Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 11/26/2024, and 6/23/2026 was filed. The submission is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Specification
The disclosure is objected to because of the following informalities:
In page X, lines Y, it is stated that an identity authentication method includes “S401-S405”, and should be corrected to “S401-S406” with respect to Fig. 6.
Appropriate correction is required.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1-10, 18, and 20-24 are rejected under 35 U.S.C. 102(a)(1) as being fully anticipated by Campagna (US 20170171174 A1).
Regarding claim 1, Campagna discloses “an identity authentication method, comprising: generating a first authentication information based on a first identification information, and generating an Nth authentication information based on an Nth identification information, when a plurality of clouds carry out data interaction, wherein the first identification information comprises registration information or random information of an initiator, and the Nth identification information comprises registration information or random information of an interactive end” ([0059]-[0063] Figs. 5-6, Client A can generate a message 510 identifying sender and public key QA. In certain implementations, the message may be delivered to the cryptographic service via a web API. The cryptographic service 510 may apply a cryptographic key to generate a digital signature or a MAC tag on the message (equivalent to generating first authentication information based on received identification data, which includes the initiator's registration details). The cryptographic service returns an authenticated message containing both the original message and the MAC tag to Client A (equivalent to transmitting the first authentication information to the initiator).);
“sending the first authentication information to the initiator, and sending the Nth authentication information to the interactive end” ([0059]-[0063] Figs. 5-6, Client A may then send a request 514 to Client B for an encrypted communication session protected by the authenticated message. This request may include information identifying Client A, the public key QA, and the corresponding MAC tag (equivalent to the initiator sending the identification data and authentication information to the recipient). Client B may submit the authenticated message 518 to the cryptographic service 506 and request verification of the message. The Cryptographic Service 506 receives authenticated messages from Client B containing instructions to verify authenticity (equivalent to receiving the first identification information and first authentication information sent by the interaction endpoint). It obtains a cryptographic key, generates a MAC tag for the message, and compares this generated MAC tag with the received MAC tag to determine message credibility (equivalent to decrypting the first authentication information received from the interaction endpoint to obtain decrypted authentication data).);
“receiving the first identification information and the first authentication information sent by the interactive end, and receiving the Nth identification information and the Nth authentication information sent by the initiator, wherein the first identification information and the first authentication information are sent by the initiator to the interactive end, and the Nth identification information and the Nth authentication information are sent from the interactive end to the initiator” ([0059]-[0063] Figs. 5-6, upon verifying message authenticity (equivalent to instructing the interaction endpoint to determine whether identity authentication between the initiator and the interaction endpoint has succeeded based on the decrypted authentication data), Client B 504 extracts the public key OA, generates an ECDH key pair DB and QB, and computes 3 shared secret using DB and OA at step 522. Client B then generates a message identifying the sender as itself and using the public key QB, and submits this message to the Cryptographic Service 606 for authentication. The service authenticates the message by generating either a MAC tag or digital signature (equivalent to producing the Nth authentication information based on received identification data-including the initiator's registration details) at step 612, subsequently delivering the authenticated message to Client B 504 (equivalent to transmitting the Nth authentication information to the interaction endpoint). Client B can respond to request 614 establishing an encrypted communication session by including an authentication message as part of the reply (corresponding to the transmission of identification information N and authentication information N from the interacting party to the initiating party).);
“and decrypting the Nth authentication information received from the initiator to obtain the decrypted Nth authentication information, and decrypting the first authentication information received from the interactive end to obtain the decrypted first authentication information, so that the initiator and the interactive end determine whether the identity authentication between the initiator and the interactive end passes according to the decrypted Nth authentication information and the decrypted first authentication information, respectively” ([0059]-[0063] Figs. 5-6, Client A can receive response 616 and perform verification using a cryptographic service (using the identification information N and authentication information N sent by the initiating party) to determine whether the authentication message in the reply is valid (by decrypting the received authentication information N from the initiating party to obtain the decrypted authentication information N).If the request is confirmed valid (i.e., indicating to the interaction endpoint whether identity authentication between the initiator and the interaction endpoint has succeeded based on the decrypted Nth authentication information), the public key QB can be used to compute the shared secret 620.);
