DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Status of Claims
The following is a final office action.
Claims [1-20] are currently pending and have been examined based on their merits.
Claims 1, 11, and 16 are currently amended see REMARKS May 11, 2026.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to a judicial exception that is an abstract idea without a practical application or significantly more.
Step 1: Claims 1-10 recite a system, claims 11-15 recite a method (i.e. a process such as an act or series of steps), and claims 16-20 recite a hardware memory device and therefore each claim falls within one of the four statutory categories.
Step 2A prong 1 (Is a judicial exception recited?):
The representative claims 1 recite: receive a message from a supplier, wherein the message identifies a device; and in response to verification of an identity of the device against a Purchase Order (PO) of an Original Equipment Manufacturer (OEM), send encrypted material to the supplier, wherein the supplier is configured to generate a Certificate Signing Request (CSR) comprising the encrypted material; and after the device has been shipped form the supplier and deployed into service, verify an authenticity of the device using the CSR, the authenticity confirming that the device is uniquely associated with the purchase order.
Claim 11: A method, comprising: receiving a message from a supplier, wherein the message identifies a device; and in response to verification of the device against a Purchase Order (PO) of an Original Equipment Manufacturer (OEM), transmitting an OEM’s digital certificate to the supplier, wherein the supplier is configured to generate a Certificate Signing Request (CSR) for the device comprising the OEM’s digital certificate; and after the device has been shipped form the supplier and deployed into service, verify an authenticity of the device using the CSR, the authenticity confirming that the device is uniquely associated with the purchase order.
Claim 16: send a message to an OEM, wherein the message identifies a device; and receive encrypted material from an Original Equipment Manufacturer (OEM) in response to the OEM’s verification of the device against a Purchase Order (PO); and after the device has been shipped form the supplier and deployed into service, verify an authenticity of the device using the CSR, the authenticity confirming that the device is uniquely associated with the purchase order.
The claims recite a certain method of organizing human activity. The claims recite a certain method of organizing human activity as the disclosure recites managing personal behavior or relationships or interactions between people. The claims simply recite a series of steps to send a message from an entity such as a supplier to identify a device or item, verify the item against a records such as a purchase order, and send material in response to the verification. Merely verifying the ownership or authenticity of an item and sending information in response is a method of organizing human activity or the interactions between a supplier and a manufacturer when validating items or devices.
Alternatively, the claims recite a mental process. The claims merely recite the process of verifying a device or item against a record such as a purchase order and sending data or material to a user in response to the verification. The claims are found to merely recite a mental process as receiving and verifying information such as comparing an identifier for a device to the records of a purchase order and validating the device can be performed in the human mind or with the use of a simple tool such as pen and paper. The claimed invention is found to be similar to concepts the courts have defined as a mental process including observations, evaluations, judgements, and opinions. As a person would be capable of mentally receiving a message from a supplier including identifier information and compare that information to a purchase order to verify the information and respond with additional information.
Therefore, the claims are found to recite an abstract idea.
Step 2A Prong 2 (Is the exception integrated into a practical application?): The claims additionally recite additional elements, including;
Claim 1: An Information Handling System (IHS), comprising: a processor; and a memory coupled to the processor, the memory having program instructions stored thereon; a Purchase Order (PO) database; and a device.
Claim 11: a Purchase Order (PO) database and a device.
Claim 16: A hardware memory device having program instructions stored thereon that, upon execution by a processor of an Information Handling System (IHS); a Purchase Order (PO) database; and a device.
The additional elements of generic computer elements such as a processor and a database are directed to merely reciting instructions to apply a generic computer and technology to execute the method in the recited claim limitations.
Therefore, the limitations merely amount to adding the words “apply it” (or an equivalent) to the judicial exception, or mere instructions to implement an abstract idea on a computer, or merely uses a computer as a tool to perform an abstract idea, as discussed in MPEP 2106.05(f). Furthermore, a method for transmitting, receiving, and processing information does not amount to improvements to the functioning of a computer, or to any other technology or technical field, as discussed in MPEP 2106.05(a), applying the judicial exception with, or by use of, a particular machine, as discussed in MPEP 2106.05(b), effecting a transformation or reduction of a particular article to a different state or thing, as discussed in MPEP 2106.05(c), or applying or using the judicial exception in some other meaningful way beyond generally linking the use of the judicial exception to a particular technological environment, such that the claim as a whole is more than a drafting effort designed to monopolize the exception, as discussed in MPEP 2106.05(e).
Accordingly, the additional elements do not integrate the abstract idea into a practical application because they do not impose any meaningful limits on practicing the abstract idea. As the additional elements are not significant improvements to the functionality of a generic computer and are directed to merely “apply it” or applying the abstract idea on a computer.
Step 2B (Does the claim recite additional elements that amount to significantly more than the judicial exception?):
As discussed above, the additional imitations amount to adding the words “apply it” (or an equivalent) with the judicial exception, or mere instructions to implement an abstract idea on a computer, and merely uses a computer as a tool to perform an abstract idea of receiving and validating information and sending a response, as discussed in MPEP 2106.05(f). The additional elements of generic computer elements are not directed to an improvement in a technology or technical field. Therefore, the additional elements do not amount to significantly more than the judicial exception.
The dependent claims 2-10, 12-15, and 17-18 further narrow the abstract idea of verifying the received information from a supplier and sending encrypted material in response as recited in the independent claims 1, 11, and 16.
The dependent claims recite the following additional elements:
Claim 19: wherein the processor is part of a heterogenous computing platform selected from the group consisting of: a System-On-Chip (SoC), a Field-Programmable Gate Array (FPGA), and an Application-Specific Integrated Circuit (ASIC).
Claim 20: wherein the heterogenous computing platform comprises a Reduced Instruction Set Computer (RISC) processor coupled to the EC via an interconnect, and wherein the interconnect comprises at least one of: an Advanced Microcontroller Bus Architecture (AMBA) bus, a QuickPath Interconnect (QPI) bus, or a HyperTransport (HT) bus.
