DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
The present office action is responsive to communication filed on 04/28/2026. Claims 1, 8, and 15 have been amended. Claims 2,9, and 16 has previously been cancelled. Claims 1, 3-8, 10-15, and 17-20 are currently pending.
Applicant’s arguments filed on 04/28/2026, with respect to the rejections of claims 1-5, 8-12, and 15-19 under 35 USC 103 over Singh et al. (US PGPub No. 20200278948-A1) in view of Degioanni et al. (US PGPub No. 20160373327-A1), Kim et al. (US PGPub No. 20230156018-A1), Onoue et al. (US PGPub No. 20230133971-A1), and Bivans et al. (US PGPub No. 20230351010-A1) with the amended limitations, as seen in pages 10-14, of the Remarks, are met have been fully considered and are persuasive. Therefore, the rejection have been withdrawn. However, upon further consideration, a new grounds of rejection of is made in view of Halim et al. (A lightweight binary authentication system for windows. In IFIP International Conference on Trust Management (pp. 295-310). Boston, MA: Springer US. (Year: 2008)).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claims 1, 3, 4, 5, 8, 10, 11, 12, 15, 17,18, and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Singh et al. (US PGPub No. 20200278948-A1) in view of Degioanni et al. (US PGPub No. 20160373327-A1), Kim et al. (US PGPub No. 20230156018-A1), Halim et al. (A lightweight binary authentication system for windows. In IFIP International Conference on Trust Management (pp. 295-310). Boston, MA: Springer US. (Year: 2008)), and Bivans et al. (US PGPub No. 20230351010-A1).
With respect to claim 1, Singh teaches a method comprising: (¶0081: The one or more programs may be configured to implement the various processes, algorithms, methods, techniques, etc. described herein.).
acquiring, at a first time using one or more programs executing in a kernel space of an operating system, (¶0012: The host can be a user device having an agent operating thereon to perform the determining. The host can be any of a server, virtual machine, and a container. The cloud service can include microsegmentation of the host. The cloud service can be configured to match a unique identifier of the host of host with the fingerprint for the enrollment and management. The plurality of hardware parameters can be obtained through any of assembly code and operating system. ¶0249: The agent, residing partially in the kernel, hooks into attempts to send and read from the network. The agent can send related information to the cloud-based system, so we can understand what’s happening on the network; also, after policies have started being enforced, the agent receives those policies and then can prevent other apps from sending and receiving from certain other hosts, as the policies direct.).
first fingerprinting data (¶0246: In an embodiment, the network can include cryptographic identity of workloads for identifying communications, authorizing communications, etc. The cryptographic identity is used to verify software and / or machine identity, i.e., the identity of the application and the identity of the devices, hosts. The cryptographic identity can be referred to as a device or application fingerprint. Importantly, the cryptographic identity is based on multiple characteristics to ensure unique identification and prevent spoofing. As seen in Table 11 (below ¶0246) shows the cryptographic identity can be based on process identifiers.) associated with a target application process in a user space of the operating system responsive to detecting an execution of the target application process, (¶0247: Also, the cryptographic identity can include values based on Software Reputation, Behavioral Scoring, Capabilities, and the like. Figure 25 the block diagram of two systems communicating to one another and their example cryptographic identities, i.e., fingerprints);
sharing, by a processing device (¶0077: As seen in Figure 2, the data inspection engines 116, processing node manager 118, authority node manager 128, user interface manager 132, logging node manager 148, and authority agent 180 may be realized by instructions that upon execution cause one or more processing devices to carry out the processes and functions described above.) using the one or more programs, the first fingerprinting data with a user space monitoring application executing in the user space of the operating system; (¶0251: In this manner, the various fingerprinting techniques described herein can be used to uniquely identify a host on which the agent (application 600 as seen in Figure 6) is operating on, and this unique fingerprint can be used by cloud-shared by the cloud-based system 100 (sharing) , as seen in Figure 1, to manage the device, assign policy, and the like).
