DETAILED ACTION
This Office Action is in response to the communication filed on 3/9/2026.
Election was made without traverse, group 1 claims 1-11 were elected.
Claims 1-11 are pending.
Claims 1-11 are rejected.
The Examiner cites particular sections in the references as applied to the claims below for the convenience of the applicant(s). Although the specified citations are representative of the teachings in the art and are applied to the specific limitations within the individual claim, other passages and figures may apply as well. It is respectfully requested that, in preparing responses, the applicant(s) fully consider the references in their entirety as potentially teaching all or part of the claimed invention, as well as the context of the passage as taught by the prior art or disclosed by the Examiner.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1 (and dependent claims 2-11) rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Regarding claims 1 and 6-7, the calculating a pre-shared renders the claim indefinite. It is not clear how the pre-shared key is and generated by the IoT device and also still considered to be pre-shared.
Claim 6 recites “generate the PSK… at the IoT device and at a GBA server upon calculation of the PSK” it is unclear how the “PSK is generated”… “upon calculation of the PSK”. The relationship between generating and calculating is not clear.
Claim 7 recites “derive the pre-shared key based on hash-based pseudo random number generation using the subscriber key and the IMSI”. The claim reads that the PSK is derived based on the RNG. Is it not clear how the subscriber key and the IMSI are used. For does PSK=(RNG+key+IMSI) or does PSK=RNG and RNG=(key+IMSI)?
Claim 9 recites the limitation "the instructions that when executed cause the processor to update the LwM2M server with the Lwm2M device identifier and the PSK" in claim 9. There is insufficient antecedent basis for this limitation in the claim. Applicant has not introduced any “instructions… to update the LwM2M server with the Lwm2M device identifier and the PSK”.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-2 and 4 are rejected under 35 U.S.C. 103 as being unpatentable over Chertov (W.O. 2024251721), in view of Kumar (U.S. 20200186365)
Regarding claim 1,
Chertov in view of Kumar discloses: A system for provisioning an Internet of Things (IoT) device, comprising:
a processor; and a memory comprising instructions that when executed, cause the processor to: (Chertov [Pg. 10 Ln 15 - Pg. 11 Ln 1-20] teaches memory and processor)
initiate (Chertov [Pg. 10 Ln 1 – Ln 30; Pg. 12 Ln 1 – Ln 30; Pg 17 Ln 1 – Ln 30] teaches SIM-based Zero Touch Provisioning and Automatic Device Onboarding, which [Pg. 3 Ln 1-5] teaches includes extended functionality of the SE, an efficient, hardware-agnostic solution for zero touch provisioning of loT devices)
perform self-contained definition of the IoT device based on the SIM authentication; (Chertov [Pg. 12 Ln 1 – Pg. 12 Ln 30] teaches a “self-contained” process, including use of identify modules such as SIM cards, which extracts information, which is used for SIM based device authentication, that has been embedded in the device itself)
(Chertov [Pg. 18 Ln 1-25] teaches PSK provisioning)
update an IoT device management server with an IoT device identifier and the (Chertov [Pg. 18 Ln 1-25] teaches automatically updating the device manager with the device identifier when onboarding the new device)
update a device agent of the IoT device with the IoT device identifier, the IoT device management server URL, and the PSK, thereby facilitating registration of the IoT device with the IoT device management server. (Chertov [Pg. 3 Ln 1] teaches ZTP agent; [Pg. 18 Ln 1-25] teaches that the ZTP agent is updated with device configurations (including information which identifies the device) and PSK’s which are used for device onboarding with the device management server)
While Chertov discloses authenticating device based using information which is known to be good (bootstrapping), Chertov does not explicitly recite the word: Bootstrapping
calculating a pre-shared key (PSK)
updating an IoT device management server with the PSK obtained from the self-contained definition of the IoT device
collect a uniform resource locator (URL) associated with the IoT device management server;
However, in the same field of endeavor Kumar discloses: Bootstrapping (Kumar [Abstract] a method is executed for zero-touch provisioning of devices using device configuration templates by device type from a device owner, a secure element on a device, a provisioning wizard on the device by a device manufacturer, and a provisioning client, an enrollment client, an update client and bootstrap metadata on the device, and an enrollment service, a device owner signing certificate, a device owner encryption certificate and an update publisher service on a device management service)
calculating a pre-shared key (PSK) and updating an IoT device management server with the PSK obtained from the self-contained definition of the IoT device (Kumar [0041] teaches generating a key using the devices secure element and sending that key to the device management server)
collect a uniform resource locator (URL) associated with the IoT device management server; and (Kumar [Abstract, 0008-0010, 0025-0028, 0036] teaches zero-touch provisioning of devices at scale using device configuration templates; The device enrollment configuration template may comprise of at least a device enrollment service network address (for example a uniform resource locator (URL))
Chertov and Kumar are analogous art because they are from the same field of endeavor of device provisioning using ZTP.
