffey (US Publication No. 2016/0277923 A1) in further view of Kehr(International Publication No. EP 1601153 B1)
Regarding Claim 28:
Guillory in view of Ligatti disclose:
The method of claim 21,…
Guillory in view of Ligatti in further view of Steffey do not disclose:
wherein the authentication challenge is transmitted from the authentication service to the computing device over a remote wireless connection
and wherein the authentication challenge is transmitted from the computing device to the mobile device over a local wireless connection
Kehr teaches:
wherein the authentication challenge is transmitted from the authentication service to the computing device over a remote wireless connection(Kehr, [0030], The application service 110 further may include various mechanisms for delivering voice and/or non-voice data, such as, for example, the short message service (SMS), the wireless application protocol (WAP), the transport connection protocol (TCP), the Internet protocol (IP), the World Wide Web, one or more local area networks (LANs), one or more wireless LANs (WLAN), and/or one or more wide area networks (WANs). );
and wherein the authentication challenge is transmitted from the computing device to the mobile device over a local wireless connection(Kehr, [0018], The client 105 generally may include any device, system, and/or piece of code that relies on another service to perform an operation and that communicates using a wired or wireless communication path. For example, the client 105 may include a fixed or a mobile device 107 such as a cellular telephone, a personal digital assistant (PDA), a pen-based computer, a notebook computer, or a workstation.).
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Guillory in view of Ligatti in further view of Steffey’s system and methods for authentication using multiple devices by enhancing Guillorys in view of Ligatti in further view of Steffey’s authentication challenge by enhancing and validating the computing device within the cryptographic information as taught by Kehr in order to protect sensitive data and gain security from exposure while transmitting an authentication challenge from the computing and mobile device over a wireless connection.
The motivation is to provide several security benefits by reducing exposure, external threats and utilizing local wireless technologies within the authentication process which can be both secure and efficient while the wireless connection allows authentication to occur even when the devices are connected within the network.
Regarding Claim 29:
The method of claim 28, Guillory in view of Ligatti in further view of Steffey in further view of Kehr teaches wherein the local wireless connection is a Bluetooth connection (Ligatti, Col. 19, lines 38-43, the authentication challenge can be a nonce and may be communicated in the form of a sound wave, NFC, images, infrared rays, vibration, Bluetooth, the state of a memory device such as a USB drive or magnetic tape, or any form of communication between devices 105 that can be received via the devices 105.).
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Guillory’s methods and systems for user authentication by enhancing Guillory’s authentication challenge by enhancing and validating the computing device within the cryptographic information as taught by Ligatti in order to leverage specific security features of Bluetooth while ensuring a secure and efficient authentication process.
The motivation is to ensure using a Bluetooth to transmit an authentication challenge provides robust security and validation to protects and reduces exposure to remote attacks while securing the authentication and mechanism process.
Regarding Claim 37:
Guillory teaches:
A system for authenticating a user for use of a secure application, the system comprising: a programmable circuit operatively connected to the local wireless communication interface(Guillory, [0074], the communication media may include a wired media such as a wired network or direct-wired connection, and wireless media such as acoustic, RF, infrared and other wireless media);
a memory operatively connected to the programmable circuit and storing instructions configured to, when executed by the programmable circuit: establish a local wireless communication between the mobile device and a computing device via the local wireless communication interface(Guillory, [0071], operating environment 500 typically may include at least one processing unit 502 and system memory 504. Depending on the exact configuration and type of computing device, system memory 504 (storing, among other things, venue-based applications module(s). [0011], The automatic authentication application may be provided on a user device. For example, the automatic authentication application may be installed on a user device as an independent application for automatic user authentication. The automatic authentication application allows a user to take advantage of a public-key cryptography mechanism to authenticate the user to an online service through a challenge and a challenge response. In some examples, a second application is installed on a server associated with the online service to support the exchange of challenge and challenge response between the user device and an authentication server.);
and sign the authentication challenge, wherein the signed authentication challenge is validated by the authentication service(Guillory, [0032], authentication application 109 is activated in response to receiving the sign-in request. In examples, authentication application 109 is activated automatically in response to user 110 signing into a computing device hosting authentication application 109)).
