Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
The instant application having Application No. 19/212,359 is presented for examination by the examiner.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 11 and 16 are rejected under 35 U.S.C. 103 as being unpatentable over Hongzhou (CN 112,713,989 A), in view of N.P.L Wei (Third-Party DFA Evaluation on Encrypted Files), and in view of Cui (CN 112,019,335 A).
Regarding Claim 1
Hongzhou discloses:
A data processing method, the method being performed by a first service terminal among a plurality of service terminals [“a first decryption terminal”, such as a user mobile phone], the plurality of service terminals further comprising a second service terminal other than the first service terminal l [“a second decryption terminal”], the first service terminal storing a first private key component pre-generated for a first service object [Page 13: the user mobile phone generates the first private key component hdA using a random number generator and stores the first private key component locally.], the second service terminal storing a second private key component pre-generated for a second service object [Page 10: the server determines a second public key component according to a second private key component generated by a random number generator and stores the second private key component locally at the server], the first private key component and the second private key component being configured for collaboratively generating a collaborative public key that is to be used for data encryption [Page 10:“the user mobile phone and the server end can jointly calculate a corresponding public key through the first private key component and the second private key component and publicly issue the public key,” and “the public key is used for encrypting the message by adopting an elliptic curve public key encryption algorithm”], both the first service object and the second service object being service objects participating in data decryption [Page 11: “the decryption calculation needs to be completed together with the server end through the first private key component and the second private key component”], and the method comprising:
receiving encrypted session data transmitted by a data encryption terminal corresponding to an encryption service object [Page 10:“the encryption terminal encrypts the message M … and sends the ciphertext to the user mobile phone”], the encryption service object being a service object that encrypts session service data to be transmitted [Page 10: when the encryption terminal determines that the message needs to be sent to the user], and the encrypted session data being obtained by the data encryption terminal by encrypting the session service data by using the collaborative public key [Page 10:“the public key is used for encrypting the message by adopting an elliptic curve public key encryption algorithm to obtain a corresponding message to be decrypted,” which is sent as ciphertext to the user mobile phone];
obtaining a first encrypted data component from the encrypted session data [Page 11: extracting C1 from the message to be decrypted”], and generating a random mask configured for masking the first encrypted data component [Page 11: “u is a random number generated by a random number generator,” and the first decryption terminal uses u to obtain CA1=C1+[u]G; step 102];
masking the first encrypted data component by using the random mask to obtain mask data corresponding to the first encrypted data component [Page 11: determining the first message according to CA1=C1+[u]G, wherein u is a random number generated by a random number generator and [u]G is the point multiplication of the random number and the elliptic-curve base point],
transmitting [Page 11: “the first message and the second message,” CA1 and CA2] , the second service terminal performing collaborative decryption on the first decrypted data component based on the second private key component to obtain a second decrypted data component to be returned to the first service terminal [Page 12: the second decryption terminal decapsulates the first message CA1 and the second message CA2 using the second private key component hdS to obtain the third message SC1=[hdS]CA1−CA2, and sends SC1 to the first decryption terminal]; and
obtaining the session service data through decryption based on the second decrypted data component and the first encrypted data component [Page 12: the first decryption terminal decrypts the returned third message SC1 according to the first private key component to obtain plaintext M, wherein (x1,y1)=[hdA]SC1 and M=C3⊕KDF(x1∥ y1,klen); step 106].
Hongzhou does not explicitly teach obtaining a first decrypted data component based on both the first private key component and the masked first encrypted data component. On the other hand, Wei teaches splitting a private key into shares sk1 and sk2, masking ciphertext α using a random value r, applying sk1 to the masked ciphertext to obtain partial decryption β, transmitting α and β to a server, and having the server apply sk2 to obtain and return completed decryption result γ* [§4.1; Fig. 1, c112-c116, m105-m106, s112]. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Hongzhou so that the first terminal applies its private key component to the masked first encrypted data component because Wei teaches that this sequence allows the second terminal to complete collaborative decryption without learning the corresponding unmasked value. Hongzhou would continue to operate for its intended purpose because it already uses random masking and distributed private key components, and the modification would have produced the predictable result of allowing the server to complete collaborative decryption while preventing the server from learning the corresponding unmasked value. In the modified method, Wei's partial decryption β, generated by applying the first private key component sk1 to masked ciphertext α, is the claimed first decrypted data component transmitted to the second service terminal and γ*, obtained by applying the second private key component sk2 and returned to the first terminal is the claimed second decrypted data component.
