DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 03/09/2026 has been entered.
Response to Arguments
In response to 35 USC 102, filed 03/09/2026, on pages 11-17, for independent claims 1, 46 and 55 along with their respective dependent claims, applicant argues that Castilho does not teach “Before run time enforcement of at least one policy, resolving a plurality of metadata labels into respective binary encodings”, “a binary encoding of the at least one metadata label”, “Input pattern corresponding to allowed instructions”, and “Selecting … values for … variables” .
The Examiner does not concede. Castilho teaches “Before run time enforcement of at least one policy, resolving a plurality of metadata labels into respective binary encodings”. Castilho discloses characteristic detection rules 234 may comprise a rule, logic, or code that is configurable to detect a characteristic of at least a portion of an electronic communication. Each description, also known as a rule, consists of a set of strings and a Boolean expression which determines its logic [0098][0102][0123-0124]. The execution of the compiled rule set returns the tags, the name, and the metadata for each of the characteristic detection rules in the rule set that matched against the electronic communication (such as for which the binary or textual pattern specified by the characteristic detection rule was found in the electronic communication) [0009]. Characteristic detection rule creation service 210 is configured to receive input from IT administrator 240 and/or company administrator 242 and may create characteristic detection rules that are associated with a specific organization and may store organization specific characteristic detection rules in characteristic detection rules storage 222a [0073]. A characteristic detection rule may be configured to detect and Eicar pattern in some part or all of an electronic communication [0128]. Combination rule computational service 207 may output the binary result (e.g., yes it matches, or not it doesn't match) of the evaluation of a combination rule to classification service [0070][0075][0127][0005]”. Castilho shows binary result and then send for evaluation of a rule.
In regard to argument “a binary encoding of the at least one metadata label”. The Examiner does not concede. Castilho teaches “a binary encoding of the at least one metadata label”. Castilho discloses “the execution of the compiled rule set returns the tags, the name, and the metadata for each of the characteristic detection rules in the rule set that matched against the electronic communication (such as for which the binary or textual pattern specified by the characteristic detection rule was found in the electronic communication) [0009]. Combination rule computational service 207 may output the binary result (e.g., yes it matches, or not it doesn't match) of the evaluation of a combination rule to classification service [0070][0075][0127][0096][0103]”. Castilho shows a binary result of the evaluation of a combination rule. The execution of the compiled rule set returns the tags, the name, and the metadata for each of the characteristic detection rules in the rule set. Selecting the binary representation such as 0 or 1 (a plurality of respective values), the variables are the rules. The claims does not indicate how they are encoding the binary. It would appear that the resolving the plurality of metadata labels into the respective binary encodings is selecting a plurality of respective values for a plurality of variables.
In regard to argument “input pattern corresponding to allowed instructions”. The Examiner does not concede. Castilho teaches input pattern corresponding to allowed instructions. Castilho discloses “characteristic detection rules 234 may comprise a rule, logic, or code that is configurable to detect a characteristic of at least a portion of an electronic communication. Each description, also known as a rule, consists of a set of strings and a Boolean expression which determines its logic [0098][0102][0123-0124]. The execution of the compiled rule set returns the tags, the name, and the metadata for each of the characteristic detection rules in the rule set that matched against the electronic communication (such as for which the binary or textual pattern specified by the characteristic detection rule was found in the electronic communication) [0009]. Characteristic detection rule creation service 210 is configured to receive input from IT administrator 240 and/or company administrator 242 and may create characteristic detection rules that are associated with a specific organization and may store organization specific characteristic detection rules in characteristic detection rules storage 222a [0073]. A characteristic detection rule may be configured to detect and Eicar pattern in some part or all of an electronic communication [0128]” Please also see Fig. 3 and Table 1. Castilho shows an input pattern as the Eicar pattern corresponding to the allowed instructions in accordance with the at least one policy. Applicant should further amend “input paten corresponding to allowed instructions”.