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art, having the teachings of Chertov and Kumar before him or her, to modify the method of Chertov to include the generation of a key by the device and updating the device manager with the device generated key of Kumar because it will allow for a key generated by the device to be used for future authentication purposes.
The motivation for doing so would be [“The disclosed method can provide significant improvements and efficiencies to retrofit legacy brownfield devices for zero-touch remote device lifecycle management.”] (Paragraph 0007 by Kumar)].
Therefore, it would have been obvious to combine Chertov and Kumar to obtain the invention as specified in the instant claim.
Regarding claim 2,
Chertov in view of Kumar discloses: The system of claim 1, wherein the instructions that when executed cause the processor to perform self-contained definition of the IoT device further cause the processor to derive the IoT device identifier from an international mobile subscriber identity (IMSI) and related key information stored on the SIM. (Chertov [Pg, 1 Ln 20-30; Pg. 12 Ln 5-30; Pg. 17 Ln 1-17; Pg. 18 Ln 1-30; Pg. 20 Ln 15-20] teaches an integrated Circuit Card Identification Number (ICCID), which is used to determine a deviceID and is “derived” from the SIM card, which are used for the self-contained definitions of the device)
Regarding claim 4,
Chertov in view of Kumar discloses: The system of claim 2, wherein the related key information comprises at least one of a unique serial number of the SIM, access control class information, a set of PSKs stored on the SIM used for the authentication of the SIM and the bootstrapped provisioning of the ioT device, a subscriber key uniquely identifying a subscriber associated with the IoT device, and a tenant identifier. (Chertov [Pg. 18 Ln 1-25] teaches PSK’s, deviceID, ICCID and SIM, which is information related key infomration)
Regarding claim 11,
Chertov in view of Kumar discloses: The system of claim 1, wherein the initiated bootstrapped provisioning of the IoT device comprises initiating and performing provisioning of communications componentry of the IoT device and functional IoT componentry of the IoT device beginning with and based on the authentication of the SIM of the IoT device. (Chertov [Pg. 11, Pg. 12, Pg. 18-Pg. 20] teaches initialization and performing provisioning including components of IoT devices which is based on SIM authentication of an IoT device)
Claim 3 and 5-10 is rejected under 35 U.S.C. 103 as being unpatentable over Chertov (W.O. 2024251721), in view of Kumar (U.S. 20200186365) and in further view of Bone (G.B. 2518975)
Regarding claim 3,
Chertov in view of Kumar discloses: The system of claim 2,
Chertov in view of Kumar does not explicitly disclose: wherein the derived IoT device ID comprises a lightweight machine-to-machine (LwM2M) device identifier.
However, in the same field of endeavor Bone teaches: wherein the derived IoT device ID comprises a lightweight machine-to-machine (LwM2M) device identifier. (Bone [Abstract, Pg. 32 para 3, Pg. 45 para 2-4, Pg. 50 Para 2-6] teaches The communication may be for managing the M2M device or services provided via the device, preferably based on a standardized device management protocol such as the lightweight-machine-to-machine LWM2M protocol including “identifiers for device”)
Chertov in view of Kumar and Bone are analogous art because they are from the same field of endeavor Bootstrapping authentication.
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art, having the teachings of Chertov in view of Kumar and Bone before him or her, to modify the method of Chertov in view of Kumar to include the lwM2M of Bone because it will This makes it easier to discover a single server.
The motivation for doing so would be [“As a further enhancement, the GBA BSF may be merged into the LWM2M bootstrap server. This makes it easier to discover a single server.”] (Pg. 50 para 1 by Bone)].
Therefore, it would have been obvious to combine Chertov in view of Kumar and Bone to obtain the invention as specified in the instant claim.
Regarding claim 5,
Chertov in view of Kumar and Bone discloses: The system of claim 4,
Chertov in view of Kumar does not explicitly disclose: wherein the processor comprises a processor of a generic bootstrapping architecture (GBA).
However, in the same field of endeavor Bone teaches: wherein the processor comprises a processor of a generic bootstrapping architecture (GBA). (Bone [Pg. 32] teaches 3GPP standards and technologies used to implement aspects of the method and system One of these architectures of 3GPP is a Generic Authentication Architecture (GAA); Generic Bootstrapping Architecture (GBA) is a 3GPP standard defined in 3GPP TS 33.220).
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify with Bone for similar reasons as cited in claim 3.
Regarding claim 6,
Chertov in view of Kumar and Bone discloses: The system of claim 5, wherein the memory comprises further instructions that when executed further cause the processor to
Chertov in view of Kumar does not explicitly disclose: generate the PSK based on the SIM authentication at the IoT device and at a GBA server upon calculation of the PSK.
However, in the same field of endeavor Bone teaches: generate the PSK based on the SIM authentication at the IoT device and at a GBA server upon calculation of the PSK. (Bone [Pg. 20, 31-32, 39, 52] teaches that the client device and the GAB server can generate the PSK using the SIM authentication)
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify with Bone for similar reasons as cited in claim 3.
