Last month, U.S. Patent and Trademark Office Director Andrei Iancu issued a notice on the "Authentication Changes for Registered Users of EFS-Web and Private PAIR." Although most of the information provided in the Director's notice had been previously provided by the Office earlier this year (see "USPTO Moving to New Authentication System for EFS-Web and Private PAIR"), the notice served as a reminder about the new authentication system as the Office prepares to phase out the use of Public Key Infrastructure (PKI) certificates (which have been used by the Office since 2006), perhaps as early as December 31, 2018 (the Director's notice states that "[u]se of PKI certificates may no longer be available after December 31, 2018").
When details of the new authentication system were first provided by the Office in October, the Office described the system as being safer and simpler than the old system, allowing for access to multiple USPTO systems with one consolidated sign-in, eliminating the need to share credentials by providing practitioners and their support staff with their own USPTO.gov accounts, and helping resolve browser compatibility issues. The Office noted that the new system would provide users with access to the EFS-Web and Private PAIR until the full release of Patent Center, the next generation tool that will replace the EFS-Web and Private PAIR in 2020.
In October, the Office also announced the release of a migration tool, which allows existing PKI digital certificate holders to link their USPTO.gov accounts to their current PKI digital certificates. To migrate an existing PKI digital certificate, users must have a USPTO.gov account. Users who need to create a USPTO.gov account can do so by following the steps under the "Create a USPTO.gov Account" tab at the Office's authentication change webpage. Once a USPTO.gov account has been created, users can follow the steps under the "Migrate your PKI Certificate" tab at the Office's authentication change webpage (or refer to the Guide for Migration) to link that account to their PKI certificate. The Office notes that users should allow 1–2 business days after the migration steps are finished for the migration process to be completed. Once the process is completed, users will be able to sign into the EFS-Web or Private PAIR using their USPTO.gov account. Users should use the following new links to sign into the EFS-Web or Private PAIR using their USPRTO.gov accounts:
EFS-Web:
https://efs-my.uspto.gov/EFSWebUIRegistered/EFSWebRegistered
Private PAIR:
https://ppair-my.uspto.gov/pair/PrivatePair
Additional information regarding the new authentication process can be found in the Office's Patent Electronic System Access Document. This resource includes information about USPTO.gov accounts; two-step authentication; signing in and signing out from USPTO systems; Patent Electronic Access roles for practitioners, support staff, and inventors; suspension of accounts; authorization; authentication steps; the sponsorship process (by which practitioners can grant or remove sponsorship for support staff individuals to work under their direction and control); and the Office's verification policy and identity proofing of sponsored support staff. With respect to identity proofing, the Office notes that "[e]ach practitioner will be responsible for verifying the identity of the person using any sponsored support Staff account."
When announcing the new authentication system in October, the Office cautioned practitioners that migration to link USPTO.gov accounts to PKI certificates should be completed by the end of October (although practitioners can still do so using the migration tool), sponsorship of support staff should be completed by the end of November (again, practitioners can still do so using the sponsorship tool that was released on November 1), and that PKI certificates are scheduled to be retired in December (which the Director's notice indicates may be phased out on December 31, 2018).
The Director emphasizes in his notice that practitioners no longer have to share their credentials, and in fact, will no longer be permitted to share accounts with support staff, who will need to establish their own USPTO.gov accounts in order to access the EFS-Web Registered and Private PAIR. USPTO.gov accounts will be used as the first step to log into EFS-Web Registered and Private PAIR, and the Director notes that "[u]sers who do not currently have a USPTO.gov account should take steps now to obtain an account." The second step of the two-step authentication system will require users to choose to receive an e-mail or phone call which will provide a 6-digit code that is to be entered along with their USPTO.gov password. The Director notes that users may also download a free authenticator app on their mobile phone to provide the additional secure verification. According to the Office's authentication system FAQs webpage, the 6-digit code can be generated by a RFC 6238-compliant authenticator app.
The Director's notice provides more information about the Office's sponsorship tool, which can be accessed here. The sponsorship tool, which was made available by the Office on November 1, allows practitioners to grant or remove sponsorship for support staff individuals (under the direction and control of sponsoring practitioners) to work on their behalf. In order to be sponsored, the support staff individual must have already created a USPTO.gov account. The Director notes that each support staff member must have their own USPTO.gov account, and that accounts cannot be shared among support staff members.
The notice closes by addressing the identify verification (or proofing) requirements of the new authentication system. Under the identity proofing and enrollment process, the identity evidence and attributes of users of the Office's Patent Electronic System are collected, uniquely resolved to a single identity within a given population or context, then validated and verified. The Director notes that current PKI certificate holders who migrate using the migration tool will be considered to have met the identity proofing requirements. However, for support staff being sponsored by practitioners, the practitioner "will be responsible for proofing the identity of the person being sponsored." The Director's notice indicates that "[e]ach sponsoring practitioner will establish a procedure for identity proofing sponsored users and maintain a record of that procedure." The notice points out that identity proofing consists of three steps: resolution of the prospective sponsored user's identity based upon identity evidence, validation of the evidence, and verification of the evidence. Additional details regarding identity verification requirements can be found in the Office's Patent Electronic System Access Document.
Users requiring assistance to create a USPTO.gov account should call the USPTO Contact Center (UCC) at 800-786-9199. Users requiring assistance with migration should contact the Patent Electronic Business Center at ebc@uspto.gov or 866-217-9197. Questions or comments related to the new authentication method may be sent to eMod@uspto.gov. The Office has also been offering several informational sessions on authentication changes; a schedule of upcoming sessions can be found at the "Information sessions" tab at the Office's authentication change webpage. A list of Frequently Asked Questions (FAQs) about the authentication change for EFS-Web and Private PAIR can be found here.