In regard to argument “Selecting … values for … variables”. The Examiner does not concede. Castilho teaches input pattern corresponding to instruction to be allowed. Castilho teaches Selecting … values for … variables. The claim terms of values and variables are very broad. What are the respective value and what are the variables. The claim limitation is just being to select a value based on the rule. Castilho discloses a plurality of characteristic detection rules, to be applied against an electronic communication to detect characteristics. A combination rule may be selected from system combination rules [0096][0103] The combination rule computation service 207 then evaluates the Boolean expression and determines the binary outcome of the combination rule (such as, either “1” or “0”). If the outcome is “0”, the reported electronic communication does not match the combination rule. If the outcome is “1”, the reported electronic communication does match the combination rule. [0127]”. Selecting the binary representation such as 0 or 1 (a plurality of respective values), the variables are the rules. Applicant should further amend “selecting a plurality of respective values for a plurality of variables”.
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 1-8 and 45-57 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
Re. claims 1, 46 and 55; the claims recite “before run time enforcement of at least one policy, resolving a plurality of metadata labels into respective binary encodings”. The specification does not have support for before run time enforcement of at least one policy. Neither does the specification mention resolving a plurality of metadata labels into respective binary encodings. Applicant’s specification in paragraph [117-119] recites “one or more concrete rules may be computed and installed into a rule cache before run time” and “resolve metadata labels in the one or more concrete rules computed by the policy compiler 220 and/or the policy linker 225 into binary representations”. Therefore, the specification does not have support for before run time enforcement of at least one policy, resolving a plurality of metadata labels into respective binary encodings.
Claims 2-8, 45, 47-54 and 56-57 fall together accordingly as they do not cure the deficiencies of the independent claims.
Claim Rejections - 35 USC § 112
following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-8 and 45-57 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claims 1-8, 45 and 56 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Re. claims 1, the BRI of the claim requires the functional language that the computer must somehow “before run time enforcement of at least one policy, resolving a plurality of metadata labels into respective binary encodings, wherein: each metadata label of the plurality of metadata labels occurs in at least one input pattern of a plurality of input patterns associated with the at least one policy; the plurality of input patterns comprise an input pattern corresponding to allowed instructions in accordance with the at least one policy; resolving the plurality of metadata labels into the respective binary encodings comprises selecting a plurality of respective values for a plurality of variables; the plurality of variables correspond, respectively, to the plurality of metadata labels; and for at least one metadata label of the plurality of metadata labels, a binary encoding of the at least one metadata label is obtained based on the respective value of the variable corresponding to the at least one metadata label; and storing the binary encodings of the plurality of metadata labels for use at run time to check instructions executed by a host processor against the at least one policy”. The recited functions do not flow from the structure recited in the claim. The claimed function are not performed by any element in the claim.
The boundaries of the functional language is unclear because the claim does not provide a discernable boundary on what performs the function. It is unclear whether the function requires some other structure or is simply a result of operating the computer in a certain manner. Thus one of ordinary skill in the art would not be able to draw a clear boundary between what is and is not covered by the claim. The claims are therefore rendered indefinite.
Claims 2-8, 45 and 56 fall together accordingly as they do not cure the deficiencies of the independent claims.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claim(s) 1-3, 45-48 and 54-57 are rejected under 35 U.S.C. 102(a)(2) as being anticipated by Castilho et al. (US 20200195664, hereinafter Castilho).
