U.S. Patent Application No. 12/210,926
`Attorney Docket No. IQAMR002USO
`
`Certification Under 37 C.F.R.
`
`1.8
`
`I hereby certify that on March 1, 2012 this correspondence is being: (a) deposited with the
`United States Postal Service in an envelope addressed to Commissioner for Patents, P.O.
`Box 1450, Alexandria, Virginia 22313-1450; or (b) transmitted via facsimile to facsimile
`number 571-273-8300; or (c) electronically filed with the U.S. Patent Office.
`
`
`Date: March 1 2012
`
`Signature:
`
`/Michael P. Fortkort/
`Michael P. Fortkort
`
`(Reg. No. 35,141)
`
`IN THE UNITED STATES PATENT & TRADEMARK OFFICE
`
`APPLICANT: NADER ASGHARI-KAMRANI and IQAMRAN ASGHARI-KAMRANI
`
`SERIAL NO.: 12/210,926
`
`FILING DATE: September 15, 2008
`
`EXAMINER: Mr. Abdulhakim Nobahar
`
`ART UNIT: 2432
`
`TITLE: CENTRALIZED IDENTIFICATION AND AUTHENTICATION SYSTEM AND
`METHOD
`
`ATTORNEY DOCKET: KAMR002USO
`
`CONFIRMATION NO.: 7516
`
`VIA ELECTRONIC FILING SYSTEM
`ASSISTANT COMMISSIONER FOR PATENTS
`
`WASHINGTON, D.C. 20231
`
`AFFIDAVIT UNDER RULE 132
`
`Applicants hereby submit this affidavit in support of their response to the Office
`
`Action mailed January 6, 2012 which rejected the pending claims.
`
`This affidavit is being provided as testimony in the prosecution of U.S. Serial No.
`
`12/210,926, and pursuant to the provisions of 37 C.F.R. § 1.132. The witness hereby avers
`
`and testifies as follows:
`
`

`
`1.
`
`I am James Hewitt, residing at 12587 Fair Lakes Circle, #202, Fairfax,
`
`Virginia 2203 3.
`
`2.
`
`3.
`
`I received a Bachelors of Arts in Philosophy from Vassar College in 1983.
`
`I have been a Certified Information System Security Professional since 2001.
`
`My certification number is #21060 per ISC2.org.
`
`4.
`
`From 1998-2002, I was Director of Professional Services at CertCo, Inc. in
`
`Cambridge, Massachusetts. During this time, I produced cryptographic systems used by Tier 1
`
`banks for authentication of users, machines and financial transactions.
`
`5.
`
`From 2002-2003, I was Secure Messaging Project Manager for the
`
`Commonwealth of Massachusetts Information Technology Division. During this period, I
`
`implemented a system for securing healthcare-related transactions statewide.
`
`6.
`
`Since 2004 I have been Director of Security Governance for CGI Federal in
`
`Fairfax, Virginia. In this position, I design, implement and manage the security of large—scale
`
`applications for government and commercial clients.
`
`7.
`
`I am familiar with the specification and pending claims of the present
`
`Application.
`
`8.
`
`I have reviewed U.S. Patent Publication No. 2010/0100724 A1 by Kaliski, Ir.
`
`(“KaZiskz', J24”).
`
`Nonce Not Equivalent to SecureCode
`
`9.
`
`One of skill in the authentication art would understand that an identifier is
`
`non secret information such as a name or label that identifies an entity. And in the world of
`
`authentication an identifier is only used for identification of an entity and not for
`
`authentication of the entity.
`
`10.
`
`One of skill in the authentication art would understand that in Kaliski, Jr., a
`
`nonce is a session identifier. “The authentication server 730 returns the blinded result R to
`
`

