DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim(s) 1-19 is/are pending. Claim(s) 1, 10, 11, and 13-15 is/are independent. Claim(s) 1-17 is/are amended. Claims 1-19 are rejected. Claim families comprise: Verification Entity (claims 1-9, 12, 13, 16, and 17), First Device (claims 10, 14, and 18), and Second Device (claims 11, 15, and 19).
Information Disclosure Statement
The information disclosure statement(s) (IDS) submitted on 3/28/2025 is/are in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement(s) is/are being considered by the examiner.
Examiner notes that at least one of the above IDS’s contain references which are not being considered (and accordingly, have been lined through) due to them being in a foreign language, and there being no translation or concise explanation of their relevance included.
Specification
The disclosure is objected to because of the following informalities:
The acronym(s), “QUIC” appear(s) with no indication to what they refer. Standard practice is to include the fully spelled out name or phrase on first usage, followed immediately by the acronym in parentheses (i.e., “… Quick UDP Internet Connection (QUIC) …”), and thereafter use only the acronym.
Appropriate correction is required.
Claim Objections
The following is a quotation of 35 U.S.C. 112(d):
(d) REFERENCE IN DEPENDENT FORMS. — Subject to subsection (e), a claim in dependent form shall contain a reference to a claim previously set forth and then specify a further limitation of the subject matter claimed. A claim in dependent form shall be construed to incorporate by reference all the limitations of the claim to which it refers.
A series of singular dependent claims is permissible in which a dependent claim refers to a preceding claim which, in turn, refers to another preceding claim.
A claim which depends from a dependent claim should not be separated by any claim which does not also depend from said dependent claim. It should be kept in mind that a dependent claim may refer to any preceding independent claim. In general, Applicant's sequence will not be changed. See MPEP § 608.01(n).
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1, 2, 4-10, 12-14, and 16-18 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. As drafted, the claim limitations are processes that, under their broadest reasonable interpretation, may be performed in the mind. That is, nothing in the claim elements precludes the steps from practically being performed in the mind (or with pen and paper).
If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it falls within the “Mental Processes” grouping of abstract ideas. Accordingly, the claims recite an abstract idea.
The claims, minus their recited generic computer components, are summarized as follows:
From claim group 1:
Claim(s) 1 and 13 recite(s):
Sending a “challenge.”
Receiving a key.
Receiving an encrypted “challenge.”
“Using” the original challenge, the key, and the received challenge.
Claim 2 recites:
Receiving an “identifier.”
Claim 4 recites:
That received messages contain an indicator.
Claim 8 recites:
Verifying the presence of the received identifier on a list.
From claim group 2:
Claims 10 and 14 recite:
Receiving a “challenge.”
Sending a message containing the challenge.
Receiving an encrypted “challenge.”
Sending the encrypted “challenge.”
This judicial exception is not integrated into a practical application because other aspects of the claims’ limitations amount to no more than mere instructions to apply the exception using generic computer components and functions (processors, memory, terminals, and devices). Accordingly, these additional elements do not integrate the abstract idea into a practical application because they do not impose any meaningful limits on practicing the abstract idea. The claims are directed to an abstract idea.
Regarding the generic computer components, patents may be directed to abstract ideas where they disclose the use of an already available technology, with its already available basic functions, to use as a tool in executing the claimed process.
The claims further do not include additional elements that amount to significantly more than the judicial exception because there is nothing in the claims, whether considered individually or in their ordered combination, that would transform the application into something “significantly more” than the abstract idea of collecting data, analyzing data, sending data, and “using data.” Further, the claims do not contain steps through which the invention represents an improvement to computer technology. The claims are not patent eligible.
Regarding claims 3, 5, 9, 12, and 16-18:
They are dependent on one or more rejected claims, and thus inherit those rejections. This rejection could be overcome by overcoming the rejection(s) to any claims upon which these claims depend, or by amending the claims such that they are no longer dependent on any rejected claim.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION. — The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
Claim(s) 1-9, 12, 13, 16, and 17 is/are rejected under 35 U.S.C. 112(b) as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor regards as the invention.