Hongzhou and Wei do not explicitly teach recovering the session service data based on both the returned second decrypted data component and the original first encrypted data component. On the other hand, Cui teaches completing collaborative decryption using the returned value and the originally extracted C1, according to (x₂,y₂) = d_server[*]C′_m_temp [−] C1 [Page 9: S321 and S33], and recovering the plaintext as t = KDF(x₂‖y₂, klen) and M = C2 ⊕ t [Pages 9-10: S341-S342]. It is noted that Cui's C2 carries the encrypted payload (C = C₁‖C₃‖C₂), whereas Hongzhou's corresponding payload is C3 [Hongzhou, step 106]. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the Hongzhou-Wei method so that the first terminal recovers the session service data using both the returned second decrypted data component and the originally extracted C1 as taught by Cui, because combining the two cancels the ciphertext component introduced during encryption and yields the elliptic curve point from which the plaintext is derived. The Hongzhou-Wei method would continue to operate for its intended collaborative decryption purpose because Hongzhou’s first terminal already performs final plaintext recovery, obtains the original C1, and receives a collaborative decryption result from the second terminal. Applying Cui’s known final recovery arrangement at Hongzhou’s first terminal would therefore have predictably tied recovery of the plaintext to the originally received ciphertext.
Regarding Claim 11
Hongzhou discloses:
A data processing method, the method being performed by a second service terminal among a plurality of service terminals ["a second decryption terminal", such as a server], the plurality of service terminals further comprising a first service terminal other than the second service terminal ["a first decryption terminal", such as a user mobile phone], the first service terminal storing a first private key component pre-generated for a first service object [Page 13: the user mobile phone generates the first private key component hdA using a random number generator and stores the first private key component locally], the second service terminal storing a second private key component pre-generated for a second service object [Page 10: the server determines a second public key component according to a second private key component generated by a random number generator and stores the second private key component locally at the server], the first private key component and the second private key component being configured for collaboratively generating a collaborative public key that is to be used for data encryption [Page 10: "the user mobile phone and the server end can jointly calculate a corresponding public key through the first private key component and the second private key component and publicly issue the public key," and "the public key is used for encrypting the message by adopting an elliptic curve public key encryption algorithm"], both the first service object and the second service object being service objects participating in data decryption [Page 11: "the decryption calculation needs to be completed together with the server end through the first private key component and the second private key component"], and the method comprising:
receiving a first decrypted data component transmitted by the first service terminal, [Page 11: "the first message and the second message," CA1 and CA2, sent by the user mobile phone to the server; CA1=C1+[u]G, wherein u is a random number generated by a random number generator and [u]G is the point multiplication of the random number and the elliptic-curve base point; step 102], the random mask being configured for indicating the first service terminal to perform mask processing on the first encrypted data component, the encrypted session data being transmitted by a data encryption terminal corresponding to an encryption service object, the encryption service object being a service object that encrypts session service data to be transmitted [Page 10: "the encryption terminal encrypts the message M … and sends the ciphertext to the user mobile phone"; when the encryption terminal determines that the message needs to be sent to the user], and the encrypted session data being obtained by the data encryption terminal by encrypting the session service data by using the collaborative public key [Page 10: "the public key is used for encrypting the message by adopting an elliptic curve public key encryption algorithm to obtain a corresponding message to be decrypted," which is sent as ciphertext to the user mobile phone];
performing collaborative decryption on the first decrypted data component based on the second private key component to obtain a second decrypted data component through collaborative decryption [Page 12: the second decryption terminal decapsulates the first message CA1 and the second message CA2 using the second private key component hdS to obtain the third message SC1=[hdS]CA1−CA2]; and
returning the second decrypted data component to the first service terminal, the first service terminal obtaining the session service data through decryption based on the second decrypted data component [Page 12: sends SC1 to the first decryption terminal; the first decryption terminal decrypts the returned third message SC1 according to the first private key component to obtain plaintext M, wherein (x1,y1)=[hdA]SC1 and M=C3⊕KDF(x1‖y1,klen); step 106].