Singh does not disclose:
the first fingerprinting data comprising mount namespace information associated with the target application process with a first mount namespace;
However, Degioanni teaches the first fingerprinting data comprising mount namespace information associated with the target application process with a first mount namespace; (¶053-0054: As seen in Figure 1, first namespace(s) 102 constrains first application process 104. Example namespaces includes process identifier (PID) namespaces, network namespaces, and mount namespaces. First programmatic container 100 includes first namespace(s) 102. Thus, if first namespace(s) 102 includes a PID namespace and first programmatic container 100 is migrated, then first application program process 104 continues to be referenced as PID 1).
It would have been obvious, before the effective filing date, to modify Singh’s fingerprinting method to substitute and/or augment Singh’s fingerprint fields (e.g., process identifiers and other fingerprint attributes) with Degioanni’s mount namespace identifier, such that the first fingerprinting data includes mount namespace information associating the target application process with a first mount namespace, because both process identifiers and namespace identifiers were known in the art as process-context identifiers and a person of ordinary skill would have recognized that using a mount namespace identifier in the fingerprint is a predictable variation that improves the precision and efficiency of monitoring containerized applications and their execution environments (Degioanni ¶0007).
Singh in view of Degioanni does not disclose:
acquiring, by the user space monitoring application, second fingerprinting data associated with the target application process at a second time;
determining, using the user space monitoring application, a validity of the hash value based on the fingerprinting data by comparing the first fingerprint data with the second fingerprint data,
However, Kim teaches acquiring, by the user space monitoring application, second fingerprinting data associated with the target application process at a second time; (¶0083: The derived electronic file generation apparatus 300 may generate a second identifier for a device together with a derived electronic fingerprint of a derived electronic file, and transmit the second identifier together with the derived electronic fingerprint to the electronic fingerprint management apparatus 100. The electronic fingerprint management apparatus 100 may receive the derived electronic fingerprint and the second identifier, and store the derived electronic fingerprint and the second identifier in the memory unit RM to be mapped to each other.).
determining, using the user space monitoring application, a validity of the hash value based on the fingerprinting data by comparing the first fingerprint data with the second fingerprint data, (¶0095: For example, when the electronic file linked to the electronic fingerprint management apparatus 100 is an electronic file of a contract image, whether the authenticity of the contract image of the linked electronic file may be quickly verified by generating a hash value of the contract image and comparing the hash value with that stored in the electronic fingerprint management apparatus 100.).
It would have been obvious, before the effective filing date, to modify Singh in view of Degioanni such that the user-space monitoring application acquires second fingerprinting data associated with the same target application at a later time and determines a validity of a hash value by comparing the first and second fingerprinting data, as taught by Kim, to yield the predictable result of verifying the authenticity and integrity of the monitored application file using a known re-fingerprinting and comparison technique applied to the application files monitored in the Singh–Degioanni system.
Singh in view of Degioanni and Kim does not disclose:
generating a hash value of a target application file associated with the target association with the target application process by accessing a mapping between the first mount namespace and one or more process identifiers maintained in a shared memory by a mount namespace tracking program executing in the kernel space
switching the user space monitoring application to the first mount namespace based on the mount namespace information and a process identifier from the mapping, and the accessing the target application file in the first mount namespace; and
However, Halim teaches generating a hash value of a target application file associated with the target association with the target application process by accessing a mapping between the first mount namespace and one or more process identifiers maintained in a shared memory by a mount namespace tracking program executing in the kernel space (4.2.2 Verifier, Page 297-298: The core data structure of the Verifier component can be viewed as a table of tuples in the form ⟨Kernel path, FileID, MAC, Authenticated bit⟩ representing the allowed binaries. It is indexed on Kernel path and FileID for fast lookup… • The Kernel path is Windows kernel (internal) pathname representation of a file. In Window’s user space, a file can have multiple absolute pathnames, due to: (i) 8.3 file naming format, e.g. “C:\Program Files\” and “C:\progra∼1\ ” are the same; (ii) symbolic links (reparse points is similar); (iii) hard links; (iv) volume mount points; or (v) the SUBST and APPEND DOS commands. The Kernel path is a unique representation for all the possible pathnames. When the system loads ⟨path name, software digest⟩ from Digest file during the startup, path name is converted to Kernel path since all subsequent checks by Verifier in the kernel all use the latter…The MAC is same as a software digest entry in Digest file. Our prototype implements the HMAC-MD5 [4], HMAC-SHA-1 and HMAC-SHA-256 [16] hash algorithms (generating hash value based on mapping). );