Regarding claims 1 and 13:
Claim 1 recites, “sending, to the first device, a challenge; receiving, from the first or the second device, an encryption key; receiving, from the first or the second device, a challenge encrypted by the second device; and verifying a usage of said cipher suite by using at least the sent challenge, the received encrypted challenge, the encryption key, and said cipher suite.” Claim 11 recites similar language. The claims are indefinite because it is ambiguous how the “verification” performs the claimed function of verifying the use of a particular cipher suite. Examiner first notes that a given cipher text does not, as typical in the art, contain any identifying information regarding the device which performed the encryption. The multiple alternatives provided for in the claims raise multiple issues.
In the alternative where the verification entity sends a challenge to the first device, and then receives an encrypted challenge back from the first device, it is unclear how the verification entity determines that the second device performed the encryption.
Similarly, in the alternative where the verification entity receives both the key and the encrypted challenge from the second device, it is unclear how the verification entity determines that the cipher suite was used in the communication between the devices, as this sequence does not require the first device to perform any steps related to the cipher suite, only that it sends the unencrypted challenge to the second device.
In the alternative where the key is received from the first device, and the encrypted challenge is received from the second device, it is unclear how the verification entity determines that the first device did not encrypt the challenge before sending it to the second device, thus requiring no engagement with the cipher suite by the second device.
In the alternative where the encrypted challenge is received from the first device, and the key is received from the second device, it is unclear how the verification entity determines that the first device did not encrypt the challenge before sending the key to the second device thus requiring no engagement with the cipher suite by the second device.
In each of the scenarios posited above, there is at least the issue of at least one essential missing step. In cases where the original disclosure does not provide essential missing steps (i.e. determining which device performed the encryption of a received ciphertext), the issue is one of 35 U.S.C. 112(a) and enablement. This rejection can be overcome by amending the claims such that it is clear how each claimed step is performed and is supported by the original disclosure.
Regarding claim(s) 8:
Claim 8 recites, “… verifying that the identifier of said cipher suite …”. The claim(s) is/are indefinite because “the identifier of said cipher suite” lacks antecedent basis. It is unclear to what identifier is being referred, as it has not been previously recited in this claim or in any depended-on claim. This rejection can be overcome by amending the claim(s) such that “an identifier” of the cipher suite is positively claimed.
Regarding claim 9:
Claim 9 recites, “… sending an instruction to interrupt the exchanges between the first and the second device.” The claim(s) is/are indefinite because it is unclear to what or where this instruction is being sent. This rejection can be overcome by amending the claim to recite that the instruction is being sent to the first device, second device, or to some other location or entity.
Regarding claims 2-7, 12, 16, and 17:
They are dependent on one or more rejected claims, and thus inherit those rejections. This rejection could be overcome by overcoming the rejection(s) to any claims upon which these claims depend, or by amending the claims such that they are no longer dependent on any rejected claim.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claim(s) 11, 15, and 19 is/are rejected under 35 U.S.C. 102(a)(2) as being anticipated by IKEYA (Doc ID US 20200067717 A1).
Regarding claim 11:
IKEYA teaches:
A method for proving usage of a cipher suite to encrypt data exchanged during a connection between a first device and a second device in a communication network, the method being implemented by the second device and comprising: receiving, from the first device, a connection initiation message comprising a challenge ([0117] "In step ST203, challenge generation unit 205 transmits, to terminal device 1, a response including the generated challenge …");
encrypting the challenge by using an encryption key and said cipher suite ([0120] "In step ST206, response generation unit 108 encrypts … the challenge included in the response received from authentication device 2 …"); and
sending, to the first device or to a verification entity, the encrypted challenge ([0121] "In step ST207, response generation unit 108 transmits the generated response, as a response authentication request, to authentication device 2.").
Regarding claim 15:
IKEYA teaches:
A second communication device, comprising a processor, the second communication device configured to ([0135] "… terminal device 1 and authentication device 2 ... may be individually chipped .... Further … may be implemented by … a general-purpose processor …"):
The remainder of this claim’s limitations are rejected with the same prior art mapping and justification, mutatis mutandis, as its counterpart claim 11.
Regarding claim 19:
IKEYA teaches:
A terminal comprising the second communication device of claim 15 ([0117] "In step ST203, challenge generation unit 205 transmits, to terminal device 1, a response including the generated challenge …").
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 13, 16, and 17are rejected under 35 U.S.C. 103 as being unpatentable over TRAW et al (Doc ID US 20020007452 A1), and further in view of FUTA et al (Doc ID US 20070150735 A1).
