Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This action is in response to the Amendment filed on 08/12/2026.
Claims 1-20 are under examination.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP §§ 706.02(l)(1) - 706.02(l)(3) for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/process/file/efs/guidance/eTD-info-I.jsp.
Claims 1-20 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-11 of U.S. Patent No. 12,711,210. Although the claims at issue are not identical, they are not patentably distinct from each other because the subject matter claimed in the instant application is fully disclosed in the patent and is covered by the patent since the patent and the application are claiming common subject matter, as follows: A method, comprising: detecting an indication of an attempted login by a user [[form]] while accessing a web page on a website; in response to detecting the attempted login [[form]], attempting to authenticate the user via a first authentication process; [[and]] in response to a successful authentication of the user by the first authentication process, automatically providing login credentials for the user; detecting an indication of a challenge from the website; and automatically responding to the challenge using a second authentication process different than the first authentication process.
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 1-20 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention. Independent claims have been amended to recite “detecting an indication of an attempted login by a user [[form]] while accessing a web page on a website”. However, the specification fails to disclose an indication of an attempted login by a user and detecting the indication.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-2, 4, 7-9, 11, 14-16 and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Zeng et al. (US 2011/0321141 A1) and Hoyos (US 2014/0337949 A1).
Regarding claim 1, Zeng et al. discloses A method [par. 0066, “ a method for automatically filling in the user logon credential”], comprising: detecting a login while accessing a web page on a website; in response to detecting attempted the login; attempting to authenticate the user via a first authentication process [par. 0027, “a user can input the user name and the password via a log-on window, e.g., a log-on interface, displayed on a screen of the network device 110. The log-on component 118 may also receive the credential by using face-recognition software to capture the characteristics of the face of the user”, par. 0067, “when a web page is opened, the processor 804 can execute the sink module 834 to capture the website address of the web page. In block 1004, the processor 804 can determine if the user U1 has passed the authentication”, fig. 10 1004, has user passed facial authentication]; [[and]] in response to a successful authentication of the user by the first authentication process, automatically providing login credentials for the user; detecting an indication of a challenge from the website; and automatically responding to the challenge using a second authentication process different than the first authentication process [par. 0060, “If the processor 804 detects that the electrical signals representing the captured facial image from the camera 802 matches a facial image template stored in the database 838, the processor 804 can execute the sink module 834 to check if a logon credential associated with the web address of the web page and associated with the matched image template is stored in the database 838. If such a logon credential is found in the database 838, the processor 804 can execute the sink module 834 to automatically fill in the corresponding user logon credential in the webpage. As such, the user does not have to input the logon credential manually. Upon successful user authentication, the processor 804 can execute the sink module 834 to automatically fill in the user's logon credential” (challenge is the user login credential in the webpage)].
Zeng et al. does not explicitly disclose detecting an indication of an attempted login by a user while accessing a web page on a website.
However, Hoyos teaches detecting an indication of an attempted login by a user while accessing a web page on a website [par. 0019, “As the user attempts to access a networked environment that is access controlled, for example, a website which requires a secure login, the user is prompted to authenticate using the user's preregistered mobile device. Authentication includes capturing biometric information in the form of at least images of the user's eyes, periocular region and face…”, par. 0089, “the configured mobile device processor can prompt the user to repeat the biometric capture process via the display or other such output of the mobile device”].
Before the effective filing date of the claimed invention, it would have been obvious to a person having ordinary skill in the art to incorporate the teaching of Hoyos into the teaching of Zeng et al. with the motivation for facilitating secure authentication of transactions at a terminal as taught by Hoyos [Hoyos: par. 0048].
Regarding claim 2, the rejection of claim 1 is incorporated.
Zeng et al. further disclose wherein parameters associated with the first authentication process include a first type of data [par. 0027, The log-on component 118 may also receive the credential by using face-recognition software to capture the characteristics of the face of the user] and parameters associated with the second authentication process include a second type of data different from the first type of data [par. 0060, “the processor 804 can execute the sink module 834 to automatically fill in the corresponding user logon credential in the webpage”].