switching the user space monitoring application to the first mount namespace based on the mount namespace information and a process identifier from the mapping, and the accessing the target application file in the first mount namespace; and (4.2.2 Verifier, Page 299: The cached MAC verifier needs to ensure that binaries which have been already authenticated are not modified. However, the uncached verifier will not need to perform file monitoring. A binary with pathname P is considered modified, if the following occurs: • P is created: Hence, we monitor system call NtCreateFile() and NtOpenFile(). • P is opened with write access mode: the previous two system calls are also intercepted for this purpose. • Another file is renamed to P: We monitor file renaming(NtSetInformation File(FileRenameInformation)) system call. •A drive containing P is mounted: We monitor drive mounting IRP_MJ_VOLUME-MOUNT. Upon modification of P, we reset the Authenticated bit of binary P, and update the FileID in the table if it is changed. Should FAT file system be used, pathname is used to identify the binary as FileID is not supported but neither are hard and soft links. Since FileID is optional and can be removed, we monitor FileID removal (NtFsControlFile(FSCTL_DELETE_OBJECT_ID)) (processor identifier) and deny the removal if the FileID is in the table.);
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention utilize the teachings of Halim with regards to using the mapping of process identifier and mount namespace to calculate hash value to the method of Singh in view of Degioanni and Kim in order to prevent TOCTTOU (Time-Of-Check-Time-Of-Use) and increase kernel protection (Halim 1 Introduction Page 291 & 4.3 Security Analysis Page 301).
Singh in view of Degioanni, Kim, and Halim does not disclose:
wherein the validity of the hash value indicates whether the hash value is a correct representation of instructions executing in the target application process.
However, Bivans teaches wherein the validity of the hash value indicates whether the hash value is a correct representation of instructions executing in the target application process. (¶0152: Additionally or alternatively, the security agent can access a configuration profile defining a security policy defining a periodic verification of an application—based on other validation information, such as a cryptographic hash value, associated with a valid set of instructions representing the application—at the predefined time interval (or another time interval) during runtime execution of the application. The security agent can: periodically calculate a value based on a cryptographic hash of the application; and execute the action in response to detecting a difference between the value and the cryptographic hash value.)
It would have been obvious to a person having ordinary skill in the art, before the effective filing date, to modify the combined teaching of Singh in view of Degioanni, Kim, and Halim by further configuring the user-space monitoring application to interpret the result of the comparison between the first and second fingerprinting data (including the generated hash value) as an indication of whether the hash value corresponds to a valid set of instructions for the monitored application, as taught by Bivans’ use of a cryptographic hash associated with a valid set of application instructions for runtime verification, thereby applying a known hash-based code-validation technique to the monitored application in the Singh–Degioanni–Kim–Halim system according to known methods to yield the predictable result of detecting when the executing application’s instructions deviate from the expected valid instructions so as to prevent access violations and mitigate security vulnerabilities.
With respect to claim 3, the combination of Singh in view of Degioanni, Kim, Halim, and Bivans teaches method of claim 1 (see rejection of claim 1 above), wherein determining the validity of the hash value is based on a comparison of elements of the first fingerprinting data acquired at the first time with corresponding elements of the second fingerprinting data acquired at the second time. (Kim: ¶0013: Here, the original electronic fingerprint may include a first original electronic fingerprint generated by the original electronic file generation apparatus during the generation of the original electronic file, and a second original electronic fingerprint generated when the original electronic file generated by the original electronic file generation apparatus is changed or deleted. And as further demonstrated ¶0131 and Figure 5, when receiving the image copy authenticity verification request (S690), the electronic fingerprint managing apparatus generates an image hash value and image meta information regarding the image copy received from the court server and searches for the presence of the same image on the basis of the image hash value and image meta information stored in a database (S700, S710). The electronic fingerprint managing apparatus determines the authenticity of the image on the basis of whether the same image hash value as the image copy exists and transmits a result thereof to the court server (S720).).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention utilize the teachings of Kim with regards to validity of hash value to the method of Singh in view of Degioanni, Halim, and Bivans in order to ensure confidence in verification of the authenticity and integrity of data and effectively prevent illegal, alteration, and use of data thereby ensuring objective and transparent of confidential information (Kim ¶0023).
