DETAILED CORRESPONDENCE
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Acknowledgments
This Action is in response to the Patent Application filed on November 25, 2025. Claims 20-40 are currently pending and have been fully examined. Claims 1-20 have been cancelled by Applicant.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 21-40 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-19 of U.S. Patent No. 12,505,433.
Although the claims at issue are not identical, they are not patentably distinct from each other because the present claims are broadened by removing the step of generating a unique token. The features of the present claims are recited in claims 1-19 of the US Patent No. 12,505,433, with minor differences shown in bold letters in the claim comparison table below.
Current Application 19/400109
U.S. Patent No. 12,505,433
21. A computer-implemented method for tokenization of sensitive data, the method comprising:
receiving, by a tokenization device, personally identifiable information (PII) from a computing device;
receiving, by the tokenization device, a request to change a unique token associated with the PII, wherein the request includes the unique token and a token identifier linked to the unique token in a database;
retrieving, by the tokenization device and using the token identifier, the PII from the database;
generating, by the tokenization device and using a new token key, a new token for associating with the PII;
in response to generating the new token, updating, by the tokenization device, the token identifier for associating with the new token; and
transmitting, by the tokenization device, the new token to the computing device.
1. A method for tokenization of sensitive data, comprising:
receiving, by a tokenization computing device, sensitive data from a vendor computing device associated with a vendor;
generating, by the tokenization computing device and using a token key of the vendor, a unique vendor-specific token associated with the sensitive data;
receiving, by the tokenization computing device, a request to change the unique vendor-specific token, wherein the request includes the unique vendor-specific token and a token identifier linked to the unique vendor-specific token in a database associated with the tokenization computing device;
retrieving, by the tokenization computing device and using the token identifier, the sensitive data from the database;
generating, by the tokenization computing device and using a new token key, a new token for associating with the sensitive data;
in response to generating the new token, updating, by the tokenization computing device, the token identifier for associating with the new token; and
sending, by the tokenization computing device, the updated token identifier and the new token to the vendor computing device, wherein a tokenization of the new token is validated using the updated token identifier.
22. The computer-implemented method of claim 21, further comprising:
generating, by the tokenization device, a rollup identifier associated with the unique token,
wherein the rollup identifier provides a pointer to the new token key, and wherein the new token key is a common token key.
3. The method of claim 1, further comprising
generating, by the tokenization computing device, a rollup identifier associated with the unique vendor-specific token,
wherein the rollup identifier provides a pointer to the token key, wherein the token key is common to a plurality of entities.
23. The computer-implemented method of claim 21, further comprising:
receiving, by the tokenization device,
a request to associate the new token with another token associated with a second entity; and
updating, by the tokenization device, the token identifier to generate a rollup identifier that points to a common token key.
4. The method of claim 1, further comprising:
receiving, by the tokenization computing device,
an indication of joining of the vendor with a second entity, wherein the indication includes
a request to associate the new token with another token from the second entity;
updating, by the tokenization computing device, the token identifier to generate a rollup identifier that points to a common token key for the vendor and the second entity; and
sending, by the tokenization computing device, the updated token and the token identifier to the vendor.
24. The computer-implemented method of claim 21, further comprising:
receiving, by the tokenization device, a request to rotate the new token;
determining, by the tokenization device, that the new token is associated with a rollup identifier in a data structure; and
determining, by the tokenization device, a new token key associated with a plurality of entities.
2. The method of claim 1, further comprising:
receiving, by the tokenization computing device, a request to rotate the new token;
accessing, by the tokenization computing device, a table to determine whether the new token is associated with a rollup identifier; in response to
determining that the new token is associated with the rollup identifier,
determining, by the tokenization computing device, a new token key that is utilized for entities in a predetermined group;
updating, by the tokenization computing device, the new token according to the new token key; and sending, by the tokenization computing device, the updated new token and the token identifier to the vendor.
25.The computer-implemented method of claim 24, further comprising:
updating, by the tokenization device, the new token according to the new token key; and
transmitting, by the tokenization device, the updated new token and the token identifier to the computing device.
2. The method of claim 1, further comprising:
receiving, by the tokenization computing device, a request to rotate the new token;
accessing, by the tokenization computing device, a table to determine whether the new token is associated with a rollup identifier; in response to
determining that the new token is associated with the rollup identifier,
determining, by the tokenization computing device, a new token key that is utilized for entities in a predetermined group;
updating, by the tokenization computing device, the new token according to the new token key; and
sending, by the tokenization computing device, the updated new token and the token identifier to the vendor.
26.The computer-implemented method of claim 21,
wherein the PII includes one or more of payment vehicle data, a primary account number, an address, or a social security number.
7.
wherein the sensitive data includes at least one of a credit card number, a debit card number, a prepaid card number, a social security number, a bank account number, a telephone number, and an address.
27. The computer-implemented method of claim 21,
wherein the token identifier includes a sanity value.