Hongzhou does not explicitly teach that the first decrypted data component received by the second service terminal is obtained by the first service terminal based on the first private key component and mask data. On the other hand, Wei teaches splitting a private key into shares sk1 and sk2, masking ciphertext α using a random value r, applying sk1 to the masked ciphertext to obtain partial decryption β, and transmitting α and β to a server, which applies sk2 to obtain and return completed decryption result γ* [§4.1; Fig. 1, c112-c116, m105-m106, s112]. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Hongzhou so that the value received by the second service terminal is generated by applying the first private key component to the masked first encrypted data component, as taught by Wei, because Wei teaches that this sequence allows the second terminal to complete collaborative decryption without learning the corresponding unmasked value. Hongzhou would continue to operate for its intended purpose because it already uses random masking and distributed private key components, and the modification would have produced the predictable result of allowing the second service terminal to complete collaborative decryption while preventing it from learning the corresponding unmasked value.
Hongzhou and Wei do not explicitly teach that the first service terminal obtains the session service data through decryption based on both the returned second decrypted data component and the first encrypted data component. On the other hand, Cui teaches completing collaborative decryption using the returned value and the originally extracted C1, according to (x2,y2)=d_server[*]C_m_temp[−]C1 [Page 9: S321 and S33], and recovering the plaintext as t=KDF(x2‖y2,klen) and M=C2⊕t [Pages 9-10: S341-S342]. It is noted that Cui's C2 carries the encrypted payload (C=C1‖C3‖C2), whereas Hongzhou's corresponding payload is C3 [Hongzhou, step 106]. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the Hongzhou-Wei method so that the first service terminal recovers the session service data using both the returned second decrypted data component and the originally extracted C1, as taught by Cui, because combining the two cancels the ciphertext component introduced during encryption and yields the elliptic curve point from which the plaintext is derived. The Hongzhou-Wei method would continue to operate for its intended collaborative decryption purpose because Hongzhou's first terminal already performs final plaintext recovery, obtains the original C1, and receives a collaborative decryption result from the second terminal, such that the modification would have predictably tied recovery of the plaintext to the originally received ciphertext.
Regarding Claim 16
Claim 16 is directed to a computer device comprising a processor and computer-readable storage medium storing instructions that implement the method of claim 1. Claim 16 is similar in scope to claim 1 and is therefore rejected under similar rationale.
Claims 2-3, 6, 12 and 17-18 are rejected under 35 U.S.C. 103 as being unpatentable over Hongzhou (CN 112,713,989 A), in view of N.P.L Wei (Third-Party DFA Evaluation on Encrypted Files), in view of Cui (CN 112,019,335 A) as applied to claim 1 above, and in further view of Li2 (US 2023/0080856 A).
Regarding Claim 2
Hongzhou in view of Wei and Cui teaches the method according to claim 1, as set forth above, wherein the encrypted session data comprises a second encrypted data component [Hongzhou, Page 10: ciphertext C═C1‖C2‖C3], the first encrypted data component is an encrypted data component that meets a collaborative decryption policy and that is determined by the first service terminal [Cui, Page 10: "checking and verifying... the first bit string C1 whether it is a point on an elliptic curve, if C1 [is] a point on the non-elliptic curve, an error is prompted, and the decryption process is exited"], and the collaborative decryption policy comprises a collaborative elliptic curve used for data decryption [Hongzhou Page 10: "the elliptic curve parameter adopts an SM2 curve parameter specified by the State crypto administration"]; and Cui further teaches determining a decryption elliptic curve point on the collaborative elliptic curve based on the second decrypted data component and the first encrypted data component [Cui, Page 9: (x2,y2)=d_server[*]C_m_temp[−]C1], extracting the second encrypted data component from the encrypted session data and determining a bit length of the second encrypted data component [Cui, Page 9-10: extracting the second bit string C2, klen is the output bit string length; S341-S342], and performing key extension on the bit length and the decryption elliptic curve point by using a KDF in the collaborative decryption policy to obtain a key derivation bit string [Cui, Page 9: t = KDF(x2‖y2,klen); S341]. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate Cui's curve-point validation and final decryption computation into the Hongzhou-Wei method, because both are directed to the same class of SM2 collaborative decryption, and the Hongzhou-Wei method already extracts a first encrypted data component and already produces a returned collaborative-decryption value, such that the modification would have predictably yielded the claimed decryption elliptic curve point and key derivation bit string.