Guillory does not disclose:
receive, from the computing device, an authentication challenge issued by an authentication service
Ligatti teaches:
receive, from the computing device, an authentication challenge issued by an authentication service(Ligatti, Col. 17, lines 51-58, The verifying client device 105B sends a response 630 back to the authenticator computing device 103. If the authenticator computing device 103 determines that the response 630 is valid for the issued authentication challenge 620, the authenticator computing device 103 grants the requesting client device 105A access 635 to the resource.);
Guillory and Ligatti do not disclose:
exchanging cryptographic data with the computing device over the local wireless communication, wherein the cryptographic data is used by the mobile device to validate the computing device;
Steffey teaches:
exchanging cryptographic data with the computing device over the local wireless communication, wherein the cryptographic data is used by the mobile device to validate the computing device(Steffey, [0036-0037]The validation unit 120 may validate a vehicle terminal inverse certificate received from the user terminal 300 in exchange for the user terminal inverse certificate. According to embodiments, the validation unit 120 may validate the received vehicle terminal inverse certificate using the vehicle terminal private key. Furthermore, according to embodiments, the validation unit 120 may obtain a user terminal public key through decryption of the received vehicle terminal inverse certificate. The validation unit 120 may receive a server public key from the authority server 200 through the communication unit 150 during setup of a telematics service on the vehicle terminal 100…).
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Guillory and Ligatti’s methods and systems for user authentication by enhancing Guillory and Ligatti’s authentication challenge by enhancing and validating the computing device within the cryptographic information to communicate security information to a user entering content into the device as taught by Steffey in order to improve the security of proximity based device pairing and prevent impersonation attacks.
The motivation is to ensure that the mobile device can verify the authenticity of the computing device before establishing a trusted wireless connection, thereby preventing spoofing or impersonation. Furthermore, the vehicle terminal 100 may transmit an encrypted message requesting the user terminal inverse certificate to the authority server 200 for security[Steffey, 0025].
Guillory in view of Ligatti in further view of Steffey do not disclose:
a mobile device comprising: a local wireless communication interface
Kehr teaches:
a mobile device comprising: a local wireless communication interface(Kehr, [0018], The client 105 generally may include any device, system, and/or piece of code that relies on another service to perform an operation and that communicates using a wired or wireless communication path.);
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Guillory in view of Ligatti’s system and methods for authentication using multiple devices by enhancing Guillorys in view of Ligatti’s authentication challenge by enhancing and validating the computing device within the cryptographic information as taught by Kehr in order to protect sensitive data and gain security from exposure while transmitting an authentication challenge from the computing and mobile device over a wireless connection.
The motivation is to provide several security benefits by reducing exposure, external threats and utilizing local wireless technologies within the authentication process which can be both secure and efficient while the wireless connection allows authentication to occur even when the devices are connected within the network.
Regarding Claim 38:
The system of claim 37, Guillory in view of Ligatti in further view of Steffey in further view of Kehr teaches wherein the stored instructions are further configured to: transmit the signed authentication challenge to the computing device over the local wireless communication(Ligatti, Col. 11, lines 13-20, The authentication application on the smart ring can automatically transmit the authentication challenge data received in the smart ring to the authenticator computing device 103. Alternatively, the smart ring can transmit a signed version of the authentication challenge data to the smart phone, which then forwards the signed authentication challenge data to the authenticator computing device 103.),
wherein the signed authentication challenge is transmitted from the computing device to the authentication service(Ligatti, Col. 11, lines 13-20, The authentication application on the smart ring can automatically transmit the authentication challenge data received in the smart ring to the authenticator computing device 103. Alternatively, the smart ring can transmit a signed version of the authentication challenge data to the smart phone, which then forwards the signed authentication challenge data to the authenticator computing device 103).
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Guillory’s methods and systems for user authentication by enhancing Guillory’s authentication challenge by enhancing and validating the computing device within the cryptographic information as taught by Ligatti in order validate and transmit the signed mobile challenge to enhance security systems.
The motivation is to ensure the security mechanisms process helps ensure the mobile device is secure and prevents attacks within the signing process.
