DETAILED ACTION
Status of Claims
Claims 1 and 21 have been amended.
Claims 2-3 and 7-20 have been previously cancelled.
Claims 1, 4-6, and 21-24 are currently pending and have been considered the examiner.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
101 Rejection:
Applicant’s arguments have been considered and have been deemed unpersuasive by the examiner based upon the rationale provided in the following 101 rejection.
Prior Art Rejection:
Applicant’s arguments have been considered and are moot in view of new grounds of rejection.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1, 4-6, and 21-24 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
In the instant case, claims 1 and 4-6 are directed towards a method and claims 21-24 are directed to a system/apparatus. Therefore, these claims fall within the four statutory categories of invention.
Claim 1 recites the following:
A method comprising:
generating, by an identity provider computer program for an identity provider, a supplier attestation for a supplier comprising a chain of trust that attests that the identity provider is authorized to issue the supplier attestation and a legal entity identifier for the supplier or a certificate of incorporation for the supplier, wherein the supplier attestation is nested within an identity provider attestation;
claiming, by a supplier using a supplier electronic device, a supplier attestation for the supplier from an identity provider,
making available, by the identity provider computer program, the supplier attestation to the supplier;
storing, by the supplier using the supplier electronic device, the supplier attestation in a supplier electronic wallet; and
providing, by the supplier using the supplier electronic device, the supplier attestation to a buyer electronic device;
verifying, by the buyer electronic device and via a portal provided by the identity provider, that the supplier attestation with a distributed ledger network have not been revoked, by verifying that the chain of trust for the supplier attestation are not written as revoked on a distributed ledger; and
onboarding by the buyer electronic device, the supplier for payments following verification.
Regarding Step 2A Prong One, the claims recite the abstract idea of performing a Mental Process. Specifically, the claims recite the limitations underlined above which recite the process of performing steps which could reasonably be performed by the human mind such as observation and judgement which is grouped within the Mental Processes grouping of abstract ideas in prong one of step 2A of the Alice/Mayo test (See MPEP § 2106.04) because the claims involve the process of performing steps which could reasonably be performed by the human mind such as observation and judgement. Accordingly, the claims recite an abstract idea (See pages 7, 10, Alice Corporation Pty. Ltd. v. CLS Bank International, et al., US Supreme Court, No. 13-298, June 19, 2014; 2019 Revised Patent Subject Matter Eligibility Guidance, 84 Fed. Reg. 50, 53-54 (January 7, 2019)).
Regarding Step 2A Prong Two, the recited abstract idea is not integrated into a practical application because, when analyzed under prong two of step 2A of the Alice/Mayo test (See MPEP § 2106.04(d)), the additional element(s) of the claim(s) such as a “supplier electronic device”, “buyer electronic device”, “electronic wallet”, “portal”, and “network” merely use(s) a computer as a tool to perform an abstract idea. Specifically, the “supplier electronic device”, “buyer electronic device”, “electronic wallet”, “portal”, and “network” perform(s) the steps or functions underlined above. The use of a processor/computer as a tool to implement the abstract idea does not integrate the abstract idea into a practical application because it requires no more than a computer performing functions that correspond to acts required to carry out the abstract idea. The additional elements do not involve improvements to the functioning of a computer, or to any other technology or technical field (MPEP 2106.05(a)), the claims do not apply or use the abstract idea to effect a particular treatment or prophylaxis for a disease or medical condition (Vanda Memo), the claims do not apply the abstract idea with, or by use of, a particular machine (MPEP 2106.05(b)), the claims do not effect a transformation or reduction of a particular article to a different state or thing (MPEP 2106.05(c)), and the claims do not apply or use the abstract idea in some other meaningful way beyond generally linking the use of the abstract idea to a particular technological environment, such that the claim as a whole is more than a drafting effort designed to monopolize the exception (MPEP 2106.05(e) and Vanda Memo). Therefore, the claims do not, for example, purport to improve the functioning of a computer. Nor do they effect an improvement in any other technology or technical field. Accordingly, the additional elements do not impose any meaningful limits on practicing the abstract idea, and the claims are directed to an abstract idea.
The claim(s) do not include additional elements that are sufficient to amount to significantly more than the judicial exception because, when analyzed under step 2B of the Alice/Mayo test (See MPEP § 2106.05), the additional element(s) of a “supplier electronic device”, “buyer electronic device”, “electronic wallet”, “portal”, and “network” amounts to no more than using a computer or processor to automate and/or implement the abstract idea. As discussed above, taking the claim elements separately, the “supplier electronic device”, “buyer electronic device”, “electronic wallet”, “portal”, and “network” perform(s) the steps or functions underlined above. These functions correspond to the actions required to perform the abstract idea. Viewed as a whole, the combination of elements recited in the claims merely recite risk mitigation. Therefore, the use of these additional elements does no more than employ the computer as a tool to automate and/or implement the abstract idea. The use of a computer or processor to merely automate and/or implement the abstract idea cannot provide significantly more than the abstract idea itself (MPEP 2106.05(I)(A)(f) & (h)). Therefore, the claim is not patent eligible.