Hongzhou, Wei, and Cui do not explicitly teach obtaining the session service data through decryption based on the key derivation bit string and the second encrypted data component when it is determined that the key derivation bit string meets a decryption condition in the collaborative decryption policy. On the other hand, Li2 teaches performing a key derivation function based on the bit length klen of a partial ciphertext input C2 and a decryption elliptic curve point (x2,y2), such that t=KDF(x2‖y2, klen), checking whether the derived value t is zero, and, only when t is not zero, proceeding to perform an exclusive-OR operation C2⊕t to calculate the plaintext output, wherein if t is zero the processor outputs a decryption failure prompt instead of proceeding [Li2, ¶¶0117-0118]. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to gate the Hongzhou-Wei-Cui method's exclusive-OR recovery step on a nonzero determination of the key derivation bit string as taught by Li2 because the method already computes that bit string via KDF and already uses it in the recovery step, such that the modification would have predictably prevented recovery using a degenerate key derivation bit string.
Regarding Claim 3
Hongzhou discloses:
The method according to claim 2, wherein the encrypted session data further comprises a third encrypted data component, and the method further comprises:
performing hash calculation on the session service data obtained through decryption and the decryption elliptic curve point to obtain a digest value corresponding to the session service data [Page 12: calculating v=Hash(x1∥M∥y1), wherein M is the plaintext and (x1, y1 is the elliptic-curve point derived during decryption.];
extracting the third encrypted data component from the encrypted session data, and comparing the digest value corresponding to the session service data with the third encrypted data component [Page 12-13: extracting verification code C2 and comparing v with C2. Hongzhou's ciphertext is C ═ C1‖C2‖C3 [Page 10: step 101], the art states its "first," "second," etc. designators distinguish components rather than indicate order, so check code C2 reads on the claimed third encrypted data component despite its position in that ordering.]; and
outputting the session service data when the digest value corresponding to the session service data is the same as the third encrypted data component [Page 13: outputting plaintext M when v=C2].
Regarding Claim 6
Hongzhou in view of Wei and Cui teaches the method according to claim 1, as set forth above, wherein the first encrypted data component is an encrypted data component that meets a collaborative decryption policy and that is determined by the first service terminal [Cui, Page 10: "checking and verifying... the first bit string C1 whether it is a point on an elliptic curve, if C1 [is] a point on the non-elliptic curve, an error is prompted, and the decryption process is exited"], and the collaborative decryption policy comprises a collaborative elliptic curve used for collaborative decryption [Hongzhou, Page 10].
Hongzhou, Wei, and Cui do not explicitly teach determining, if the second decrypted data component meets an expression of the collaborative elliptic curve and the second decrypted data component is not an infinity point, that the second decrypted data component meets the collaborative decryption policy. On the other hand, Li2 teaches checking whether an elliptic curve point meets the elliptic curve equation before it is relied upon in further processing, and separately checking whether an elliptic curve point resulting from a point-multiplication operation is a zero point (an infinity point), wherein if either check fails the processor outputs a decryption failure prompt rather than proceeding [Li2, ¶¶0114, 0116]. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to apply Li2's known pair of validity checks to the second decrypted data component returned to the first service terminal in the Hongzhou-Wei-Cui method, because Li2 teaches performing these same two checks on elliptic curve points arising during SM2 decryption as a known technique for detecting invalid or degenerate results, and the modification would have predictably prevented the method from relying on an invalid second decrypted data component.