Regarding claim 1:
TRAW teaches:
A method for verifying usage of a cipher suite to encrypt data exchanged during a connection between a first device and a second device in a communication network, the method being implemented by a verification entity and comprising: sending, to the first device, a challenge ([0081] "… Device A generates a random challenge 302, concatenates the random challenge with the certificate of Device A to form a data string (M.sub.A1). and transmits 304 M.sub.A1 to Device B.");
receiving, from the first or the second device, a challenge encrypted by the second device ([0082] "… Device B encrypts 307 the random challenge received from Device A. ... The result of this encryption is then hashed 309 to form a data string (M.sub.B2)."); and
verifying a usage of said cipher suite by using at least the sent challenge, the received encrypted challenge, the encryption key, and said cipher suite ([0083] "… data string M.sub.B2 is transmitted 311 to Device A where it is compared 312 to the expected value. If both M.sub.A2 and M.sub.B2 match the expected values, then a preliminary control channel key is generated 315 …").
FUTA teaches the following limitation(s) not taught by TRAW:
receiving, from the first or the second device, an encryption key ([0144] "Control unit 115 transmits … certificate Cert_A to device B 200 via transmit/receive unit 102 (step S507)." and [0148] "… Control unit 215 transmits key information KEMB to device A100 via transmit/receive unit 202 (step S512).");
Examiner notes that control units 115 and 215 are incorporated in devices A 100 and B 200, respectively.
Sending a challenge to a device, receiving back the challenge as encrypted, and verifying the challenge is/are known technique(s) in the art, as demonstrated by TRAW. Further, receiving an encryption key in response to sending a challenge to a device is/are known technique(s) in the art, as demonstrated by FUTA. It would have been obvious to a person having ordinary skill in the art (PHOSITA) before the effective filing date of the claimed invention to modify the encryption verification of TRAW with the key exchange of FUTA with the motivation to include the ability to decrypt the received message instead of verifying the encrypted message against a maintained encrypted copy. This represents a solution that is obvious to try.
Regarding claim(s) 13:
The listed claim(s) is/are rejected with the same justification, mutatis mutandis, as its/their counterpart claim(s) 1 above.
Regarding claim 16:
The combination of TRAW and FUTA teaches:
A terminal comprising verification entity of claim 13 (TRAW [0140] "… when the computer program code is loaded into and executed by a computer, the computer becomes an apparatus for practicing the invention.").
Regarding claim 17:
The combination of TRAW and FUTA teaches:
A non-transitory, computer-readable medium having stored thereon instructions which, when executed by a processor, causes the processor to perform the method of claim 1 (TRAW [0140] "... embodied in the form of computer program code embodied in ... computer-readable storage medium... When implemented on a general purpose microprocessor …").
Claims 2, 3, 8, 9, and 12 are rejected under 35 U.S.C. 103 as being unpatentable over TRAW et al (Doc ID US 20020007452 A1) and FUTA et al (Doc ID US 20070150735 A1) as applied to claim 1 above, and further in view of BARR et al (Doc ID US 20140331287 A1).
Regarding claim 2:
The combination of TRAW and FUTA teaches:
The method of claim 1,
BARR teaches the following limitation(s) not taught by the above combination:
further comprising obtaining an identifier of said cipher suite in at least one message sent by the first or the second device ([0035] "… At step 302, the interceptor 200 intercepts a handshake message transmitted over the network between the first and second endpoints 201, 202. At step 304 an identification of a security standard ... is extracted ... by extracting a cipher suite from a "Server Hello" message.").
Obtaining the identifier of a cipher suite is/are known technique(s) in the art, as demonstrated by BARR. It would have been obvious to a PHOSITA before the effective filing date of the claimed invention to modify the encryption verification of TRAW and FUTA with the cipher suite identification of BARR with the motivation to provide a concrete identifier for the encryption algorithms used in the process. This is a known technique which has been used to improve similar devices.
Regarding claim 3:
The combination of TRAW, FUTA, and BARR teaches:
The method of claim 2,
BARR teaches the following limitation(s) not taught by the above combination:
wherein the identifier of said cipher suite is obtained in at least one message exchanged between the first and the second device during an establishment of a connection, said at least one message indicating to use said cipher suite (BARR [0035] "… At step 302, the interceptor 200 intercepts a handshake message transmitted over the network between the first and second endpoints 201, 202. At step 304 an identification of a security standard ... is extracted ... by extracting a cipher suite from a "Server Hello" message.").
