DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
The Amendment filed
Claims 1-20 are pending.
This Action is Final.
Claim Objections
The objections to claims 2 and 12 are withdrawn based on the filed amendment.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 8-11, and 15-17 are rejected under 35 U.S.C. 103 as being unpatentable over Eberwine et al. (US 20150350913) in view of Vasquez (US 20140049366) and further in view of Scoggins et al. (US 20150199863).
As per claims 1 and 11, Eberwine et al. discloses a method and a system comprising: an access control application operable on a mobile device and comprising a mobile library; an access control (see Fig. 1 and paragraphs [0019]-[0024]);
the access control system configured to operate as follows: the mobile device and access control establishing a near field communication session in response to a user with the mobile device on the access control; on the mobile device using near field communication to transfer a mobile credential to the access control by a secure credential exchange (see paragraphs [0021] and [0034] where the payload includes a credential and the exchange is secured because NFC is a secure protocol and the information is encrypted);
on the access control, decrypting and validating the mobile credential; and on the access control, in response to validating the mobile credential, allowing access by the user of the mobile device (see paragraphs [0035]-[0038]).
Eberwine et al. fails to explicitly disclose the access control includes a credential module and that the connection is established in response to tapping the mobile device on the access control.
However, Vasquez teaches an access control with a credential module that decrypts and validates a credential information (see paragraph [0074] and Fig. 4) in response to tapping the mobile phone to the access control (see paragraphs [0099]-[0101]).
At a time before the effective filing date of the invention, it would have been obvious to one of ordinary skill in the art to include the specific modules and tapping of Vasquez in the Eberwine et al. system.
Motivation, as recognized by one of ordinary skill in the art, to do so would have been to allow flexibility in the system by having specific modules to perform the different operations and that tapping is a well-known and common way to initiate NFC communications.
While the modified Eberwine et al. and Vasquez system discloses the use of a mobile app, i.e. software library, used to initiate the secure credential exchange with the access control (see Eberwine et al. paragraphs [0030] and [0043]), there lacks an explicit teaching of the use of an application programming interface.
However, Scoggins et al. teaches a software-to-software application programming interface in the mobile library to initiate the secure credential exchange, and the mobile library communicate with the access control to perform the secure credential exchange (see paragraphs [0067], [0073], and [0119]).
At a time before the effective filing date of the invention, it would have been obvious to one of ordinary skill in the art to use the software aspects of Scoggins et al. in the modified Eberwine et al. and Vasquez system.
Motivation, as recognized by one of ordinary skill in the art, to do so would have been to allow for easy implementation on different mobile devices.
As per claims 8, 9, 15, and 16, the modified Eberwine et al., Vasquez, and Scoggins et al. system discloses the access control is a door lock and the access control is a lockbox (see Vasquez paragraph [0026]).
As per claims 10 and 17, the modified Eberwine et al., Vasquez, and Scoggins et al. system discloses the access control storing data identifying the mobile device for use in an audit trail (see Vasquez paragraphs [0044] and [0049]).
Claims 2-7, 12-14, and 18-20 are rejected under 35 U.S.C. 103 as being unpatentable over the modified Eberwine et al., Vasquez, and Scoggins et al. system as applied to claims 1 and 11 above, and further in view of Conrad et al. (US 20160036788).
As per claims 2 and 12, the modified Eberwine et al., Vasquez, and Scoggins et al. system discloses a credential service adapted to wirelessly communicate with the mobile device, the system further configured to operate as follows: the mobile device downloading an encrypted credential from the credential service by: the mobile device securely authenticating to the credential service; in response to the authenticating, the credential service generating the encrypted credential; the mobile device receiving and storing the encrypted credential; the mobile device communicating the encrypted credential to the access control (see Eberwine et al. paragraphs [0032]-[0038] and Vasquez paragraph [0043]).
The modified Eberwine et al. and Vasquez system discloses fails to explicitly disclose the encrypted credential is an encrypted programming credential.
However, Conrad et al. teaches a system with a mobile device wirelessly in communication with a server and an access control where the server provides an encrypted programming credential which is communicated to the access control (see paragraphs [0094] and [0098] the key change command is a programming credential since it programs the new credential in the access control).
At a time before the effective filing date of the invention, it would have been obvious to one of ordinary skill in the art to include the encrypted programming credential of Conrad et al. in the modified Eberwine et al., Vasquez, and Scoggins et al. system.