Regarding claim 4, the rejection of claim 1 is incorporated.
Zeng et al. further disclose the login credentials include a username and a password [par. 0027, “The log-on component 118 can receive a credential, e.g., a user name, a password”].
Regarding claim 7, the rejection of claim 1 is incorporated.
Zeng et al. further disclose the first authentication process operates independent of an action of the user [par. 0057, “The computer system 800 can automatically fill in a user's logon identification and password to enable website logon if the user passes the facial authentication”, par. 0058, “The image recognition module 832, executed by the processor 804, compares the captured facial image of a user from the camera 802 to one or more facial templates stored in the database 838. The user passes authentication if the captured facial image of the user matches at least one facial template stored in the database 838”].
Regarding claim 8, it recites limitations like claim 1. The reason for the rejection of claim 1 is incorporated herein.
Regarding claim 9, it recites limitations like claim 2. The reason for the rejection of claim 2 is incorporated herein.
Regarding claim 11, it recites limitations like claim 4. The reason for the rejection of claim 4 is incorporated herein.
Regarding claim 14, it recites limitations like claim 7. The reason for the rejection of claim 7 is incorporated herein.
Regarding claim 15, it recites limitations like claim 1. The reason for the rejection of claim 1 is incorporated herein.
Regarding claim 16, it recites limitations like claim 2. The reason for the rejection of claim 2 is incorporated herein.
Regarding claim 18, it recites limitations like claim 4. The reason for the rejection of claim 4 is incorporated herein.
Claims 3, 10 and 17 are rejected under 35 U.S.C. 103 as being unpatentable over Zeng et al. (US 2011/0321141 A1) and Hoyos (US 2014/0337949 A1) as applied to claims 1-2, 4, 7-9, 11, 14-16 and 18 above, and further in view of Thavasi et al. (US 2013/0067546 A1).
Regarding claim 3, the rejection of claim 1 is incorporated.
Zeng et al. discloses a method for automatically filling in the user logon credential.
They do not explicitly disclose reverting to a third authentication process in response to the first authentication process failing to successfully authenticate the user.
However, Thavasi et al. teaches reverting to a third authentication process in response to the first authentication process failing to successfully authenticate the user [par. 0029, “the security tool may switch from a passive authentication mode to an active authentication mode in response to an authentication failure in at least one of the re-authentication tests that follow an initial authentication”].
Before the effective filing date of the claimed invention, it would have been obvious to a person having ordinary skill in the art to incorporate the teaching of Thavasi et al. into the teaching of Zeng et al. and Hoyos with the motivation such that the security tool may authenticate a user by either a passive authentication analysis test or an active authentication analysis as taught by Thavasi et al. [Thavasi et al.: par. 0029].
Regarding claim 10, it recites limitations like claim 3. The reason for the rejection of claim 3 is incorporated herein.
Regarding claim 17, it recites limitations like claim 3. The reason for the rejection of claim 3 is incorporated herein.
Claims 5, 12 and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Zeng et al. (US 2011/0321141 A1) and Hoyos (US 2014/0337949 A1) as applied to claims 1-2, 4, 7-9, 11, 14-16 and 18 above, and further in view of Whiteside et al. (US 2017/0093839 A1).
Regarding claim 5, the rejection of claim 4 is incorporated.
Zeng et al. discloses a method for automatically filling in the user logon credential.
They do not explicitly disclose interacting with a change-password mechanism on the website to automatically change the password for the user.
However, Whiteside et al. teaches interacting with a change-password mechanism on the website to automatically change the password for the user [see fig. 4, strong password reset , par. 0054, “securely modifying or resetting user credentials”, par. 0059, “The existing credentials and the newly generated credentials may then be provided to the corresponding web site in block 409… The non-rendered application uses a content script for the specific web site to allow injection of old and new credentials into the form provided by the web site for credential resetting. In some embodiments, the non-rendered application may need to be able to inject the old credentials into one form and the new credentials into another form”].