Obtaining the identifier of a cipher suite from a message exchanged between devices during connection initiation is/are known technique(s) in the art, as demonstrated by BARR. It would have been obvious to a PHOSITA before the effective filing date of the claimed invention to modify the encryption verification of TRAW, FUTA, and BARR with the cipher suite identification of BARR with the motivation to provide a concrete identifier for the encryption algorithms used in the process. This is a known technique which has been used to improve similar devices.
Regarding claim 8:
The combination of TRAW and FUTA teaches:
The method of claim 1,
BARR teaches the following limitation(s) not taught by the above combination:
further comprising verifying that the identifier of said cipher suite belongs to a list of identifiers of cipher suites considered valid ([0035] "… At step 306 a predefined security policy is referenced to determine a validity status of the identified security standard. For example, a security policy includes a definition of supported cipher suites.").
Verifying that the cipher suite used by devices is on a list of authorized cipher suites is/are known technique(s) in the art, as demonstrated by BARR. It would have been obvious to a PHOSITA before the effective filing date of the claimed invention to modify the encryption verification of TRAW and FUTA with the cipher suite validation of BARR with the motivation to ensure that only those cipher algorithms which are deemed appropriate for the system are permitted to be used. This is a known technique which has been used to improve similar devices.
Regarding claim 9:
The combination of TRAW and FUTA teaches:
The method of claim 1,
BARR teaches the following limitation(s) not taught by the above combination:
further comprising, upon a determination that at least one result of a said verification is negative, sending an instruction to interrupt the exchanges between the first and the second device ([0035] "… communication is prevented based on a negatively determined validity status of the security standard.").
Blocking communication by devices not using an approved cipher suite is/are known technique(s) in the art, as demonstrated by BARR. It would have been obvious to a PHOSITA before the effective filing date of the claimed invention to modify the encryption verification of TRAW and FUTA with the cipher suite validation of BARR with the motivation to ensure that only those cipher algorithms which are deemed appropriate for the system are permitted to be used. This is a known technique which has been used to improve similar devices.
Regarding claim 12:
The combination of TRAW and FUTA teaches:
The method of claim 1,
BARR teaches the following limitation(s) not taught by the above combination:
wherein a TLS type protocol is used to exchange data between the first and the second device ([0027] "The second endpoint 202 (known as a TLS server) receives the "Client Hello".").
Utilizing the TLS protocol for exchanging messages is/are well-known technique(s) in the art, as demonstrated by BARR. It would have been obvious to a PHOSITA before the effective filing date of the claimed invention to modify the encryption verification of TRAW and FUTA with the cipher suite validation of BARR with the motivation to use a widely adopted and standardized communication protocol such as TLS.
Claim 4 is rejected under 35 U.S.C. 103 as being unpatentable over TRAW et al (Doc ID US 20020007452 A1) and FUTA et al (Doc ID US 20070150735 A1) as applied to claim 1 above, and further in view of LANGE (Doc ID US 20180332009 A1).
Regarding claim 4:
The combination of TRAW and FUTA teaches:
The method of claim 1,
LANGE teaches the following limitation(s) not taught by the above combination:
further comprising: obtaining at least one encrypted message exchanged between the first and the second device ([0071] "… At block 502, a server, such as remote patient monitoring server 126 receives a data packet from a remote patient monitoring device …");
decrypting said at least one encrypted message obtained by using the encryption key and said cipher suite ([0081] At block 516, the encryption module decrypts the encrypted portion of the data packet, which includes the data payload.); and
verifying an integrity of said at least one decrypted message by using at least one message authentication code associated with said at least one decrypted message ([0079] "... the enhanced protocol module authenticates the data packet payload against the previously identified payload MAC using the symmetric authentication key.").
Intercepting encrypted communication, decrypting the information, and validating the message authentication code (MAC) for the information is/are well-known technique(s) in the art, as demonstrated by LANGE. It would have been obvious to a PHOSITA before the effective filing date of the claimed invention to modify the encryption verification of TRAW and FUTA with the data validation of LANGE with the motivation to use a widely adopted and standardized protocol such validating a MAC of a received message.