However, the additional elements are directed to merely “apply it” or applying generic computer elements to perform the abstract idea.
Therefore, claims 1-20 are rejected under 35 U.S.C. 101.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966), that are applied for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Dellow (US 2014/0090078) in view of Britt (US 2015/0356278) further in view of Vikas (US 2019/0108482).
Claim 1: Dellow discloses an Information Handling System (IHS), comprising: a processor; and a memory coupled to the processor, the memory having program instructions stored thereon that, upon execution, cause the IHS to: receive a message from a supplier, wherein the message identifies a device (Paragraph [0011-0013]; [0027-0028]; [0030-0031]; Fig. 6, methods, devices, systems, and computer program products are provided to facilitate cryptographically secure retrieval of secrete information that is embedded in a device. Upon receiving a request for the embedded secret information, an encrypted secret is provided to the requestor that enables the recovery of the embedded information by only the requestor. The disclosed embodiments provide examples for implementing methods for facilitating the exchange of secret information that resides in a device, such as a chip, system-on chip, and the like. Another set of operations can be carried out to securely provide secret information associated with a device. For example, one or more components of the device that comprise a security system outside of the device manufacturing facility. A message that includes a signed public key and a requester ID is received from a requestor. Next, the public key is verified, and if the determination indicates that the public key is not valid a reset operation is initiated. If the determination indicates a valid public key, the operation continue to determine if the secret information has not been previously exported to the requesting entity. If not a derived secret is created using the requester ID and secret embedded information. The derived secret is encrypted. The encrypted secret is further signed. The signed and encrypted derived secret is outputted. The device is marked to indicate that the embedded secret information has been exported to the particular requestor);
in response to verification of an identity of the device, send encrypted material to the supplier, wherein the supplier is configured to generate a Certificate Signing Request (CSR) for the device comprising the encrypted material (Paragraph [0011-0013]; [0027-0028]; [0030-0031]; Fig. 6, methods, devices, systems, and computer program products are provided to facilitate cryptographically secure retrieval of secrete information that is embedded in a device. Upon receiving a request for the embedded secret information, an encrypted secret is provided to the requestor that enables the recovery of the embedded information by only the requestor. The disclosed embodiments provide examples for implementing methods for facilitating the exchange of secret information that resides in a device, such as a chip, system-on chip, and the like. Another set of operations can be carried out to securely provide secret information associated with a device. For example, one or more components of the device that comprise a security system outside of the device manufacturing facility. A message that includes a signed public key and a requester ID is received from a requestor. Next, the public key is verified, and if the determination indicates that the public key is not valid a reset operation is initiated. If the determination indicates a valid public key, the operation continue to determine if the secret information has not been previously exported to the requesting entity. If not a derived secret is created using the requester ID and secret embedded information. The derived secret is encrypted. The encrypted secret is further signed. The signed and encrypted derived secret is outputted. The device is marked to indicate that the embedded secret information has been exported to the particular requestor).
Dellow discloses a system for delivering encrypted device secret information to a requestor based on a verification process. However, Dellow does not disclose the following claim limitations: in response to verification of an identity of the device against a purchase order stored in a Purchase Order (PO) database of an Original Equipment Manufacturer (OEM); and after the device has been shipped from the supplier and deployed into service, verify an authenticity of the device using the CSR, the authenticity confirming that the device is uniquely associated with the purchase order.
In the same field of endeavor of delivering secret information based on verifying ownership of a product Britt teaches in response to verification of an identity of the device against a purchase order stored in a Purchase Order (PO) database of an Original Equipment Manufacturer (OEM) (Paragraph [0005-0006]; [0027]; [0039]; [0112-0113]; Fig. 3A, systems for delivering content from an internet-connected hosted server system to various client computing devices. The systems described here permit a user to obtain cloud-based access to content that the user has purchased and which she possess in physical form e.g. a CD. To implement such access the physical version of the content in the form of a physical item may be encoded with a unique identifier and an owner of the item can capture the unique identifier. Such capture may occur by exposing the physical item to an electronic device which can read the identifier. The identifying information may then be sent to a networked content previsioning system along with information that identifies the topic of the content. The identification information may include information that identifies the user, such as a user account number, and also information that identifies the particular media item. Information identifying the particular media item may include for example, a unique identifying number that has been encoded in an NFC chip and may additionally include an image of the item captured by a camera, where the image may include graphics from the item for verification by the registration server that may resolve the barcode into metadata that describes the item).
Before the effective filing date of the invention it would have been obvious to one of ordinary skill in the art to modify the system of verifying the ownership of a device and requesting encrypted information based on the identity of the owner and device as disclosed by Dellow with the system of and in response to verification of the device against a Purchase Order (PO) database of an Original Equipment Manufacturer (OEM) as taught by Britt (Britt [0005]). With the motivation of helping to securely disseminate information to verified entities (Britt [0004]).
In the same field of endeavor of verifying a product Vikas teaches and after the device has been shipped from the supplier and deployed into service, verify an authenticity of the device using the CSR, the authenticity confirming that the device is uniquely associated with the purchase order (Paragraph [0016-0017]; [0062]; [0069-0073]; a distributed ledger replicates and distributes data (transactions, files, or information) across multiple sites or institutions. This technology allows each party in the network to access and own an identical copy of the record and any changes or additions. In an example embodiment, a supplier application may include software application for handling supplier-side operations. A purchaser submits a purchase order for raw material from a supplier. When a raw material (or a good) is transferred any required documentation are obtained and recorded in a blockchain. For example, the supplier application call one or more API’s of the blockchain service to write the documentation of the blockchain. The documentation can then be verified on the blockchain. When finished goods are delivered to the purchaser, the stock is updated. When finished goods are sold to a customer, the ownership transfer is recorded in the blockchain. A verifying authority can verify any documentation recorded in the blockchain including a certificate of origin).