Re. claim 1, Castilho discloses a computer-implemented method comprising acts of:
Before run time enforcement of at least one policy, resolving a plurality of metadata labels into respective binary encoding, wherein: each metadata label of the plurality of metadata labels occurs in at least one input pattern of a plurality of input patterns associated with at least one policy (Castilho discloses characteristic detection rules 234 may comprise a rule, logic, or code that is configurable to detect a characteristic of at least a portion of an electronic communication. Each description, also known as a rule, consists of a set of strings and a Boolean expression which determines its logic [0098][0102][0123-0124]. The execution of the compiled rule set returns the tags, the name, and the metadata for each of the characteristic detection rules in the rule set that matched against the electronic communication (such as for which the binary or textual pattern specified by the characteristic detection rule was found in the electronic communication) [0009]. Characteristic detection rule creation service 210 is configured to receive input from IT administrator 240 and/or company administrator 242 and may create characteristic detection rules that are associated with a specific organization and may store organization specific characteristic detection rules in characteristic detection rules storage 222a [0073]. A characteristic detection rule may be configured to detect and Eicar pattern in some part or all of an electronic communication [0128]. Combination rule computational service 207 may output the binary result (e.g., yes it matches, or not it doesn't match) of the evaluation of a combination rule to classification service [0070][0075][0127][0005] Fig. 3 and Table 1); the plurality of input patterns comprise an input pattern corresponding to allowed instructions in accordance with the at least one policy (Castilho discloses characteristic detection rules 234 may comprise a rule, logic, or code that is configurable to detect a characteristic of at least a portion of an electronic communication. Each description, also known as a rule, consists of a set of strings and a Boolean expression which determines its logic [0098][0102][0123-0124]. The execution of the compiled rule set returns the tags, the name, and the metadata for each of the characteristic detection rules in the rule set that matched against the electronic communication (such as for which the binary or textual pattern specified by the characteristic detection rule was found in the electronic communication) [0009]. Characteristic detection rule creation service 210 is configured to receive input from IT administrator 240 and/or company administrator 242 and may create characteristic detection rules that are associated with a specific organization and may store organization specific characteristic detection rules in characteristic detection rules storage 222a [0073]. Rule creation manager 210 allows for user input through a non-graphical user interface, such as a user interface that accepts text or vocal input without displaying an interactive image [0080]. A characteristic detection rule may be configured to detect and Eicar pattern in some part or all of an electronic communication [0128][0111] Fig. 3 and Table 1); resolving the plurality of metadata labels into the respective binary encoding comprises selecting a plurality of respective values for a plurality of variables and the plurality of variables correspond, respectively, to the plurality of metadata labels (Castilho discloses a plurality of characteristic detection rules, to be applied against an electronic communication to detect characteristics. A combination rule may be selected from system combination rules [0096][0103] The combination rule computation service 207 then evaluates the Boolean expression and determines the binary outcome of the combination rule (such as, either “1” or “0”). If the outcome is “0”, the reported electronic communication does not match the combination rule. If the outcome is “1”, the reported electronic communication does match the combination rule. [0127], selecting the binary representation such as 0 or 1 (a plurality of respective values) that corresponds to the plurality of metadata labels, the variables are the rules); and for at least one metadata label of the plurality of metadata labels, a binary encoding of the at least one metadata label is obtained based on the respective value of the variable corresponding to the at least one metadata label (Castilho discloses YARA rules allow the creation of descriptions of malware families based on textual or binary patterns [0097-0098]. Combination rule computational service 207 may output the binary result (e.g., yes it matches, or not it doesn't match) of the evaluation of a combination rule to classification service [0070][0072][0106][0109][0117][0127] Fig. 3, obtaining “0” or “1” of the detected characteristics based on the rules); and storing the binary encoding of the plurality of metadata labels for use at run time to check instructions executed by a host processor against the at least one policy (Castilho discloses the execution of the compiled rule set returns the tags, the name, and the metadata for each of the characteristic detection rules in the rule set that matched against the electronic communication (such as for which the binary or textual pattern specified by the characteristic detection rule was found in the electronic communication) [0009]. Combination rule computational service 207 may output the binary result (e.g., yes it matches, or not it doesn't match) of the evaluation of a combination rule to classification service [0070][0075][0127]).
Re. claim 2, Castilho discloses the method of claim 1, wherein: the act of selecting the plurality of respective values for the plurality of variables comprises solving, subject to at least one constraint, for the plurality of variables to obtain the plurality of respective values pattern (Castilho discloses a plurality of characteristic detection rules, to be applied against an electronic communication to detect characteristics. A combination rule may be selected from system combination rules [0096][0103], selecting a plurality of rules, the metadata ).
