DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-15 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claims 1, 14, and 15 recite “or attempting to select” and “or attempt to select”, however, it is unclear whether the selection is required as part of these claims as this language suggests no selection may be made which would make the claimed invention non-existent/non-functional.
Claims 1, 5, 14, and 15 recite "validating entity and/or in accordance with" and "at least one rule or selection criterium, a respective weighting; and/or" and many other instances of “and/or”, however, the usage of “and/or” makes the claim scope indefinite as it is unclear what the intended metes and bounds of the claim are with many/every limitation in the alternative or potential alternative. The claimed invention cannot reasonably be made up of only one of these features as it would be incomplete by omitting essential elements/functions.
Claims 1, 14, and 15 recite "a connection, association of combination of at least two of identity resources in the set of identity resources is assigned a weighting", however, it is unclear what “a connection, association of...” is intended to capture. There appears to be language missing between “a connection” and “association of” that would bridge what appears to be two separate aspects.
Claims 1, 5, 6, 14, 15 recite “i)” and “ii)”, however, typically these sequential markers are used to specify a particular order of operation of functions. It is unclear whether this is what is intended as each limitation does not appear to have a significant order/sequence requirement. Similar issue applies to claims 3 and 4 with the addition of “iii)”.
Claims 1, 14, and 15 recite “respective weighting” and “weighting”, however, it is unclear what the difference(s) is/are between these two weights.
The term “preferably” in claims 4, 5 and 7 is a relative term which renders the claim indefinite. The term “preferably” is not defined by the claim, the specification does not provide a standard for ascertaining the requisite degree, and one of ordinary skill in the art would not be reasonably apprised of the scope of the invention. It is unclear what makes something “preferable” in the claimed invention.
Claims 1, 14, and 15 recites the limitation "select at least one identity resource" and “one or a plurality of identity resources”. There is insufficient antecedent basis for these limitations in the claims. It is unclear if these are a different set of identity resource or the same as earlier instances of identity resource(s) in the claims.
Claim 7 recites “is used to determine” and “that is to be selected” which raise indefinite issues of intended use/intended result. It is unclear whether these limitations are required as part of the claimed invention or if the functions are ever necessarily performed. It is also unclear how the intended result is accomplished.
Claim 10 recites “...is rejected; or allowing...”, however, it is unclear if this is meant in the alternative as a contingent claim or if “and” should be in the place of the “or” to clearly capture that the claimed invention requires both conditions to be accounted for.
The following is a quotation of 35 U.S.C. 112(d):
(d) REFERENCE IN DEPENDENT FORMS.—Subject to subsection (e), a claim in dependent form shall contain a reference to a claim previously set forth and then specify a further limitation of the subject matter claimed. A claim in dependent form shall be construed to incorporate by reference all the limitations of the claim to which it refers.
The following is a quotation of pre-AIA 35 U.S.C. 112, fourth paragraph:
Subject to the following paragraph [i.e., the fifth paragraph of pre-AIA 35 U.S.C. 112], a claim in dependent form shall contain a reference to a claim previously set forth and then specify a further limitation of the subject matter claimed. A claim in dependent form shall be construed to incorporate by reference all the limitations of the claim to which it refers.
Claim 11 is rejected under 35 U.S.C. 112(d) or pre-AIA 35 U.S.C. 112, 4th paragraph, as being of improper dependent form for failing to further limit the subject matter of the claim upon which it depends, or for failing to include all the limitations of the claim upon which it depends.
Claim 11 recites “wherein: the set of identity resources is selected and/or generated by the user”, however, the scope of this is already captured in independent claim 1 which from which 11 depends as claim 1 recites “selecting, or attempting to select, by a validating entity, at least one identity resource from a set of identity resources made available to the validating entity by the user for verifying the user's identity”. The portion of claim 1 “...made available to the validating entity by the user for verifying the user's identity” already inherently covers the scope of claim 11’s “: the set of identity resources is selected and/or generated by the user”.
