Notice of Pre-AIA or AIA Status
The present application is being examined under the pre-AIA first to invent provisions.
Status of Claims
This is the first office action on the merits in response to the application filed on 04/28/2025.
Claims 1-20 are currently pending and have been examined.
Priority
Applicant’s claim for the benefit of a US Application No. 17/976,432 filed on 10/28/2022 is acknowledged.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 05/16/2025 is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/process/file/efs/guidance/eTD-info-I.jsp.
Claims 1, 11, and 16 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-2, 12-13, and 20 and 13, respectively, of U.S. Patent No. 12,327,233 B2. Although the claims at issue are not identical, they are not patentably distinct from each other because every limitation in instant claims 1, 11, and 16 has a similarly-worded limitation in claims 1-2, 12-13, and 20 of US Patent 12,327,233 B2. For example, claims 1-2 in 12,327,233 B2 comprise the concept of “validating, by the computer system, integrity of an environment of the terminal device in which an instance of the application is installed and running on the terminal device, wherein validation is based at least in part on validation of a signature generated by a trusted execution environment of the terminal device using a first private encryption key and a second private encryption key; receiving, by the computer system, a device attestation request comprising terminal device identification data, encrypted signal data generated by the trusted execution environment of the terminal device using a third encryption key that encrypts one or more terminal device signal data, and a signature generated from the terminal device identification data and encrypted signal data using the first private encryption key; accessing, by the computer system, the first public encryption key that is associated with the terminal device identification data from a data store; verifying, by the computer system, the signature using the first public encryption key; in response to verification of the signature, accessing, by the computer system, a third decryption key from a data store that is associated with the terminal device identification data; decrypting, by the computer system, the encrypted signal data using the third decryption key to obtain plaintext signal data; matching, by the computer system, the plaintext signal data with known signal data that is associated with the device identification data; in response to the matching, generating, by the computer system, an attestation cryptogram that includes an identifier of the second public encryption key; and transmitting, by the computer system to the terminal device, the attestation cryptogram as a response to the device attestation request, the attestation cryptogram validating integrity of the terminal device when the terminal device submits processing requests to the computer system with the attestation cryptogram.”
Claims 2, 12, and 17 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 7, 17, and 17, respectively, of U.S. Patent No. 12,327,233 B2. Although the claims at issue are not identical, they are not patentably distinct from each other because every limitation in instant claims 2, 12, and 17 has a similarly-worded limitation in claims 7 and 17 of US Patent 12,327,233 B2. For example, claim 7 in 12,327,233 B2 comprises the concept of “encrypting, by the computer system, at least a portion of the attestation cryptogram using a fourth encryption key; and storing, by the computer system, an association between the fourth encryption key and the terminal device identification data.”
Claims 6, 15, and 20 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 8 and 18 of U.S. Patent No. 12,327,233 B2. Although the claims at issue are not identical, they are not patentably distinct from each other because every limitation in instant claims 6, 15, and 20 has a similarly-worded limitation in claims 8 and 18, respectively, of US Patent 12,327,233 B2. For example, claim 8 in 12,327,233 B2 comprises the concept of “wherein the third encryption key is a symmetric encryption key generated by the computer system and transmitted to the terminal device for storage in the trusted execution environment of the terminal device in response to validating integrity of an environment of the terminal device.”
Claim 7 is rejected on the ground of nonstatutory double patenting as being unpatentable over claim 9 of U.S. Patent No. 12,327,233 B2. Although the claims at issue are not identical, they are not patentably distinct from each other because every limitation in instant claim 7 has a similarly-worded limitation in claim 9 of US Patent 12,327,233 B2. For example, claim 9 in 12,327,233 B2 comprises the concept of “wherein the plaintext signal data comprises one or more of a device characteristic, a unique identifier, sensor data, location data, a file system parameter associated with the terminal device, and wherein the plaintext signal data is compared with corresponding signal data associated with the terminal device stored by the computer system.”