Regarding claim 7,
Chertov in view of Kumar and Bone discloses: The system of claim 6, wherein the instructions that when executed cause the processor to
Chertov does not explicitly disclose: calculate the pre-shared key further causes the processor to derive the pre-shared key based on hash-based pseudo random number generation using the subscriber key and the IMSI. (Kumar [Col 14 Ln 4-63, Col 36 Ln 37-68, Fig. 7A] teach that the PSK can be generated using a hash based randomly generated nonce (number) and uses a client’s key and IMSI)
Regarding claim 8,
Chertov in view of Kumar and Bone discloses: The system of claim 6, wherein the IoT device management server comprises
Chertov in view of Kumar does not explicitly disclose: a LwM2M server communicatively coupled to the GBA server via an Internet connection.
However, in the same field of endeavor Bone teaches: a LwM2M server communicatively coupled to the GBA server via an Internet connection. (Bone [Pg. 32, 50] teaches the device management server can contain a GBA server which can be coupled to the lwM2M server)
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify with Bone for similar reasons as cited in claim 3.
Regarding claim 9,
Chertov in view of Kumar and Bone discloses: The system of claim 8,
Chertov teaches zero touch provisioning (ZTP) (Chertov [Pg. 10 Ln 1 – Ln 30; Pg. 12 Ln 1 – Ln 30; Pg 17 Ln 1 – Ln 30, Pg. 18 Ln 1-30] teaches SIM-based Zero Touch Provisioning and Automatic Device Onboarding and updating)
Chertov in view of Kumar and Bone does not explicitly disclose: wherein the instructions that when executed cause the processor to update the LwM2M server with the LwM2M device identifier and the PSK further cause the processor to control a GBA application programming interface (API) implemented within the LwM2M server to update… software of the LwM2M server with the LwM2M device identifier and the PSK.
However, in the same field of endeavor Bone teaches: wherein the instructions that when executed cause the processor to update the LwM2M server with the LwM2M device identifier and the PSK further cause the processor to control a GBA application programming interface (API) implemented within the LwM2M server to update… software of the LwM2M server with the LwM2M device identifier and the PSK. (Bone [Pg. 53-54] teaches updating; [Pg. 32, 50] teaches the GBA application and the lwM2M server; [Pg. 41] teaches API’s may be used)
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify with Bone for similar reasons as cited in claim 3.
Regarding claim 10,
Chertov in view of Kumar and Bone discloses: The system of claim 9,
Chertov discloses: wherein the instructions that when executed cause the processor to collect the…URL from the ZTP software. (Chertov [Pg. 10 Ln 1 – Ln 30; Pg. 12 Ln 1 – Ln 30; Pg 17 Ln 1 – Ln 30, Pg. 18 Ln 1-30] Collecting a URL of the ZTP software)
Chertov in view of Kumar does not explicitly disclose: LwM2M server URL… of the LwM2M server
However, in the same field of endeavor Bone teaches: LwM2M server URL… of the LwM2M server. (Bone [Pg.41-42, 50] teaches the URL can be the URL of a lwM2M server)
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to modify with Bone for similar reasons as cited in claim 3.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's
disclosure.
Kohnhaeuser 2024-04-03 (U.S. 20250258894 ) teaches A method for providing a secure onboarding of a component from at least one first host device into a second host device includes verifying the integrity, authenticity and/or execution environment of the first host device by an orchestrator; providing a trusted root certificate to the second host device by the orchestrator; providing an onboarding identity by the orchestrator to the first host device, when the integrity, the authenticity and/or the execution environment of the first host device has been verified; receiving the onboarding identity from the orchestrator by the first host device and assigning the onboarding identity to the component; providing the assigned onboarding identity to the second host device; and securely onboarding the component from the first host device into the second host device based on the assigned onboarding identity and the provided trusted root certificate.
Bruner 2019-10-21 (U.S. 20210120412 ) teaches An internet of things (“IoT”) device is disclosed that can be authenticated on a wireless local area network (“WLAN”) without human intervention. The IoT device can also authenticate itself with a network service without human intervention. In order to enable this functionality, data identifying a service set identifier (“SSID”) used by the WLAN, a digital certificate for use in authenticating on the WLAN, and a digital certificate for use in authenticating with a network service are stored in the IoT device at the time it is manufactured. The digital certificate for authenticating on the WLAN is stored at an authentication server and information about the digital certificate for use in authenticating with the network service is stored at the network service. The IoT device can use the SSID to connect to the WLAN and use the digital certificates to authenticate with the authentication server and the network service, respectively.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to THOMAS A CARNES whose telephone number is (571)272-4378. The examiner can normally be reached Monday-Friday.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Shewaye Gelagay can be reached at (571) 272-4219. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
THOMAS A. CARNES
Examiner
Art Unit 2436
/THOMAS A CARNES/Examiner, Art Unit 2436 /SHEWAYE GELAGAY/Supervisory Patent Examiner, Art Unit 2436