DETAILED ACTION
Acknowledgements
This Office Action is in response to Applicant’s correspondence filed on 8/6/24.
The Examiner notes that citations to United States Patent Application Publication paragraphs are formatted as [####], #### representing the paragraph number.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Status of Claims
Claims 1-20 are currently pending.
Claims 1-20 are rejected as set forth below.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 1-20 are provisionally rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-20 of copending Application No. 18796236 (reference application). Although the claims at issue are not identical, they are not patentably distinct from each other because the scope of the ‘236 claims anticipate the scope of the instant claims.
This is a provisional nonstatutory double patenting rejection because the patentably indistinct claims have not in fact been patented.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-5, 7-12, 14-19 is/are rejected under 35 U.S.C. 103 as being unpatentable over United States Patent Application Publication No. 20210192519 to McHugh in view of United States Patent No. 11244297 to Puffer, and United States Patent Application Publication No. 20210004454 to Chester.
As per claims 1, 8, 15, McHugh teaches:
A method comprising: receiving, via a near-field communication (NFC) component of the user device and from a physical credential, credential information associated with the physical credential; ([0072]-[0074], “As illustrated in FIG. 6, the user selects the one-tap contactless card authentication 608 option. According to embodiments, when the user computing device detects the contactless card via NFC, the computing device may receive one or more cryptograms from the contactless card.”)
transmitting, by a digital wallet on the user device and to a provider server via an intermediate server, a request to verify the credential information, the request including the credential information; receiving, by the digital wallet and from the provider server via the intermediate server, an indication that the physical credential is verified by the provider server; ([0077], “In another example, the banking app 602 may receive the one or more cryptograms from the contactless card and send the cryptogram(s) to one or more remote computing devices, which may be secure backend servers, to perform the decryption of the cryptograms and determine whether the information contained in the one or more cryptograms match authentication information related to the user. The one or more remote computing devices may then send to banking app 602 an indication or confirmation of verification of the user's identity.”; [0027], “System 100 may include one or more networks 115. In some examples, network 115 may be one or more of a wireless network, a wired network or any combination of wireless network and wired network and may be configured to connect client device 110 to server 120.”)
McHugh does not explicitly teach, but Puffer teaches:
transmitting a request for a digital wallet; receiving, by a digital wallet on a user device and from a provider server via an intermediate server, a digital credential generated by the provider server based on a request; (col 2 lines 39-59, “An example embodiment is described as follows. A customer registers for a mobile wallet account with a mobile wallet provider and registers a payment card (e.g., a debit card, a credit card) to the customer's mobile wallet account. In response, an inactive payment token representing the payment card is provisioned to the customer's mobile wallet on the customer's mobile device, either by the mobile wallet provider or by a token service provider.”; col 3 lines 28-33, “As described in further detail below, the system 100 includes a mobile device 102 and a payment card 104 associated with a customer 106, a mobile wallet computing system 108, a token service provider computing system 110, an issuer computing system 112, and an ATM 114 connected by a secure network (e.g., network 116).”)
One of ordinary skill in the art would have recognized that applying the known technique of Puffer to the known invention of McHugh would have yielded predictable results and resulted in an improved invention. It would have been recognized that the application of the technique would have yielded predictable results because the level of ordinary skill in the art demonstrated by the references applied shows the ability to incorporate such digital credential features into a similar invention. Further, it would have been recognized by those of ordinary skill in the art that modifying the step of receiving, by the digital wallet and from the provider server via the intermediate server, an indication that the physical credential is verified by the provider server so a digital credential is received instead of the indication results in an improved invention because applying said technique ensures that a digital credential is securely stored in the digital wallet for future verification and use, thus improving the overall security of the invention.
McHugh as modified does not explicitly teach, but Chester teaches:
provisioning, by the digital wallet, the digital credential on a secure element of the user device. ([0019], “For example, as shown in FIG. 1, system 1 may include a first end-user host electronic device 100 (e.g., a laptop computer (see, e.g., FIG. 1) or a smart phone (see, e.g., FIG. 3) or a wearable device or the like) that may be accessible to a first user U1 and/or a second user U2 and on which at least one user credential may be provisioned (e.g., on a secure element of first electronic device 100).”; [0037], “Device 100 may launch or otherwise access a specific device application (e.g., card management application 113b of FIG. 2A (e.g., as a “Wallet” or “Passbook” application) for managing various credentials on secure element 145.”)
