1

Correct me if I’m wrong but after reviewing latest claim changes in global dossier of the US20160226868 patent application it seems that applicant submitted patent application claiming NIST Electronic Authentication Guideline publish in 2013 (pdf) guidelines as their invention, moreover the claim changes indicate adaptation to conform to the latest version of the guidelines (now Digital Identity Guidelines) (GitHub) (note claim elements: an electronic mail (e-mail) message, a mobile application push notification, and a web push notification).

Also is it possible to submit this review to the USPTO?

Below are corresponding claim elements from latest submitted claim 4 against citations from the 2013 NIST guideline.

4. (Currently Amended) An integrated interactive messaging system comprising:

[p. iii]

The recommendation covers remote authentication of users (such as employees, contractors, or private individuals) interacting with government IT systems over open networks. E-authentication presents a technical challenge when this process involves the remote authentication of people over an open network, for the purpose of electronic government and commerce.

[p. v]

This recommendation provides technical guidelines to agencies to allow an individual to remotely authenticate his or her identity to a Federal IT system.

an interactive messaging server comprising one or more computers and configured to communicate an interactive push message to a client device used by a user; and

[p. 44]

For example, a Claimant attempts to log into a website and receives a text message on his or her cellular phone, PDA, pager, or land line (pre-registered with the CSP during the registration phase) with a random authenticator to be presented as a part of the electronic authentication protocol.

[p. 67]

The challenge and session key are securely transmitted to the Verifier. The Verifier in turn sends only the challenge to the Claimant, and the Claimant applies the challenge to the long-term shared secret to generate the session key. Both Claimant and Verifier now share a session key, which can be used for authentication.

Also see 4. E-Authentication Model

a biometric engine, executed on a computer, to verify the user via one or more biometrics captured at the client device; and

[p. 35]

For physical transactions, the Applicant shall identify himself/herself in person by either using a secret as described above, or by biometric verification (comparing a captured biometric sample to a reference biometric sample that was enrolled during a prior encounter).

[p. 40]

Obtain and verify a copy of a biometric recorded when the original credential was issued. An example of such a biometric is the signed biometric data object on a PIV card, however if the biometric reference is not available from the Level 4 token, it may be obtained elsewhere, as long as its authenticity is assured; Compare a fresh biometric sample obtained in person from the Applicant to the reference biometric retained from the original Level 4 credentials and determine that they match, and; wherein the interactive push message is a push message and comprises a request for biometric capture and is selected from the group consisting of:

[p. 43]

The second factor of authentication may be achieved through some kind of integral entry pad, an integral biometric (e.g., fingerprint) reader or a direct computer interface (e.g., USB port).

[p. 44]

For example, a Claimant attempts to log into a website and receives a text message on his or her cellular phone, PDA, pager, or land line (pre-registered with the CSP during the registration phase) with a random authenticator to be presented as a part of the electronic authentication protocol.

a short message service (SMS) message,

a multimedia messaging service (MMS) message,

[p. 44]

For example, a Claimant attempts to log into a website and receives a text message on his or her cellular phone, PDA, pager, or land line (pre-registered with the CSP during the registration phase) with a random authenticator to be presented as a part of the electronic authentication protocol.

an electronic mail (e-mail) message,

Push message via “email” was not part of original patent application. Email was identified as an example of personal information, not a messaging platform.

a mobile application push notification, and

Could not find “mobile application push notification” as part of original patent application.

a web push notification;

Could not find “web push notification” as part of original patent application.

the biometric engine is configured to communicate with a service provider and the interactive message messaging server using an out-of-band network distinct from a primary network connecting the client device and the service provider;

[p. 4]

Recognition of more types of tokens, including pre-registered knowledge token, lookup secret token, out-of-band token, as well as some terminology changes for more conventional token types;

[p. 15]

Trust Anchor A public or symmetric key that is trusted because it is directly built into hardware or software, or securely provisioned via out-of-band means, rather than because it is vouched for by another trusted entity (e.g. in a public key certificate).

[p. 44]

For example, a Claimant attempts to log into a website and receives a text message on his or her cellular phone, PDA, pager, or land line (pre-registered with the CSP during the registration phase) with a random authenticator to be presented as a part of the electronic authentication protocol.

the biometric engine is configured to receive, over the out-of-band network, a request from the service provider for verification of a user;

[p. 15]

Trust Anchor A public or symmetric key that is trusted because it is directly built into hardware or software, or securely provisioned via out-of-band means, rather than because it is vouched for by another trusted entity (e.g. in a public key certificate).

