DETAILED ACTION
Acknowledgements
This office action is in response to the claims filed 09/16/2025.
Claims 1-24, 26, 28, and 30-32 are amended.
Claims 1-24, 26, 28, and 30-32 are pending.
Claims 1-24, 26, 28, and 30-32 have been examined.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-24, 26, 28, and 30-32 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Subject Matter Eligibility Standard
When considering subject matter eligibility under 35 U.S.C. § 101, it must be determined whether the claim is directed to one of the four statutory categories of invention, i.e., process, machine, manufacture, or composition of matter (101 Analysis: Step 1). Even if the claim does fall within one of the statutory categories, it must then be determined whether the claim is directed to a judicial exception (i.e., law of nature, natural phenomenon, and abstract idea) (101 Analysis: Step 2a(Prong 1), and if so, Identify whether there are any additional elements recited in the claim beyond the judicial exception(s), and evaluate those additional elements to determine whether they integrate the exception into a practical application of the exception. (101 Analysis: Step 2a (Prong 2). If additional elements does not integrate the exception into a practical application of the exception, claim still requires an evaluation of whether the claim recites additional elements that amount to an inventive concept (aka “significantly more”) than the recited judicial exception. If the claim as a whole amounts to significantly more than the exception itself (there is an inventive concept in the claim), the claim is eligible. If the claim as a whole does not amount to significantly more (there is no inventive concept in the claim), the claim is ineligible. (101 Analysis: Step 2b).
The 2019 PEG explains that the abstract idea exception includes the following groupings of subject matter: a) Mathematical concepts b) Certain methods of organizing human activity and c) Mental processes
Analysis
In the instant case, claim 1 is directed to a method, claim 24, 30, 31 are directed to an article of manufacture and claim 26 is directed to an ‘application’.
Step 2a.1– Identifying an Abstract Idea
The claims recite the steps of “recording … state… causing recording … state … sending a request … receiving a response … and controlling access to the protected asset ….” The recited limitations fall within the certain methods of organizing human activity grouping of abstract ideas, specifically, controlling access to an asset or product. Accordingly, the claims recites an abstract idea.
See MPEP 2106.
Step 2a.2 – Identifying a Practical Application
The claim does not currently recite any additional elements or combination of additional elements that integrate the judicial exception into a practical application.
Accordingly, even in combination, these elements do not integrate the abstract idea into a practical application because they do not impose any meaningful limits on practicing the abstract idea.
Mere instructions to apply the exception using generic computer components and limitations to a particular field of use or technological environment do not amount to practical applications. The claim in directed to an abstract idea.
Step 2b
The claim limitations recite “recording … state… causing recording … state … sending a request … receiving a response … and controlling access to the protected asset ….” are not additional elements and they amount to no more than mere instructions to apply the exception using a generic computer component. For the same reason these elements are not sufficient to provide an inventive concept. This is also determined to be well-understood, routine and conventional activity in the field. The Symantec, TLI, and OIP Techs, court decision cited in MPEP 2106.05(d)(II) indicates that mere receipt or transmission of data over a network is a well-understood, routine and conventional function when it is claimed in a merely generic manner, as it is here. Therefore, when considering the additional elements alone, and in combination, there is no inventive concept in the claim and thus the claim is not eligible.
Viewed as a whole, instructions/method claims recite the concept of a fundamental economic practice as performed by a generic computer. The claims do not currently recite any additional elements or combination of additional elements that amount to significantly more than the judicial exception. The elements used to perform the claimed judicial exception amount to no more than mere instructions to implement the abstract idea in a network, and/or merely uses a network as a tool to perform an abstract idea and/or generally linking the use of the judicial exception to a particular environment.
Dependent claims 2, 4-13, 20 and 16- 20 discuss functions in more descriptive detail of the steps geared toward the abstract idea. As such, these elements do not provide the significantly more to the underlying abstract idea necessary to render the invention patentable.
Dependent claims 3, 14-19, 21-23, 28 and 32 provide descriptive language surrounding the abstract idea. As such, these elements do not provide the significantly more to the underlying abstract idea necessary to render the invention patentable.