Re. claim 3, Castilho discloses the method of claim 2, wherein: the variable corresponding to the at least one metadata label comprises a first variable; the constraint further references a second variable of the plurality of variables; the constraint comprises a condition relating the first variable and the second variable (Castilho discloses a plurality of characteristic detection rules, to be applied against an electronic communication to detect characteristics. A combination rule may be selected from system combination rules [0096][0103]. If the textual or binary pattern of the YARA rule is found in the message, then the properties of the YARA rule (e.g., the name, metadata, or tags of the YARA rule) are returned in response to the call [0005][0102], the rule containing first and second variable).
Re. claim 45, Castilho discloses the method of claim 2, wherein: the at least one constraint comprises a plurality of constraints corresponding, respectively, to the plurality of input patterns; and the constraint corresponding to the input pattern comprising the metadata label references the variable corresponding to the metadata label (Castilho discloses classification score service 209 may assign a higher severity score to an electronic communication that produces a match against more than one of the compiled rule sets executed against that communication, as compared to an electronic communication that produced a match against only one of the compiled rule sets executed against that communication. In examples, classification score service 209 may assign a higher severity score to an electronic communication that produces a match against one part of an electronic communication, as compared to a different part of an electronic communication [0072]).
Re. claim 46, Castilho discloses a system for resolving input patterns into binary representations, the system comprising: at least one processor (Castilho discloses processor [0133]); and at least one computer-readable medium having stored thereon instructions that, when executed (Castilho discloses software or programmable code embedded in a computer readable medium that is executed by a processor [0133]), program the at least one processor to: before run time enforcement of at elast one policy, resolve a plurality of metadata labels into respective binary encoding, wherein: each metadata label of the plurality of metadata labels occurs in at least one input pattern of a plurality of input patterns associated with at least one policy (Castilho discloses characteristic detection rules 234 may comprise a rule, logic, or code that is configurable to detect a characteristic of at least a portion of an electronic communication. Each description, also known as a rule, consists of a set of strings and a Boolean expression which determines its logic [0098][0102][0123-0124]. The execution of the compiled rule set returns the tags, the name, and the metadata for each of the characteristic detection rules in the rule set that matched against the electronic communication (such as for which the binary or textual pattern specified by the characteristic detection rule was found in the electronic communication) [0009]. Characteristic detection rule creation service 210 is configured to receive input from IT administrator 240 and/or company administrator 242 and may create characteristic detection rules that are associated with a specific organization and may store organization specific characteristic detection rules in characteristic detection rules storage 222a [0073]. A characteristic detection rule may be configured to detect and Eicar pattern in some part or all of an electronic communication [0128]. Combination rule computational service 207 may output the binary result (e.g., yes it matches, or not it doesn't match) of the evaluation of a combination rule to classification service [0070][0075][0127][0005] Fig. 3 and Table 1); the plurality of input patterns comprise an input pattern corresponding to allowed instructions in accordance with the at least one policy (Castilho discloses characteristic detection rules 234 may comprise a rule, logic, or code that is configurable to detect a characteristic of at least a portion of an electronic communication. Each description, also known as a rule, consists of a set of strings and a Boolean expression which determines its logic [0098][0102][0123-0124]. The execution of the compiled rule set returns the tags, the name, and the metadata for each of the characteristic detection rules in the rule set that matched against the electronic communication (such as for which the binary or textual pattern specified by the characteristic detection rule was found in the electronic communication) [0009]. Characteristic detection rule creation service 210 is configured to receive input from IT administrator 240 and/or company administrator 242 and may create characteristic detection rules that are associated with a specific organization and may store organization specific characteristic detection rules in characteristic detection rules storage 222a [0073]. A characteristic detection rule may be configured to detect and Eicar pattern in some part or all of an electronic communication [0128] Fig. 3 and Table 1; the claim language of “to be” is an intended result. MPEP 2103 I C states that language that suggests or makes optional but does not require steps to be performed or does not limit a claim to a particular structure does not limit the scope of the claim or claim limitation); resolving the plurality of metadata labels into the respective binary encoding comprises selecting a plurality of respective