DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103, which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 21-26, 29-40 are rejected under 35 U.S.C. 103 as being unpatentable over US 20220408243 A1 (Mattsson), in view of 3GPP SA3 CR S3-213902 (InterDigital).
Regarding Claims 21 and 35:
A method applied to a universal integrated circuit card (Mattsson: discloses that the padding/SUCI-generation method may be performed by the USIM, a component of the universal integrated circuit card, e.g., [0090] "In some embodiments, SUCI can be calculated by both USIM and mobile phone... when padding is used... the USIM can return the padded SUPI (padded MSIN or padded username) to the mobile phones."),
the method comprising: generating, by the universal integrated circuit card, the universal integrated circuit card configured with a subscription permanent identifier and a pseudo identifier corresponding to the subscription permanent identifier, a subscription concealed identifier based on the pseudo identifier (Mattsson: discloses generating a padded identifier (a pseudo identifier corresponding to the SUPI) and using it, rather than the unpadded SUPI, as the basis for the SUCI, e.g., [0005] "generating a padded identifier by inserting a padding bitstring in a field of an identifier associated with the UE... encrypting the padded identifier to generate a concealed padded identifier."; and further discloses that the identifier may be pre-configured (i.e., the UE/UICC is "configured with" the padded version) prior to any single encryption event, e.g., [0089] "if there are two users and their usernames are ABC (length 3) and QRST (length 4), then the network could already assign the fixed length usernames as ABC0000000 (length 10) and QRST000000 (length 10)... This would mean that IMSI and NAI when provisioned in UE (USIM, simcard, or mobile phones), those identifiers are already padded."),
wherein a length of a username comprised in the pseudo identifier is different from a length of a username comprised in the subscription permanent identifier (Mattsson: padded username necessarily differs in length from the unpadded username, e.g., [0071]-[0075] "Assuming the Network Specific Identifier user17@example.com... With padding for the Profile A protection scheme: type1.rid678.schid1.hnkey27.ecckey<ECC ephemeral public key>.cip<encryption of byte-encode(user17@@.@)>mac<MAC tag value>@example.com where "@@...@" is a character string that adds Ni/8 [bits] to the length in bytes of byte-encode(user17@@...@) compared to byte-encode(user17)."),
and the length of the username comprised in the pseudo identifier is greater than a first threshold and less than a second threshold (Mattsson: discloses padding lengths chosen based on a statistical distribution of username lengths, and padding to a target total length, e.g., [0061] "information elements in the SUPI can be padded with padding where a length of the padding is randomly, pseudo-randomly or deterministically chosen in the integer interval [N2,N3]." It would be obvious to a person of ordinary skill that selecting a length within the interval [N2, N3] constitutes bounding the length greater than a first threshold (N2) and less than a second threshold (N3); Mattsson further discloses that the padding decision-maker (e.g., the home network) bases this target length on the distribution of username lengths across its subscriber base, e.g., [0077] "The HN may have more information regarding the distribution of username lengths in its subscriber database (like HSS or UDM) and therefore, the HN may be able to make better padding decisions than the UE."; InterDigital also confirms this same population-distribution-based target-length concept, e.g., Reason for change: "The scheme cannot dynamically adapt when the username length distribution at a particular realm changes... requiring the username length distribution to be established in advance to be configured into the UE and the network (i.e., SIDF)”, where incorporating industry standard into one’s products ensures product compatibility and expands market compatibility);
and sending, by the universal integrated circuit card, the subscription concealed identifier to a mobile equipment (Mattsson: discloses the USIM calculating the SUCI and passing it to the mobile equipment, e.g., [0090]-[0090] "When a mobile phone calculates SUCI, it may ask for a SUPI from a USIM. ... the USIM can return the padded SUPI to the mobile phones.")
Regarding Claims 22, 36, Mattsson as modified further teaches:
The method according to claim 21, further comprising: receiving, by the universal integrated circuit card, a user identity request message from the mobile equipment; and in response to the user identity request message, sending, by the universal integrated circuit card, the subscription permanent identifier to the mobile equipment (Mattsson: teaches the mobile equipment requesting the identifier from the universal integrated circuit card, e.g., [0090], "When a mobile phone calculates SUCI, it may ask for a SUPI from a USIM. ... the USIM can return the padded SUPI to the mobile phones." It is noted that it would be an obvious operational requirement of standard smart-card communication protocols for the mobile equipment to send a formal request message to retrieve this permanent identifier).