The claims do not, for example, purport to improve the functioning of the computer itself. Nor do they effect an improvement in any other technology or technical field. Therefore, based on case law precedent, the claims are claiming subject matter similar to concepts already identified by the courts as dealing with abstract ideas. See Alice Corp. Pty. Ltd., 573 U.S. 208 (citing Bilski v. Kappos, 561, U.S. 593, 611 (2010)).
The claims at issue amount to nothing significantly more than an instruction to apply the abstract idea using some unspecified, generic computer. See Alice Corp. Pty. Ltd., 573 U.S. 208. Mere instructions to apply the exception using a generic computer component and limitations to a particular field of use or technological environment cannot integrate a judicial exception into a practical application at Step 2A or provide an inventive concept in Step 2B. The use of a computer or processor to merely automate and/or implement the abstract idea cannot provide significantly more than the abstract idea itself (MPEP 2106.05(I)(A)(f) & (h)). Therefore, the claim is not patent eligible.
Conclusion
The claim as a whole, does not amount to significantly more than the abstract idea itself. This is because the claim does not affect an improvement to another technology or technical filed; the claim does not amount to an improvement to the functioning of a computer system itself; and the claim does not move beyond a general link of the use of an abstract idea to a particular technological environment.
Accordingly, the Examiner concludes that there are no meaningful limitations in the claim that transform the judicial exception into a patent eligible application such that the claim amounts to significantly more than the judicial exception itself.
Dependent claims do not resolve the deficiency of independent claims and accordingly stand rejected under 35 USC 101 based on the same rationale.
Dependent claims 2-23, 28 and 32 are also rejected.
Claim 26 recites “A trusted application comprising computer program code " and claim 28 recites “A computerized backend resource for preventing fraudulent rollback of a trusted application executable in a secure execution environment” are directed to software per se. Software is defined as "Microsoft Press Dictionary Definition" or "IEEE Definition". There are four categories of invention: process, machine, article of manufacture or composition of matter. Therefore, as "software" is neither a category of invention nor a subset of one of the categories it does not represent patent eligible subject matter, In re Nuijten, 84 U.S.P.Q.2d 1495 (Fed. Cir. 2007).
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 24, 26, 30 and 31 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
Claim 24, and 30 recites “A host device comprising a secure execution environment for executing a trusted application, the trusted application comprising a protected asset, the host device being configured to prevent fraudulent rollback of the trusted application by performing the functionality of the method of claim 1,… A non-transitory computer readable storage medium having stored thereon a computer program comprising computer program code” and Claim 26, and 31 recites “A trusted application comprising computer program code being executable in a secure execution environment of a host device, the trusted application comprising a protected asset and being configured to prevent fraudulent rollback by performing the functionality of the trusted application in the method of claim 1… A non-transitory computer readable storage medium having stored thereon a computer program comprising computer program code”. The disclosure does not provide written description for the host device, or the trusted application, and/or the external entity/ computerized backend resource performing the functions of “repeatedly recording an execution state of the trusted application within the trusted application, the execution state being a monotonic function of execution progress of the trusted application; repeatedly causing recording of the execution state in an entity external to the trusted application ; upon occurrence of an event in the trusted application, sending a request to said external entity; receiving a response to said request from said external entity, the response including information which enables verification by the trusted application that a present execution state within the trusted application is not older than a most recent execution state as recorded by the external entity; and controlling access to the protected asset depending on an outcome of the verification, wherein the external entity signs the response to the trusted application with a private cryptographic key kept secret by the external entity, and wherein the trusted application verifies the signature of the response using a public cryptographic key corresponding to the private cryptographic key as part of the verification by the trusted application. ” The disclosure does not provide support for the recited limitations.
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-24, 26, 28, and 30-32 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor, or for pre-AIA the applicant regards as the invention.
Claim 1 recites “a trusted application executable in a secure execution environment of a host device , the trusted application comprising a protected asset…repeatedly recording an execution state of the trusted application within the trusted application… repeatedly causing recording of the execution state in an entity external to the trusted application… receiving a response to said request from said external entity, the response including information which enables verification by the trusted application”. The scope of the claim is unclear and indefinite. The preamble recites a trusted application that is ‘executable’ on a host device. The claim does not provide direction as to the entity performing the claimed steps. For example, it is unclear if the trusted application is making recordings of itself, or whether another entity is recording the states or the application and also an external entity. It is unclear from the claims what entity is performing the claimed steps and if a single entity performs the method. Additionally, dependent claims recite functions of the host device and the external entity. The scope of the claims are unclear. Dependent claims 2-23, 28 and 32 are also rejected.