values for a plurality of variables and the plurality of variables correspond, respectively, to the plurality of metadata labels (Castilho discloses a plurality of characteristic detection rules, to be applied against an electronic communication to detect characteristics. A combination rule may be selected from system combination rules [0096][0103] The combination rule computation service 207 then evaluates the Boolean expression and determines the binary outcome of the combination rule (such as, either “1” or “0”). If the outcome is “0”, the reported electronic communication does not match the combination rule. If the outcome is “1”, the reported electronic communication does match the combination rule. [0127], selecting the binary representation such as 0 or 1 (a plurality of respective values), the variables are the rules); and for at least one metadata label of the plurality of metadata labels, a binary encoding of the at least one metadata label is obtained based on the respective value of the variable corresponding to the at least one metadata label (Castilho discloses YARA rules allow the creation of descriptions of malware families based on textual or binary patterns [0097-0098]. Combination rule computational service 207 may output the binary result (e.g., yes it matches, or not it doesn't match) of the evaluation of a combination rule to classification service [0070][0072][0106][0109][0117][0127] Fig. 3, obtaining “0” or “1” of the detected characteristics based on the rules); and storing the binary encoding of the plurality of metadata labels for use at run time to check instructions executed by a host processor against the at least one policy (Castilho discloses the execution of the compiled rule set returns the tags, the name, and the metadata for each of the characteristic detection rules in the rule set that matched against the electronic communication (such as for which the binary or textual pattern specified by the characteristic detection rule was found in the electronic communication) [0009][0075][0127]).
Re. claim 47, rejection of claim 46 is included and claim 47 is rejected with the same rationale as applied in claim 2 above.
Re. claim 48, rejection of claim 47 is included and claim 48 is rejected with the same rationale as applied in claim 3 above.
Re. claim 54, rejection of claim 47 is included and claim 54 is rejected with the same rationale as applied in claim 45 above.
Re. claim 55, Castilho discloses at least one computer-readable medium having stored thereon instructions that, when executed, program at least one processor to perform a method for resolving input patterns into binary representations (Castilho discloses software or programmable code embedded in a computer readable medium that is executed by a processor [0133]), the method comprising acts of: before run time enforcement of at least one policy, resolving a plurality of metadata labels into respective binary encoding, wherein: each metadata label of the plurality of metadata labels occurs in at least one input pattern of a plurality of input patterns associated with at least one policy (Castilho discloses characteristic detection rules 234 may comprise a rule, logic, or code that is configurable to detect a characteristic of at least a portion of an electronic communication. Each description, also known as a rule, consists of a set of strings and a Boolean expression which determines its logic [0098][0102][0123-0124]. The execution of the compiled rule set returns the tags, the name, and the metadata for each of the characteristic detection rules in the rule set that matched against the electronic communication (such as for which the binary or textual pattern specified by the characteristic detection rule was found in the electronic communication) [0009]. Characteristic detection rule creation service 210 is configured to receive input from IT administrator 240 and/or company administrator 242 and may create characteristic detection rules that are associated with a specific organization and may store organization specific characteristic detection rules in characteristic detection rules storage 222a [0073]. A characteristic detection rule may be configured to detect and Eicar pattern in some part or all of an electronic communication [0128]. Combination rule computational service 207 may output the binary result (e.g., yes it matches, or not it doesn't match) of the evaluation of a combination rule to classification service [0070][0075][0127][0005] Fig. 3 and Table 1); the plurality of input patterns comprise an input pattern corresponding to allowed instructions in accordance with the at least one policy (Castilho discloses characteristic detection rules 234 may comprise a rule, logic, or code that is configurable to detect a characteristic of at least a portion of an electronic communication. Each description, also known as a rule, consists of a set of strings and a Boolean expression which determines its logic [0098][0102][0123-0124]. The execution of the compiled rule set returns the tags, the name, and the metadata for each of the characteristic detection rules in the rule set that matched against the electronic communication (such as for which the binary or textual pattern specified by the characteristic detection rule was found in the electronic communication) [0009]. Characteristic detection rule creation service 210 is configured to receive input from IT administrator 240 and/or company administrator 242 and may create characteristic detection rules that are associated with a specific organization and may store organization specific characteristic detection rules