Regarding Claim 12
Hongzhou in view of Wei, Cui, and Li2 teaches the method according to claim 11. Li2 further teaches checking whether an elliptic curve point meets the elliptic curve equation before it is relied upon in further processing, and separately checking whether an elliptic curve point resulting from a point-multiplication operation is a zero point (an infinity point), wherein if either check fails the processor outputs a decryption failure prompt rather than proceeding [Li2, ¶¶0114, 0116]. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to apply Li2's known pair of validity checks to the first decrypted data component received by the second service terminal in the Hongzhou-Wei-Cui method, because Li2 teaches performing these same two checks on ciphertext derived elliptic curve points early in an SM2 decryption pipeline as a known technique for detecting invalid or degenerate results. The modification would have predictably prevented the second service terminal from performing collaborative decryption on an invalid or degenerate first decrypted data component.
Regarding Claim 17
Claim 17 is directed to a computer device comprising a processor and computer-readable storage medium storing instructions that implement the method of claim 2. Claim 17 is similar in scope to claim 2 and is therefore rejected under similar rationale.
Regarding Claim 18
Claim 18 is directed to a computer device comprising a processor and computer-readable storage medium storing instructions that implement the method of claim 3. Claim 18 is similar in scope to claim 3 and is therefore rejected under similar rationale.
Claims 4-5, 7-10, 14 and 19-20 are rejected under 35 U.S.C. 103 as being unpatentable over Hongzhou (CN 112,713,989 A), in view of N.P.L Wei (Third-Party DFA Evaluation on Encrypted Files), in view of Cui (CN 112,019,335 A) as applied to claim 1 above, and in further view of Li (US 2016/0191252 A1).
Regarding Claim 4
Hongzhou in view of Wei and Cui teaches the method according to claim 1, as set forth above. Hongzhou further teaches generating a random mask u∈[1,n−1], wherein n is the order of elliptic curve base point G, and masking C1 according to C_A1=C1+[u]G [Pages 7 and 11]. Hongzhou in view of Wei and Cui does not explicitly teach if the modulo value corresponding to the random mask is not equal to a preset mask value, masking the first encrypted data component by using the random mask to obtain the mask data. On the other hand, Li teaches generating an elliptic curve random number k∈[1,n−1], performing modulo-n validity checks on values derived from k, comparing the results with zero and proceeding only when the result is nonzero [¶¶97-102, 114, 118-124, 130-137]. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to apply Li's known modulo-n validity technique to Hongzhou's random mask u, using u to mask C1 only when u mod n≠0, because Hongzhou already requires u∈[1,n−1] and Li teaches this same range validation technique for elliptic curve scalars, such that the modification would predictably enforce Hongzhou's disclosed nonzero scalar requirement before u is used to mask C1.
Regarding Claim 5
Hongzhou in view of Wei, Cui, and Li teaches the method according to claim 4, as set forth above. Li further teaches that when a value derived from random number k fails a modulo-n validity check, including r=0, (r+k) mod n=0, or s=0 , the process returns to random number generation and regenerates k [¶¶114-124, 130-137, 155-160]. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to apply Li's known regenerate on invalid result technique to Hongzhou's random mask u, such that the first random number generator regenerates u when u mod n equals zero, because Li already teaches this same regeneration technique for elliptic curve scalars validated by the modulo-n check applied to u in claim 4, and the modification would have predictably prevented an invalid zero equivalent mask from being used to mask C1.
Regarding Claim 7
As per claim 7, Hongzhou teaches receiving a second public key component from the second service terminal [Page 13: WS=[hdS]G], generating the first private key component using a random number generator [Page 13: hdSA∈[1,n−1]], generating the collaborative public key based on the first private key component, the second public key component, and base point G [Page 13: PA=[hdA]WS−G], and publishing the collaborative public key [Page 10: "the user mobile phone and the server end can jointly calculate a corresponding public key... and publicly issue the public key"]. Li further teaches generating an elliptic curve random value, computing a value derived therefrom, reducing the derived value modulo elliptic curve parameter n, comparing the result with zero, and proceeding only when the validity condition is satisfied [¶¶97-102, 114, 118-124, 130-137]. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to apply Li's known generate reduce compare validity technique to Hongzhou's first private key component before using it to generate PA, because doing so would predictably ensure that only a valid nonzero scalar is used in the collaborative public key calculation.