Claim 3 recites “prevented by the method is re-use of the protected asset”. The claim is unclear and indefinite as to which “method” is being referenced that prevents fraudulent rollback.
Claims 24 and 30 recite “A host device comprising a secure execution environment for executing a trusted application, the trusted application comprising a protected asset, the host device being configured to prevent fraudulent rollback of the trusted application by performing the functionality of the method of claim 1… A non-transitory computer readable storage medium having stored thereon a computer program comprising computer program code….” The claim is unclear and indefinite as to what the ‘functionality of the method of claim 1’ is and what method of claim 1 the host device performs.
Claims 26 and 31 recite “A trusted application comprising computer program code being executable in a secure execution environment of a host device, the trusted application comprising a protected asset and being configured to prevent fraudulent rollback by performing the functionality of the trusted application in the method of claim 1… A non-transitory computer readable storage medium having stored thereon a computer program comprising computer program code….” The claim is unclear and indefinite as to what the ‘functionality of the trusted application in the method of claim 1’ is and what method of claim 1 the trusted application performs.
Claim 28 recites “A computerized backend resource for preventing fraudulent rollback of a trusted application executable in a secure execution environment of a host device, the trusted application comprising a protected asset, the computerized backend resource being configured to perform the functionality of the computerized backend resource in the method according to claim 15” and claim 32 recites “A non-transitory computer readable storage medium having stored thereon a computer program comprising computer program code for performing the functionality of the computerized backend resource in the method of claim 15 when the computer program code is executed by a processing device”. Claim 28 and 32 depend on dependent claim 15. The claim is unclear and indefinite as to what the ‘functionality of the computerized backend resource in the method according to claim 15’ is and what method of claim 15 the computerized backend resource performs.
Claim 28 recites “A computerized backend resource for preventing fraudulent rollback of a trusted application executable in a secure execution environment of a host device, the trusted application comprising a protected asset, the computerized backend resource being configured to perform the functionality of the computerized backend resource in the method according to claim 15” and claim 32 recites “A non-transitory computer readable storage medium having stored thereon a computer program comprising computer program code for performing the functionality of the computerized backend resource in the method of claim 15 when the computer program code is executed by a processing device”. Claim 28 and 32 depend on dependent claim 15, which is a method claim. The claim is a hybrid claim as the cited language is not directed to the method but to external use and an external entity of the claimed structural elements. Therefore, it would be unclear whether infringement of claims 15, 28 and 32 occurs based on functions of the trusted element, host device, or based on an external entity/ computerized backend resource. In re Katz Interactive Call Processing Patent Litigation, 639 F.3d 1303 (Fed. Cir. 2011). IPXL Holdings v. Amazon.com, Inc., 430 F.2d 1377, 1384, 77 USPQ2d 1140, 1145 (Fed. Cir. 2005). Ex parte Lyell, 17 USPQ2d 1548 (Bd. Pat. App. & Inter. 1990).
The following is a quotation of 35 U.S.C. 112(d):
(d) REFERENCE IN DEPENDENT FORMS.—Subject to subsection (e), a claim in dependent form shall contain a reference to a claim previously set forth and then specify a further limitation of the subject matter claimed. A claim in dependent form shall be construed to incorporate by reference all the limitations of the claim to which it refers.
The following is a quotation of pre-AIA 35 U.S.C. 112, fourth paragraph:
Subject to the following paragraph [i.e., the fifth paragraph of pre-AIA 35 U.S.C. 112], a claim in dependent form shall contain a reference to a claim previously set forth and then specify a further limitation of the subject matter claimed. A claim in dependent form shall be construed to incorporate by reference all the limitations of the claim to which it refers.