Dependent claims 4-6 and 22-24 further describe the recited abstract idea. The dependent claims do not include additional elements that integrate the abstract idea into a practical application or that provide significantly more than the abstract idea. Specifically:
Claims 4 and 22 merely further describes the supplier and buyer providing data which is observed during the recited abstract idea.
Claims 5 and 23 recite additional steps which are also directed towards the abstract idea of performing a mental process.
Claims 6 and 24 merely further describes the additional element of a buyer electronic device with integrating the recited abstract idea into practical application nor amounting to significantly more.
Therefore, as the dependent claims do not include additional elements that integrate the abstract idea into a practical application nor provide significantly more than the abstract idea, the dependent claims are also not patent eligible.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1, 4-6, and 21-24 is/are rejected under 35 U.S.C. 103 as being unpatentable over Williams et al. (US 20210081957 A1) in view of Smith et al. (US 20170317997 A1) in further view of Costa (CA 3046497 C).
Regarding Claims 1 and 21, Williams discloses:
A method comprising:
generating, by an identity provider computer program for an identity provider, a supplier attestation for a supplier comprising a chain of trust (See Williams Para. [0067] and [0051])
claiming, by a supplier using a supplier electronic device, a supplier attestation for the supplier from an identity provider (See Williams: Para. [0127] – “The method also includes an operation 3111 for receiving data defining a continuous attestation program (201) for the supplier for the set of security requirements through the supplier account.”),
providing, by the supplier using the supplier electronic device, the supplier attestation to a buyer electronic device (See Williams: Para. [0127] – “The method also includes an operation 3117 for generating evaluation metrics for the supplier automatically and in real-time based on: the continuous attestation program (201) for the supplier, and the compliance attestation responses received from the supplier, and a set of risk levels respectively corresponding to the set of security requirements. The evaluation metrics include an overall risk level for the supplier. The method also includes an operation 3119 for exposing in real-time the overall risk level for the supplier to the buyer through the buyer account in accordance with the access privilege for the buyer.”);
verifying, by the buyer electronic device and via a portal provided by the identity provider, that the supplier attestation have not been revoked (See Williams: Para. [0106] – “For each buyer account in the listing of buyer accounts, the interface of FIG. 23 enables the supplier to grant or revoke access privilege to the supplier's annual attestation program 203 and associated attestation responses. Also, for each buyer account in the listing of buyer accounts, the interface of FIG. 23 enables the supplier to grant or revoke access privilege to the supplier's sub-annual attestation program 203 and associated attestation responses.”), and
onboarding by the buyer electronic device, the supplier for payments following verification (See Williams: Para. [0122] – “In some embodiments, the buyer interface enables the buyer to create a number of supplier groups and add one or more suppliers to the supplier groups. In some embodiments, the buyer interface shows how many supplier groups of the buyer currently include at least one supplier that has a sensitive data exposure likelihood in each of a plurality of sensitive data exposure likelihood categories (such as very low, low, moderate, high, very high). In some embodiments, the buyer interface shows a group-level sensitive data exposure likelihood for each of the number of supplier groups, where the group-level sensitive data exposure likelihood for a given supplier group is a worse case sensitive data exposure likelihood for suppliers within the given supplier group. In some embodiments, the buyer interface enables the buyer to assign a priority level to each supplier group. In some embodiments, the buyer portal logic 109 is configured to aggregate supplier groups in accordance with the priority level assigned to each supplier group when showing how many supplier groups of the buyer currently include at least one supplier that has sensitive data exposure likelihood in each of the plurality of sensitive data exposure likelihood categories.”).
making available, by the identity provider computer program, the supplier attestation to the supplier (See Williams: Para. [0127] – “The method also includes an operation 3111 for receiving data defining a continuous attestation program (201) for the supplier for the set of security requirements through the supplier account.”);
However, Williams fails to explicitly disclose:
storing, by the supplier using the supplier electronic device, the supplier attestation in a supplier electronic wallet
a distributed ledger network
verifying that the chain of trust for the supplier attestation are not written as revoked on a distributed ledger;
However, in a similar field of endeavor, Smith discloses:
storing, by the supplier using the supplier electronic device, the supplier attestation in a supplier electronic wallet (See Smith: Para. [0185] – “The signed attestation transaction may include the user's public attest key, and is stored at an attestation address. In one embodiment, the user information that was validated and used to generate the attest key is stored by the user. In one embodiment, the user information is stored on the user's device. In one embodiment, the user information is stored in the user's digital wallet”)
a distributed ledger network (See Smith: Para. [0185] – “Note that, although transactions are communicated over the Bitcoin network for entry into the blockchain, participants referred to as “miners” may ultimately be the entities that perform transaction verification and entry into the blockchain”)
verifying that the chain of trust for the supplier attestation are not written as revoked on a distributed ledger (See Smith: Para. [0083] – “verifying the existence of the attestation transaction at the attestation address in the centralized or distributed ledger and verifying that the attestation transaction has not been revoked”);
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date to modify the method of Williams to be implemented using the blockchain distributed ledger with nodes such as an electronic wallet as disclosed by Smith to process the supplier attestation information disclosed by Williams yielding the predictable result of an increase in the security strength of the invention by leveraging the immutable properties of blockchain ledgers.