Regarding Claim 8
As per claim 8, Hongzhou teaches generating, by using a random number generator, a first private key component used for data decryption [Page 13: hdA∈[1,n−1]], and generating a first public key component based on the first private key component and the base point on the collaborative elliptic curve [Page 13: WA=[hdA]G]. Hongzhou's specific embodiment discloses the second service terminal generating a second private key component and transmitting the corresponding second public key component to the first service terminal, which then computes the collaborative public key privately [Page 13: PA=[hdA]WS−G]. Hongzhou does not explicitly teach the first service terminal transmitting its first public key component to the second service terminal, or the second service terminal generating a second private key component and collaboratively generating the collaborative public key using the received first public key component. Hongzhou's general disclosure states, however, that“the user mobile phone and the server end can jointly calculate a corresponding public key through the first private key component and the second private key component," without limiting which terminal performs the final calculation or which terminal transmits its public key component to the other [Hongzhou, Pages 10]. Because PA=[hdA]WS−G=[hdS]WA−G, computing the collaborative public key at the second service terminal using a transmitted first public key component produces the identical result as Hongzhou's disclosed computation at the first service terminal. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Hongzhou so that the first terminal transmits its public key component and the second terminal completes the calculation, because Hongzhou's own disclosure describes the computation as jointly performed without specifying direction or which party finishes, such that the modification would have predictably produced the same collaborative public key via the algebraically symmetric final step.
Hongzhou does not explicitly teach generating the first public key component when it is determined that the first private key component meets private key validity, or generating the second private key component when determining that the second private key component meets private key validity. On the other hand, Li teaches generating an elliptic-curve random value, computing a value derived therefrom, reducing the derived value modulo elliptic-curve parameter n, comparing the result with zero, and proceeding to use the random value only when the result is nonzero [¶¶97-102, 114, 118-124, 130-137]. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to apply Li's known generate reduce compare validity technique to both private key components before their respective public key computations, because Li teaches this same modulo-n validity technique for elliptic curve scalars in SM2 operations such that the modification would have predictably ensured only valid nonzero scalars are used at each stage.
Regarding Claim 9
Hongzhou in view of Wei, Cui, and Li teaches the method according to claim 7. Li further teaches computing s=((1+dA)⁻¹(k−rdA)) mod n, wherein dA is a private key, k and r are associated values, and n is the elliptic curve parameter, and determining whether the resulting modulo value s is nonzero before proceeding with the signature operation [¶¶17-18, 29-30, 102]. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to apply Li's known modulo-n validity technique to Hongzhou's first private key component hdA, using associated values and base point order n because doing so would predictably provide an express validity check before the private key component is used in the collaborative public key calculation.
Regarding Claim 10
Hongzhou in view of Wei, Cui, and Li teaches the method according to claim 9, as set forth above. Li further teaches determining that a value fails a validity condition when the modulo value s equals a preset target value of zero, and, in response, regenerating the values used to compute s, including k and r, using the random number generator [Li, ¶¶17-18, 30, 102]. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to apply Li's known determine invalid and regenerate technique to Hongzhou's first private key component hdA, such that when the modulo value computed as taught in claim 9 is equal to the preset target value, it is determined that hdA does not meet private key validity, and the second random number generator regenerates a first private key component, because Li already teaches this same regenerate technique for the modulo-n validity check applied to the private key component in claim 9, and the modification would have predictably prevented an invalid private key component from being used in the collaborative public key calculation.
Regarding Claim 14
As per claim 14, Hongzhou teaches receiving a first public key component of the first service object transmitted by the first service terminal, the first public key component being generated by the first service terminal using the first private key component and the base point on the collaborative elliptic curve [Page 13: WA=[hdA]G], and generating, by using a random number generator, a second private key component used for data decryption [Page 13: hdS∈[1,n−1]]. Hongzhou's specific embodiment discloses the second service terminal generating its own private key component and transmitting the corresponding second public key component to the first service terminal, which then computes the collaborative public key privately [Page 13: PA=[hdA]WS−G]. Hongzhou does not explicitly teach the second service terminal receiving a first public key component from the first service terminal, or the second service terminal collaboratively generating the collaborative public key using the received first public key component. Hongzhou's general disclosure states, however, that "the user mobile phone and the server end can jointly calculate a corresponding public key through the first private key component and the second private key component," without limiting which terminal performs the final calculation or which terminal transmits its public key component to the other [Hongzhou, Page 10]. Because PA=[hdA]WS−G=[hdS]WA−G, computing the collaborative public key at the second service terminal using a transmitted first public key component produces the identical result as Hongzhou's disclosed computation at the first service terminal. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Hongzhou so that the first terminal transmits its public key component and the second terminal completes the calculation, because Hongzhou's own disclosure describes the computation as jointly performed without specifying direction or which party finishes, such that the modification would have predictably produced the same collaborative public key via the algebraically symmetric final step. Hongzhou further teaches publishing the collaborative public key [Hongzhou, Page 10: "the user mobile phone and the server end can jointly calculate a corresponding public key... and publicly issue the public key"].