Regarding claim 2, Campagna discloses the identity authentication method of claim 1 above. Campagna also discloses “wherein the first identification information comprises registration information and random information of the initiator, and the generating a first authentication information based on a first identification information comprises: obtaining a root key” ([0059]-[0063] Figs. 5-6, cryptographic service 510 can generate a digital signature or 3 MAC tag on a message using a cryptographic key.);
“calculating a key of the initiator according to the registration information of the initiator and the root key” ([0059]-[0063] Figs. 5-6, Client A may provide a unique identifier to the cryptographic service as part of an authentication request; this identifier corresponds to the cryptographic key used by the service to authenticate the message. The key identifier may be determined based on the caller's identity.);
“and calculating the first authentication information according to the key of the initiator and the random information” ([0059]-[0063] Figs. 5-6, Calculating the encryption key using the root key and relevant parameters is a common technical practice in the field.);
Regarding claim 3, Campagna discloses the identity authentication method of claim 1 above. Campagna also discloses “wherein the Nth identification information comprises the registration information of the interactive end, and the decrypting the Nth authentication information received from the initiator to obtain the decrypted Nth authentication information, comprising: obtaining a root key” ([0059]-[0063] Figs. 5-6, Client B may send an authenticated message 518 to the password service 506 and request the password service to verify the authenticated message. The password service 506 may receive from client B an authenticated message containing instructions for verifying its authenticity, obtain a cryptographic key, generate a MAC tag on the message, and compare the generated MAC tag with the received MAC tag to determine whether the message is trustworthy. Client B may then generate a response 610 identifying the sender as itself and its public key. The QB sends the message and provides it to the password service 606 for authentication.);
“calculating a key of the interactive end according to the registration information of the interactive end and the root key” ([0059]-[0063] Figs. 5-6, The password service 606 can authenticate the message 612, for example by generating a MAC tag or digital signature on it, and then delivers the authenticated message to client B 604, Client B may respond 614 to the request for establishing an encrypted communication session, including the authenticated message as part of the response.);
“and decrypting the Nth authentication information received from the initiator through the key of the interactive end to obtain the decrypted Nth authentication information” ([0059]-[0063] Figs. 5-6, Client A receives the response 616 and performs verification using the password service to determine whether the authenticated message is valid; decrypting the information with the corresponding key is a conventional technique in the field.);
Regarding claim 4, Campagna discloses the identity authentication method of claim 1 above. Campagna also discloses “wherein the decrypted Nth authentication information comprises a decryption random number and a decryption time stamp” ([0059]-[0063] Figs. 5-6, appropriate parameters are selected as the encrypted information; random numbers and timestamps are authentication parameters. Claim 18 of Campagna states that a message further includes a timestamp, with verification stating that a second binding is authentic, which determines plaintext and ciphertext including the timestamp);
Regarding claim 5, Campagna discloses the identity authentication method of claim 1 above. Campagna also discloses “wherein the registration information comprises a registration number or a registration type of the cloud, and the random information comprises a random number and a time stamp generated when the cloud carries out data interaction” ([0059]-[0063] Figs. 5-6, Client A can generate a message 510 identifying the sender and the public key QA. Client A can then provide message 512 to the cryptographic service for authentication, appropriate parameters are selected as the encrypted information; random numbers and timestamps are authentication parameters. Claim 18 of Campagna states that a message further includes a timestamp, with verification stating that a second binding is authentic, which determines plaintext and ciphertext including the timestamp);
