DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This Office Action is in response to the Amendment filed on 04/28/2026.
In the instant Amendment, claims 2 and 12 have been amended; claim 1 is canceled; and claims 2 and 12 are independent claims. Claims 2-21 have been examined and are pending. This Action is made Final.
Information Disclosure Statement
The information disclosure statement (IDS), submitted on 07/28/2026, is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Response to Arguments
The objection to the Abstract is withdrawn as a replacement Abstract has been submitted.
The non-statutory obviousness type double patenting rejection to claims 2-21 is withdrawn as a terminal disclaimer has been filed and approved.
The rejection of claims 2-11 under 35 U.S.C. § 112 (b) is withdrawn as the claims have been amended.
Applicants’ arguments in the instant Amendment, filed on 04/28/2026, with respect to limitations listed below, have been fully considered but they are not persuasive.
Applicant’s arguments in regards to independent claims 2 and 12: “For the sake of a complete response, even if Rule were considered prior art, the Examiner's combinations fail to render the claims obvious. The primary rejection of claims 2-4, 6-10, 12-14, and 16-20 over Canfield in view of Rule is improper. Canfield teaches a method for installing a mobile application via a dynamic link but is entirely silent on the core elements of the claimed invention, namely, the use of a contactless card to initiate a post-installation authentication operation, the receipt and processing of encrypted data from that card, and the subsequent enablement of sensitive actions. The motivation to combine these distinct technologies is based on impermissible hindsight, as Canfield's focus on simplifying app installation does not suggest the specific, secure authentication workflow claimed by the Applicant.”
The Examiner disagrees with the Applicants. In response to applicant's argument that the examiner's conclusion of obviousness is based upon improper hindsight reasoning, it must be recognized that any judgment on obviousness is in a sense necessarily a reconstruction based upon hindsight reasoning. But so long as it takes into account only knowledge which was within the level of ordinary skill at the time the claimed invention was made, and does not include knowledge gleaned only from the applicant's disclosure, such a reconstruction is proper. See In re McLaughlin, 443 F.2d 1392, 170 USPQ 209 (CCPA 1971).
The Examiner further submits that the claim limitations being taught by Canfield, “determining, by a mobile device, first data comprising to cause the mobile device to download and install a mobile application on the mobile device, wherein the first data is received via scanning quick-response (QR) code or receiving a message comprising the first data” only require receiving first data via scanning quick-response (QR) codes or receiving a message comprising first data. Canfield teaches a mobile device that is operable to receive data from one device directly to another device via Bluetooth, NFC, WiFi, or any other device to device communication protocol known in the art of electronic communication (Canfield: Para. [0051]). Rule includes a client device with functionality to transfer data between an application executing on the mobile device and a contactless card through NFC data transfer (Rule Para. [0040]). It would be within the knowledge and capabilities of a person having ordinary skill in the art to implement the teachings of Rule with the mobile device of Canfield utilizing techniques known in the art including receiving data from one device directly to another device, such as a contactless card, via NFC or any other device to device communication protocol known in the art.
Applicant’s arguments in regards to claims 5 and 15: “The Examiner cites Beilis for its teaching of launching an application and passing an identifier via an NFC-enabled card. However, Beilis does not remedy the deficiencies of the base combination. The process taught by Beilis is for convenience in launching an application, not for performing a secure authentication process to authorize high-risk financial or personal actions. The combination fails to teach or suggest the critical steps of receiving encrypted data like a cryptogram, authenticating that data at a remote server, and enabling sensitive actions based on that authentication.”
In response to applicant's argument that the references fail to show certain features of the invention, it is noted that the features upon which applicant relies (e.g., “receiving encrypted data like a cryptogram, authenticating that data at a remote server, and enabling sensitive actions based on that authentication”) are not recited in the rejected claim(s). Although the claims are interpreted in light of the specification, limitations from the specification are not read into the claims. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993).