in characteristic detection rules storage 222a [0073]. A characteristic detection rule may be configured to detect and Eicar pattern in some part or all of an electronic communication [0128] Fig. 3 and Table 1; the claim language of “to be” is an intended result. MPEP 2103 I C states that language that suggests or makes optional but does not require steps to be performed or does not limit a claim to a particular structure does not limit the scope of the claim or claim limitation); resolving the plurality of metadata labels into the respective binary encoding comprises selecting a plurality of respective values for a plurality of variables and the plurality of variables correspond, respectively, to the plurality of metadata labels (Castilho discloses a plurality of characteristic detection rules, to be applied against an electronic communication to detect characteristics. A combination rule may be selected from system combination rules [0096][0103] The combination rule computation service 207 then evaluates the Boolean expression and determines the binary outcome of the combination rule (such as, either “1” or “0”). If the outcome is “0”, the reported electronic communication does not match the combination rule. If the outcome is “1”, the reported electronic communication does match the combination rule. [0127], selecting the binary representation such as 0 or 1 (a plurality of respective values), the variables are the rules); and for at least one metadata label of the plurality of metadata labels, a binary encoding of the at least one metadata label is obtained based on the respective value of the variable corresponding to the at least one metadata label (Castilho discloses YARA rules allow the creation of descriptions of malware families based on textual or binary patterns [0097-0098]. Combination rule computational service 207 may output the binary result (e.g., yes it matches, or not it doesn't match) of the evaluation of a combination rule to classification service [0070][0072][0106][0109][0117][0127] Fig. 3, obtaining “0” or “1” of the detected characteristics based on the rules); and storing the binary representations of the plurality of metadata labels for use at run time to check instructions executed by a host processor against the at least one policy (Castilho discloses the execution of the compiled rule set returns the tags, the name, and the metadata for each of the characteristic detection rules in the rule set that matched against the electronic communication (such as for which the binary or textual pattern specified by the characteristic detection rule was found in the electronic communication) [0009][0075][0127]).
Re. claim 56, Castilho discloses the method of claim, 1, further comprising an act of: identifying the plurality of input patten, at least in part by identifying one or more input patterns that each trigger at least one symbolic rule in the at least one policy (Castilho discloses characteristic detection rules 234 may comprise a rule, logic, or code that is configurable to detect a characteristic of at least a portion of an electronic communication. Each description, also known as a rule, consists of a set of strings and a Boolean expression which determines its logic [0098][0102][0123-0124]. The execution of the compiled rule set returns the tags, the name, and the metadata for each of the characteristic detection rules in the rule set that matched against the electronic communication (such as for which the binary or textual pattern specified by the characteristic detection rule was found in the electronic communication) [0009]. Characteristic detection rule creation service 210 is configured to receive input from IT administrator 240 and/or company administrator 242 and may create characteristic detection rules that are associated with a specific organization and may store organization specific characteristic detection rules in characteristic detection rules storage 222a [0073]. A characteristic detection rule may be configured to detect and Eicar pattern in some part or all of an electronic communication [0128] Fig. 3 and Table 1 shows a symbolic rule).
Re. claim 57, rejection of claim 46 is included and claim 57 is rejected with the same rationale as applied in claim 56 above.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 4-8 and 49-53 are rejected under 35 U.S.C. 103 as being unpatentable over Castilho et al. (US 20200195664, hereinafter Castilho) in view of Dehon et al. (US 20190213322, hereinafter Dehon).
Re. claim 4, Castilho discloses the method of claim 3, Castilho does not explicitly teach but Dehon teaches wherein: the condition indicates that the second variable matches a first expression comprising applying a selected hash function to a second expression comprising the first variable (Dehon teaches decrypting the signature with the owner's/signer's public key to obtain an expected digest or hash, and comparing the computed digest with the decrypted expected digest or hash. Matching digests confirms the message has not been modified since it was signed by the owner [0398]).
Therefore, it would have been obvious to one or ordinary skill in the art before the effective filing date of the claimed invention to modify the method and system disclosed by Castilho to include the condition indicates that the second variable matches a first expression comprising applying a selected hash function to a second expression comprising the first variable as disclosed by Dehon. One of ordinary skill in the art would have been motivated for the purpose of improving security, by disclosing if the information was modified (Dehon [0398]).