One of ordinary skill in the art would have recognized that applying the known technique of Chester to the known invention of McHugh as modified would have yielded predictable results and resulted in an improved invention. It would have been recognized that the application of the technique would have yielded predictable results because the level of ordinary skill in the art demonstrated by the references applied shows the ability to incorporate such secure element features into a similar invention. Further, it would have been recognized by those of ordinary skill in the art that modifying the invention to provision, by the digital wallet, the digital credential on a secure element of the user device results in an improved invention because applying said technique ensures that correct digital credential is securely stored in the secure element, thus improving the overall security of the invention.
As per claims 2, 9, 16, Chester teaches:
wherein the credential information is received by the NFC component and provided directly to the secure element of the user device, bypassing a host processor of the user device. ([0045], “An operating system or other application of an end user device (e.g., application 103, application(s) 113, and/or application 143 of device 100, and/or application 203, application(s) 213, and/or an NFC application of device 200) may be configured to call specific application programming interfaces (“APIs”) and SMP broker 440 may be configured to process requests of those APIs and respond with data that may derive the user interface of device 100 and/or of device 200 and/or respond with application protocol data units (“APDUs”) that may communicate with secure element 145 of device 100 and/or with secure element 245 of device 200.”)
As per claims 3, 10, 17, McHugh as modified does not explicitly teach, but Chester teaches:
receiving, on an interface of the digital wallet, a user input representing a password, wherein the request includes a cryptogram generated based on the password and at least some of the credential information. ([0040] – [0041], “In order for at least a certain type of frictionless provisioning of a credential to occur within system 1, at least one credential should first be securely provisioned on first device 100 (e.g., directly from issuer subsystem 300 or via AE subsystem 400 (e.g., via credential protection subsystem 491)). It is to be understood that each one of credential keys 155a′ and 155b′ of device 100 and of issuer subsystem 300 may be any suitable shared secret (e.g., a password, passphrase, array of randomly chosen bytes, one or more symmetric keys, respective public-private keys (e.g., asymmetric keys), etc.) available to both or a respective one of the secure element of electronic device 100 and issuer subsystem 300 that may be operative to enable any suitable crypto data (e.g., a cryptogram) or any other suitable data to be independently generated by electronic device 100 and issuer subsystem 300 (e.g., for validating payment data for a financial transaction), such as by using any suitable cryptographic algorithm or cipher whose functional output may be at least partially determined by the shared secret, where such a shared secret may be provisioned on device 100 by issuer subsystem 300, and/or to allow secure encryption and decryption of data communicated between device 100 and subsystem 300. AE subsystem 400 (e.g., device protection subsystem 471 and/or transaction protection subsystem 481 and/or credential protection subsystem 491 and/or any other suitable subsystem(s)) may be provided as an intermediary between issuer subsystem 300 and one or both of device 100 and device 200, where AE subsystem 400 may be configured to provide a new layer of security and/or to provide a more seamless user experience when a credential is being provisioned on device 100 or on device 200, and/or when such a provisioned credential is being used as part of a transaction credential data communication from device 100 or device 200 for funding a receiver user account at issuer subsystem 300. AE subsystem 400 may be provided by any suitable administration and/or commercial entity that may offer various services to a user of a user device (e.g., device 100 and/or device 200) via user-specific log-in information to a user-specific account with that administration entity (e.g., via user-specific identification and password combinations).”)
One of ordinary skill in the art would have recognized that applying the known technique of Chester to the known invention of McHugh as modified would have yielded predictable results and resulted in an improved invention. It would have been recognized that the application of the technique would have yielded predictable results because the level of ordinary skill in the art demonstrated by the references applied shows the ability to incorporate such cryptogram features into a similar invention. Further, it would have been recognized by those of ordinary skill in the art that modifying the invention to receive, on an interface of the digital wallet, a user input representing a password, wherein transmitting the credential information includes transmitting a cryptogram generated based on the password and at least some of the credential information, results in an improved invention because applying said technique ensures that the credential information can be more securely verified via the generated cryptogram, thus improving the overall security of the invention.