Motivation to do so would have been to handle the situation when a profile with an access credential could not be removed from a mobile device, thereby changing the credential to prevent unauthorized access (see Conrad et al. paragraphs [0094] and [0098]).
As per claims 3, 13, and 20, the modified Eberwine et al., Vasquez, Scoggins et al., and Conrad et al. system discloses the access control decrypting and validating the encrypted programming credential; and the access control programming an encryption key using the extracted programming data (see Conrad et al. paragraphs [0094] and [0098]).
As per claim 4, the modified Eberwine et al., Vasquez, Scoggins et al., and Conrad et al. system discloses the step of receiving and storing the encrypted programming credential is performed using native operating system protections of the mobile device (see Conrad et al. paragraph [0038] where the browser is used for communication that has native operating system protections; where any app installed, e.g. the app of Eberwine et al. and/or Vasquez, additionally are protected by the operating system).
As per claim 5, the modified Eberwine et al., Vasquez, Scoggins et al., and Conrad et al. system discloses the encrypted programming credential is for a virtual access card (see Vasquez paragraph [0045] and Conrad et al. paragraphs [0094] and [0098]).
As per claim 6, the modified Eberwine et al., Vasquez, Scoggins et al., and Conrad et al. system discloses the programming data is operable to set or roll a lock encryption key (see Conrad et al. paragraphs [0094]-[0098] where the lock key that is updated is used for both access control and encryption).
As per claims 7 and 14, the modified Eberwine et al., Vasquez, Scoggins et al., and Conrad et al. system discloses the encrypted programming credential is for use in a facility comprising a plurality of entry controls, and the encrypted programming credential includes a virtual card data which is the same for each entry control, and, for each entry control, a unique key (see Eberwine et al. paragraphs [0027] and [0033]-[0035] the use of a master key and Conrad et al. paragraph [0056] where the same profile which has common fields is used for different access controls with different values for the fields).
As per claims 18 and 19, the modified Eberwine et al., Vasquez, Scoggins et al., and Conrad et al. system discloses method of access management comprising: receiving an indication of check-in by a user; assigning an access control to the user at a management system; communicating the assigned access control and user information to a credential service; receiving, at the credential service, a communication from a mobile device of the user, the mobile device having a mobile library, the communication including a shared secret from the mobile library; at the credential service and in response to the shared secret, authenticating the mobile library; downloading, from the credential service to the mobile library, an encrypted programming credential; and communicating, from the mobile library to the assigned access control, the encrypted programming credential and, in response to the authenticating, the credential service generating the encrypted programming credential (see Eberwine et al. paragraphs [0021] and [0032]-[0038]; Vasquez paragraphs [0043]-[0045], [0074], and [0099]-[0101]; Scoggins et al. paragraphs [0067], [0073], and [0119]; and Conrad et al. paragraphs [0094] and [0098] as applied above, where the registration steps are a check-in and a password or other authentication information is a shared secret).
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 1-20 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-20 of U.S. Patent No. 12,159,497 in view of Eberwine et al., Vasquez, Scoggins et al. and/ Conrad et al. as applied above. More specifically ‘497 has a system described in claims 1-15 corresponding to claims 11-20 of the present application and where claims 16-20 correspond to claims 1-10 of the present application; where any differences (e.g. tapping to initiate) are obvious over the references as applied above where one of ordinary skill in the art would find it obvious to combine these references with the patented claims to render the present claims obvious in order to provide multiple verification steps thereby increasing security (see Eberwine et al. Fig. 4); as recognized by one of ordinary skill in the art, to allow flexibility in the system by having specific modules to perform the different operations and that tapping is a well-known and common way to initiate NFC communications (Vasquez); and to handle the situation when a profile with an access credential could not be removed from a mobile device, thereby changing the credential to prevent unauthorized access (see Conrad et al. paragraphs [0094] and [0098]).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure: the remaining references put forth on the PTO-892 form are directed towards communications between mobile devices and access controls.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MICHAEL J PYZOCHA whose telephone number is (571)272-3875. The examiner can normally be reached Monday-Thursday 7:30am-5:00pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Hadi Armouche can be reached at (571) 270-3618. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Michael Pyzocha/Primary Examiner, Art Unit 2409
Prosecution Insights