The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This Office action is in response to communications filed on 4/10/2025.
Claims 1-18 are pending.
DETAILED ACTION
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1 and 3-5 is/are rejected under 35 U.S.C. 103 as being unpatentable over Smith et al. (US 20110246756 A1, hereinafter Smith) in view of Luo (US 20190281449 A1), and further in view of Carpenter et al. (US 20160204946 A1).
Regarding claim 1, Smith discloses a method of authorizing a computer peripheral device to perform a particular action, comprising:
receiving, by a network device, a request associated with a particular action to be performed by the computer peripheral device (¶[0028], "The verifier receives a signed message from a peripheral device over a bus to which the peripheral device is connected. The verifier authenticates the signed message with the public key, and identifies device and functionality characteristics of the peripheral device responsive to the authenticating the signed message"; ¶[0018], "Whether the verifier is able to authenticate a connected peripheral affects functionality available to the connected peripheral device. Affecting the functionality is not just determining whether or not to allow the device to work with the computing device, but providing certain features to authenticated devices that are not enabled for non-authenticated devices"),
wherein the request is digitally signed using a private device key of the computer peripheral device (¶[0024], "the manufacturer provisions a private key for the peripheral devices"; ¶[0029], "a signed message, signed with the private key");
validating, by the network device, the digitally signed request using a public device key (¶[0025], "On the side of the verifier and the computing device, a single public key could be issued per device type (e.g., all USB sticks), per manufacturer (e.g., different companies), or per function-based technology (e.g., one public key for vPro, and another public key for another technology)"; ¶[0028], "The verifier authenticates the signed message with the public key"; ¶[0035], "Issuer 150 represents an entity (e.g., company) that issues one of multiple private keys to peripheral 130, and a corresponding public key to verifier 112. In one embodiment, issuer 150 indicates restrictions on how private keys are to be provisioned to peripherals. Alternatively, the peripheral manufacturer could be responsible for provisioning keys among various products, including grouping products for the distribution of keys. Thus, there is not necessarily an issuer 150 in all embodiments");
generating a response to the request, the response indicating whether the computer peripheral device is authorized to perform the particular action associated with the request (¶[0028], "The verifier authenticates the signed message with the public key, and identifies device and functionality characteristics of the peripheral device responsive to the authenticating the signed message. If the peripheral device properly authenticates, the verifier can authorize the peripheral device for the identified functionality"; ¶[0029], "full functionality in the connection may be provided to the peripheral device [...] instead of standard functionality when authentication fails").
Smith does not disclose that the public device key is previously provided by the computer peripheral device; and sending the response to a client device associated with the computer peripheral device.
Luo discloses that a device key may be previously provided by a computer peripheral device (¶[0047], "peripheral device 101 then transmits the calculated hash values back to the server 103 along with its public key"; ¶[0049], "the authentication server 103 transmits the certificate to the peripheral device 101 via the TLS tunnel. The server 103 also transmits the peripheral device's certificate to the host device 102 via its TLS connection with the host device 102. The peripheral device 101 and the host device 102 each receive a copy of the peripheral device's security certificate and store the certificate in their respective memory systems for later use"; ¶[0051], "The host device 102 attempts to locate a public key for the server 103 by performing a lookup in its public key database 222 using the received URL 332 of the server 103. If the lookup does not return a public key for the server 103, then the host obtains the public key from the server 103 via a TLS connection with the server 103"; ¶[0052], "the host device 102 authenticates the security certificate 212 of the peripheral device 101 using the public key of the authentication server 103").
Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to combine the teachings of Smith and Luo to arrive at a system in which the public device key is previously provided by the computer peripheral device.
One of ordinary skill in the art would have been motivated because it would prevent man in the middle attacks (Luo, ¶[0017]).
The combination of Smith and Luo do not disclose sending the response to a client device associated with the computer peripheral device.
Carpenter discloses sending the response to a client device associated with the computer peripheral device (Claim 18, "A computing device comprising: a processor; a communication interface configured to communicate with a peripheral device local to the computing device; and memory storing instructions which, when executed by the processor, configure the computing device to: generate a user interface that receives a user request to access data; receive an authentication request from the peripheral device that is signed with a private encryption key and includes authentication information indicative of the user request to access the data; send the signed authentication request to a computing system; and receive a response to the signed authentication request from the computing system, the response being indicative of a verification of the user request to access the data; and generate a user interface that displays the data to the user").
Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to combine the teachings of Smith, Luo, and Carpenter to arrive at a system for sending the response to a client device associated with the computer peripheral device.
One of ordinary skill in the art would have been motivated because a mouse is usually connected to a computer and not directly to a network, therefore, a computer device connected to the mouse would enable the mouse to communicate with the external device.
Regarding claim 3, the combined teachings of Smith, Luo, and Carpenter disclose the invention substantially as applied to claim 1, above, wherein: the particular action comprises an action selected from the group consisting of logging into a software application, unlocking a software-locked feature of the computer peripheral device, and performing the software-locked feature of the computer peripheral device (Smith, ¶[0028], "The verifier authenticates the signed message with the public key, and identifies device and functionality characteristics of the peripheral device responsive to the authenticating the signed message. If the peripheral device properly authenticates, the verifier can authorize the peripheral device for the identified functionality").
Regarding claim 4, the combined teachings of Smith, Luo, and Carpenter disclose the invention substantially as applied to claim 1, above, wherein: the request is received from a remote device (Smith, ¶[0028], "The verifier receives a signed message from a peripheral device over a bus to which the peripheral device is connected").
Regarding claim 5, the combined teachings of Smith, Luo, and Carpenter disclose the invention substantially as applied to claim 1, above, wherein: the request is received from the client device (Carpenter, Claim 18, "A computing device comprising: a processor; a communication interface configured to communicate with a peripheral device local to the computing device; and memory storing instructions which, when executed by the processor, configure the computing device to: generate a user interface that receives a user request to access data; receive an authentication request from the peripheral device that is signed with a private encryption key and includes authentication information indicative of the user request to access the data; send the signed authentication request to a computing system; and receive a response to the signed authentication request from the computing system, the response being indicative of a verification of the user request to access the data; and generate a user interface that displays the data to the user").
Claim(s) 6 is/are rejected under 35 U.S.C. 103 as being unpatentable over Smith (US 20110246756 A1) in view of Luo (US 20190281449 A1), and further in view of Carpenter (US 20160204946 A1), as applied to claim 1, above, and further in view of Crane ("Asymmetric vs Symmetric Encryption: Definitions & Differences", The SSL Store, 2020).
Regarding claim 6, the combined teachings of Smith, Luo, and Carpenter disclose the invention substantially as applied to claim 1, above, wherein: the public device key received from the computer peripheral device is encrypted (Luo, ¶[0051], "The host device 102 attempts to locate a public key for the server 103 by performing a lookup in its public key database 222 using the received URL 332 of the server 103. If the lookup does not return a public key for the server 103, then the host obtains the public key from the server 103 via a TLS connection with the server 103" - TLS signifies data is encrypted ); and
the method comprises decrypting, by the network device, the public device key (Luo, ¶[0051], "The host device 102 attempts to locate a public key for the server 103 by performing a lookup in its public key database 222 using the received URL 332 of the server 103. If the lookup does not return a public key for the server 103, then the host obtains the public key from the server 103 via a TLS connection with the server 103" - TLS signifies data is decrypted at receiving end).
the combined teachings of Smith, Luo, and Carpenter do not disclose that the encryption is using a public key of the network device; and the decryption is by using a private key of the network device.
Crane discloses that the encryption is using a public key of the network device (page 2 and page 10 suggests that data may be encrypted using either symmetric or asymmetric encryption depending on design choices; page 4, when using asymmetric encryption, a public key of the receiving device is used to encrypt); and
the decryption is by using a private key of the network device (page 2 and page 10 suggests that data may be encrypted using either symmetric or asymmetric encryption depending on design choices; page 4, when using asymmetric encryption, a private key of the receiving device is used to encrypt - note the concepts on who the key belongs to are well-known in the art).
Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to combine the teachings of Smith, Luo, Carpenter and Crane to arrive at a system in which the encryption is using a public key of the network device; and the decryption is by using a private key of the network device.
One of ordinary skill in the art would have been motivated because for public channels asymmetric encryption might work better than symmetric encryption (Crane, page 9).