Li further teaches generating an elliptic curve random value, computing a value derived therefrom, reducing the derived value modulo elliptic curve parameter n, comparing the result with zero, and proceeding to use the random value only when the result is nonzero [¶¶97-102, 114, 118-124, 130-137]. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to apply Li's known generate-reduce-compare validity technique to the second private key component before it is used in the collaborative public key computation, because Li teaches this same modulo-n validity technique for elliptic-curve scalars in SM2 operations, such that the modification would have predictably ensured that only a valid nonzero scalar is used in the collaborative public key calculation.
Regarding Claim 19
Claim 19 is directed to a computer device comprising a processor and computer-readable storage medium storing instructions that implement the method of claim 4. Claim 19 is similar in scope to claim 4 and is therefore rejected under similar rationale.
Regarding Claim 20
Claim 20 is directed to a computer device comprising a processor and computer-readable storage medium storing instructions that implement the method of claim 5. Claim 20 is similar in scope to claim 5 and is therefore rejected under similar rationale.
Claim 13 is rejected under 35 U.S.C. 103 as being unpatentable over Hongzhou (CN 112,713,989 A), in view of N.P.L Wei (Third-Party DFA Evaluation on Encrypted Files), in view of Cui (CN 112,019,335 A) and in view of Li2 (US 2023/0080856 A) as applied to claim 11 above, and in further view of Qiu (US 2015/0319140 A1).
Regarding Claim 13
Hongzhou in view of Wei, Cui, and Li2 teaches the method according to claim 12, as set forth above. Li2 further teaches determining that an elliptic-curve component is invalid when the component does not satisfy the elliptic-curve expression or is an infinity point [Li2, ¶¶0114, 0116]. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to apply Li2's elliptic curve validity check to Wei's first decrypted data component upon receipt because doing so would predictably prevent collaborative decryption using an invalid component. The combination does not explicitly teach returning second error information to the first service terminal indicating that the first decrypted data component is incorrect. Qiu teaches verifying whether a decryption key received from a terminal matches a stored decryption key and, when verification fails, sending a key verification failure message to that terminal [¶¶0079-0080, 0134-0136, 0245-0247]. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to return a corresponding error message to Wei's first terminal when its first decrypted data component fails Li2's validity check because Qiu teaches notifying the terminal that supplied invalid decryption information, thereby predictably identifying the incorrect component to the transmitting terminal.
Claim Objections
Claim 15 is objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Allowable Subject Matter
Regarding Claim 15: The closest prior art of record, Hongzhou, discloses two decryption terminals that collaboratively generate a public key and cooperatively decrypt data received from a data-encryption terminal distinct from either decryption terminal. Cui similarly discloses a trusted center and group members cooperatively decrypting data received from a message sender external to the group. However, none of reference of record discloses the second service terminal itself acting as the data encryption terminal, obtaining and encrypting session data using the collaboratively generated public key for transmission to the first service terminal while also holding a private key component used for collaborative decryption.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SAAD ABDULLAH whose telephone number is 571-272-1531. The examiner can normally be reached on Monday-Friday 9am-5pm EST. If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, LYNN FIELD can be reached on 571-272-2092.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SAAD AHMAD ABDULLAH/ Examiner, Art Unit 2431
/SHIN-HON (ERIC) CHEN/ Primary Examiner, Art Unit 2431
Prosecution Insights