Re. claim 5, the combination of Castilho-Dehon teach the method of claim 4, Castilho does not explicitly teach but Dehon teaches wherein: the method further comprises an act of storing an entry for a concrete rule having the at least one input pattern in a rule cache; and the entry comprises at least a portion of the respective value of the second variable (Dehon teaches the concrete rules stored in the rule cache. Concrete rules with concrete instances of symbolic Rule (3) above in the PUMP rule cache for c=23 and c=24. Encodes⊥ as 0 and marks don't care fields as 0 [0198]. The PUMP simulator 28 allows captures the access patterns in the PUMP 10 rule caches [0131]).
Therefore, it would have been obvious to one or ordinary skill in the art before the effective filing date of the claimed invention to modify the method and system disclosed by Castilho to include the method further comprises an act of storing an entry for a concrete rule having the at least one input pattern in a rule cache; and the entry comprises at least a portion of the respective value of the second variable as disclosed by Dehon. One of ordinary skill in the art would have been motivated for the purpose of improving security, reduce area and energy (Dehon [0143]).
Re. claim 6, the combination of Castilho-Dehon teach the method of claim 5, Castilho does not explicitly teach but Dehon teaches wherein: the rule cache comprises a Level 1 (L1) cache and a Level 2 (L2) cache (Dehon teaches L1 and L2 rule cache [0129]); the L1 cache has an address space that is smaller than an address space of the L2 cache; the entry comprises a first entry (Dehon teaches the example 430 includes process P1 having address space 434 and process P2 having address space 436. Element 434 may denote the virtual memory process address space or range 0 through MAX, where MAX denotes the maximum virtual memory address used by P1 and 0 denotes the minimum virtual address used by P1 [0305][0129]); the method further comprises acts of: obtaining a first address based on the respective value of the second variable (Dehon teaches the example 430 includes process P1 having address space 434 and process P2 having address space 436. Element 434 may denote the virtual memory process address space or range 0 through MAX, where MAX denotes the maximum virtual memory address used by P1 and 0 denotes the minimum virtual address used by P1 [0305][0129]), wherein the first entry is stored at a first address in the L1 cache; obtaining a second address based on the respective value of the second variable; and storing a second entry for the concrete rule at the second address in the L2 cache (Dehon teaches the parameters for 1024-entry L1 and 4096-entry L2 rule caches [0129]).
Therefore, it would have been obvious to one or ordinary skill in the art before the effective filing date of the claimed invention to modify the method and system disclosed by Castilho to include the rule cache comprises a Level 1 (L1) cache and a Level 2 (L2) cache; the L1 cache has an address space that is smaller than an address space of the L2 cache; the entry comprises a first entry; the method further comprises acts of: obtaining a first address based on the respective value of the second variable, wherein the first entry is stored at a first address in the L1 cache; obtaining a second address based on the respective value of the second variable; and storing a second entry for the concrete rule at the second address in the L2 cache as disclosed by Dehon. One of ordinary skill in the art would have been motivated for the purpose of improving security, reduce area and energy (Dehon [0143]).
Re. claim 7, Castilho discloses the method of claim 2, wherein: the variable corresponding to the at least one metadata label comprises a first variable; the plurality of variables further comprise a plurality of second variables; the constraint comprises a first constraint (Castilho discloses a plurality of characteristic detection rules, to be applied against an electronic communication to detect characteristics. A combination rule may be selected from system combination rules [0096][0103]. If the textual or binary pattern of the YARA rule is found in the message, then the properties of the YARA rule (e.g., the name, metadata, or tags of the YARA rule) are returned in response to the call [0005][0102], the rule containing first and second variable).
Castilho does not explicitly teach but Dehon teaches the plurality of variables are solved further subject to a second constraint indicating that the plurality of second variables have pairwise distinct values (Dehon teaches the new rule may identify a transfer of control from the source and target and may be included in a first set of learned rules 604. At the end of program execution, the first set of learned rules 604 includes a rule for each different transfer of control that occurred at runtime [0382]. Execution may be performed for the program using many different data sets to learn what may be considered average or normal program behavior [0392]).
