Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 2-4, 6-14, 16-21 is/are rejected under 35 U.S.C. 103 as being unpatentable over Stahlhut (20200410314) in view of Choi (US 20120253607) and Wurmfield (US 20160307089)
Stahlhut discloses
2. A contactless card, comprising:
a communications interface comprising an antenna and circuitry configured to establish a communication link with an external computing device via a Near-Field Communication (NFC) protocol or an EMV protocol (par. 42); a fingerprint sensor 731 (Fig. 7, par. 170) configured to capture fingerprint samples;
a processor; and a memory comprising a non-volatile read/write memory portion and a secure memory portion, the memory storing:
at least one setting corresponding to a transaction limit, wherein the at least one setting corresponding to a transaction limit comprises a single transaction spending limit, a total transaction spending limit, a geolocation limit, a date/time limit, or combination thereof
(Stahlhut, par. 98: smart card may be configured to accept an override request to adjust the limits on sensitive data; par. 5, 95 sensitive data includes an amount, a name, expiration date, a card verification value ("CVV"), an identification number or any other suitable sensitive data … Sensitive data presented by the smart card may be usable to initiate a purchase transaction … the sensitive data presented by the smart card may include information typically included on a conventional credit or debit cards.;
Stahlhut is silent to transaction spending limit;
However, it is inherently well known for typical credit or debit cards to include spending limits, especially debit cards have total account balance which is the maximum spending limit; the spending limit is also mentioned in previously cited reference Wurmfield, in which spending limits in typical cards can be modified via mobile device 140 and provider system 130; par. 15, 19, 60-61, 64, 68, 111, 116-117;
Note that Stahlhut meet the amended limitation of date limit by disclosing the expiration date without having to meet the limitation of spending limit).
at least one encrypted verified biometric template, the template stored in the secure memory portion
(Stahlhut is silent to encrypted verified biometric template;
Choi discloses the card issue server of the biometric authentication card 110 is a server of the official certificate authority or the private certificate authority, interlinks with the vehicle assignment server 130 serving the vehicle assignment service, stores the user biometric information of the biometric authentication card 110 in the biometric information storage section 41 [actually 412], registers and stores the biometric information which is matched with the user biometric information stored, and encrypts the biometric authentication card 110 not to allow amendment, deletion, addition and etc. for the biometric information stored in the biometric information storage section 412 of the biometric authentication card 110; par. 59
Therefore, it would have been obvious to one of ordinary skill in the art before the effective date the invention was made to incorporate the teachings of Choi to prevent alteration or tampering with biometric data)
a payment applet configured to perform payment operations, and a verification applet configured to perform verification operations, the payment applet and verification application further configured to operate according to a Java Card framework (par. 5-8, 35);wherein the processor is configured to execute the payment applet to:
receive, via the communications interface, one or more Near-Field Communication Data Exchange Format (NDEF) messages from the external computing device, the NDEF messages comprising a request to change the at least one setting, the request including an identifier for the setting and a new value for the setting;
in response to the request, securely initiate a verification routine by sending a message to the verification applet;
cause the verification applet to perform the verification routine by: receiving a captured fingerprint sample from the fingerprint sensor; retrieving and decrypting the at least one encrypted verified biometric template from the secure memory portion; and verifying the captured fingerprint sample with the decrypted template to verify a user; and in response to the verification applet verifying the user, cause, by the verification applet, the payment applet to update the at least one setting with the new value, or in response to the verification applet failing to verify the user, prevent, by the verification applet, the update of the at least one setting
(Stahlhut/Choi discloses card may accept override requests for limit adjustments/updates via a paired mobile device linked to the smart card and mobile device or card may prompt the user for biometric authentication before presentation of sensitive data on the card; sensitive data include card data for a transaction, which is encrypted forming a cryptogram; Stahlhut, par. 35, 91, 98, 104, 173-174, 179, 183; Choi, par. 59;
Stahlhut/Choi is silent to Java Card and NDEF messages
Wurmfield discloses these features are well known in the art; abstract, par. 70; Wurmfield further teaches spending limits in typical cards can be modified or updated via mobile device 140 and provider system 130; par. 15, 19, 60-61, 64, 68, 111, 116-117; To authorize presentation of sensitive data on a smart car, a user may present a biometric credential to the biometric sensor for verification. The smart card may only authorize release of the sensitive data after verifying a submitted biometric feature (par. 35-36, 64, 103-105)
Therefore, it would have been obvious to one of ordinary skill in the art before the effective date the invention was made to incorporate the teachings of Wurmfield for compatibility with existing infrastructures or systems that utilize these features)
3.2, wherein the external computing device is one of a point-of-sale terminal, an automatic teller machine (ATM), or a mobile phone device.