Before the effective filing date of the invention it would have been obvious to one of ordinary skill in the art to modify the system of verifying the ownership of a device and requesting encrypted information based on the identity of the owner and device as disclosed by Dellow with the system of and after the device has been shipped from the supplier and deployed into service, verify an authenticity of the device using the CSR, the authenticity confirming that the device is uniquely associated with the purchase order as taught by Vikas (Vikas [0016]). With the motivation of helping to authenticate a product
Claim 2: Modified Dellow discloses the IHS as per claim 1. Dellow further discloses wherein to verify the device against the PO database, the program instructions, upon execution, further cause the IHS to determine the device has not been previously processed (Paragraph [0011-0013]; [0027-0028]; [0030-0031]; Fig. 6, methods, devices, systems, and computer program products are provided to facilitate cryptographically secure retrieval of secrete information that is embedded in a device. Upon receiving a request for the embedded secret information, an encrypted secret is provided to the requestor that enables the recovery of the embedded information by only the requestor. The disclosed embodiments provide examples for implementing methods for facilitating the exchange of secret information that resides in a device, such as a chip, system-on chip, and the like. Another set of operations can be carried out to securely provide secret information associated with a device. For example, one or more components of the device that comprise a security system outside of the device manufacturing facility. A message that includes a signed public key and a requester ID is received from a requestor. Next, the public key is verified, and if the determination indicates that the public key is not valid a reset operation is initiated. If the determination indicates a valid public key, the operation continue to determine if the secret information has not been previously exported to the requesting entity. If not a derived secret is created using the requester ID and secret embedded information. The derived secret is encrypted. The encrypted secret is further signed. The signed and encrypted derived secret is outputted. The device is marked to indicate that the embedded secret information has been exported to the particular requestor).
Claim 3: Modified Dellow discloses the IHS as per claim 1. However, Dellow does not disclose wherein the encrypted material comprises at least one of: a device serial number, a model number, or a PO number.
In the same field of endeavor of delivering secret information based on verifying ownership of a product Britt teaches wherein the encrypted material comprises at least one of: a device serial number, a model number, or a PO number (Paragraph [0005-0006]; [0027]; [0039]; [0112-0113]; Fig. 3A, systems for delivering content from an internet-connected hosted server system to various client computing devices. The systems described here permit a user to obtain cloud-based access to content that the user has purchased and which she possess in physical form e.g. a CD. To implement such access the physical version of the content in the form of a physical item may be encoded with a unique identifier and an owner of the item can capture the unique identifier. Such capture may occur by exposing the physical item to an electronic device which can read the identifier. The identifying information may then be sent to a networked content previsioning system along with information that identifies the topic of the content. The identification information may include information that identifies the user, such as a user account number, and also information that identifies the particular media item. Information identifying the particular media item may include for example, a unique identifying number that has been encoded in an NFC chip and may additionally include an image of the item captured by a camera, where the image may include graphics from the item for verification by the registration server that may resolve the barcode into metadata that describes the item).
Before the effective filing date of the invention it would have been obvious to one of ordinary skill in the art to modify the system of verifying the ownership of a device and requesting encrypted information based on the identity of the owner and device as disclosed by Dellow with the system of and in response to verification of the device against a Purchase Order (PO) database of an Original Equipment Manufacturer (OEM) as taught by Britt (Britt [0005]). With the motivation of helping to securely disseminate information to verified entities (Britt [0004]).
Claim 4: Modified Dellow discloses the IHS as per claim 1. Dellow further discloses wherein the supplier is configured to receive a digital certificate in response to the CSR (Paragraph [0011-0013]; [0027-0028]; [0030-0031]; Fig. 6, methods, devices, systems, and computer program products are provided to facilitate cryptographically secure retrieval of secrete information that is embedded in a device. Upon receiving a request for the embedded secret information, an encrypted secret is provided to the requestor that enables the recovery of the embedded information by only the requestor. The disclosed embodiments provide examples for implementing methods for facilitating the exchange of secret information that resides in a device, such as a chip, system-on chip, and the like. Another set of operations can be carried out to securely provide secret information associated with a device. For example, one or more components of the device that comprise a security system outside of the device manufacturing facility. A message that includes a signed public key and a requester ID is received from a requestor. Next, the public key is verified, and if the determination indicates that the public key is not valid a reset operation is initiated. If the determination indicates a valid public key, the operation continue to determine if the secret information has not been previously exported to the requesting entity. If not a derived secret is created using the requester ID and secret embedded information. The derived secret is encrypted. The encrypted secret is further signed. The signed and encrypted derived secret is outputted. The device is marked to indicate that the embedded secret information has been exported to the particular requestor).
Claim 5: Modified Dellow discloses the IHS as per claim 1. Dellow further discloses wherein the message comprises a message ID indicating an impending digital certificate for the device (Paragraph [0011-0013]; [0027-0028]; [0030-0031]; Fig. 6, methods, devices, systems, and computer program products are provided to facilitate cryptographically secure retrieval of secrete information that is embedded in a device. Upon receiving a request for the embedded secret information, an encrypted secret is provided to the requestor that enables the recovery of the embedded information by only the requestor. The disclosed embodiments provide examples for implementing methods for facilitating the exchange of secret information that resides in a device, such as a chip, system-on chip, and the like. Another set of operations can be carried out to securely provide secret information associated with a device. For example, one or more components of the device that comprise a security system outside of the device manufacturing facility. A message that includes a signed public key and a requester ID is received from a requestor. Next, the public key is verified, and if the determination indicates that the public key is not valid a reset operation is initiated. If the determination indicates a valid public key, the operation continue to determine if the secret information has not been previously exported to the requesting entity. If not a derived secret is created using the requester ID and secret embedded information. The derived secret is encrypted. The encrypted secret is further signed. The signed and encrypted derived secret is outputted. The device is marked to indicate that the embedded secret information has been exported to the particular requestor).