`
`U.S. Patent Application No. 12/210,926
`Attorney Docket No. KAMRO02USO
`
`the client 715, along with a nonce or other session identifier 772.” Kaliski, Jr., 1] [01 l l]
`
`(emphasis supplied).
`
`A cryptographic nonce is an arbitrary number used to establish the uniqueness or
`
`discreteness of an operation. That is, an operation such as a data request is accompanied by a
`
`nonce in order to demonstrate that the request is not a repeat or replay of a previous request.
`
`A session is a series of information exchanges between two communicating parties,
`
`usually involving an initiation protocol and more than one message in each direction.
`
`In Kaliski, Jr. a nonce is used for identification of a user’s session. In the
`
`client/server world, a session refers to all the requests that a single client makes to a server. A
`
`session is specific to each user and for each user a new session is created to track all the
`
`requests from that user. Every user has a separate session and separate session identifier is
`
`associated with that session.
`
`11.
`
`One of skill in the authentication art would understand that the nonce in
`
`Kaliski, Jr. is not equivalent to the SecureCode of the present application. A nonce is a
`
`session identifier associated with a user’s session, but a nonce is not used for authentication
`
`of a user, as is the SecureCode recited in the claims of Kamrani.
`
`12.
`
`One of skill in the authentication art would understand that the statement “the
`
`nonce corresponds to the recited dynamic SecureCode” is inaccurate. In Kaliski, Jr. the web
`
`server receives the nonce and hardened password from the client and authenticates the user
`
`based on successful decryption of a digital signature associated with the hardened password.
`
`Kaliski, Jr., ‘W [0109] and [01 12]. The nonce is used by the web server to identify the user
`
`and the hardened password used in the authentication process of authenticating the user. In
`
`Kamrani, a dynamic code authenticates a user whereas in Kaliski, Jr. a nonce is a session
`
`identifier. Therefore the argument that “the nonce corresponds to the recited dynamic code”
`
`is invalid.
`
`

`
`U.S. Patent Application No. 12/210,926
`Attorney Docket No. KAMROOZUSO
`
`No Authentication Request Message
`
`13.
`
`One of skill in the authentication art would understand that in the system of
`
`Kaliski, Jr. there is nothing equivalent to a Central Entity receiving an authentication request
`
`message, as recited in the claims at issue. The Office Action equates the claimed
`
`authentication request message to message 776 of Kaliski, Jr. But, message 776 that the
`
`authentication server in FIG 7 of Kaliski, Jr. receives is NOT an authentication request
`
`message. Rather, message 776 indicates simply whether or not the authentication of the
`
`client by the web server was successful. See Kaliski, Jr. flfll [0109] through [0112]. This
`
`message 776 is a one way acknowledgement and expects no return, whereas the
`
`authentication request message as recited in the claims at issue is a different type of message
`
`than the cited acknowledgement as the claimed authentication request should generate a
`
`response because it is a REQUEST as opposed to an acknowledgement. Thus, the message
`
`in Kaliski, Jr. cited by the Office Action at issue is not equivalent to the claimed
`
`authentication request message in Kamram‘. Thus, one of skill in the authentication art would
`
`understand that the argument in the Office Action equating the claimed authentication request
`
`message to the acknowledgement message 776 in Kaliski, Jr. is not valid.
`
`No Central Entity Authenticating User
`
`14.
`
`One of skill in the authentication art would understand that there is nothing in
`
`Kaliski, Jr. equivalent to a Central Entity authenticating the user as recited in the claims at
`
`issue. The Office Action equates the Central Entity to the authentication server 730 in
`
`Kaliski, Jr. But, the authentication server 730 in FIG 7 never authenticates the client.
`
`Rather, the web server 710 authenticates the client based on successful decryption of the
`
`client’s digital signature associated with the hardened password. See Kaliski, Jr. W [0109]
`
`through [01 12]. Moreover, the web server 710 of Kaliski, Jr. does not generate anything
`
`-3-
`
`