Applicant may cancel the claim(s), amend the claim(s) to place the claim(s) in proper dependent form, rewrite the claim(s) in independent form, or present a sufficient showing that the dependent claim(s) complies with the statutory requirements.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claim(s) 1, 4, 7, 9, 11, 12, 14, and 15 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Dasgupta et al. (US 20200014702 A1).
Claims 1, 14, and 15:
Dasgupta et al. teach a computer-implemented verification method for verifying an identity of a user [para 34], computer equipment comprising: memory comprising one or more memory units; and processing apparatus comprising one or more processing units, wherein the memory stores code arranged to run on the processing apparatus, the code being configured so as when run on the processing apparatus, the processing apparatus performs a computer-implemented verification method for verifying an identity of a user [para 108], and a non-transitory computer-readable medium, comprising a computer program configured so as, when run on one or more processors, the one or more processors perform a computer-implemented verification method for verifying an identity of a user [para 109] comprising,
selecting, or attempting to select, by a validating entity, at least one identity resource from a set of identity resources made available to the validating entity by the user for verifying the user's identity (“...continual authentication to existing cyber-enabled or computer systems (specifically, mobile devices such as smart-phones, tablets and PDAs)...adaptive selection of the available authentication modalities and considers different factors other than only user preference...”) [paras 45, 49];
wherein the selection or attempt to select at least one identity resource from the set of identity resources is performed in accordance with at least one rule or selection criterium established by the validating entity (“...a genetic algorithm (GA) is used for adaptive selection of modalities and their corresponding features using the active authentication process. Implementation requires the appropriate design of chromosome, contracts, objection functions, and penalty functions...”) [para 51];
and i) one or a plurality of identity resources in the set of identity resources is assigned, by the validating entity and/or in accordance with the at least one rule or selection criterium, a respective weighting (“...“trustworthiness” factor, which is expressed as a numeric value for particular types of devices and media, and signifies the impact of the device or media on a particular selected modality...”) [paras 52-54];
and/or ii) a connection, association of combination of at least two of identity resources in the set of identity resources is assigned a weighting (“...Several of these considerations also can change with time and with user feedback, thereby resulting in changing trustworthiness values over time...The constants/weights are adjusted for different environment settings...a weighting factor, so that one modality is not always chosen in successive authentication triggering events...weight factor controls the effect of the cost factor while computing fitness values for a set of modalities during the selection process...”) [paras 52-54].
Claim 4:
Dasgupta et al. teach a computer-implemented verification method for verifying an identity of a user [para 34], as in claim 1 above, further comprising,
wherein: the set of identity resources is made available to the validating entity by the user by sharing access credentials, by the user to the validating entity (“...continual authentication to existing cyber-enabled or computer systems (specifically, mobile devices such as smart-phones, tablets and PDAs)...adaptive selection of the available authentication modalities and considers different factors other than only user preference...”) [para 45];
preferably wherein the access credentials: i) comprise one or more of: a password, PIN, passcode or other identifier (“...password 130...”) [para 38];
or a cryptographic key (“...security token...”) [para 38];
and/or ii) are generated by the user (“...facial recognition 110, fingerprint recognition 120...voice recognition 150, keystroke recognition 160...”) [para 38];
and/or iii) are associated with or assigned to the validating entity by the user (“...Different modalities for authentication of user identity...”) [para 38].
Claim 7:
Dasgupta et al. teach a computer-implemented verification method for verifying an identity of a user [para 34], as in claim 1 above, further comprising,
wherein: the at least one rule or selection criterium is implemented in software logic (“...The present invention then determines a penalty function incorporating computational complexity and cost along with a weighting factor, so that one modality is not always chosen in successive authentication triggering events...”) [paras 52-54];
and preferably wherein the weighting is used to determine the at least one identity resource in the set of identity resources that is to be selected in accordance with at least one rule or selection criterium (“...weight factor controls the effect of the cost factor while computing fitness values for a set of modalities during the selection process...”) [paras 52-54].