Claim 6: Modified Dellow discloses the IHS as per claim 5. However, Dellow does not disclose wherein attestation of the digital certificate indicates the device was made for the OEM.
In the same field of endeavor of delivering secret information based on verifying ownership of a product Britt teaches wherein attestation of the digital certificate indicates the device was made for the OEM (Paragraph [0005-0006]; [0027]; [0039]; [0112-0113]; Fig. 3A, systems for delivering content from an internet-connected hosted server system to various client computing devices. The systems described here permit a user to obtain cloud-based access to content that the user has purchased and which she possess in physical form e.g. a CD. To implement such access the physical version of the content in the form of a physical item may be encoded with a unique identifier and an owner of the item can capture the unique identifier. Such capture may occur by exposing the physical item to an electronic device which can read the identifier. The identifying information may then be sent to a networked content previsioning system along with information that identifies the topic of the content. The identification information may include information that identifies the user, such as a user account number, and also information that identifies the particular media item. Information identifying the particular media item may include for example, a unique identifying number that has been encoded in an NFC chip and may additionally include an image of the item captured by a camera, where the image may include graphics from the item for verification by the registration server that may resolve the barcode into metadata that describes the item).
Before the effective filing date of the invention it would have been obvious to one of ordinary skill in the art to modify the system of verifying the ownership of a device and requesting encrypted information based on the identity of the owner and device as disclosed by Dellow with the system of and in response to verification of the device against a Purchase Order (PO) database of an Original Equipment Manufacturer (OEM) as taught by Britt (Britt [0005]). With the motivation of helping to securely disseminate information to verified entities (Britt [0004]).
Claim 7: Modified Dellow discloses the IHS as per claim 5. However, Dellow does not disclose wherein attestation of the digital certificate indicates the device was made for a customer of the OEM.
In the same field of endeavor of delivering secret information based on verifying ownership of a product Britt teaches wherein attestation of the digital certificate indicates the device was made for a customer of the OEM (Paragraph [0005-0006]; [0027]; [0039]; [0112-0113]; Fig. 3A, systems for delivering content from an internet-connected hosted server system to various client computing devices. The systems described here permit a user to obtain cloud-based access to content that the user has purchased and which she possess in physical form e.g. a CD. To implement such access the physical version of the content in the form of a physical item may be encoded with a unique identifier and an owner of the item can capture the unique identifier. Such capture may occur by exposing the physical item to an electronic device which can read the identifier. The identifying information may then be sent to a networked content previsioning system along with information that identifies the topic of the content. The identification information may include information that identifies the user, such as a user account number, and also information that identifies the particular media item. Information identifying the particular media item may include for example, a unique identifying number that has been encoded in an NFC chip and may additionally include an image of the item captured by a camera, where the image may include graphics from the item for verification by the registration server that may resolve the barcode into metadata that describes the item).
Before the effective filing date of the invention it would have been obvious to one of ordinary skill in the art to modify the system of verifying the ownership of a device and requesting encrypted information based on the identity of the owner and device as disclosed by Dellow with the system of and in response to verification of the device against a Purchase Order (PO) database of an Original Equipment Manufacturer (OEM) as taught by Britt (Britt [0005]). With the motivation of helping to securely disseminate information to verified entities (Britt [0004]).
Claim 8: Modified Dellow discloses the IHS as per claim 5. Dellow further discloses wherein the digital certificate comprises a Security Protocol and Data Model (SPDM) certificate (Paragraph [0011-0013]; [0027-0028]; [0030-0031]; Fig. 6, methods, devices, systems, and computer program products are provided to facilitate cryptographically secure retrieval of secrete information that is embedded in a device. Upon receiving a request for the embedded secret information, an encrypted secret is provided to the requestor that enables the recovery of the embedded information by only the requestor. The disclosed embodiments provide examples for implementing methods for facilitating the exchange of secret information that resides in a device, such as a chip, system-on chip, and the like. Another set of operations can be carried out to securely provide secret information associated with a device. For example, one or more components of the device that comprise a security system outside of the device manufacturing facility. A message that includes a signed public key and a requester ID is received from a requestor. Next, the public key is verified, and if the determination indicates that the public key is not valid a reset operation is initiated. If the determination indicates a valid public key, the operation continue to determine if the secret information has not been previously exported to the requesting entity. If not a derived secret is created using the requester ID and secret embedded information. The derived secret is encrypted. The encrypted secret is further signed. The signed and encrypted derived secret is outputted. The device is marked to indicate that the embedded secret information has been exported to the particular requestor).
Claim 9: Modified Dellow discloses the IHS as per claim 8. Dellow further discloses wherein the supplier is configured to store the SPDM certificate in slot 0 of the device (Paragraph [0011-0013]; [0027-0028]; [0030-0031]; Fig. 6, methods, devices, systems, and computer program products are provided to facilitate cryptographically secure retrieval of secrete information that is embedded in a device. Upon receiving a request for the embedded secret information, an encrypted secret is provided to the requestor that enables the recovery of the embedded information by only the requestor. The disclosed embodiments provide examples for implementing methods for facilitating the exchange of secret information that resides in a device, such as a chip, system-on chip, and the like. Another set of operations can be carried out to securely provide secret information associated with a device. For example, one or more components of the device that comprise a security system outside of the device manufacturing facility. A message that includes a signed public key and a requester ID is received from a requestor. Next, the public key is verified, and if the determination indicates that the public key is not valid a reset operation is initiated. If the determination indicates a valid public key, the operation continue to determine if the secret information has not been previously exported to the requesting entity. If not a derived secret is created using the requester ID and secret embedded information. The derived secret is encrypted. The encrypted secret is further signed. The signed and encrypted derived secret is outputted. The device is marked to indicate that the embedded secret information has been exported to the particular requestor).