Claims 28 and 32 rejected under 35 U.S.C. 112(d) or pre-AIA 35 U.S.C. 112, 4th paragraph, as being of improper dependent form for failing to further limit the subject matter of the claim upon which it depends, or for failing to include all the limitations of the claim upon which it depends
Claim 28 recites “A computerized backend resource for preventing fraudulent rollback of a trusted application executable in a secure execution environment of a host device, the trusted application comprising a protected asset, the computerized backend resource being configured to perform the functionality of the computerized backend resource in the method according to claim 15” and claim 32 recites “A non-transitory computer readable storage medium having stored thereon a computer program comprising computer program code for performing the functionality of the computerized backend resource in the method of claim 15 when the computer program code is executed by a processing device”. Claim 28 and 32 depend on dependent claim 15 and the claims broaden the subject matter with relation to the ‘computerized backend resource’. It is unclear whether claims are supposed to be independent claims dependent on the language of a dependent claim. Applicant may cancel the claim(s), amend the claim(s) to place the claim(s) in proper dependent form, rewrite the claim(s) in independent form, or present a sufficient showing that the dependent claim(s) complies with the statutory requirements.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-24, 26, 28, and 30-32 are rejected under 35 U.S.C. 103 as being unpatentable over Jakobsson et al (US 20230281606) (“Jakobsson”), and further in view of Mayblum et al. (US 20220122062) (“Mayblum”).
Regarding claims 1, 24, 26, 30, and 31, Jakobsson discloses repeatedly recording an execution state of the trusted application within the trusted application, the execution state being a monotonic function of execution progress of the trusted application (¶ 158, 205, 215, 258, 295-300, 407, 423);
upon occurrence of an event in the trusted application, sending a request to said external entity (¶ 101-107, 112-114, 119, 250-255, 300-310, 423);
receiving a response to said request from said external entity, the response including information which enables verification by the trusted application that a present execution state within the trusted application is not older than a most recent execution state as recorded by the external entity (¶ 112-118, 156, 250-255, 271); and
controlling access to the protected asset depending on an outcome of the verification (¶ 112-120, 156, 250-257, 271),
wherein the external entity signs the response to the trusted application with a private cryptographic key kept secret by the external entity, and wherein the trusted application verifies the signature of the response using a public cryptographic key corresponding to the private cryptographic key as part of the verification by the trusted application (¶ 130-134, 236, 272, 325-333, 449).
Jakobsson does not disclose repeatedly causing recording of the execution state in an entity external to the trusted application.
Mayblum teaches repeatedly causing recording of the execution state in an entity external to the trusted application (¶ 231, 338-39, 345-46, 462).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Jakobsson and Mayblum in order to provide access monitoring for transactions (Mayblum; ¶ 4-7).
Regarding claim 2, Jakobsson discloses wherein the trusted application signs the request to the external entity with a private cryptographic key kept secret by the trusted application and wherein the external entity verifies the signature of the request using a public cryptographic key corresponding to the private cryptographic key as a requisite for sending the response to the trusted application (¶ 134, 141-143, 147-150, 188, 238-39, 272, 383-85, 418-23).
Regarding claim 3, Jakobsson discloses wherein the fraudulent rollback prevented by the method is re-use of the protected asset for a specific action already performed once before (¶ 270-276).
Regarding claim 4, Jakobsson discloses the host device being configured for executing a non-secure normal application in a non- secure normal execution environment, wherein controlling access to the protected asset involves admitting full usage of the protected asset for the non-secure normal application when the verification was successful and preventing any and all access usage of the protected asset for the non-secure normal application when the verification failed (¶ 267, 301-317, 320, 341, 407, 444).
Regarding claim 5, Jakobsson discloses the host device being configured for executing a non-secure normal application in a non-secure normal execution environment, wherein controlling access to the protected asset involves admitting full usage of the protected asset for the non-secure normal application when the verification was successful and admitting limited usage of the protected asset for the non-secure normal application when the verification failed (¶ 160-170, 257-267, 301-317, 320, 341, 444).
Regarding claim 6, Jakobsson discloses wherein admitting limited usage of the protected asset for the non-secure normal application when the verification failed includes admitting usage of the protected asset during a time period (¶ 160-170, 257-267, 301-317, 320, 341, 444).
Regarding claim 7, Jakobsson discloses wherein admitting limited usage of the protected asset for the non-secure normal application when the verification failed includes admitting usage of the protected asset for a maximum number of actions only (¶ 160-170, 252-267, 301-317, 320, 341, 442-444).
Regarding claim 8, Jakobsson discloses wherein admitting limited usage of the protected asset for the non-secure normal application when the verification failed includes admitting usage of the protected asset for a first type of action but not for a second type of action (¶ 160-170, 252-267, 301-317, 320, 341, 442-444).