Regarding claim 6, Campagna discloses the identity authentication method of claim 1 above. Campagna also discloses “before the generating a first authentication information based on a first identification information, and the generating an Nth authentication information based on an Nth identification information, wherein the identity authentication method further comprises: receiving and recording a registered cloud identification information sent by a registration system” ([0059]-[0063] Figs. 5-6, the cryptographic service 510 can generate a digital signature or a MAC tag on a message using a cryptographic key. Client A may provide a unique identifier to the cryptographic service as part of an authentication request; this identifier corresponds to the cryptographic key used by the service to authenticate the message. The cryptographic key based on the identifier, with a third-party module/institution responsible for establishing the correspondence between the identifier and the key.);
Regarding claim 7, Campagna discloses similar limitations as described in claim 1 above. Campagna also discloses “sending a first identification information to a management end and an interactive end when a plurality of clouds carry out data interaction” ([0059]-[0063] Figs. 5-6, Client A can generate a message 510 identifying the sender and public key QA. Client A then sends this message 510 to the cryptographic service (equivalent to the management end) for authentication (equivalent to transmitting the first identification information to the management end). In some implementations, the message may be delivered to the cryptographic service via a web API. The cryptographic service 510 can apply a cryptographic key to generate a digital signature or a MAC tag on the message. The cryptographic service returns an authenticated message containing both the original message and the MAC tag to client A.);
“receiving a first authentication information sent by the management end, wherein the first authentication information is generated by the management end according to the first identification information” ([0059]-[0063] Figs. 5-6, the cryptographic service returns an authenticated message containing both the original message and the MAC tag to client A; client A provides a unique identifier as part of the authentication request, which corresponds to the cryptographic key used by the service to authenticate the message (equivalent to receiving the first authentication information generated by the management end based on the initial identification information).);
“receiving an Nth identification information and an Nth authentication information sent by the interactive end, wherein the management end generates and sends the Nth authentication information to the interactive end according to the Nth identification information received by the interactive end” ([0059]-[0063] Figs. 5-6, Client B can send an authenticated message 518 to Cryptographic Service 506 and request authentication of the message (equivalent to instructing the interacting party to verify the initiator's identity using the first identification information and the first authentication information). Cryptographic Service 506 receives from Client B an authenticated message containing a verification instruction. It derives a cryptographic key, generates a MAC tag for the message, and compares this tag with the received MAC tag to determine the message's authenticity. Upon confirming the message's validity, Client B 504 extracts the public key QA, generates an ECDH key pair DB and QB, and computes a shared secret 522 using DB and QA.);
“sending the Nth identification information and the Nth authentication information to the management end, so that the management end decrypts the Nth authentication information to obtain a decrypted Nth authentication information” ([0059]-[0063] Figs. 5-6, Client B then creates a message 610 identifying itself as Client B with the public key QB, sends it to Cryptographic Service 606 for authentication-where Service 606 verifies the message, e.g., by generating a MAC tag or digital signature 612-and returns the authenticated message to Client B 604 (equivalent to the management server generating and transmitting the Nth authentication information to the interacting party based on the received Nth identification information). Client B subsequently responds 614 to the request for establishing an encrypted communication session, including the authenticated message as part of its reply.);
“determining whether the decrypted Nth authentication information and the Nth identification information received from the interactive end satisfy preset conditions, so as to confirm an identity authentication of the interactive end” ([0059]-[0063] Figs. 5-6, Client A can receive response 616 (equivalent to receiving the Nth identification information and the Nth authentication information sent by the interaction endpoint) and perform verification using 3 cryptographic service (equivalent to sending the Nth identification information and the Nth authentication information to the management endpoint) to determine whether the authentication message in the response is valid (equivalent to instructing the management endpoint to decrypt the Nth authentication information, obtaining the decrypted Nth authentication information).);
“and sending the first authentication information to the interactive end to control the interactive end to authenticate an identity of the initiator according to the first identification information and the first authentication information” ([0059]-[0063] Figs. 5-6, if the request is confirmed as valid, the public key QB can be used to compute the shared secret at step 620.);