Therefore, it would have been obvious to one or ordinary skill in the art before the effective filing date of the claimed invention to modify the method and system disclosed by Castilho to include the plurality of variables are solved further subject to a second constraint indicating that the plurality of second variables have pairwise distinct values as disclosed by Dehon. One of ordinary skill in the art would have been motivated for the purpose of improving security, reduce area and energy (Dehon [0143]).
Re. claim 8, Castilho discloses the method of claim 2, wherein: the input pattern comprises a first input pattern (Castilho discloses characteristic detection rules 234 may comprise a rule, logic, or code that is configurable to detect a characteristic of at least a portion of an electronic communication [0098][0102][0123-0124] Fig. 3); the method further comprises identifying a second input pattern that is not part of the plurality of input patterns (Castilho discloses Combination rule computational service 207 may output the binary result (e.g., yes it matches, or not it doesn't match) of the evaluation of a combination rule to classification service 208 [0070]); the metadata label comprises a first metadata label; the second input pattern comprises a second metadata label (Castilho discloses classification score service 209 may assign a higher severity score to an electronic communication that produces a match against more than one of the compiled rule sets executed against that communication, as compared to an electronic communication that produced a match against only one of the compiled rule sets executed against that communication. In examples, classification score service 209 may assign a higher severity score to an electronic communication that produces a match against one part of an electronic communication, as compared to a different part of an electronic communication [0072]); the variable comprises a first variable; the plurality of variables further comprise a second variable corresponding to the second metadata label; the plurality of variables further comprise a plurality of third variables; the constraint comprises a first constraint; (Castilho discloses YARA rules allow the creation of descriptions of malware families based on textual or binary patterns [0097-0098]. Combination rule computational service 207 may output the binary result (e.g., yes it matches, or not it doesn't match) of the evaluation of a combination rule to classification service [0070][0106][0109][0117][0127] Fig. 3, obtaining “0” or “1” of the detected characteristics based on the rules).
Castilho does not explicitly teach but Dehon teaches the plurality of variables are solved further subject to a second constraint indicating that none of the plurality of second variables matches a first expression comprising applying a selected hash function to a second expression comprising the second variable (Dehon teaches decrypting the signature with the owner's/signer's public key to obtain an expected digest or hash, and comparing the computed digest with the decrypted expected digest or hash. Matching digests confirms the message has not been modified since it was signed by the owner [0398]).
Therefore, it would have been obvious to one or ordinary skill in the art before the effective filing date of the claimed invention to modify the method and system disclosed by Castilho to include the plurality of variables are solved further subject to a second constraint indicating that none of the plurality of second variables matches a first expression comprising applying a selected hash function to a second expression comprising the second variable as disclosed by Dehon. One of ordinary skill in the art would have been motivated for the purpose of improving security, reduce area and energy (Dehon [0143]).
Re. claim 49, rejection of claim 48 is included and claim 49 is rejected with the same rationale as applied in claim 4 above.
Re. claim 50, rejection of claim 49 is included and claim 50 is rejected with the same rationale as applied in claim 5 above.
Re. claim 51, rejection of claim 50 is included and claim 51 is rejected with the same rationale as applied in claim 6 above.
Re. claim 52, rejection of claim 47 is included and claim 52 is rejected with the same rationale as applied in claim 7 above.
Re. claim 53, rejection of claim 47 is included and claim 53 is rejected with the same rationale as applied in claim 8 above.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. Rubakha (US 20160182531) discloses the IVE may also contain binary analysis tools to analyze an input binary to identify and tag portions that receive user input, so that in a binary translation, those portions can be run within the enclave.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to KEVIN A AYALA whose telephone number is (571)270-3912. The examiner can normally be reached Monday-Thursday 8AM-5PM; Friday: Variable EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jorge Ortiz-Criado can be reached on 571-272-7624. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/KEVIN AYALA/Primary Examiner, Art Unit 2496
Prosecution Insights