Regarding claim 9, Jakobsson discloses wherein repeatedly recording the execution state of the trusted application within the trusted application involves incrementing a first counter maintained by the trusted application, and wherein repeatedly causing recording of the execution state in the external entity involves causing incrementing of a second counter maintained by the external entity (¶ 134, 252-267, 327, 475).
Regarding claim 10, Jakobsson discloses wherein the first counter is incremented in preparation of the sending of the request to said external entity, and wherein the second counter is incremented between the receiving of the request and the sending of the response by said external entity (¶ 134, 252-267, 327, 475).
Regarding claim 11, Jakobsson discloses wherein the first counter is included in the request to the external entity, and wherein the second counter is included in the response to the trusted application and used by the trusted application to verify that the first counter is higher than the second counter and that, accordingly, the present execution state within the trusted application is not older than the most recent execution state as recorded by the external entity (¶ 134, 186, 196-7, 252-267, 327, 475).
Regarding claim 12, Jakobsson discloses wherein the first counter is included in the request to the external entity, and wherein the second counter is used by the external entity to verify that the first counter is higher than the second counter and that, accordingly, the present execution state within the trusted application is not older than the most recent execution state as recorded by the external entity (¶ 134, 186, 196-7, 252-267, 319, 327, 475).
Regarding claim 13, Mayblum teaches wherein a timestamp is included by the trusted application in the request to the external entity, wherein the timestamp is included in the response by said external entity, and wherein the verification by the trusted application includes checking that the timestamp in the response indicates that no more than a threshold time has passed since the generation of the request and the receiving of the response (¶ 10, 144-45, 204, 513).
Regarding claim 14, Jakobsson discloses wherein the external entity is a host device comprising protected hardware resources (¶ 173, 312-3, 408, 413).
Regarding claim 15, 28, and 32, Jakobsson discloses wherein the external entity is a computerized backend resource being connectable with the host device over one or more communication networks (¶ 119-121, 147, 235).
Regarding claim 16, Mayblum teaches wherein the sending of the request to the computerized backend resource and the receiving of the response from said computerized backend resource involves circuit-switched telecommunication (¶ 208-233).
Regarding claim 17, Jakobsson discloses wherein the trusted application supports actions that operate upon the protected asset and involves packet- switched wide area network communication with the computerized backend resource (¶ 310-314, 404-406).
Regarding claim 18, Jakobsson discloses wherein, in case the present execution state within the trusted application is found to be older than a most recent execution state as recorded by the computerized backend resource, the computerized backend resource prohibits further actions that operate upon the protected asset (¶ 112, 214, 257-263, 442, 504-506).
Claim Interpretation – “wherein, in case the present execution state” recites optional and conditional language, and therefore does not have patentable weight. See MPEP 2103(I)(c).
Regarding claim 19, Jakobsson discloses wherein said event in the trusted application is any of the following: a rebooting of the host device; a request for an action that operates upon the protected asset; an occurrence of a scheduled event; and a randomized occurrence of an event (¶ 101-107, 112-114, 119, 250-285, 300-320, 423).
Regarding claim 20, Jakobsson discloses wherein the secure execution environment is a software-based virtual execution environment, and wherein the protected asset is maintained in protected hardware resources accessible to the trusted application when executed in the software-based virtual execution environment (¶ 184, 194, 325-27).
Regarding claim 21, Jakobsson discloses wherein the protected asset represents a finite digital resource, such as a service subscription or a license scheme (¶ 189, 196, 252-257, 270-72, 388).
Regarding claim 22, Mayblum teaches wherein the trusted application is a secure digital wallet for a payment application service and the protected asset represents a balance of the secure digital wallet (¶ 42, 52, 74-76, 198, 201).
Regarding claim 23, Mayblum teaches wherein the trusted application supports offline digital payments communicated by short-range wireless communication between the host device acting as a payer device and an external communication device acting as a payee device (¶ 204, 270-275, 285-293).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Nolan et al., (US 20190035018) teaches wallet control access.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ILSE I IMMANUEL whose telephone number is (469)295-9094. The examiner can normally be reached Monday-Friday 9:00 am to 5:00pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, NEHA PATEL can be reached on 571-270-1492. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ILSE I IMMANUEL/Primary Examiner, Art Unit 3699
Prosecution Insights