4.2, wherein memory portion is a non-volatile read/write memory portion comprising an Electrically Erasable Programmable Read-Only Memory (EEPROM) (Wurmfield, par. 52)
6.2, wherein the fingerprint sensor is one of an optical scanner, a capacitance scanner, an ultrasonic scanner, or a thermal scanner (Stahlhut, par. 35).
7.2, wherein the processor is further configured to execute the payment applet to: determine that characteristics of a transaction attempt exceed the transaction limit; in response, initiate the verification routine to verify the user; and permit the transaction to proceed upon successful verification of the user (Wurmfield, par. 11, 15, 60-61, 116-117: card can include account limit, budget limit).
8.2, wherein the memory stores a plurality of encrypted verified biometric templates for a corresponding plurality of users, and wherein each of the plurality of users is associated with a different transaction limit (Choi, par. 60: a card is well known to store data for multiple users; it would have also been obvious to associate each user to a different limit depending on age or family structure, i.e. parent vs children).
9.2, wherein initiating the verification routine comprises providing an indication for the user to provide the fingerprint sample, the indication comprising one of activating a light-emitting diode (LED) on a substrate of the contactless card or sending a message to the external computing device for display (Stahlhut, par. 137).
10.2, wherein the contactless card has physical characteristics compliant with the ID-1 format of the ISO/IEC 7816 standard and is further compliant with the ISO/IEC 14443 standard (Stahlhut, par. 25).
11.2, wherein the at least one encrypted verified biometric template is encrypted using a Triple DES (3DES) algorithm implemented by hardware in the contactless card (Stahlhut discloses Application programs may utilize one or more algorithms that securely store sensitive data, encrypt sensitive data, display instances of sensitive data; thus, incorporating known 3DES algorithm is an obvious extension of the prior art).
Re claims 12-14, 16-21, see discussion regarding claims above.
Claim(s) 22-23 is/are rejected under 35 U.S.C. 103 as being unpatentable over Stahlhut (20200410314) ,Choi (US 20120253607), Wurmfield (US 20160307089), further in view of Matthiassen (US 20040123113 )
22.2, Stahlhut is silent to wherein the processor is configured to cause the verification applet to generate a reduced set of captured minutiae from the captured fingerprint sample, wherein the captured fingerprint sample is verified using the reduced set of captured minutiae.
Matthiassen discloses [0070] The central processor (2) will further reduce the fingerprint data to a compact form by so-called minutiae, where significant details of the fingerprint are transformed into an alphanumeric string comprising at least X and Y coordinates of each minutiae, plus its direction. This compact fingerprint representation by minutiae may be expanded with other features deemed necessary. When the central processor (2) has completed the reduction of the captured fingerprint image to compact minutia form, it will transfer this access minutiae table via the high-speed bus (3) for temporary storage in the working volatile memory (6A or 6C).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective date the invention was made to incorporate the teachings of Matthiassen for faster authentication process.
Re claim 23, see discussion regarding claims above.
Response to Arguments
Applicant's arguments have been fully considered but they are not persuasive.
Applicant argues that
The limit adjustments of Stahlhut are adjustments to the sensitive data presented by the card rather than transaction limits. Stahlhut's limits imposed may be "based on a geographic location of a paired mobile device," but the limit adjustments are not adjustments to "a setting corresponding to a transaction limit" as recited in claim 2. Moreover, Stahlhut's limit adjustment is not a "transaction limit comprises a single transaction spending limit, a total transaction spending limit, a geolocation limit of a merchant, a date/time limit, or combination thereof' as recited in claim 2. Therefore, Stahlhut fails to disclose updating "at least one setting" corresponding to a transaction limit, "wherein the at least one setting corresponding to a transaction limit comprises a single transaction spending limit, a total transaction spending limit, a geolocation limit of a merchant, a date/time limit, or combination thereof' as recited in claim 2. Stahlhut also does not disclose changing a setting of a transaction limit based on verification of the user, much less verification of a captured fingerprint sample.
It is respectfully submitted that the combined teachings of the references Stahlhut, Choi, and Wurmfield meet the amended limitation of date limit by disclosing the expiration date without having to meet the limitation of spending limit.
With respect to the transaction spending limits, the current claim does not recite how the spending limit setting is changed. Thus, per combined teachings, the typical spending limit discussed above can be limited in presentation as well as being modified in the amount.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to THIEN T. MAI whose telephone number is (571)272-8283. The examiner can normally be reached on M-F, 8-5pm.
If attempts to reach the examiner by telephone are unsuccessful, the examiner' s supervisor, Steve S. Paik can be reached at (571)272-2404. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Thien T Mai/
Primary Examiner, Art Unit 2887
Prosecution Insights