Regarding claim 8, Campagna discloses the identity authentication method of claim 7 above. Campagna also discloses the limitations as described in claims 4 and 5 above. Campagna also discloses “determining whether the random number and the decryption random number are the same to obtain a first determination result” ([0059]-[0063] Figs. 5-6, Verification of the authenticated message 518 is used to determine if the random number and decrypted random number are equal to each other.);
“determining whether a difference between the time stamp and the decryption time stamp is within the configured time to obtain a second determination result” ([0059]-[0063] Figs. 5-6, Claim 18 of Campagna states that a message further includes a timestamp, with verification stating that a second binding is authentic, which determines plaintext and ciphertext including the timestamp.);
“and confirming the identity authentication of the interactive end when both the first determination result and the second determination result satisfy the preset conditions” ([0059]-[0063] Figs. 5-6, verification of authenticated message is performed in block 518, a cryptographic key is obtained and a MAC tag is generated over the message and the generated MAC tag is compared against the received MAC tag to determine whether the message is authentic. In some embodiments, the cryptography service may receive a digital signature be received in lieu of a MAC tag, generate a digital signature, and compare the generated digital signature with the received digital signature.);
Regarding claim 9, Campagna discloses the identity authentication method of claim 7 above. Campagna also discloses “further comprising: generating an initiator session key when the identity authentication of both the initiator and the interactive end are confirmed” ([0059]-[0063] Figs. 5-6, once both parties have calculated the shared secrets 620 and 622, these shared secrets may be used to establish a password-protected communication session.);
“encrypting a session message through the initiator session key to obtain an initiator session authentication message” ([0059]-[0063] Figs. 5-6, once both parties have calculated the shared secrets 620 and 622, these shared secrets may be used to establish a password-protected communication session.);
“and sending the initiator session authentication message to the interactive end to verify the session authentication message” ([0059]-[0063] Figs. 5-6, Upon establishment, Client A and Client B can communicate via the password-protected communication.);
Regarding claim 10, Campagna discloses the identity authentication method of claim 7 above. Campagna also discloses “wherein after the sending the first authentication information to the interactive end to control the interactive end to authenticate an identity of the initiator according to the first identification information and the first authentication information, the method further comprises: establishing a session communication with the interactive end in response to a reception of an authentication pass message sent by the interactive end” ([0059]-[0063] Figs. 5-6, once both parties have calculated the shared secrets 620 and 622, these shared secrets may be used to establish a password-protected communication session. Upon establishment, Client A and Client B can communicate via the password-protected communication.);
Regarding claim 18, Campagna discloses similar limitations as described in claim 1 above. Campagna also discloses “an electronic device, comprising a processor and a memory storing computer-readable instructions executable by the processor to perform operations” ([0123] Server includes an operating system providing executable program instructions stored in a memory executed by a processor of the server. Memory is in a storage medium such as a hard disk.);
Regarding claim 20, Campagna discloses the electronic device of claim 18 above. Campagna also discloses the limitations as described in claim 2 above.
Regarding claim 21, Campagna discloses the electronic device of claim 18 above. Campagna also discloses the limitations as described in claim 3 above.
Regarding claim 22, Campagna discloses the electronic device of claim 18 above. Campagna also discloses the limitations as described in claim 4 above.
Regarding claim 23, Campagna discloses the electronic device of claim 18 above. Campagna also discloses the limitations as described in claim 5 above.
Regarding claim 24, Campagna discloses the electronic device of claim 18 above. Campagna also discloses the limitations as described in claim 6 above.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Lee et al. (US 11706031 B2, "Security Authentication System For Membership Login Of Online Website And Method Thereof")
Yin et al. (US 20200169548 A1, "NETWORK ACCESS AUTHENTICATION METHOD, APPARATUS, AND SYSTEM")
Driever et al. (US 20200076600 A1, "SHARED KEY PROCESSING BY A HOST TO SECURE LINKS")
Liu et al. (US 20240097895 A1, "DEVICE IDENTITY AUTHENTICATION METHOD AND APPARATUS, ELECTRONIC DEVICE, AND COMPUTER-READABLE MEDIUM")
Wang et al. (NPL, "EBIAS: ECC-enabled blockchain-based identity authentication scheme for IoT device", 2024)
Any inquiry concerning this communication or earlier communications from the examiner should be directed to TOMMY MARTINEZ whose telephone number is (703)756-5651. The examiner can normally be reached Monday thru Friday 8AM-4PM ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jorge L. Ortiz-Criado can be reached at (571) 272-7624 on Monday thru Friday 7AM-7PM ET. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/T.M./ Examiner, Art Unit 2496 /ABU S SHOLEMAN/Primary Examiner, Art Unit 2496
Prosecution Insights