[p. 44]

• Out of Band Token – A physical token that is uniquely addressable and can receive a Verifier-selected secret for one-time use. The device is possessed and controlled by the Claimant and supports private communication20 over a channel that is separate from the primary channel for e-authentication. The token authenticator is the received secret and is presented to the Verifier using the primary channel for e-authentication. For example, a Claimant attempts to log into a website and receives a text message on his or her cellular phone, PDA, pager, or land line (pre-registered with the CSP during the registration phase) with a random authenticator to be presented as a part of the electronic authentication protocol. Out of Band Tokens are something you have.

the biometric engine is configured to communicate with the interactive messaging server to request one or more biometric probes from the user;

This is implied.

the one or more biometric probes are generated at the client device using biometric information collected from the user by the client device;

Camera equipped mobile devices were already popular at the time of patent applications. Thus obvious to one skilled in art.

[p. 45]

The second factor of authentication may be achieved through some kind of integral entry pad, an integral biometric (e.g., fingerprint) reader or a direct computer interface (e.g., USB port).

[p. 44]

For example, a Claimant attempts to log into a website and receives a text message on his or her cellular phone, PDA, pager, or land line (pre-registered with the CSP during the registration phase) with a random authenticator to be presented as a part of the electronic authentication protocol.

the biometric engine is configured to receive the biometric probes over the out-of-band network;

Not explained how response biometric probe is sent back via e.g. Text Messaging service.

the biometric engine is configured to compare the biometric probes with biometric templates stored in a database; and

[p. 40]

Obtain and verify a copy of a biometric recorded when the original credential was issued. An example of such a biometric is the signed biometric data object on a PIV card, however if the biometric reference is not available from the Level 4 token, it may be obtained elsewhere, as long as its authenticity is assured; Compare a fresh biometric sample obtained in person from the Applicant to the reference biometric retained from the original Level 4 credentials and determine that they match, and;

the biometric engine is configured to provide a response to the service provider representing the possibility that the biometric probe and the biometric template are from the same user.

E-authentication begins with registration. The usual sequence for registration proceeds as follows. An Applicant applies to a Registration Authority (RA) to become a Subscriber of a Credential Service Provider (CSP). If approved, the Subscriber is issued a credential by the CSP which binds a token to an identifier (and possibly one or more attributes that the RA has verified). ... When a Claimant successfully demonstrates possession and control of a token to a Verifier through an authentication protocol, the Verifier can verify that the Claimant is the Subscriber named in the corresponding credential. The Verifier passes on an assertion about the identity of the Subscriber to the Relying Party (RP). That assertion includes identity information about a Subscriber, such as the Subscriber name, an identifier assigned at registration, or other Subscriber attributes that were verified in the registration process (subject to the policies of the CSP and the needs of the application). Where the Verifier is also the RP, the assertion may be implicit. The RP can use the authenticated information provided by the Verifier to make access control or authorization decisions.

Also see 4. E-Authentication Model

5. (Original) The system of claim 4, wherein the response to the service provider comprises a biometric fusion score.

Either match/no match or fusion score has no real difference, in any case the result from biometric matcher at some point has to be converted into match/no match form.

1

US20160226868A1 is a patent application, not a patent. I may or may not ever get granted as a patent and even if it does, it is highly likely the claims will change from what is in the application. In any case a claim needs to be taken in its entirety. The claim doesn't restrict others from using the individual steps. For claims with multiple steps, each and every step needs to be implemented in order to infringe on a claim. It is even possible for each step to have prior art yet the claim may be acceptable if the combination of steps is novel and non-obvious.

Wither regards to this application, I've not researched the documentation or prior art and I'm not an expert in this field. So I'm not making any assessment as to the validity of the invention. You can find an updated status by checking on the US Public Pair site. When there type "20160226868" into the search field and select "Publication Number". Under the Transaction History tab you'll find that it received a rejection in May 2nd of 2019 and updated claims were filed on October 23rd, 2019. They are substantially changed. An allowance was issued on January 15th, 2020. In the Image File Wrapper tab you can read filed documents. The most recent haven't been uploaded yet. It is very interesting to read the documents as you can see what the examiner was objecting to in the rejections and how the applicant responded.

  • My mistake, corrected the title - added "application". In the post itself it was "patent application". The claims I've cited are from the last submission on 10/23/2019 . I know about rejections, I agree they are interesting to read. The problem is that I've checked other patent applications by this company and what I noticed is that this company is very determined to get patents. Apparently after numerous rejections they change claims beyond recognition, but get their patent. So that's the reason for concern here. IMHO USPTO Global Dossier is more convenient (and modern) than Public Pair. – Randy Daft Jan 23 at 7:22
  • And examiner issued notice of allowance dated 01/23/2020. To my understanding this means the patent got approved. – Randy Daft Jan 24 at 13:37
  • @RandyDaft I mentioned the allowance in my answer. You're correct it means a patent was granted. – Eric Shain Jan 24 at 20:51
  • I've checked the Public Pair and didn't find the January 15th, 2020 allowance you've mentioned. What I see in public pair is: i.stack.imgur.com/WWFZg.png only Jan 23 Notice of allowance – Randy Daft Jan 27 at 11:39

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.