The Examiner submits that Beilis is cited for teaching the limitations of claim 5, which recites “wherein the second data comprises an embedded link that, when activated, launches the mobile application and passes the identifier to the mobile application.” Paragraph [0045] of Beilis describes how “[i]t will be apparent to the skilled person that there are only a few enterprises presently providing NFC-enabled cards, and none of these are enabled with a unique identifier such as is described above for invoking an application and authenticating a user” and paragraph [0039] of Beilis further describes how “[i]n this embodiment the customer, having invoked the application on appliance 115 (1) accessing the bank's web site on server 109 also has his or her NFC enabled telephone 115 (3) at hand and NFC-enabled card 202. The customer taps the card to the telephone, which invokes the telephone application as described above, acquires the unique identifier and optionally other data, and links to the same web site on server 109, where the SW at the server recognizes the customer is connected by appliance 115 (1) as well, and authenticates the customer transparently for the connection to appliance 115(1).” Under the broadest reasonable interpretation, the aforementioned teachings of Beilis, in combination with Canfield and Rule, corresponds to and teaches the instant claim limitation of “wherein the second data comprises an embedded link that, when activated, launches the mobile application and passes the identifier to the mobile application.”
Applicant’s arguments in regards to claims 11 and 21: “Finally, the rejection of claims 11 and 21 over Canfield, Rule, and Polyakov is also respectfully traversed. The addition of Polyakov, which teaches an agent providing a link for an app download during a voice or chat session, does not complete the picture. This combination only addresses the initial step of getting the application onto the user's device. It is completely devoid of any teaching or suggestion of the subsequent, crucial steps of the claimed invention: the use of a second communication to launch an authentication, the involvement of a contactless card, the processing of encrypted data from that card, and the ultimate enablement of sensitive actions. The combination merely describes a customer service scenario for app distribution and does not anticipate the novel, secure, and integrated authentication workflow that is the subject of the claimed invention.”
In response to applicant's argument that the references fail to show certain features of the invention, it is noted that the features upon which applicant relies (e.g., “the use of a second communication to launch an authentication, the involvement of a contactless card, the processing of encrypted data from that card, and the ultimate enablement of sensitive actions”) are not recited in the rejected claim(s). Although the claims are interpreted in light of the specification, limitations from the specification are not read into the claims. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993).
The Examiner submits that Polyakov is cited for teaching the limitations of claim 11, which recites “further comprising, prior to determining the first data, establishing a voice or chat communication channel with an agent of a service provider, wherein the first data is received in response to the agent determining that the mobile application is not installed on the mobile device.” Paragraph [0011] of Polyakov describes how “[i]n operation, a customer service support agent, upon receiving a phone call from a customer, can supply a link to the customer to download and install a mobile application or push the mobile application to the customer's device, e.g., a smart phone, directly” Under the broadest reasonable interpretation, the aforementioned teachings of Polyakov, in combination with Canfield and Rule, corresponds to and teaches the instant claim limitation of “the use of a second communication to launch an authentication, the involvement of a contactless card, the processing of encrypted data from that card, and the ultimate enablement of sensitive actions.”
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claim(s) 2-4, 6-10, 12-14, and 16-20 are rejected under 35 U.S.C. 103 as being unpatentable Canfield et al. (US 2021/0168140; Hereinafter “Canfield”) in view of Rule et al. (US 2020/0106617; Hereinafter “Rule”).
Regarding claim 2, Canfield teaches a computer-implemented method, comprising: determining, by a mobile device, first data comprising that causes the mobile device to download and install a mobile application on the mobile device, wherein the first data is received via scanning quick-response (QR) code or receiving a message comprising the first data (Canfield: Fig. 1-3, Para. [0043], Para. [0026], Exemplary embodiments include at step 111 providing a registration code for the user and embedding the registration code within a dynamic link. The registration code may be any code that uniquely identifies the user. The registration code may be used to identify the user as the user of the created user account from step 110, when the user is trying to associate another remote application to their account. Para. [0027], When the account is initially created or at some time thereafter, a mobile application registration message may be sent to the user at step 112. The mobile application registration message may be sent to the user via email, SMS, or other entered communication identification method. This message may contain the dynamic link including the registration code. The dynamic link may be embedded in a button, such as might be found in an email, or a web link that can be selected by the user. Para. [0051]);
Canfield does not explicitly teach receiving, by the mobile device, second data comprising an identifier to identify and launch an authentication operation of the mobile application utilizing a contactless card based on the identifier; receiving, by the mobile device, encrypted data from the contactless card; authenticating, by the mobile device, the encrypted data; receiving, by the mobile device, an indication to perform sensitive actions based on authentication of the encrypted data.