Before the effective filing date of the claimed invention, it would have been obvious to a person having ordinary skill in the art to incorporate the teaching of Whiteside et al. into the teaching of Zeng et al. and Hoyos with the motivation for hardening the entry of user credentials in web sites as taught by Whiteside et al. [Whiteside et al.: abs.].
Regarding claim 12, it recites limitations like claim 5. The reason for the rejection of claim 5 is incorporated herein.
Regarding claim 19, it recites limitations like claim 5. The reason for the rejection of claim 5 is incorporated herein.
Claims 6, 13 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Zeng et al. (US 2011/0321141 A1), Hoyos (US 2014/0337949 A1) and Whiteside et al. (US 2017/0093839 A1) as applied to claims 5, 12 and 19 above, and further in view of Hadsall (US 9,898,619 B1).
Regarding claim 6, the rejection of claim 1 is incorporated.
Whiteside et al. teaches a change-password mechanism.
They do not explicitly disclose changing the password responsive to one or more further accesses of the website.
However, Hadsall teaches changing the password responsive to one or more further accesses of the website [col. 15, line 23-col. 17, line 7, “When a user activates an internet search engine or directs the computing device to access a website, such as a website associated with a bank, financial or trading account… detecting an unauthorized viewer or eavesdropper is looking at a display… require a username or password reset, and/or prevent access to other or related websites or accounts until corrective action is taken by the authorized user or owner of the computing device to ensure security of their information and/or accounts”].
Before the effective filing date of the claimed invention, it would have been obvious to a person having ordinary skill in the art to incorporate the teaching of Hadsall into the teaching of Zeng et al. and Whiteside et al. with the motivation to ensure security of their information and/or accounts as taught by Hadsall [Hadsall: col. 17, lines 5-7].
Regarding claim 13, it recites limitations like claim 6. The reason for the rejection of claim 6 is incorporated herein.
Regarding claim 20, it recites limitations like claim 6. The reason for the rejection of claim 6 is incorporated herein.
Response to Arguments
Applicant’s arguments, filed on 08/12/2026, with respect to rejection under 35 USC § 103 have been considered but are moot in view of the new ground(s) of rejection.
Conclusion
The prior art made of record and not relied upon is considered pertinent to Applicant’s disclosure:
US 10200359 B1 Systems And Methods For Creating Credential Vaults That Use Multi-factor Authentication To Automatically Authenticate Users To Online Services
US 20170214678 A1 SYSTEM AND METHOD FOR CREATING AND IMPLEMENTING SCALABLE AND EFFECTIVE MULTI-MEDIA OBJECTS WITH HUMAN INTERACTION PROOF (HIP) CAPABILITIES
US 9536067 B1 Password Submission Without Additional User Input
US 8977709 B2 Using An Interactivity Object To Facilitate Web-based Aggregation
US 20100017889 A1 Control Of Website Usage Via Online Storage Of Restricted Authentication Credentials
US 20050177731 A1 Secure Management Of Authentication Information
US 10019561 B1 Systems And Methods For Continuous Biometric Authentication
US 9781106 B1 Method For Modeling User Possession Of Mobile Device For User Authentication Framework
US 20170140141 A1 SYSTEM FOR IDENTITY VERIFICATION
US 20160105420 A1 Identity And Access Management
US 20160063471 A1 METHODS AND A SYSTEM FOR PASSIVE AUTHENTICATION
US 20150281200 A1 PASSIVE SECURITY ENFORCEMENT
US 20140298432 A1 METHOD AND APPARATUS FOR AUTOMATED PASSWORD ENTRY
US 8640213 B2 Method And System For Automatic Authentication
US 20030177250 A1 Access Control
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JASON CHIANG whose telephone number is (571)270-3393. The examiner can normally be reached on 9 AM TO 6 PM.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lynn Feild can be reached on (571) 272-2092. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/JASON CHIANG/Primary Examiner, Art Unit 2431
Prosecution Insights