Claim 9 is rejected on the ground of nonstatutory double patenting as being unpatentable over claim 10 of U.S. Patent No. 12,327,233 B2. Although the claims at issue are not identical, they are not patentably distinct from each other because every limitation in instant claim 9 has a similarly-worded limitation in claim 10 of US Patent 12,327,233 B2. For example, claim 10 in 12,327,233 B2 comprises the concept of “wherein second transaction identifier corresponds to a previous transaction.”
Claim 10 is rejected on the ground of nonstatutory double patenting as being unpatentable over claim 11 of U.S. Patent No. 12,327,233 B2. Although the claims at issue are not identical, they are not patentably distinct from each other because every limitation in instant claim 10 has a similarly-worded limitation in claim 11 of US Patent 12,327,233 B2. For example, claim 11 in 12,327,233 B2 comprises the concept of “wherein second transaction identifier corresponds to a previous transaction.”
Allowable Subject Matter
The following is a statement of reasons for the indication of allowable subject matter: The independent claim 1 contains allowable subject matter. As per claim 2, the closest prior art of record, United States Patent Application No. 20190318342 to Mushing teaches a method for secured receipt and usage of payment credentials using a commercial-off-the-shelf (COTS) device includes: storing, in the COTS device, a secure application program and cryptographic keys; establishing, by the program, a secure communication channel with a back-end system inaccessible by any application program or component in the COTS device; exchanging attestation data between the program and the back-end system using the communication channel; receiving payment credentials from a payment card by a near field communication (NFC) interface in the COTS device; transmitting the payment credentials to the program by the NFC interface; enciphering, by the program, the payment credentials; and transmitting, by the program of the COTS device, the enciphered payment credentials to the back-end system using the secure communication channel. In addition, United States Patent No. 11979389 B1 to Thomas teaches a method and system for secure messaging on a mobile network, leveraging public/private key encryption. The method includes steps for deploying a trusted application by a mobile carrier on a device with a Trusted Execution Environment (TEE). A wireless Software Development Kit (SDK) on the subscriber device interacts with the trusted application and a wireless original equipment manufacturer (OEM) cloud service for mutual attestation, confirming the identity and trustworthiness of the device. A pair of public and private keys are generated, with the private key secured on the device. Messages are encrypted with the public key at a cloud messaging application, and decrypted with the private key at the device, enabling secure, viewable messages. The system can support secure transmission of one-time-passwords (OTPs) from an enterprise application, as well as encrypted chat functionality for device responses to the enterprise application. In addition, United States Patent Application No. 20220270064 to Cat teaches embedded card reader security. In an example, personal account number data read from a payment instrument may be temporally and/or spatially separated from personal identification number data utilized to complete a payment for products. Temporal separation may include removing the personal account number data from a merchant device prior to request personal identification number data. Spatial separation may include utilization of trusted execution environments, separated embedded card reader applications, intermediary applications, and/or trust routines, for example to enable different components of a merchant device, and/or components of other devices and systems to handle personal account number data and personal identification number data. In addition, United States Patent Application No. 20190020647 to Sinha teaches a computing device sends a request for an attestation certificate to an attestation service along with information regarding the hardware and/or software of the device. The attestation service processes the request and verifies the information received from the device. After verifying the information, the attestation service selects a public/private key pair from a collection of reusable public/private key pairs and generates an attestation certificate for the device and public key of the public/private key pair. This attestation certificate is digitally signed by the attestation service and returned to the device. The private key of the selected public/private key pair is also encrypted to a trusted secure component of the device, ensuring that the key cannot be stolen by malware and re-used on another device, and is returned to the device. The device uses this attestation certificate to access relying parties, and optionally generates additional public/private key pairs and attestation certificates. In addition, United States Patent Application No. 20220385467 to Ramadasse teaches devices, systems, and methods for binding with cryptographic key attestation. A method can include generating, by hardware of a device, a device public key and a device private key, based on the device private key, signing a first attestation resulting in a signed first attestation, the first attestation claiming the device private key originated from the hardware, based on the device public key and the signed first attestation, registering the device with a trusted authority, generating, by the hardware, a first application private key and a first application public