Claim 9:
Dasgupta et al. teach the computer-implemented verification method for verifying an identity of a user [para 34], as in claim 1 above, further comprising
using the at least one identity resource selected from the set of identity resources to attempt to verify the user's identity (“...multi-factor authentication of user identity for access to a computing device, system, or resource...adaptive selection of the available authentication modalities and considers different factors other than only user preference...”) [paras 2, 45, 49].
Claim 11:
Dasgupta et al. teach a computer-implemented verification method for verifying an identity of a user [para 34], as in claim 1 above, further comprising,
wherein: the set of identity resources is selected and/or generated by the user (“...continual authentication to existing cyber-enabled or computer systems (specifically, mobile devices such as smart-phones, tablets and PDAs)...adaptive selection of the available authentication modalities and considers different factors other than only user preference...”) [paras 45, 49].
Claim 12:
Dasgupta et al. teach a computer-implemented verification method for verifying an identity of a user [para 34], as in claim 1 above, further comprising,
wherein: the set of identity resources is selected and/or generated by the user as a subset of a larger set of identity resources (“...continual authentication to existing cyber-enabled or computer systems (specifically, mobile devices such as smart-phones, tablets and PDAs)...adaptive selection of the available authentication modalities and considers different factors other than only user preference...”) [paras 45, 49].
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claim(s) 2, 6, and 10 are rejected under 35 U.S.C. 103 as being unpatentable over Dasgupta et al. (US 20200014702 A1) in view of Ramalingam (US 20180349581 A1).
Claim 2:
Dasgupta et al. teach the computer-implemented verification method for verifying an identity of a user [para 34], as in claim 1 above, but do not explicitly teach,
wherein: the set of identity resources is made available to the validating entity by the user by providing the set of identity resources in or on a storage facility
However, Ramalingam does teach,
wherein: the set of identity resources is made available to the validating entity by the user by providing the set of identity resources in or on a storage facility
(“...the user 410 uses the installed SAIF client app 28 on her SAIF client device 26 (laptop, mobile, etc.) to define her credential properties...the credential properties may be a user-defined set of multiple identification properties...The user 410 also has the choice to backup the encrypted data on the SAIF cloud service 256 on the SAIF site 252...”) [paras 187, 188, 193, 194];
Therefore, it would have been obvious to one of ordinary skill in the art at the time of applicants’ filed invention to incorporate the teachings of Ramalingam into that of Dasgupta et al. in order to provide for a federated model of identity based credential management and authentication while also protecting the user’s credential data. While Dasgupta et al. teach storage of different identity authentication modalities on one or more separate servers for better security, Dasgupta et al. does not disclose details regarding specific implementations, whereas Ramalingam provides for an example of such an implementation relying on a federated credential storage system for identity based authentication.
Claim 6:
Dasgupta et al. teach the computer-implemented verification method for verifying an identity of a user [para 34], as in claim 1 above, but do not explicitly teach,
wherein: i) at least one of the identity resources in the set of identity resources is signed, encoded, secured or otherwise associated with a cryptographic key that is owned by, controlled by or associated with an issuing entity of the at least one identity resource
and ii) the validating entity performs the step of using a corresponding cryptographic key to validate that the at least one identity resource has been validly issued by the issuing entity
However, Ramalingam does teach,
wherein: i) at least one of the identity resources in the set of identity resources is signed, encoded, secured or otherwise associated with a cryptographic key that is owned by, controlled by or associated with an issuing entity of the at least one identity resource
and ii) the validating entity performs the step of using a corresponding cryptographic key to validate that the at least one identity resource has been validly issued by the issuing entity
(“...The compilation secures the data by, for example, a one-way transform, which may be, for example, a one-way hash function, converting static strings using one-way hashes with salting, reducing facial or fingerprint images to identity data (e.g., distance between eyes, ratio of facial dimensions, principal component analysis (PCA), fingerprint minutiae data, etc.), thereby making sure that the user's original credential data is not maintained by the SAIF cloud service 256 on the SAIF server 254. Please note that the SAIF cloud service 256 on the SAIF server 254 may offer a cloud backup for the storage of the user's encrypted credential data, but the keys for the decryption are preferably only with the user 410 on the SAIF client device 26 and not stored in the cloud...”) [paras 187, 188, 193, 194];
Therefore, it would have been obvious to one of ordinary skill in the art at the time of applicants’ filed invention to incorporate the teachings of Ramalingam into that of Dasgupta et al. in order to provide for a federated model of identity based credential management and authentication while also protecting the user’s credential data. While Dasgupta et al. teach storage of different identity authentication modalities on one or more separate servers for better security, Dasgupta et al. does not disclose details regarding specific implementations, whereas Ramalingam provides for an example of such an implementation relying on key encryption within a protected federated credential storage system for identity based authentication.