In an analogous art, Rule teaches receiving, by the mobile device, second data comprising an identifier to identify and launch an authentication operation of the mobile application utilizing a contactless card based on the identifier (Rule: Para. [0158], In some examples, the tap may activate or launch the application of the device and then initiate one or more actions or communications with one or more servers to activate the contactless card. Subsequent to installation, a tap of the contactless card may activate or launch the application, and then initiate, for example via the application or other back-end communication), activation of the contactless card. After activation, the contactless card may be used in various activities, including without limitation commercial transactions. Para. [0039]-[0040], Para. [0041], For example, a reader, such as application 122, may transmit a message, such as an applet select message, with the applet ID of an NDEF producing applet. Upon confirmation of the selection, a sequence of select file messages followed by read file messages may be transmitted. For example, the sequence may include “Select Capabilities file”, “Read Capabilities file”, and “Select NDEF file”. At this point, a counter value maintained by the contactless card 105 may be updated or incremented, which may be followed by “Read NDEF file.” At this point, the message may be generated which may include a header and a shared secret. Session keys may then be generated. The MAC cryptogram may be created from the message, which may include the header and the shared secret. The MAC cryptogram may then be concatenated with one or more blocks of random data, and the MAC cryptogram and a random number (RND) may be encrypted with the session key. Thereafter, the cryptogram and the header may be concatenated, and encoded as ASCII hex and returned in NDEF message format (responsive to the “Read NDEF file” message).);
receiving, by the mobile device, encrypted data from the contactless card; authenticating, by the mobile device, the encrypted data (Rule: Para. [0041], Para. [0044], At step 106, the contactless card 105 sends the MAC cryptogram to the application 122. In some examples, the transmission of the MAC cryptogram occurs via NFC, however, the present disclosure is not limited thereto.);
receiving, by the mobile device, an indication to perform sensitive actions based on authentication of the encrypted data (Rule: Para. [0046], At step 112, the processor 124 verifies the MAC cryptogram pursuant to an instruction from the application 122. For example, the MAC cryptogram may be verified, as explained below. Para. [0054]).
It would have been obvious to a person having ordinary skill in the art, before the effective filing date of the claimed invention, to combine the teachings of Rule with the system and method of Canfield to include receiving, by the mobile device, second data comprising an identifier to identify and launch an authentication operation of the mobile application utilizing a contactless card based on the identifier; receiving, by the mobile device, encrypted data from the contactless card; authenticating, by the mobile device, the encrypted data; receiving, by the mobile device, an indication to perform sensitive actions based on authentication of the encrypted data because this functionality provides for transmitting sensitive data after verification of a contactless card (Rule: Para. [0054]).
Regarding claim 3, Canfield, in combination with Rule, teaches the method of claim 2, wherein the message comprising the first data is a text message communicated via a short message service (SMS), multimedia messaging service (MMS), or rich communication service (RCS) (Canfield: Fig. 1-3, Para. [0027], When the account is initially created or at some time thereafter, a mobile application registration message may be sent to the user at step 112. The mobile application registration message may be sent to the user via email, SMS, or other entered communication identification method. This message may contain the dynamic link including the registration code. The dynamic link may be embedded in a button, such as might be found in an email, or a web link that can be selected by the user. Para. [0051]).