Claim(s) 7 is/are rejected under 35 U.S.C. 103 as being unpatentable over Smith (US 20110246756 A1) in view of Luo (US 20190281449 A1), and further in view of Carpenter (US 20160204946 A1), as applied to claim 1, above, and further in view of Crane ("Asymmetric Encryption: What It Is & Why Your Security Depends On It", The SSL Store, 2020, hereinafter Crane_2).
Regarding claim 7, the combined teachings of Smith, Luo, and Carpenter disclose the invention substantially as applied to claim 1, above.
The combined teachings of Smith, Luo, and Carpenter does not disclose that the request is encrypted using a public key of the network device; and the method comprises decrypting, by the network device, the request using a private key of the network device.
Crane_2 discloses that a request may be encrypted using a public key of the network device (page 2, data may be encrypted prior to transmission, where asymmetric encryption may be used by encrypting the data using the recipient's public key); and
the method comprises decrypting, by the network device, the request using a private key of the network device (page 2, data may be encrypted prior to transmission, where asymmetric encryption may be used by decrypting the data using the recipient's private key).
Therefore, it would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to combine the teachings of Smith, Luo, Carpenter and Crane_2 to arrive at a system in which the request is encrypted using a public key of the network device; and the method comprises decrypting, by the network device, the request using a private key of the network device.
One of ordinary skill in the art would have been motivated because it would keep information "out of hands of unauthorized users" (Crane_2, page 2).
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 1-18 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-18 of U.S. Patent No. 12,299,184 B2. Although the claims at issue are not identical, they are not patentably distinct from each other because, for example:
Regarding claim 1,
PNG
media_image1.png
200
400
media_image1.png
Greyscale
Claims 2-18 of the present application are equally similar to claims 2-18 of U.S. Patent No. 12,299,184 B2.
Allowable Subject Matter
Claims 8-18 would be allowable by overcoming all double patenting rejections set forth above.
Claim 2 would be allowable by overcoming all double patenting rejections set forth above and if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure:
US 20170243023 A1, which discloses "the peripheral device 420 may generate a pair of a private key and a public key, and may store the private key and transmit the public key to the electronic device 410" (¶[0135]) and "the peripheral device 420 may encrypt the random data using the private key, thereby generating authentication data. In addition, the peripheral device 420 may transmit the authentication data to the electronic device 410" (¶[0149]).
US 20140188732 A1, which discloses "the key pair is generated and the private key is injected or stored in the peripheral's long term memory at some point during the process of manufacturing the peripheral. The public key is provided with the peripheral but not stored in the memory of the peripheral. When the peripheral is registered with the transaction system 10, information about the peripheral including the vendor's model number, the vendor's serial number, the vendor's product identification and the public key are sent to the enterprise provisioning server 20 and stored in a database of registered peripherals" (¶[0056]).
US 20030233550 A1, which discloses "after a session key has been generated, the peripheral could create a private/public key pair, encrypt the public key and a machine authentication code (MAC) with the symmetric key, and send the encrypted public key and MAC to the processor. Then, if the peripheral includes a non-volatile memory, the peripheral's private key may be stored permanently in the peripheral, and the public key of the peripheral may be stored in memory accessible to the processor" (¶[0032]).
US 20170364713 A1, which discloses "the device 1014 has an encryption facility 1072 is able to send a public key to the keyboard and mouse. The keyboard has a corresponding encrypt facility that encrypts the keystrokes signals sent to the security device 1014 using the public key. Similarly the mouse has an encrypt store that that encrypts the mouse signals sent to the security device 1014 using the public key. In this embodiment the keyboard and mouse are also authenticated using the virtual computer service 1032. Both the keyboard and mouse have unique identifiers that are sent to the virtual computer service for authentication by the remote access connector 1026. In this manner each of the device, keyboard and mouse are authenticated. Once authenticated the keyboard and mouse are activated and able to control the virtual computer service" (¶[0194]).
Any inquiry concerning this communication or earlier communications from the examiner should be directed to BORIS D GRIJALVA LOBOS whose telephone number is (571)272-0767. The examiner can normally be reached M-F 10:30AM to 6:30PM EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jorge L Ortiz-Criado can be reached at 571-272-7624. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/BORIS D GRIJALVA LOBOS/ Primary Patent Examiner, Art Unit 2496
Prosecution Insights