5. The method of claim 1,
wherein the token identifier includes a sanity value.
28. A system for tokenization of sensitive data, the system comprising:
a tokenization device comprising a processor; and
a memory device comprising instructions that, when executed by the processor, cause the system to perform operations comprising
receiving, by the tokenization device, personally identifiable information (PII) from a computing device;
receiving, by the tokenization device, a request to change a unique token associated with the PII,
wherein the request includes the unique token and a token identifier linked to the unique token in a database;
retrieving, by the tokenization device and using the token identifier, the PII from the database;
generating, by the tokenization device and using a new token key, a new token for associating with the PII;
in response to generating the new token, updating, by the tokenization device, the token identifier for associating with the new token; and
transmitting, by the tokenization device, the new token to the computing device.
6. A system for tokenization of sensitive data, comprising:
a tokenization computing device comprising a processor; and
a memory component that is coupled to the processor and stores logic that when executed by the processor, causes the system to perform at least the following:
receive, by the tokenization computing device, sensitive data from a vendor computing device associated with a vendor;
generate, by the tokenization computing device and using a token key of the vendor, a unique vendor-specific token associated with the sensitive data;
receive, by the tokenization computing device, a request to change the unique vendor-specific token,
wherein the request includes the unique vendor-specific token and a token identifier linked to the unique vendor-specific token in a database associated with the tokenization computing device;
retrieve, by the tokenization computing device and using the token identifier, the sensitive data from the database;
generate, by the tokenization computing device and using a new token key, a new token for associating with the sensitive data;
in response to generating the new token, update, by the tokenization computing device, the token identifier for associating with the new token; and
send, by the tokenization computing device, the updated token identifier and the new token to the vendor computing device,
wherein a tokenization of the new token is validated using the updated token identifier.
29. The system of claim 28, the operations further comprising:
generating, by the tokenization device, a rollup identifier associated with the unique token, wherein the rollup identifier provides a pointer to the new token key, and
wherein the new token key is a common token key.
9. The system of claim 6, wherein the logic further causes the system to
generate a rollup identifier associated with the unique vendor-specific token, wherein the rollup identifier provides a pointer to the token key,
wherein the token key is common to a plurality of entities.
30. The system of claim 28, the operations further comprising:
receiving, by the tokenization device,
a request to associate the new token with another token associated with a second entity; and
updating, by the tokenization device, the token identifier to generate a rollup identifier that points to a common token key.
4.
receiving, by the tokenization computing device,
an indication of joining of the vendor with a second entity, wherein the indication includes
a request to associate the new token with another token from the second entity;
updating, by the tokenization computing device, the token identifier to generate a rollup identifier that points to a common token key for the vendor and the second entity;
31. The system of claim 28, the operations further comprising:
receiving, by the tokenization device, a request to rotate the new token;
determining, by the tokenization device, that the new token is associated with a rollup identifier in a data structure; and
determining, by the tokenization device, a new token key associated with a plurality of entities.
11. The system of claim 6, wherein the logic further causes the system to perform at least the following:
receive a request to rotate the new token;
access a table to
determine whether the new token is associated with a rollup identifier; in response to determining that the new token is associated with a rollup identifier,
determine a new token key that is utilized for entities in a predetermined group;
update the new token according to the new token key; and send the updated new token and the token identifier to the vendor computing device.
32. The system of claim 31, the operations further comprising:
updating, by the tokenization device, the new token according to the new token key; and
transmitting, by the tokenization device, the updated new token and the token identifier to the computing device.
11. The system of claim 6, wherein the logic further causes the system to perform at least the following:
receive a request to rotate the new token;
access a table to
determine whether the new token is associated with a rollup identifier; in response to determining that the new token is associated with a rollup identifier,
determine a new token key that is utilized for entities in a predetermined group;
update the new token according to the new token key; and
send the updated new token and the token identifier to the vendor computing device.
33. The system of claim 28,
wherein the PII includes one or more of payment vehicle data, a primary account number, an address, or a social security number.
7. The system of claim 6,
wherein the sensitive data includes at least one of a credit card number, a debit card number, a prepaid card number, a social security number, a bank account number, a telephone number, and an address.
34.The system of claim 28,
wherein the token identifier includes a sanity value.
12. The system of claim 6,
wherein the token identifier includes a sanity value.
35. A non-transitory computer-readable medium storing instructions that when executed by a processor of a tokenization device, causes the tokenization device to perform a method for tokenization of sensitive data, the method comprising:
receiving, by the tokenization device, personally identifiable information (PII) from a computing device;
receiving, by the tokenization device, a request to change a unique token associated with the PII,
wherein the request includes the unique token and a token identifier linked to the unique token in a database;
retrieving, by the tokenization device and using the token identifier, the PII from the database;
generating, by the tokenization device and using a new token key, a new token for associating with the PII;
in response to generating the new token, updating, by the tokenization device, the token identifier for associating with the new token; and
transmitting, by the tokenization device, the new token to the computing device.