Claim 10:
Dasgupta et al. teach the computer-implemented verification method for verifying an identity of a user [para 34], as in claim 9 above, but do not explicitly teach,
denying access to a controlled resource if verification of the user's identity is rejected
or allowing access to a controlled resource if verification of the user's identity is successful
However, Ramalingam does teach,
denying access to a controlled resource if verification of the user's identity is rejected
(“...provides an indication to the system that the user has either been authenticated or not been authenticated; and in response to an indication from the login service that the user has been authenticated, permitting the user to access the computing resource as an authenticated user...”) [para 18];
or allowing access to a controlled resource if verification of the user's identity is successful
(“...in response to an indication from the login service that the user has not been authenticated, denying the user access to the computing resource as an unauthenticated user...”) [para 18];
Therefore, it would have been obvious to one of ordinary skill in the art at the time of applicants’ filed invention to incorporate the teachings of Ramalingam into that of Dasgupta et al. to provide an indication of the authentication result/status of the user. While Dasgupta et al. teach an identity based authentication process utilizing a plurality of selected different authentication credential modalities, it is not focused on details regarding how it handles the success or failure of authentication outcomes. Ramalingam provides for an example of one obvious implementation design choice for how to typically handle user identity authentication outcomes through an indication from the login service that would fit into a system like that taught by Dasgupta et al.
Claim 3 is rejected under 35 U.S.C. 103 as being unpatentable over Dasgupta et al. (US 20200014702 A1) in view of Ramalingam (US 20180349581 A1) in view of Zhu “Blockchain-Based Identity Authentication and Intelligent Credit Reporting”.
Claim 3:
Dasgupta et al. and Ramalingam teach the computer-implemented verification method for verifying an identity of a user [para 34], as in claim 2 above, but do not explicitly teach,
wherein: i) the storage facility is a blockchain
and/or ii) the set of identity resources is managed by a digital wallet
and/or iii) the user and/or validating entity is an actor or participant in a Web of Trust or Public Key Infrastructure
However, Zhu does teach,
wherein: i) the storage facility is a blockchain
(“...the user biometric files, behavioral information files, and hash values are stored in blockchain...user's individual each dimension identity authentication score Aij and the final identity authentication comprehensive weighted average score Si are stored in the blockchain distributed ledger...”) [Section 2.2];
Therefore, it would have been obvious to one of ordinary skill in the art at the time of applicants’ filed invention to incorporate the teachings of Zhu into that of Dasgupta et al. and Ramalingam in order to provide greater security as blockchain ledgers promote tamper resistance and data record integrity as well as non-repudiation “...the user feature information is stored in the
blockchain platform, which cannot be tampered with, and the data record can be traced...” [Zhu Section 2.2].
Claim 5 is rejected under 35 U.S.C. 103 as being unpatentable over Dasgupta et al. (US 20200014702 A1) in view of Zhu “Blockchain-Based Identity Authentication and Intelligent Credit Reporting”.