Regarding Claim 39:
The system of claim 37, Guillory in view of Ligatti in further view of Steffey in further view of Kehr teaches wherein to exchange cryptographic data with the computing device over the local wireless communication includes to: transmit a mobile challenge from the mobile device to the computing device(Guillory, [0002],The most common way to authenticate a user for access to a digital service is to use a login and a password that the user has to enter every time he opens a session. The user authentication involves a user entering the user's login and password on a user device, which is then transmitted over a communication network to a server. [0019], Computing device 102 further includes an authentication application 109 (also referred to as automatic authentication application).);
sign the mobile challenge at the computing device(Ligatti, Col. 11, lines 16-20, Alternatively, the smart ring can transmit a signed version of the authentication challenge data to the smart phone, which then forwards the signed authentication challenge data to the authenticator computing device 103. );
transmit the signed mobile challenge from the computing device to the mobile device(Ligatti, Col. 11, lines 13-20, The authentication application on the smart ring can automatically transmit the authentication challenge data received in the smart ring to the authenticator computing device 103. Alternatively, the smart ring can transmit a signed version of the authentication challenge data to the smart phone, which then forwards the signed authentication challenge data to the authenticator computing device 103.);
and validate the signed mobile challenge at the mobile device(Ligatti, Col. 11, lines 13-20, The authentication application on the smart ring can automatically transmit the authentication challenge data received in the smart ring to the authenticator computing device 103. Alternatively, the smart ring can transmit a signed version of the authentication challenge data to the smart phone, which then forwards the signed authentication challenge data to the authenticator computing device 103.).
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Guillory’s methods and systems for user authentication by enhancing Guillory’s authentication challenge by enhancing and validating the computing device within the cryptographic information as taught by Ligatti in order validate and transmit the signed mobile challenge to enhance security systems.
The motivation is to ensure the security mechanisms process helps ensure the mobile device is secure and prevents attacks within the signing process.
Regarding Claim 40:
The system of claim 39, Guillory in view of Ligatti in further view of Steffey further view of Kehr teaches wherein the mobile challenge is signed by the computing device with a private key of a public-private key pair(Guillory, [0038], Authentication application 109 is operative to access the private key from key database 112. Authentication application 109 is then operative to resolve the challenge using the private key. For example, authentication application 109 is operative to solve the challenge programmatically without further input from the user 110. For example, the challenge is solved by signing the challenge data with the private key of the public/private pair);
and wherein mobile device validates the signed mobile challenge using a public key of the public-private key pair(Guillory, [0041], The webpage backend then is operative to retrieve the public key of the public/private key pair for the user and the associated web service from public key database 114. The webpage backend is then operative to verify the challenge response. In some examples, the webpage backend is operative to verify the challenge response using a combination of challenge response, the public key, and the challenge. For example, server authentication application 116 may use the public key to verify the signature in the challenge response. Server authentication application 116 can verify the signature using the one or more algorithms used to sign the challenge response.).
Claims are 41 are rejected under 35 U.S.C. 103 as being unpatentable over Guillory(US Publication No. 2018/0183777 A1) in view of Ligatti (US Patent No. 9659160 B2) in further view of Steffey(US Publication No. 2016/0277923 A1) in further view of Matsuoka(US Patent No. 9107075 B1)
Regarding Claim 41:
Guillory in view of Ligatti in further view of Steffey disclose:
The method of claim 26…
Guillory in view of Ligatti in further view of Steffey do not disclose:
Matsuoka discloses:
further comprising: in response to determining disconnection of a connection between the mobile device and the computing device, terminating access to the secure application at the computing device(Matsuoka, When the computer 120 determines that the mobile device 110 is no longer in close proximity to the mobile device 110, the computer 120 may automatically log out of the user account. For example, the computer 120 may determine that the mobile device 110 is no longer is in close proximity to the computer 120 when the signal strength from the mobile device 110 drops below a threshold or the computer 120 losses communication with the mobile device 110).
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Guillory in view of Ligatti in further view of Steffey’s system and methods for authentication using multiple devices by enhancing Guillorys in view of Ligatti in further view of Steffey’s authentication challenge by enhancing and validating the computing device within the cryptographic information as taught by Matsuoka is to ensure continuous verification of user presence and to revoke secure access the moment the trusted mobile device is no longer detected.
The motivation is to ensure that secure application access is automatically revoked when the authenticated mobile device is not longer present, thereby preventing unauthorized users from exploiting an unattended computing device or an abandoned authenticated session.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MAYASA SHAAWAT whose telephone number is (571)272-3939. The examiner can normally be reached on M-F, 8 AM TO 5 PM.
If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, JEFFREY PWU can be reached on (571)272-6789. The fax phone number for the organization where this application