13. A non-transitory computer-readable medium for tokenization of sensitive data that stores a program that when executed by a tokenization computing device, causes the tokenization computing device to perform operations including:
receive, by the tokenization computing device, sensitive data from a vendor computing device associated with a vendor;
generate, by the tokenization computing device and using a token key of the vendor, a unique vendor-specific token associated with the sensitive data;
receive, by the tokenization computing device, a request to change the unique vendor-specific token,
wherein the request includes the unique vendor-specific token and a token identifier linked to the unique vendor-specific token in a database associated with the tokenization computing device;
retrieve, by the tokenization computing device and using the token identifier, the sensitive data from the database;
generate, by the tokenization computing device and using a new token key, a new token for associating with the sensitive data;
in response to generating the new token, update, by the tokenization computing device, the token identifier for associating with the new token; and
send, by the tokenization computing device, the updated token identifier and the new token to the vendor computing device,
wherein a tokenization of the new token is validated using the updated token identifier.
36. The non-transitory computer-readable medium of claim 35, the method further comprising:
generating, by the tokenization device, a rollup identifier associated with the unique token, wherein the rollup identifier provides a pointer to the new token key, and
wherein the new token key is a common token key.
9.
generate a rollup identifier associated with the unique vendor-specific token, wherein the rollup identifier provides a pointer to the token key,
wherein the token key is common to a plurality of entities.
37. The non-transitory computer-readable medium of claim 35, the method further comprising:
receiving, by the tokenization device,
a request to associate the new token with another token associated with a second entity; and
updating, by the tokenization device, the token identifier to generate a rollup identifier that points to a common token key.
18. The non-transitory computer-readable medium of claim 13, wherein the program further causes the computing device to perform at least the following:
receive an indication of joining of the vendor with a second entity, wherein the indication includes
a request to associate the token with another token from the second entity;
update the token identifier to generate a rollup identifier that points to a common token key to the vendor and the second entity; and
send the updated token and the token identifier to the vendor computing device.
38.The non-transitory computer-readable medium of claim 35, the method further comprising:
receiving, by the tokenization device, a request to rotate the new token;
determining, by the tokenization device, that the new token is associated with a rollup identifier in a data structure; and
determining, by the tokenization device, a new token key associated with a plurality of entities.
15. The non-transitory computer-readable medium of claim 13, wherein the program further causes the computing device to perform at least the following:
receive a request to rotate the token;
access a table to
determine whether the token is associated with a rollup identifier;
in response to determining that the token is associated with a rollup identifier,
determine a new token key that is utilized for entities in a predetermined group; and
update the token according to the new token key.
39. The non-transitory computer-readable medium of claim 38, the method further comprising:
updating, by the tokenization device, the new token according to the new token key; and
transmitting, by the tokenization device, the updated new token and the token identifier to the computing device.
11. The system of claim 6, wherein the logic further causes the system to perform at least the following:
receive a request to rotate the new token;
access a table to
determine whether the new token is associated with a rollup identifier; in response to determining that the new token is associated with a rollup identifier,
determine a new token key that is utilized for entities in a predetermined group;
update the new token according to the new token key; and
send the updated new token and the token identifier to the vendor computing device.
40. The non-transitory computer-readable medium of claim 35,
wherein the PII includes one or more of payment vehicle data, a primary account number, an address, or a social security number.
14. The non-transitory computer-readable medium of claim 13,
wherein the sensitive data includes at least one of a credit card number, a debit card number, a prepaid card number, a bank account number, a social security number, a telephone number, and an address.
Prior Art Analysis
Claims 21-40 are allowable contingent on overcoming the current Double Patenting rejection. Tokenization by generating tokens associated with sensitive information such as personally identifiable information (PII) is well known as evidenced by the prior art cited in the record including US Patent Publications US 20110258123 A1, US 20100210240 A1, US 20090031131 A1, US 6748367 B1, US 20120114119 A1, US 20110179478 A1.
The prior art of record, however, does not appear to reasonably disclose, at least features of independent claims 21, 28 and 35: “a request to change a unique token associated with the PII, wherein the request includes the unique token and a token identifier linked to the unique token in a database,” and “in response to generating the new token, updating, by the tokenization device, the token identifier for associating with the new token.”
The examiner notes that further search and consideration will be required, if the claims are amended in reply to this Office Action. Reasons for allowance, if applicable, will be the subject of a separate communication to the Applicant or patent owner, pursuant to 37 CFR § 1.104 and MPEP § 1302.14.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SIMA ASGARI whose telephone number is (571)272-2037. The examiner can normally be reached M-F 9am-6pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Patrick McAtee can be reached at (571)272-7575. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SIMA ASGARI/Examiner, Art Unit 3698
/PATRICK MCATEE/Supervisory Patent Examiner, Art Unit 3698
Prosecution Insights