`
`U.S. Patent Application No. 12/210,926
`Attorney Docket No. KAMROOZUSO
`
`equivalent to the claimed SecureCode, as recited in the claims at issue. Thus, neither the web
`
`server 710 nor the authentication server 730 of Kaliski, Jr. performs the functions of the
`
`Central Entity recited in the claims.
`
`15.
`
`One of skill in the authentication art would understand that in Kaliski, fir. a
`
`user’s client application generates a hardened password (based on the blinded result R
`
`received from the authentication server) and submits the generated hardened password to the
`
`web server and not to the authentication server cited by the Office Action. In Kaliski, Jr. the
`
`client receives the blinded result R along with a nonce from the authentication server and
`
`generates the hardened password at the client side for authentication to the web server.
`
`Kaliski, Jr., 1] [O111].
`
`16. One of skill in the authentication art would understand that the argument in the
`
`Office Action equating the claimed “authenticating by the Central-Entity the user during the
`
`transaction, if the digital identity is valid” with the authentication protocol in Kaliski, Jr. is
`
`not valid. The authentication server 730 does not authenticate the client; it is the web server
`
`that authenticates the client. And, the web server 710 of Kaliski, Jr. also cannot be the
`
`claimed Central Entity because the web server does not generate anything equivalent to the
`
`claimed SecureCode. Thus, there is no Central Entity authenticating the user in Kaliski, Jr.
`
`Authentication Process Different
`
`17. The web server of Kaliski, Jr. stores the user’s personal information as encryption
`
`secrets (See Kaliskz’, Jr, fl [0103]) and the encrypted secrets are stored such that they can be
`
`decrypted with a decryption key/hardened password. In Kaliski, Jr. a blind function
`
`evaluation protocol is used by the client to drive a decryption key/hardened password from a
`
`blinded result R received from the authentication server (See Kaliski, Jr., 1l [0] I 1]), to
`
`decrypt the encrypted secrets. The web server authenticates the client if the hardened
`
`password received from the client successfully decrypt user’s information.
`
`-4-
`
`

`
`U.S. Patent Application No. 12/210,926
`Attorney Docket No. KAMROO2USO
`
`18. It is clear that in Kaliski, Jr., authentication is based on a cgzptographic protocol.
`
`The use of this cryptographic approach allows authenticity of a client to be checked by
`
`creating a digital signature of a user’s personal information using the encryption key, which
`
`can be verified using hardened password as the decryption key received from the client
`
`during the transaction.
`
`19. One of skill in the authentication art would understand that in the blind function
`
`evaluation protocol used in Kaliski, Jr. (See, Kaliski, Jr. 1] [003 8]), the client has some secret
`
`information and the authentication server has some secret information, and together the client
`
`and the authentication server provide their respective secrets as an input to a jointly
`
`calculated function, with only the client obtaining the output of the jointly calculated function
`
`(the output is the decryption key or hardened password). This means that only the client
`
`obtains the hardened password (decryption key) as the output of the blind function evaluation
`
`protocol. See Kaliski, Jr. Figure 7. The authentication server of Kaliski, Jr. which the Office
`
`Action equated to the Central Entity of the claims cannot generate the hardened password
`
`(decryption key) since the authentication server does not have access to the client’s secret
`
`information. See Kaliski, Jr. 1] [0040], which states:
`
`The use of a blind function evaluation protocol, or other
`embodiments in which the decryption key is derived from the
`client information, provides additional security benefits
`resulting from the fact that the first server 30 does not have the
`decryption key in an unblinded form. Even if the first server 30
`is compromised, and a server secret obtained, it will still be
`necessary for an attacker to do more work to transform the
`server secret into the decryption key. Just as one example, in
`one such embodiment, the first server 30 and client 15 engage
`in a blind function evaluation protocol that results in the first
`server 30 providing to the client 15 a blinded key as the
`intermediate data 22. The client 15 has information used to
`
`unblind the decryption key 24, which is then used to decrypt
`the encrypted secrets 5. Compromise of the first server 30
`would still not directly reveal the decryption key 25 to an
`attacker.
`
`