As per claims 4, 11, 18, Chester teaches:
wherein the password is encrypted by the secure element of the user device, and the cryptogram is generated by the secure element of the user device. ([0040])
As per claims 5, 12, 19, McHugh as modified does not explicitly teach, but Chester teaches:
receiving, on an interface of the digital wallet, a user input representing a security code associated with the physical credential, wherein the request includes the security code. ([0040] – [0041], “In order for at least a certain type of frictionless provisioning of a credential to occur within system 1, at least one credential should first be securely provisioned on first device 100 (e.g., directly from issuer subsystem 300 or via AE subsystem 400 (e.g., via credential protection subsystem 491)). It is to be understood that each one of credential keys 155a′ and 155b′ of device 100 and of issuer subsystem 300 may be any suitable shared secret (e.g., a password, passphrase, array of randomly chosen bytes, one or more symmetric keys, respective public-private keys (e.g., asymmetric keys), etc.) available to both or a respective one of the secure element of electronic device 100 and issuer subsystem 300 that may be operative to enable any suitable crypto data (e.g., a cryptogram) or any other suitable data to be independently generated by electronic device 100 and issuer subsystem 300 (e.g., for validating payment data for a financial transaction), such as by using any suitable cryptographic algorithm or cipher whose functional output may be at least partially determined by the shared secret, where such a shared secret may be provisioned on device 100 by issuer subsystem 300, and/or to allow secure encryption and decryption of data communicated between device 100 and subsystem 300. AE subsystem 400 (e.g., device protection subsystem 471 and/or transaction protection subsystem 481 and/or credential protection subsystem 491 and/or any other suitable subsystem(s)) may be provided as an intermediary between issuer subsystem 300 and one or both of device 100 and device 200, where AE subsystem 400 may be configured to provide a new layer of security and/or to provide a more seamless user experience when a credential is being provisioned on device 100 or on device 200, and/or when such a provisioned credential is being used as part of a transaction credential data communication from device 100 or device 200 for funding a receiver user account at issuer subsystem 300. AE subsystem 400 may be provided by any suitable administration and/or commercial entity that may offer various services to a user of a user device (e.g., device 100 and/or device 200) via user-specific log-in information to a user-specific account with that administration entity (e.g., via user-specific identification and password combinations).”)
One of ordinary skill in the art would have recognized that applying the known technique of Chester to the known invention of McHugh as modified would have yielded predictable results and resulted in an improved invention. It would have been recognized that the application of the technique would have yielded predictable results because the level of ordinary skill in the art demonstrated by the references applied shows the ability to incorporate such cryptogram features into a similar invention. Further, it would have been recognized by those of ordinary skill in the art that modifying the invention to receive, on an interface of the digital wallet, a user input representing a security code associated with the physical credential, wherein the request includes the security code, results in an improved invention because applying said technique ensures that the credential information can be more securely verified via the entered security code, thus improving the overall security of the invention.
As per claims 7, 14, McHugh teaches:
wherein the credential information includes at least one of a card number, an expiry date, and a credential cryptogram associated with physical credential. ([0077])
Claims 6, 13, 20 is/are rejected under 35 U.S.C. 103 as being unpatentable over United States Patent Application Publication No. 20210192519 to McHugh in view of United States Patent No. 11244297 to Puffer, and United States Patent Application Publication No. 20210004454 to Chester, and further in view of United States Patent Application Publication No. 20220391482 to Gaviola.
As per claims 6, 13, 20, McHugh teaches:
before receiving the credential information, launching a digital wallet application on the user device; and after provisioning the digital credential, rendering a graphic on the digital wallet application on the user device. ([0072]; [0082], “Upon successful verification of the user's identity, the banking app 702 may then transition or link out to a third-party wallet app 710, where at least confirmation of the successful identity verification may be shared with the third-party wallet app 710. Thereafter, the third-party wallet app 710 may display a graphic or indication 712 stating that the one or more financial instruments have been successfully activated in the third-party wallet.”)
Chester teaches:
provisioning the digital credential on the secure element ([0019])
McHugh as modified does not explicitly teach, but Gaviola teaches:
rendering a representation of the digital credential on the digital wallet application on the user device; (Fig 6AF, [0231], “At FIG. 6AF, in response to user input 674, electronic device 600 displays wallet user interface 604, which now includes a representation of digital identification credential 606G, as well as confirmation indication 676 indicating that the new digital identification credential has been successfully added to electronic device 600.”)
One of ordinary skill in the art would have recognized that applying the known technique of Gaviola to the known invention of McHugh as modified would have yielded predictable results and resulted in an improved invention. It would have been recognized that the application of the technique would have yielded predictable results because the level of ordinary skill in the art demonstrated by the references applied shows the ability to incorporate such digital credential representation features into a similar invention. Further, it would have been recognized by those of ordinary skill in the art that modifying the invention to render a representation of the digital credential on the digital wallet application on the user device results in an improved invention because applying said technique ensures that the user can easily identify that the digital credential has been added to the digital wallet, thus improving the overall usability of the invention.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure:
United States Patent Application Publication No. 20220391482 to Villanueva discloses electronic devices with faster, more efficient methods and interfaces for enrolling, managing, and using digital credentials. Such methods and interfaces optionally complement or replace other methods for enrolling, managing, and using digital credentials.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JAY HUANG whose telephone number is (408)918-9799. The examiner can normally be reached 9:00a - 5:30p PT.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Anita Coupe can be reached at (571) 270-3614. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/JAY HUANG/Primary Examiner, Art Unit 3619
Prosecution Insights