Claim 10: Modified Dellow discloses the IHS as per claim 1. Dellow further discloses wherein the supplier comprises a first supplier and a second supplier, the first supplier produces the device, the second supplier produces a device part, the first supplier is configured to forward the encrypted blob to the second supplier, and the second supplier is configured to generate another CSR for the part (Paragraph [0011-0013]; [0027-0028]; [0030-0031]; Fig. 6, methods, devices, systems, and computer program products are provided to facilitate cryptographically secure retrieval of secrete information that is embedded in a device. Upon receiving a request for the embedded secret information, an encrypted secret is provided to the requestor that enables the recovery of the embedded information by only the requestor. The disclosed embodiments provide examples for implementing methods for facilitating the exchange of secret information that resides in a device, such as a chip, system-on chip, and the like. Another set of operations can be carried out to securely provide secret information associated with a device. For example, one or more components of the device that comprise a security system outside of the device manufacturing facility. A message that includes a signed public key and a requester ID is received from a requestor. Next, the public key is verified, and if the determination indicates that the public key is not valid a reset operation is initiated. If the determination indicates a valid public key, the operation continue to determine if the secret information has not been previously exported to the requesting entity. If not a derived secret is created using the requester ID and secret embedded information. The derived secret is encrypted. The encrypted secret is further signed. The signed and encrypted derived secret is outputted. The device is marked to indicate that the embedded secret information has been exported to the particular requestor).
Claim 11: Dellow discloses a method, comprising: receiving a message from a supplier, wherein the message identifies a device (Paragraph [0011-0013]; [0027-0028]; [0030-0031]; Fig. 6, methods, devices, systems, and computer program products are provided to facilitate cryptographically secure retrieval of secrete information that is embedded in a device. Upon receiving a request for the embedded secret information, an encrypted secret is provided to the requestor that enables the recovery of the embedded information by only the requestor. The disclosed embodiments provide examples for implementing methods for facilitating the exchange of secret information that resides in a device, such as a chip, system-on chip, and the like. Another set of operations can be carried out to securely provide secret information associated with a device. For example, one or more components of the device that comprise a security system outside of the device manufacturing facility. A message that includes a signed public key and a requester ID is received from a requestor. Next, the public key is verified, and if the determination indicates that the public key is not valid a reset operation is initiated. If the determination indicates a valid public key, the operation continue to determine if the secret information has not been previously exported to the requesting entity. If not a derived secret is created using the requester ID and secret embedded information. The derived secret is encrypted. The encrypted secret is further signed. The signed and encrypted derived secret is outputted. The device is marked to indicate that the embedded secret information has been exported to the particular requestor);
transmitting an OEM’s digital certificate to the supplier, wherein the supplier is configured to generate a Certificate Signing Request (CSR) for the device comprising the OEM’s digital certificate (Paragraph [0011-0013]; [0027-0028]; [0030-0031]; Fig. 6, methods, devices, systems, and computer program products are provided to facilitate cryptographically secure retrieval of secrete information that is embedded in a device. Upon receiving a request for the embedded secret information, an encrypted secret is provided to the requestor that enables the recovery of the embedded information by only the requestor. The disclosed embodiments provide examples for implementing methods for facilitating the exchange of secret information that resides in a device, such as a chip, system-on chip, and the like. Another set of operations can be carried out to securely provide secret information associated with a device. For example, one or more components of the device that comprise a security system outside of the device manufacturing facility. A message that includes a signed public key and a requester ID is received from a requestor. Next, the public key is verified, and if the determination indicates that the public key is not valid a reset operation is initiated. If the determination indicates a valid public key, the operation continue to determine if the secret information has not been previously exported to the requesting entity. If not a derived secret is created using the requester ID and secret embedded information. The derived secret is encrypted. The encrypted secret is further signed. The signed and encrypted derived secret is outputted. The device is marked to indicate that the embedded secret information has been exported to the particular requestor).
Dellow discloses a system for delivering encrypted device secret information to a requestor based on a verification process. However, Dellow does not disclose the following claim limitations: and in response to verification of the device against a Purchase Order (PO) database of an Original Equipment Manufacturer (OEM).
In the same field of endeavor of delivering secret information based on verifying ownership of a product Britt teaches and in response to verification of the device against a Purchase Order (PO) database of an Original Equipment Manufacturer (OEM) (Paragraph [0005-0006]; [0027]; [0039]; [0112-0113]; Fig. 3A, systems for delivering content from an internet-connected hosted server system to various client computing devices. The systems described here permit a user to obtain cloud-based access to content that the user has purchased and which she possess in physical form e.g. a CD. To implement such access the physical version of the content in the form of a physical item may be encoded with a unique identifier and an owner of the item can capture the unique identifier. Such capture may occur by exposing the physical item to an electronic device which can read the identifier. The identifying information may then be sent to a networked content previsioning system along with information that identifies the topic of the content. The identification information may include information that identifies the user, such as a user account number, and also information that identifies the particular media item. Information identifying the particular media item may include for example, a unique identifying number that has been encoded in an NFC chip and may additionally include an image of the item captured by a camera, where the image may include graphics from the item for verification by the registration server that may resolve the barcode into metadata that describes the item).
Before the effective filing date of the invention it would have been obvious to one of ordinary skill in the art to modify the system of verifying the ownership of a device and requesting encrypted information based on the identity of the owner and device as disclosed by Dellow with the system of and in response to verification of the device against a Purchase Order (PO) database of an Original Equipment Manufacturer (OEM) as taught by Britt (Britt [0005]). With the motivation of helping to securely disseminate information to verified entities (Britt [0004]).