Claim 5:
Dasgupta et al. teach the computer-implemented verification method for verifying an identity of a user [para 34], as in claim 1 above, but do not explicitly teach,
wherein: i) the set of identity resources is made available to the validating entity by the user by using a blockchain, preferably wherein the set of identity resources is included or referenced from a transaction on the blockchain
and/or ii) and the at least one rule or selection criterium is implemented in a smart contract arranged for execution on and/or interaction with a blockchain
However, Zhu does teach,
wherein: i) the set of identity resources is made available to the validating entity by the user by using a blockchain, preferably wherein the set of identity resources is included or referenced from a transaction on the blockchain
and/or ii) and the at least one rule or selection criterium is implemented in a smart contract arranged for execution on and/or interaction with a blockchain
(“...the user biometric files, behavioral information files, and hash values are stored in blockchain...user's individual each dimension identity authentication score Aij and the final identity authentication comprehensive weighted average score Si are stored in the blockchain distributed ledge...dynamic identity authentication smart contract is prebuilt...”) [Section 2.2];
Therefore, it would have been obvious to one of ordinary skill in the art at the time of applicants’ filed invention to incorporate the teachings of Zhu into that of Dasgupta et al. in order to provide greater security as blockchain ledgers promote tamper resistance and data record integrity as well as non-repudiation “...the user feature information is stored in the
blockchain platform, which cannot be tampered with, and the data record can be traced...” [Zhu Section 2.2].
Claims 8 and 13 are rejected under 35 U.S.C. 103 as being unpatentable over Dasgupta et al. (US 20200014702 A1) in view of Andrade (US 20180248699 A1).
Claim 8:
Dasgupta et al. teach the computer-implemented verification method for verifying an identity of a user [para 34], as in claim 1 above, but do not explicitly teach,
wherein: verification of the user's identity is rejected by the validating entity if, in accordance with the at least one rule or selection criterium, no identity resources can be selected from the set of identity resources
However, Andrade does teach,
wherein: verification of the user's identity is rejected by the validating entity if, in accordance with the at least one rule or selection criterium, no identity resources can be selected from the set of identity resources
(“...controlling the grant or denial of access depending on verification of a match of the received digital unique identifier with biometric identification data of the user associated with the verified document sought by the requesting entity (step 640)...”) [para 103];
Therefore, it would have been obvious to one of ordinary skill in the art at the time of applicants’ filed invention to incorporate the teachings of Andrade into that of Dasgupta et al. to provide identity authentication verification through the matching of specific credentials that must exist for a match for granting access, else a denial of access is issued. While Dasgupta et al. teach an identity based authentication process utilizing a plurality of selected different authentication credential modalities, it is not focused on details regarding how it handles the success or failure of authentication outcomes. Andrade provides for an example of one obvious implementation design choice for how to typically handle user identity authentication credentials comparisons through a verification grant/denial indication that would fit into a system like that taught by Dasgupta et al.
Claim 13:
Dasgupta et al. teach the computer-implemented verification method for verifying an identity of a user [para 34], as in claim 1 above, but do not explicitly teach,
removing, by the user, at least one identity resource from the set of identity resources
However, Andrade does teach,
removing, by the user, at least one identity resource from the set of identity resources
(“...activating an interface configured to add or delete data related to verified documents or biometric identification data associated with the user (step 612)...”) [para 101];
Therefore, it would have been obvious to one of ordinary skill in the art at the time of applicants’ filed invention to incorporate the teachings of Andrade into that of Dasgupta et al. to provide identity authentication verification through the matching of specific credentials that must exist for a match for granting access, else a denial of access is issued. While Dasgupta et al. teach an identity based authentication process utilizing a plurality of selected different authentication credential modalities, it is not focused on details regarding how it handles the success or failure of authentication outcomes. Andrade provides for an example of one obvious implementation design choice for how to typically handle user identity authentication credentials management through an addition/deletion interface and process that would fit into a system like that taught by Dasgupta et al.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Oscar Louie whose telephone number is (571) 270-1684 and E-mail address is OSCAR.LOUIE@USPTO.GOV. Note that a form SB-439 must be on file in order to conduct correspondence by E-mail, however, E-mail may be utilized to arrange time(s) for interview(s) without the SB-439 form. The examiner can normally be reached on Monday through Thursday between 05:30AM-03:30 PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/OSCAR A LOUIE/Supervisory Patent Examiner, Art Unit 2445