`
`U.S. Patent Application No. 12/210,926
`Attorney Docket No. KAMROO2USO
`
`Thus, the entire basis for authentication in Kaliski, Jr. is different than the claimed
`
`SecureCode authentication process of Kamrani, and one of ordinary skill in the art would
`
`understand this difference.
`
`Hill et al.
`
`20.
`
`One of skill in the authentication and payment art would understand that the
`
`user of Hill et al. purchases a set of payment tokens from the payment service provider before
`
`the user being involved in any transaction with the merchant. Hill et al., col. 5, lines 31-51
`
`and col. 8, lines I -9. The tokens are not Valid for a predefined period of time because the user
`
`buys them. The tokens are like real money and will be used for online purchases.
`
`initially, the user establishes an internet connection with
`the payment service, and purcliases tokens to a certain value.
`This transaction may be carried out, for oxaniple, by trans-
`rnitting from the client to the payment service a request for
`tokens to at certain Value, say £10. togctlier with it credit card
`number. This ntinzber may be encrypted using any one of :1
`number of public key encryption tools. such as PGP. The
`payment service debits the relevant sum from the credit card
`account, and generates at number of payment tokens, say
`3000 tokens of value 1;). These are encrypted using the
`public key algorithm and returned to the user via the internet
`connection, together with a key which is unique to the user.
`Each token comprises,
`in this exarnple. a 64 bit random
`hexadecimal nunzbcr, drawn from a large list of 11 random
`numbers l.¥’.=(r(}, r1, r2,
`.
`.
`.
`, rn—", rn—'l) at the payment
`service. For each user, the payment service keeps two pieces
`of secret information k and s. k is a rzmdorn key for use with
`a symmetric block cipher. S is a random security parainctcr,
`where (0§s§n—‘l,_) taken at random from the range (0 .
`.
`. 1]).
`There is also an integer index variable i. its secrecy is not
`essential although it's integrity is important.
`
`V):U:
`
`40
`
`45
`
`‘
`
`21.
`
`One of skill in the authentication art would understand that the payment server
`
`of Hill et al. encrypt the generated set of tokens with user’s public key and send it to the user
`
`before the user starting any transactions with a merchant. Hill et al., col. 5, lines 40-42. The
`
`Carnet program installed on user’s computer stores the tokens. Hill Col. 5, lines 25~30 and
`
`lines 52-65; C016, lines 3-20.
`
`

`
`U.S. Patent Application No. 12/210,926
`Attorney Docket No. KAMROOZUSO
`
`22.
`
`One of skill in the authentication art would understand that the merchant stores
`
`a set of authentication tokens before starting any transaction with the user. Hill et al., col. 6,
`
`lines 46-47 and col. 13, lines 1-5.
`
`‘The mercliatit module imtlucles a.d1;ni.u.istrati.or3 furzetions.
`
`These ntaintain at count of how many unused authenlieaticm
`’[f3l{.CI‘]S remain, and send a reqllest for fUéE'll’lt2-ii‘ tokens to the
`payment service wlien. that number falls below a predeterv 5
`m:i:ter:l
`tl‘.ll'CSl‘.lOl(l.
`
`23.
`
`One of skill in the authentication art would understand that the authentication
`
`tokens of the merchant are similar to the payment tokens of the user. The tokens are issued to
`
`the merchant at the time of registration and before the merchant or the user being involved in
`
`any transaction. Hill et al., col 6, lines 25-32. The merchant and the user do not receive any
`
`tokens at the time of the transaction and the tokens stored at the user or merchant’s computer
`
`are not valid for a predefined period of time. Hill’s tokens do not serve an identification
`
`function, but rather act is a fungible financial instrument. That is, a given quantity or value of
`
`tokens is equivalent to their stated value in dollars.
`
`I affirm that all statements made herein of my own knowledge are true, and that all
`
`statements made herein on information and belief are believed to be true. I understand that
`
`willful false statements and the like are punishable by line or imprisonment, or both
`
`(18 U,S.C. 1001), and may jeopardize the validity of the present patent application or any
`
`patent issuing thereon.
`
`FURTHER AFFIANT SAYETH NOT.
`
`It witness whereof,
`
`‘
`lffhl/1"?
`(‘"0
`ll‘:
`
`ames Hewitt
`
`jg’;
`” ll;
`
`‘
`
`a
`I
`
`M
`
`<9”
`
`T
`
`g’/V
`
`-*9
`
`E
`”"~
`6;} K A
`
`Date