Regarding Claims 23 and 30, Mattsson as modified further teaches:
The method according to claim 21, wherein the length of the username comprised in the subscription permanent identifier is less than the first threshold or greater than the second threshold (Mattsson: teaches identifying username lengths that fall outside normative distributions to prevent tracking, e.g., [0048], "The usernames in NAIs belonging to a single realm, typically have variable length... An attacker with knowledge of the username distribution will therefore be able to differentiate". It would be obvious to trigger the padding modification exclusively when the true identifier length falls outside the desired safety interval (i.e., less than the first threshold or greater than the second threshold).
Regarding Claims 24 and 31, Mattsson as modified further teaches:
The method according to claim 21, wherein values of the first threshold and the second threshold are determined by a distribution of lengths of usernames comprised in a plurality of subscribed subscription permanent identifiers in an operator network (Mattsson: teaches utilizing the statistical distribution of the operator network to determine padding lengths, e.g., [0061], "information elements in the SUPI can be padded with padding where a length of the padding is... chosen from a statistical distribution."; and [0077], "The HN may have more information regarding the distribution of username lengths in its subscriber database... and therefore, the HN may be able to make better padding decisions than the UE.").
Regarding Claims 25 and 37, Mattsson as modified further teaches:
The method according to claim 21, further comprising: determining, by the universal integrated circuit card, an encryption algorithm; and wherein generating, by the universal integrated circuit card, the subscription concealed identifier based on the pseudo identifier comprises: when the encryption algorithm is a non-null algorithm, generating, by the universal integrated circuit card, the subscription concealed identifier based on the pseudo identifier and the encryption algorithm (Mattsson: teaches padding the identifier specifically prior to non-null encryption algorithms (e.g., Profile A)., e.g., [0028], "There exists also a special encryption scheme named the 'null-scheme.' This null-scheme does not do any actual encryption"; and [0069]-[0070], "With padding for the Profile A protection scheme... cip< encryption of byte-encode...").
Regarding Claims 26 and 32, Mattsson as modified further teaches:
The method according to claim 21, wherein the subscription concealed identifier comprises first indication information, and the first indication information indicates that the subscription concealed identifier is generated based on the pseudo identifier (Mattsson: teaches including unencrypted indication information within the SUCI to flag the use of padding, e.g., [0058], "the length of the padding is included unencrypted in the SUCI."; and [0059], "the delimiter is included unencrypted in the SUCI." It would be obvious to use this unencrypted delimiter as "first indication information" to inform the backend network that a pseudo-identifier/padding format was generated).
Claims 27-28 are rejected under 35 U.S.C. 103 as being unpatentable over US 20220408243 A1 (Mattsson), in view of 3GPP SA3 CR S3-213902 (InterDigital) and IETF RFC 7542 (RFC 7542).
Regarding Claim 27, Mattsson as modified further teaches:
The method according to claim 21, wherein the pseudo identifier comprises second indication information, and the second indication information indicates that the username comprised in the pseudo identifier is a mapped username (Mattsson: teaches a delimiter embedded within the padded username, prior to encryption, flagging the boundary between real content and padding so the network can recover the original/mapped username, e.g., [0053] "a delimiter (e.g. the bitstring 0b0111, the character "@" or the byte value 0xFF) is used in the plaintext before being encrypted to separate the rest of the padding from the rest of the plaintext"; furthermore, InterDigital teaches the analogous use of reserved characters for the same purpose, e.g., Annex X.2, "special characters that cannot be used for a username."; and RFC 7542 p12, 2.4 illustrate the related "anonymous" placeholder convention).
It would have been obvious for one of ordinary skill in the art before the effective filling date of the claimed invention was made to modify Mattsson with second indication information, and the second indication information indicates that the username comprised in the pseudo identifier is a mapped username as further taught by RFC 7542. The advantage of doing so is to leverage industrial standard to enhance product features and ensure compatibility.
Regarding Claim 28, Mattsson as modified further teaches:
The method according to claim 21, wherein both the pseudo identifier and the subscription permanent identifier are represented in a network access identifier format (Mattsson: teaches to apply this obfuscation to NAI formatted identifiers, e.g., [0036], “If the SUPI is of type network specific identifier, the Home Network Identifier is generally represented by so-called 'realm,' and the subscription identifier is generally represented by so-called 'username.' Therefore, the NAI can look like: username@realm." [0071]-[0075], "Assuming the Network Specific Identifier user17@example.com... the NAI format for the SUCI conceptually takes the following forms."; "...mac<MAC tag value>@example.com" (illustrating the realm "example.com" preserved unchanged in the padded/concealed NAI-format output; RFC 7542 further reinforces this standard, e.g., 2.8, "The private user identity shall take the form of an NAI, and shall have the form username@realm".)