Regarding claim 4, Canfield, in combination with Rule, teaches the method of claim 2, wherein the first data comprises an embedded link that, when activated, causes the mobile device to download the mobile application from an application store (Canfield: Fig. 1-3, Para. [0026], Para. [0027], When the account is initially created or at some time thereafter, a mobile application registration message may be sent to the user at step 112. The mobile application registration message may be sent to the user via email, SMS, or other entered communication identification method. This message may contain the dynamic link including the registration code. The dynamic link may be embedded in a button, such as might be found in an email, or a web link that can be selected by the user. Para. [0029], Once the user selects the dynamic link, an associated application is launched. If the application was downloaded during or after the activation of the dynamic link, upon opening the application, a service in the app determines that the registration process initiated before an app was installed is to be continued. Para. [0051]).
Regarding claim 6, Canfield, in combination with Rule, teaches the method of claim 2, wherein receiving the encrypted data from the contactless card is performed via a near-field communication (NFC) interface of the mobile device after a user is prompted to tap the contactless card on the mobile device (Rule: Para. [0031], System 100 may include one or more contactless cards 105, which are further explained below with reference to FIGS. 5A-5B. In some embodiments, contactless card 105 may be in wireless communication, utilizing NFC in an example, with client device 110.).
Regarding claim 7, Canfield, in combination with Rule, teaches the method of claim 2, wherein authenticating the encrypted data further comprises: transmitting, by the mobile device, the encrypted data to a remote authentication server (Rule: Para. [0047], In some examples, verifying the MAC cryptogram may be performed by a device other than client device 110, such as a server 120 in data communication with the client device 110 (as shown in FIG. 1A).); and
receiving, by the mobile device, the result of the authentication from the remote authentication server (Rule: Para. [0035], Client device 110 may be in communication with one or more servers 120 via one or more networks 115, and may operate as a respective front-end to back-end pair with server 120. Client device 110 may transmit, for example from a mobile device application executing on client device 110, one or more requests to server 120. The one or more requests may be associated with retrieving data from server 120. Server 120 may receive the one or more requests from client device 110. Para. [0046], At step 112, the processor 124 verifies the MAC cryptogram pursuant to an instruction from the application 122. For example, the MAC cryptogram may be verified, as explained below. Para. [0054]).
Regarding claim 8, Canfield, in combination with Rule, teaches the method of claim 2, wherein the encrypted data is a cryptogram that includes a counter value, a unique card identifier, and a shared secret (Rule: Para. [0039]-[0040], Para. [0041], For example, a reader, such as application 122, may transmit a message, such as an applet select message, with the applet ID of an NDEF producing applet. Upon confirmation of the selection, a sequence of select file messages followed by read file messages may be transmitted. For example, the sequence may include “Select Capabilities file”, “Read Capabilities file”, and “Select NDEF file”. At this point, a counter value maintained by the contactless card 105 may be updated or incremented, which may be followed by “Read NDEF file.” At this point, the message may be generated which may include a header and a shared secret. Session keys may then be generated. The MAC cryptogram may be created from the message, which may include the header and the shared secret. The MAC cryptogram may then be concatenated with one or more blocks of random data, and the MAC cryptogram and a random number (RND) may be encrypted with the session key. Thereafter, the cryptogram and the header may be concatenated, and encoded as ASCII hex and returned in NDEF message format (responsive to the “Read NDEF file” message).)
Regarding claim 9, Canfield, in combination with Rule, teaches the method of claim 8, wherein the cryptogram is generated using a session key that is derived from a unique card master key and the counter value, and wherein the counter value is updated upon each read of the contactless card to prevent replay attacks (Rule: Para. [0008], and validate the cryptographic result using the one or more cryptographic algorithms and the session key, wherein the counter is independently updated by the contactless card and the client application for each transmission between the contactless card and the application,).
Regarding claim 10, Canfield, in combination with Rule, teaches the method of claim 2, wherein the sensitive actions include performing a financial transaction or viewing personal information (Rule: Para. [0079], After activation, the card may be used in various transactions including commercial transactions.).
