DETAILED ACTION
Office Action Summary
Claims 1-20 are pending in the instant application.
Claims 1-20 are rejected under 35 USC § 103.
Applicant’s arguments filed 7/27/2027 have been considered but are moot based on new grounds of rejection found upon further search and consideration and necessitated by applicant’s amendments which change the scope of the instant invention.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent may not be obtained though the invention is not identically disclosed or described as set forth in section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are such that the subject matter as a whole would have been obvious at the time the invention was made to a person having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the manner in which the invention was made.
Claims 1-20 rejected under 35 U.S.C. 103 as being unpatentable over McGee et al. (US Patent No: 6,694,434) hereinafter referred to as McGee in view of van de Ven et al. (US Pre-Grant Publication No: 2007/0006147) hereinafter referred to as Ven.
As per claim 1, McGee teaches … generating a caller list of a plurality of callers that issue requests for calling a designated program at runtime; (McGee, figure 3A, item 52, and associated text, each application is checked to see if call permitted each application is a list of at least one item)
generating an authorized caller list of authorized callers allowed to call the designated program, wherein the authorized callers are selected from among the plurality of callers on the caller list; and (McGee, figure 3A, item 62 and 88, and associated text teaches checking to see if application is on the list of authorized application or whether it needs to be added to the list, this authorized list is created from the lists of callers who should be authorized)
generating an authorization key for each of the authorized callers that the designated program will require as a condition for completing call requests. (McGee, figure 3B, item 68 and 70, and associated text, teaches generating application data compares the data, this data is the authorization key, since the claimed key is a key generated but not used as a key for decryption any identifier is a key)
but Mcgee does not explicitly teach designating, by a user, a program to be audited and wherein the designated program is the program being audited;
however, Ven [0034] teaches a user initiates the audit by selecting the program code and submitting it to the auditing tool;
It would have been obvious to one having ordinary skill in the art, before the effective filing of the claimed invention to modify the invention of McGee with the method of Ven because it is substituting one method of auditing a program with giving the user the ability to select which program to be audited saving time instead of auditing potentially all programs.
As per claim 2, McGee in view of Ven teaches … wherein the designated program is an executable application. (McGee, column 5, lines 49-51, teaches multiple executable files)
As per claim 3, McGee in view of Ven teaches … wherein the designated program is a shared library file. (McGee, column 13 lines 54 through 57)
As per claim 4, McGee in view of Ven teaches … wherein the generating of the caller list comprises analyzing the designated program with dynamic analysis resulting in a preliminary caller list of detected callers that issue requests for calling the designated program during the dynamic analysis. (McGee, figure 3A, item 52, and associated text, each application is checked to see if call permitted each application is a list of at least one item and it is being done dynamically)
As per claim 5, McGee in view of Ven teaches … wherein the generating of the caller list comprises: generating a candidate caller list by comparing available programs to detected callers on the caller list and identifying, as candidate callers, the available programs that have a previously designated characteristic in common with at least one detected caller on the preliminary caller list. (McGee, figure 3A, item 62 and 88, and associated text teaches checking to see if application is on the list of authorized application or whether it needs to be added to the list, this authorized list is created from the lists of callers who should be authorized, the caller application is compared to existing list of authorized callers and if not on list determined if it should be added)
As per claim 6, McGee in view of Ven teaches … wherein the previously designated characteristic is selected from the group consisting of a security policy, a business relevance, a same path, a same library, and a same dataset. (McGee, column 4, lines 1-18, teaches authorization could be per account so programs from same account would have that similarity)
As per claim 7, McGee in view of Ven teaches … wherein the generating of the caller list comprises: analyzing the candidate callers on the candidate caller list with static analysis resulting in a supplemental caller list of candidate callers that are configured to call the designated program. McGee, figure 3A, item 62 and 88, and associated text teaches checking to see if application is on the list of authorized application or whether it needs to be added to the list, final list is a static list if programs are all analyzed)
As per claim 8, McGee in view of Ven teaches … wherein the caller list comprises the preliminary caller list combined with the supplemental caller list. McGee, figure 3A, item 62 and 88, and associated text teaches checking to see if application is on the list of authorized application or whether it needs to be added to the list, the lists keeps mutating therefor the lists till the final list are the supplemental lists.)
As per claim 9, McGee in view of Ven teaches … blocking call requests to the designated program from callers that lack the authorization key. (McGee, column 4, line 56)
As per claim 10, McGee in view of Ven teaches … further comprising: requiring, by the designated program, a memory address of a save location of a caller as a condition for completing call requests. (McGee, column 5, lines 49-51, teaches location of executable file)
Claims 11-16 teach a computer readable storage medium that correspond to the method claims 1-10 and are rejected using the same rational. (Also [0112] of instant application, teaches that the medium is non-transitory)
Claims 11-16 teach a computer system that correspond to the method claims 1-10 and are rejected using the same rational.
Other Art of Record
Bello et al. (US 20170169212 A1) teaches “Abstract: A method (and structure) for enforcing a security policy includes retrieving from a memory a program to be verified against a security policy and a security specification defining the security policy. A static program analysis is performed on the program, using a processor on a computer, to determine whether the program is compatible with the security specification. The program is rejected if the program is determined by the static program analysis as being incompatible with the security specification. If the program is determined during the static program analysis as compatible with the security specification under static analysis criteria, then building a call-graph representation of the program for use to evaluate any dynamically-loaded code during an execution of the program. Any paths, if any, of the call-graph representation that reach at least one policy-relevant operation is marked.”
Lawson (US 9720925 B1) teaches “Abstract: Similarity analysis of software is disclosed. An input file is received. Pairs of files that consist of the input file and files included in a corpus are categorized into one of a possible match and a mismatch. Those pairs classified as possible matches are analyzed using a pairwise component analysis.”
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SIMON P KANAAN whose telephone number is (571)270-3906. The examiner can normally be reached on M-F (7AM-4PM).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Catherine Thiaw can be reached on (571) 270-1138. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SIMON P KANAAN/Primary Examiner, Art Unit 2407
Prosecution Insights