Regarding Claims 29 and 38:
A method, comprising: obtaining, by a mobile equipment from a universal integrated circuit card, a subscription permanent identifier and a pseudo identifier corresponding to the subscription permanent identifier (Mattsson: [0090], "When a mobile phone calculates SUCI, it may ask for a SUPI from a USIM. ... the USIM can return the padded SUPI to the mobile phones."),
wherein a length of a username comprised in the pseudo identifier is different from a length of a username comprised in the subscription permanent identifier, and the length of the username comprised in the pseudo identifier is greater than a first threshold and less than a second threshold (these limitations are fully taught in Claim 21);
generating, by the mobile equipment, a subscription concealed identifier based on the pseudo identifier (Mattsson: discloses the mobile equipment generating the encrypted SUCI from the retrieved padded pseudo-identifier, e.g., [0090], "When a mobile phone calculates SUCI, it may ask for a SUPI from a USIM. ... the USIM can return the padded SUPI to the mobile phones. In this way mobile phones would not need to perform anything extra from what it already does to produce SUCI today.");
sending, by the mobile equipment, a registration request message to a mobility management network element, wherein the registration request message comprises the subscription concealed identifier; (Mattsson: teaches sending the concealed padded identifier to the network node, e.g., [0005], "transmitting the concealed padded identifier to a network node operating in the wireless communication network." ; [0029], "UE 102 connects to a 5G radio base station (“gNB”) 104 over-the-air and sends a Registration Request message that includes a SUCI"),
receiving, by the mobile equipment, an authentication complete message from the mobility management network element; and in response to the authentication complete message, generating, by the mobile equipment based on the subscription permanent identifier, a key useable for communication with the mobility management network element (Mattsson: teaches the standard 5G authentication procedure resulting in the establishment of security contexts based on the permanent identity, e.g., [0029], "The SEAF 106 then creates and sends to the AUSF 108 in operation 130 a 5G Authentication Information Request". It is further noted that generating communication keys upon authentication completion based on the permanent identifier is an industry standard, obvious implementation of 3GPP TS 33.501 security procedures).
Regarding Claim 33 and 39, Mattsson as modified further teaches:
The method according to claim 29, wherein obtaining, by the mobile equipment from the universal integrated circuit card, the subscription permanent identifier and the pseudo identifier corresponding to the subscription permanent identifier comprises: sending, by the mobile equipment, a user identity request message to the universal integrated circuit card; and receiving, by the mobile equipment, the subscription permanent identifier and the pseudo identifier from the universal integrated circuit card (Mattsson: teaches the ME asking for the SUPI and the USIM returning the padded SUPI, e.g., [0090], "When a mobile phone calculates SUCI, it may ask for a SUPI from a USIM. ... the USIM can return the padded SUPI to the mobile phones.").
Regarding Claims 34 and 40, Mattsson as modified further teaches:
The method according to claim 29, wherein obtaining, by the mobile equipment from the universal integrated circuit card, the subscription permanent identifier and the pseudo identifier corresponding to the subscription permanent identifier comprises: sending, by the mobile equipment, a user identity request message to the universal integrated circuit card; receiving, by the mobile equipment, the subscription permanent identifier from the universal integrated circuit card; sending, by the mobile equipment, a calculation information request message to the universal integrated circuit card; and receiving, by the mobile equipment, a public key and the pseudo identifier from the universal integrated circuit card, wherein the public key is used to generate the subscription concealed identifier (Mattsson: teaches retrieving the necessary parameters (including public keys) for calculation, e.g., [0028], "The encryption can be asymmetric and can use the HN's public key... The HN can make the HN public key available to the UE." Retrieving the public key and padded identifier together in a sequence of standard request messages from the USIM to the ME is an obvious design choice).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ZHITONG CHEN whose telephone number is (571) 270-1936. The examiner can normally be reached on M-F 9:30am - 5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, Applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Yuwen Pan can be reached on 571-272-7855. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ZHITONG CHEN/
Primary Examiner, Art Unit 2649
Prosecution Insights