Regarding claims 12-14, Claims 12-14 are rejected under the same rational as claims 2-4, respectively.
Regarding claims 16-20, Claims 16-20 are rejected under the same rational as claims 6-10, respectively.
Claim(s) 5 and 15 are rejected under 35 U.S.C. 103 as being unpatentable Canfield et al. (US 2021/0168140; Hereinafter “Canfield”) in view of Rule et al. (US 2020/0106617; Hereinafter “Rule”) in view of Beilis et al. (US 2014/0045458; Hereinafter “Beilis”).
Regarding claim 5, Canfield, in combination with Rule, teaches the method of claim 2. Canfield, in combination with Rule, does not explicitly teach wherein the second data comprises an embedded link that, when activated, launches the mobile application and passes the identifier to the mobile application.
In an analogous art Beilis teaches wherein the second data comprises an embedded link that, when activated, launches the mobile application and passes the identifier to the mobile application (Beilis: Para. [0045], It will be apparent to the skilled person that there are only a few enterprises presently providing NFC-enabled cards, and none of these are enabled with a unique identifier such as is described above for invoking an application and authenticating a user. Para. [0039], In this embodiment the customer, having invoked the application on appliance 115 (1) accessing the bank's web site on server 109 also has his or her NFC enabled telephone 115 (3) at hand and NFC-enabled card 202. The customer taps the card to the telephone, which invokes the telephone application as described above, acquires the unique identifier and optionally other data, and links to the same web site on server 109, where the SW at the server recognizes the customer is connected by appliance 115 (1) as well, and authenticates the customer transparently for the connection to appliance 115(1). Para. [0012]).
It would have been obvious to a person having ordinary skill in the art, before the effective filing date of the claimed invention, to combine the teachings of Beilis with the system and method of Canfield and Rule to include wherein the second data comprises an embedded link that, when activated, launches the mobile application and passes the identifier to the mobile application because this functionality provides for authentication using mobile devices in a much quicker, less error prone, and more secure manner (Beilis: Para. [0007]).
Regarding claim 15, Claim 15 is rejected under the same rational as claim 5.
Claim(s) 11 and 21 are rejected under 35 U.S.C. 103 as being unpatentable Canfield et al. (US 2021/0168140; Hereinafter “Canfield”) in view of Rule et al. (US 2020/0106617; Hereinafter “Rule”) in view of Polyakov et al. (US 2016/0173825; Hereinafter “Polyakov”).
Regarding claim 11, Canfield, in combination with Rule, teaches the method of claim 2. Canfield, in combination with Rule, does not explicitly teach further comprising, prior to determining the first data, establishing a voice or chat communication channel with an agent of a service provider, wherein the first data is received in response to the agent determining that the mobile application is not installed on the mobile device.
In an analogous art, Polyakov teaches further comprising, prior to determining the first data, establishing a voice or chat communication channel with an agent of a service provider, wherein the first data is received in response to the agent determining that the mobile application is not installed on the mobile device (Polyakov: Para. [0011], In operation, a customer service support agent, upon receiving a phone call from a customer, can supply a link to the customer to download and install a mobile application or push the mobile application to the customer's device, e.g., a smart phone, directly.).
It would have been obvious to a person having ordinary skill in the art, before the effective filing date of the claimed invention, to combine the teachings of Polyakov with the system and method of Canfield and Rule to include further comprising, prior to determining the first data, establishing a voice or chat communication channel with an agent of a service provider, wherein the first data is received in response to the agent determining that the mobile application is not installed on the mobile device because this functionality provides on-demand distribution of applications while the end user is connected over the phone (Polyakov: Para. [0008]).
Regarding claim 21, Claim 21 is rejected under the same rational as claim 11.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Nelson Giddins whose telephone number is (571)272-7993. The examiner can normally be reached on Monday - Friday, 9:00 AM - 5:00 PM.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Linglan Edwards can be reached at (571) 270-5440. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/NELSON S. GIDDINS/ Primary Examiner, Art Unit 2408
Prosecution Insights