key, and based on the device private key, signing a second attestation resulting in a signed second attestation, the second attestation claiming the first application private key originated from the hardware, and based on the first application public key and the signed second attestation, registering a first application of the device to a first server. In addition, United States Patent Application No. 20200067897 to Smimoff teaches a portable communication device may include a mobile application executing in an application execution environment and a secure application executing in a trusted execution environment. The secure application may receive, from the mobile application, a storage request to store sensitive data. The storage request may include an encrypted data type identifier and an encrypted sensitive data. The secure application may decrypt the encrypted data type identifier and the encrypted sensitive data using a transport key, and re-encrypt the sensitive data using a storage key. The re-encrypted sensitive data can then be stored in a memory of the portable communication device which is outside the trusted execution environment. In addition, United States Patent Application No. 20190052469 to Scarlata teaches a computing platform implements one or more secure enclaves including a first provisioning enclave to interface with a first provisioning service to obtain a first attestation key from the first provisioning service, a second provisioning enclave to interface with a different, second provisioning service to obtain a second attestation key from the second provisioning service, and a provisioning certification enclave to sign first data from the first provisioning enclave and second data from the second provisioning enclave using a hardware-based provisioning attestation key. The signed first data is used by the first provisioning enclave to authenticate to the first provisioning service to obtain the first attestation key and the signed second data is used by the second provisioning enclave to authenticate to the second provisioning service to obtain the second attestation key.
The closest prior art of record fail to teach or suggest, in the context of the ordered combination of the claim, receiving, by the computer system, a device attestation request comprising terminal device identification data, encrypted signal data generated by the trusted execution environment of the terminal device using a third encryption key that encrypts one or more terminal device signal data, and a signature generated from the terminal device identification data and encrypted signal data using the first private encryption key; accessing, by the computer system, the first public encryption key that is associated with the terminal device identification data from a data store; verifying, by the computer system, the signature using the first public encryption key; in response to verification of the signature, accessing, by the computer system, a third decryption key from a data store that is associated with the terminal device identification data; decrypting, by the computer system, the encrypted signal data using the third decryption key to obtain plaintext signal data; matching, by the computer system, the plaintext signal data with known signal data that is associated with the device identification data; in response to the matching, generating, by the computer system, an attestation cryptogram that includes an identifier of the second public encryption key; and transmitting, by the computer system to the terminal device, the attestation cryptogram as a response to the device attestation request, the attestation cryptogram validating integrity of the terminal device when the terminal device submits processing requests to the computer system with the attestation cryptogram.
Claims 2-10 are dependent on claim 1 and contain allowable subject matter for the same reasons stated above. In addition, claim 11 is analogous to claim 1, and thus contains allowable subject matter for the same reasons stated above. Claims 12-15 are dependent on claim 11 and contain allowable subject matter for the same reasons stated above. In addition, claim 16 is analogous to claim 1, and thus contains allowable subject matter for the same reasons stated above. Claims 17-20 are dependent on claim 16 and contain allowable subject matter for the same reasons stated above.
A terminal disclaimer may be effective to overcome a nonstatutory double patenting rejection over U.S. Patent No. 12,327,233 B2 and U.S. Patent No. 11,880,808 B2 (37 CFR 1.321(b) and (c)).
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The filing date of the application will determine what form should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/process/file/efs/guidance/eTD-info-I.jsp.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to COURTNEY JONES whose telephone number is (469)295-9137. The examiner can normally be reached on 7:30 am - 5:30 pm CST (M-Th).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Neha Patel can be reached at (571) 270-1492. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from Patent Center. Status information for published applications may be obtained from Patent Center. Status information for unpublished applications is available through Patent Center to authorized users only. Should you have questions about access to the USPTO patent electronic filing system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
Examiner interviews are available via a variety of formats. See MPEP § 713.01. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) Form at https://www.uspto.gov/InterviewPractice.
/COURTNEY P JONES/Primary Examiner, Art Unit 3699