Claims 6 and 7 are rejected under 35 U.S.C. 103 as being unpatentable over TRAW et al (Doc ID US 20020007452 A1), FUTA et al (Doc ID US 20070150735 A1), and BARR et al (Doc ID US 20140331287 A1) as applied to claim 3 above, and further in view of GUPTA et al (Doc ID US 6658565 B1).
Regarding claim 6:
The combination of TRAW, FUTA, and BARR teaches:
The method of claim 3,
GUPTA teaches the following limitation(s) not taught by the above combination:
wherein the verification entity obtains only messages exchanged between the first and the second device comprising an active unencrypted indicator ((16) Col 6 lines 60-63 "… each incoming packet … is marked indicating whether the packet needs to be checked by a trusted switch.").
Intercepting tagged packets for inspection is/are known technique(s) in the art, as demonstrated by GUPTA. It would have been obvious to a PHOSITA before the effective filing date of the claimed invention to modify the encryption verification of TRAW, FUTA, and BARR with the packet tagging of GUPTA with the motivation to conserve computing resources from inspecting packets unnecessarily, and limiting inspection to only those packets which are marked. This is a known technique which has been used to improve similar devices.
Regarding claim 7:
The combination of TRAW, FUTA, BARR, and GUPTA teaches:
The method of claim 6,
GUPTA teaches the following limitation(s) not taught by the above combination:
wherein the unencrypted indicator is comprised in the header of the exchanged messages (GUPTA (15) Col 6 lines 52-54 "If there are no spare bits in the packet header 525, the firewall may alternately add a mini-header 530 to the packet for use within the trust domain to carry the flag.").
Intercepting packets with tagged headers for inspection is/are known technique(s) in the art, as demonstrated by GUPTA. It would have been obvious to a PHOSITA before the effective filing date of the claimed invention to modify the encryption verification of TRAW, FUTA, and BARR with the packet tagging of GUPTA with the motivation to conserve computing resources from inspecting packets unnecessarily, and limiting inspection to only those packets which are marked. This is a known technique which has been used to improve similar devices.
Allowable Subject Matter
Claim(s) 10 and 14 would be allowable if rewritten or amended to overcome the rejection(s) under 35 U.S.C. 101 set forth in this Office action.
Claim(s) 5 is/are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
The following is a statement of reasons for the indication of allowable subject matter:
Regarding claims 10 and 14:
TRAW et al (Doc ID US 20020007452 A1) teaches:
A method for proving usage of a cipher suite to encrypt data exchanged during a connection between a first device and a second device in a communication network, the method being implemented by the first device and comprising ([0081] "… Device A generates a random challenge 302, concatenates the random challenge with the certificate of Device A to form a data string (M.sub.A1). and transmits 304 M.sub.A1 to Device B."):
sending, to the verification entity, the encrypted challenge ([0082] "… Device B encrypts 307 the random challenge received from Device A. ... The result of this encryption is then hashed 309 to form a data string (M.sub.B2).").
TRAW does not teach:
Receiving an unencrypted challenge, which is part of a communication initiation message, sending the challenge on to another device, and receiving the same challenge, now encrypted, from that device.
Regarding claim 5:
The combination of TRAW et al (Doc ID US 20020007452 A1) and FUTA et al (Doc ID US 20070150735 A1) teaches:
The method of claim 1
TRAW and FUTA do not teach, alone or in combination:
A message which is partly encrypted by different encryption keys, where the portion decryptable by the receiving device contains a challenge previously sent to the device.
It should be noted that the determination of allowability is made on the combination of all limitations/features recited in the independent claims and not a single limitation.
As allowable subject matter has been indicated, applicant's reply must either comply with all formal requirements or specifically traverse each requirement not complied with. See 37 CFR 1.111(b) and MPEP § 707.07(a).
Any comments considered necessary by applicant must be submitted no later than the payment of the issue fee and, to avoid processing delays, should preferably accompany the issue fee. Such submissions should be clearly labeled “Comments on Statement of Reasons for Allowance.”
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to BRANDON BINCZAK whose telephone number is (703) 756-4528. The examiner can normally be reached M-F 0800-1600 EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, Applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Alexander Lagor can be reached on (571) 270-5143. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/BRANDON BINCZAK/Examiner, Art Unit 2437
Prosecution Insights