Claim 12: Modified Dellow discloses the method as per claim 11. Dellow further discloses wherein the message comprises a message ID indicating an impending Security Protocol and Data Model (SPDM) certificate for the device (Paragraph [0011-0013]; [0027-0028]; [0030-0031]; Fig. 6, methods, devices, systems, and computer program products are provided to facilitate cryptographically secure retrieval of secrete information that is embedded in a device. Upon receiving a request for the embedded secret information, an encrypted secret is provided to the requestor that enables the recovery of the embedded information by only the requestor. The disclosed embodiments provide examples for implementing methods for facilitating the exchange of secret information that resides in a device, such as a chip, system-on chip, and the like. Another set of operations can be carried out to securely provide secret information associated with a device. For example, one or more components of the device that comprise a security system outside of the device manufacturing facility. A message that includes a signed public key and a requester ID is received from a requestor. Next, the public key is verified, and if the determination indicates that the public key is not valid a reset operation is initiated. If the determination indicates a valid public key, the operation continue to determine if the secret information has not been previously exported to the requesting entity. If not a derived secret is created using the requester ID and secret embedded information. The derived secret is encrypted. The encrypted secret is further signed. The signed and encrypted derived secret is outputted. The device is marked to indicate that the embedded secret information has been exported to the particular requestor).
Claim 13: Modified Dellow discloses the method as per claim 11. However, Dellow does not disclose wherein the digital certificate comprises at least one of: a device serial number, a model number, or a PO number.
In the same field of endeavor of delivering secret information based on verifying ownership of a product Britt teaches wherein the digital certificate comprises at least one of: a device serial number, a model number, or a PO number (Paragraph [0005-0006]; [0027]; [0039]; [0112-0113]; Fig. 3A, systems for delivering content from an internet-connected hosted server system to various client computing devices. The systems described here permit a user to obtain cloud-based access to content that the user has purchased and which she possess in physical form e.g. a CD. To implement such access the physical version of the content in the form of a physical item may be encoded with a unique identifier and an owner of the item can capture the unique identifier. Such capture may occur by exposing the physical item to an electronic device which can read the identifier. The identifying information may then be sent to a networked content previsioning system along with information that identifies the topic of the content. The identification information may include information that identifies the user, such as a user account number, and also information that identifies the particular media item. Information identifying the particular media item may include for example, a unique identifying number that has been encoded in an NFC chip and may additionally include an image of the item captured by a camera, where the image may include graphics from the item for verification by the registration server that may resolve the barcode into metadata that describes the item).
Before the effective filing date of the invention it would have been obvious to one of ordinary skill in the art to modify the system of verifying the ownership of a device and requesting encrypted information based on the identity of the owner and device as disclosed by Dellow with the system of and in response to verification of the device against a Purchase Order (PO) database of an Original Equipment Manufacturer (OEM) as taught by Britt (Britt [0005]). With the motivation of helping to securely disseminate information to verified entities (Britt [0004]).
Claim 14: Modified Dellow discloses the method as per claim 11. Dellow further discloses wherein the supplier is configured to receive a device’s digital certificate in response to the CSR (Paragraph [0011-0013]; [0027-0028]; [0030-0031]; Fig. 6, methods, devices, systems, and computer program products are provided to facilitate cryptographically secure retrieval of secrete information that is embedded in a device. Upon receiving a request for the embedded secret information, an encrypted secret is provided to the requestor that enables the recovery of the embedded information by only the requestor. The disclosed embodiments provide examples for implementing methods for facilitating the exchange of secret information that resides in a device, such as a chip, system-on chip, and the like. Another set of operations can be carried out to securely provide secret information associated with a device. For example, one or more components of the device that comprise a security system outside of the device manufacturing facility. A message that includes a signed public key and a requester ID is received from a requestor. Next, the public key is verified, and if the determination indicates that the public key is not valid a reset operation is initiated. If the determination indicates a valid public key, the operation continue to determine if the secret information has not been previously exported to the requesting entity. If not a derived secret is created using the requester ID and secret embedded information. The derived secret is encrypted. The encrypted secret is further signed. The signed and encrypted derived secret is outputted. The device is marked to indicate that the embedded secret information has been exported to the particular requestor).
Claim 15: Modified Dellow discloses the method as per claim 11. Dellow further discloses wherein the supplier is configured to store the device’s digital certificate in slot 1 of the device (Paragraph [0011-0013]; [0027-0028]; [0030-0031]; Fig. 6, methods, devices, systems, and computer program products are provided to facilitate cryptographically secure retrieval of secrete information that is embedded in a device. Upon receiving a request for the embedded secret information, an encrypted secret is provided to the requestor that enables the recovery of the embedded information by only the requestor. The disclosed embodiments provide examples for implementing methods for facilitating the exchange of secret information that resides in a device, such as a chip, system-on chip, and the like. Another set of operations can be carried out to securely provide secret information associated with a device. For example, one or more components of the device that comprise a security system outside of the device manufacturing facility. A message that includes a signed public key and a requester ID is received from a requestor. Next, the public key is verified, and if the determination indicates that the public key is not valid a reset operation is initiated. If the determination indicates a valid public key, the operation continue to determine if the secret information has not been previously exported to the requesting entity. If not a derived secret is created using the requester ID and secret embedded information. The derived secret is encrypted. The encrypted secret is further signed. The signed and encrypted derived secret is outputted. The device is marked to indicate that the embedded secret information has been exported to the particular requestor).
Claim 16: Dellow discloses a hardware memory device having program instructions stored thereon that, upon execution by a processor of an Information Handling System (IHS), cause the IHS to: send a message to an OEM, wherein the message identifies a device (Paragraph [0011-0013]; [0027-0028]; [0030-0031]; Fig. 6, methods, devices, systems, and computer program products are provided to facilitate cryptographically secure retrieval of secrete information that is embedded in a device. Upon receiving a request for the embedded secret information, an encrypted secret is provided to the requestor that enables the recovery of the embedded information by only the requestor. The disclosed embodiments provide examples for implementing methods for facilitating the exchange of secret information that resides in a device, such as a chip, system-on chip, and the like. Another set of operations can be carried out to securely provide secret information associated with a device. For example, one or more components of the device that comprise a security system outside of the device manufacturing facility. A message that includes a signed public key and a requester ID is received from a requestor. Next, the public key is verified, and if the determination indicates that the public key is not valid a reset operation is initiated. If the determination indicates a valid public key, the operation continue to determine if the secret information has not been previously exported to the requesting entity. If not a derived secret is created using the requester ID and secret embedded information. The derived secret is encrypted. The encrypted secret is further signed. The signed and encrypted derived secret is outputted. The device is marked to indicate that the embedded secret information has been exported to the particular requestor).