However, the combination of Williams and Smith fails to explicitly disclose:
a chain of trust that attests that the identity provider is authorized to issue the supplier attestation and a legal entity identifier for the supplier or a certificate of incorporation for the supplier, wherein the supplier attestation is nested within an identity provider attestation;
However, in a similar field of endeavor, Costa discloses:
a chain of trust that attests that the identity provider is authorized to issue the supplier attestation and a legal entity identifier for the supplier or a certificate of incorporation for the supplier, wherein the supplier attestation is nested within an identity provider attestation (See Costa: Para. [0059] – “FIG. 7 depicts an example chain of trust 700 for software attestation. The chain of trust in software attestation may be rooted in a signing key owned by the manufacturer of the trusted platform, such as the trusted platform 530 of FIG. 5. The trusted platfolin may include hardware components such as a secure processor or a hardware security module (HSM), and thus the manufacturer may be a provider of computer hardware and may also provide software for the trusted platform. The manufacturer may be trusted by the verifier 702, and the verifier may know the public key PubRK 732 of the manufacturer root key 736. The enclave client 510 of FIG. 5 is an example of a
verifier 702 that may wish to have assurances about a secure container 708. The manufacturer may act as a certificate authority and provide each instance of trusted platform that it produces, for example each secure processor, with a unique attestation key 722, which is used to produce attestation signatures. The manufacturer also issues an endorsement certificate 728 for each attestation key 722. The manufacturer root key 736 includes a private key PrivRK 734 that is used to sign the endorsement certificate 728. The signing of the endorsement certificate
provides an integrity guarantee, for example as shown in FIG. 3.”);
Therefore, it would have been obvious to one of ordinary skill in the art to substitute the generic chain of trust disclosed by the combination of Williams and Smith for the chain of trusted comprising nested attestations disclosed by Costa yielding the predictable result of an increase in the security strength of the invention by leveraging multiple attestations at once.
Regarding Claims 4 and 22, the combination discloses:
wherein the supplier and the buyer are participants in a distributed ledger network (See Smith: Para. [0013] – “In some embodiments, the centralized or distributed ledger is the bitcoin blockchain.”).
Regarding Claims 5 and 23, the combination discloses:
wherein the step of providing the supplier attestation to the buyer electronic device comprises: presenting, in a portal presented by the supplier electronic device, a plurality of buyers for selection (See Williams: Fig. 30; See Williams: Para. [0114] – “FIG. 30 shows an example selectable interface of the supplier portal interface that provides an overview of the continuous-real-time supplier compliance status for the supplier account, in accordance with some embodiments.”);
receiving, in the portal executed by the supplier electronic device, a selection of the buyer (See Williams: Para. [0114] – “It should be understood that the appearance and organization of various graphical elements, informational elements, and data entry elements of the selectable interface of FIG. 30 can vary in different embodiments of the supplier portal interface.”); presenting, in the portal presented by the supplier electronic device,
a plurality of attestations for selection; and receiving, in the portal executed by the supplier electronic device, a selection of the supplier attestation (See Williams: Para. [0120] – “In some embodiments, the buyer interface includes a second selectable view showing a listing of suppliers of the buyer. In some embodiments, the second selectable view shows a current compliance attestation status of each supplier in the listing of suppliers in accordance with the access privilege for the buyer. In some embodiments, the second selectable view shows a current sensitive data exposure likelihood of each supplier in the listing of suppliers in accordance with the access privilege for the buyer. In some embodiments, the buyer interface includes a third selectable view showing details of supplier compliance attestation responses in accordance with the access privilege for the buyer. In some embodiments, the buyer interface includes a fourth selectable view showing confidence levels for supplier compliance attestation responses in accordance with the access privilege for the buyer.”)
Regarding Claims 5 and 24, the combination discloses:
wherein the buyer electronic device is configured to retrieve supplier information from an enterprise resource planning system (See Williams: Para. [0105] – “The interface of FIG. 22 enables the supplier to enter and update information for the supplier, including the physical address of the supplier, the contact information for the supplier, the supplier's NAICS list, the supplier size, and other supplier information. It should be understood that the appearance and organization of various graphical elements, informational elements, and data entry elements of the selectable interface of FIG. 22 can vary in different embodiments of the supplier portal interface.”).
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to NICHOLAS K PHAN whose telephone number is (571)272-6748. The examiner can normally be reached M-F 1 pm-9 pm EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Neha Patel can be reached at 571-270-1492. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/NICHOLAS K PHAN/Examiner, Art Unit 3699
Prosecution Insights