Dellow discloses a system for delivering encrypted device secret information to a requestor based on a verification process. However, Dellow does not disclose the following claim limitations: and receive encrypted material from an Original Equipment Manufacturer (OEM) in response to the OEM’s verification of the device against a Purchase Order (PO) database.
In the same field of endeavor of delivering secret information based on verifying ownership of a product Britt teaches and receive encrypted material from an Original Equipment Manufacturer (OEM) in response to the OEM’s verification of the device against a Purchase Order (PO) database (Paragraph [0005-0006]; [0027]; [0039]; [0112-0113]; Fig. 3A, systems for delivering content from an internet-connected hosted server system to various client computing devices. The systems described here permit a user to obtain cloud-based access to content that the user has purchased and which she possess in physical form e.g. a CD. To implement such access the physical version of the content in the form of a physical item may be encoded with a unique identifier and an owner of the item can capture the unique identifier. Such capture may occur by exposing the physical item to an electronic device which can read the identifier. The identifying information may then be sent to a networked content previsioning system along with information that identifies the topic of the content. The identification information may include information that identifies the user, such as a user account number, and also information that identifies the particular media item. Information identifying the particular media item may include for example, a unique identifying number that has been encoded in an NFC chip and may additionally include an image of the item captured by a camera, where the image may include graphics from the item for verification by the registration server that may resolve the barcode into metadata that describes the item).
Before the effective filing date of the invention it would have been obvious to one of ordinary skill in the art to modify the system of and receive encrypted material from an Original Equipment Manufacturer (OEM) in response to the OEM’s verification of the device against a Purchase Order (PO) database as taught by Britt (Britt [0005]). With the motivation of helping to securely disseminate information to verified entities (Britt [0004]).
Claim 17: Modified Dellow discloses the hardware memory device as per claim 16. Dellow further discloses wherein the encrypted material comprises a digital certificate issued by the OEM (Paragraph [0011-0013]; [0027-0028]; [0030-0031]; Fig. 6, methods, devices, systems, and computer program products are provided to facilitate cryptographically secure retrieval of secrete information that is embedded in a device. Upon receiving a request for the embedded secret information, an encrypted secret is provided to the requestor that enables the recovery of the embedded information by only the requestor. The disclosed embodiments provide examples for implementing methods for facilitating the exchange of secret information that resides in a device, such as a chip, system-on chip, and the like. Another set of operations can be carried out to securely provide secret information associated with a device. For example, one or more components of the device that comprise a security system outside of the device manufacturing facility. A message that includes a signed public key and a requester ID is received from a requestor. Next, the public key is verified, and if the determination indicates that the public key is not valid a reset operation is initiated. If the determination indicates a valid public key, the operation continue to determine if the secret information has not been previously exported to the requesting entity. If not a derived secret is created using the requester ID and secret embedded information. The derived secret is encrypted. The encrypted secret is further signed. The signed and encrypted derived secret is outputted. The device is marked to indicate that the embedded secret information has been exported to the particular requestor).
Claim 18: Modified Dellow discloses the hardware memory device as per claim 16. Dellow further discloses wherein the program instructions, upon execution by the processor, cause the IHS to generate a Certificate Signing Request (CSR) for the device comprising the encrypted material (Paragraph [0011-0013]; [0027-0028]; [0030-0031]; Fig. 6, methods, devices, systems, and computer program products are provided to facilitate cryptographically secure retrieval of secrete information that is embedded in a device. Upon receiving a request for the embedded secret information, an encrypted secret is provided to the requestor that enables the recovery of the embedded information by only the requestor. The disclosed embodiments provide examples for implementing methods for facilitating the exchange of secret information that resides in a device, such as a chip, system-on chip, and the like. Another set of operations can be carried out to securely provide secret information associated with a device. For example, one or more components of the device that comprise a security system outside of the device manufacturing facility. A message that includes a signed public key and a requester ID is received from a requestor. Next, the public key is verified, and if the determination indicates that the public key is not valid a reset operation is initiated. If the determination indicates a valid public key, the operation continue to determine if the secret information has not been previously exported to the requesting entity. If not a derived secret is created using the requester ID and secret embedded information. The derived secret is encrypted. The encrypted secret is further signed. The signed and encrypted derived secret is outputted. The device is marked to indicate that the embedded secret information has been exported to the particular requestor).
Claim 19: Modified Dellow discloses the hardware memory device as per claim 16. Dellow further discloses wherein the processor is part of a heterogenous computing platform selected from the group consisting of: a System-On-Chip (SoC), a Field-Programmable Gate Array (FPGA), and an Application-Specific Integrated Circuit (ASIC) (Paragraph [0011-0013]; [0027-0028]; [0030-0031]; Fig. 6, methods, devices, systems, and computer program products are provided to facilitate cryptographically secure retrieval of secrete information that is embedded in a device. Upon receiving a request for the embedded secret information, an encrypted secret is provided to the requestor that enables the recovery of the embedded information by only the requestor. The disclosed embodiments provide examples for implementing methods for facilitating the exchange of secret information that resides in a device, such as a chip, system-on chip, and the like. Another set of operations can be carried out to securely provide secret information associated with a device. For example, one or more components of the device that comprise a security system outside of the device manufacturing facility. A message that includes a signed public key and a requester ID is received from a requestor. Next, the public key is verified, and if the determination indicates that the public key is not valid a reset operation is initiated. If the determination indicates a valid public key, the operation continue to determine if the secret information has not been previously exported to the requesting entity. If not a derived secret is created using the requester ID and secret embedded information. The derived secret is encrypted. The encrypted secret is further signed. The signed and encrypted derived secret is outputted. The device is marked to indicate that the embedded secret information has been exported to the particular requestor).
Claim 20: Modified Dellow discloses the hardware memory device as per claim 19. However, Dellow does not disclose wherein the heterogenous computing platform comprises a Reduced Instruction Set Computer (RISC) processor coupled to the EC via an interconnect, and wherein the interconnect comprises at least one of: an Advanced Microcontroller Bus Architecture (AMBA) bus, a QuickPath Interconnect (QPI) bus, or a HyperTransport (HT) bus.
In the same field of endeavor of delivering secret information based on verifying ownership of a product Britt teaches wherein the heterogenous computing platform comprises a Reduced Instruction Set Computer (RISC) processor coupled to the EC via an interconnect, and wherein the interconnect comprises at least one of: an Advanced Microcontroller Bus Architecture (AMBA) bus, a QuickPath Interconnect (QPI) bus, or a HyperTransport (HT) bus (Paragraph [0005-0006]; [0027]; [0039]; [0112-0113]; Fig. 3A, systems for delivering content from an internet-connected hosted server system to various client computing devices. The systems described here permit a user to obtain cloud-based access to content that the user has purchased and which she possess in physical form e.g. a CD. To implement such access the physical version of the content in the form of a physical item may be encoded with a unique identifier and an owner of the item can capture the unique identifier. Such capture may occur by exposing the physical item to an electronic device which can read the identifier. The identifying information may then be sent to a networked content previsioning system along with information that identifies the topic of the content. The identification information may include information that identifies the user, such as a user account number, and also information that identifies the particular media item. Information identifying the particular media item may include for example, a unique identifying number that has been encoded in an NFC chip and may additionally include an image of the item captured by a camera, where the image may include graphics from the item for verification by the registration server that may resolve the barcode into metadata that describes the item. Computing devices include a processor, memory, and a low-speed interface connecting to low-speed bus. Each component are interconnected using various busses).
Before the effective filing date of the invention it would have been obvious to one of ordinary skill in the art to modify the system of verifying the ownership of a device and requesting encrypted information based on the identity of the owner and device as disclosed by Dellow with the system of and in response to verification of the device against a Purchase Order (PO) database of an Original Equipment Manufacturer (OEM) as taught by Britt (Britt [0005]). With the motivation of helping to securely disseminate information to verified entities (Britt [0004]).
Therefore, claim 1-20 are rejected under U.S.C. 103.
Response to arguments
Applicant’s arguments, see REMARKS, filed May 11, 2026, with respect to the rejections of claims 1-20 under U.S.C. 101 have been fully considered but are not persuasive.
Representative argues that the newly amended claims do not recite an abstract idea as they are not capable of being performed in the human mind. However, the examine respectfully disagrees as the claims recite a method for verifying an identity of a device against a purchase order, sending material to a supplier to generate a certificate signing request, and after the device ahs been shipped form the supplier verifying the authenticity of the product using the certificate signing request. Merely verifying the authenticity of a product by comparing a product’s identity to a purchase order and having a supplier generate material confirming the authenticity is a mental process. As a person is capable of mentally, or using basic tools such as pen and paper, confirming the authenticity of a product by comparing a product identification against a purchase order and having a supplier generate a certificate. The additional elements or a system comprising a plurality of generic computer components to transmit and store information to perform the abstract idea are directed to merely “apply it” or applying the generic computer elements to perform the abstract idea without reciting a technical improvement to a technology or technical field.
Therefore, the examiner maintains the current 101 rejection.
Claims 2-10, 12-15, and 17-20 are dependent on claims 1, 11, and 16 and therefore are rejected under the same rejection.
Applicant’s arguments, see REMARKS, filed May 11-2026, with respect to the rejections of 1-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Dellow (US 2014/0090078) in view of Britt (US 2015/0356278) further in view of Vikas (US 2019/0108482) are not persuasive as claims were amended which required further search and consideration and new art was applied.
Claims 1, 11, and 16 The applicant argues that the current combination of prior art does not disclose the currently amended claim limitation. However, upon further search and consideration the examiner finds that Vikas can be used in combination with the current prior art to disclose the newly amended claim limitations. Dellow discloses a system of sending encrypted information from a source and a device such as a supplier. Britt teaches a system of verifying the purchase of a product by sending information from a product or device to a supplier to be compared to the unique identifier in a database. While Vikas teaches a system of authenticating a product by managing the traceability of a product and it’s transfer of ownership using a blockchain. Vikas teaches a system of having a supplier application which allows a supplier to record information pertaining to a product that can be stored in a blockchain and used to confirm the product’s authenticity when requested. Therefore, Vikas is found to be able to be used in combination with the current prior art to disclose the amended claim limitations.
Therefore, claims 1, 11, and 16 are rejected under U.S.C. 103
Claims 2-10, 12-15, and 17-20 are argued as being allowable as being dependent on claims 1, 11, and 16. Therefore, they are also rejected under the same rejection as above.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant’s disclosure.
McKenzie (US 2021/0248653) Authentication of products.
Chester (US 2004/0054888) Method and system of authentication and ownership verification of collectables.
Au Li (US 2014/0378387) System and method for life cycle operation of supply chain business transaction.
Sharma (US 2013/0277425) System for and method of securing articles along a supply chain.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to COREY RUSS whose telephone number is (571)270-5902. The examiner can normally be reached on M-F 7:30-4:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lynda Jasmin can be reached on 5712726782. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service. Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/COREY RUSS/Primary Examiner, Art Unit 3629
Prosecution Insights