With respect to claim 4, the combination of Singh in view of Degioanni, Kim, Halim, and Bivans teaches method of claim 1 (see rejection of claim 1 above), wherein the first fingerprinting data comprises at least one of: a file change time indicating when file contents of the target application file are changed; a device identifier (Singh: ¶0066: Such instances may include, for example, whether a given file has been virus scanned, whether content at a given URL has been scanned for inappropriate (e.g., pornographic) content, whether a given fingerprint matches any of a set of stored documents, and whether a checksum corresponds to any of a set of stored documents. ¶0129: The mobile admin (agent management cloud 606) performs inventory lookup with device fingerprints at the MDM server to authorize the user and the device 604 (step 806) as seen in Figure 16. Singh: ¶0246: The cryptographic identity is used to verify software and/or machine identity, i.e., the identity of the applications and the identity of the devices, hosts.) indicating a storage location of the target application file; a file inode number of the target application file; or a device mount count indicating a number of times a storage device with the device identifier was changed. (Kim ¶0127-0129:As seen in Figure 5, the image information processor generates and stores one or more image files (S620). When an image file is generated by the image information processor, an image hash value and additional information, including but not limited to, an image storing path, device identification information (IP address, MAC address, model name, installation apparatus, installation purpose) and image meta information (hash value generation date and time, and generation date and time, name, type, size, and generation coordinates of the image file) are generated together (S630). The image hash value may be transmitted together with at least one from the group consisting of an image storing path, device identification information, and image meta information.).
Although Singh does mention the fingerprinting data being correlated to the device identifier indicating an inventory and target application (the implication of use in ¶0066 & 0129) , but Singh does not explicitly disclose that the device identifier indicating a storage location of the target application file. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention utilize the teachings of Kim with regards to second fingerprinting data to the method of Degioanni, Halim, and Bivans in order to maintain protection while verifying authenticity and integrity of newly introduced data (Kim ¶0002).
With respect to claim 5, the combination of Singh in view of Degioanni, Kim, Halim, and Bivans teaches the method of claim 4 (see rejection of claim 4 above),further comprising: executing a second program of the one or more programs in the kernel space of the operating system (Singh: ¶0139-0141: Specifically, FIG. 19 illustrates activity between the client applications 864, the TUN interface 852, a UDP listening socket 862, a VPN listening socket 864, and the VPN/broker server 860. First, the client application 854 sends a DNS query for an internal domain (step 902). The TUN interface 852 receives the IP packet corresponding to the DNS request and changes the packet's destination to the UDP listening socket 862 and writes the packet back (step 904).) to maintain the device mount count indicating the number of times the storage device with the device identifier was changed. (Singh: ¶0146-0147: The client application listens for security critical events such as Operating System (OS) upgrades, abrupt geolocation changes, device information deviation, and changes in the installed application list, and updates the cloud-based security system. The cloud-based security system evaluates the changes and computes a new risk index for the device. Specifically, the cloud-based security system creates a device fingerprint and a risk index for the mobile device based on the nature of applications installed on the system, operating system vulnerabilities, anti-virus status, patch level, device configuration, and the like (maintain the device mount count indicating the number of times the storage device with the device identifier was changed) . As seen in Figure 21, the multidimensional risk profiling process 1000 includes threat data management where the cloud-based security system collects information related to threats (step 1010)).
With respect to claim 8, Singh teaches a system comprising: (¶0012-0013: In various embodiments, the present disclosure relates to systems and methods for fingerprinting to identify devices and applications for use in management and policy in the cloud.) memory; and a processing device, operatively coupled to the memory, to: (¶0017-0018: In another embodiment, a cloud node in a cloud-based security system, configured to provide network access control of a mobile device based on multidimensional risk profiling includes a network interface, a data store, and a processor communicatively coupled to one another; and memory storing computer executable instructions, and in response to execution by the processor, the computer-executable instructions cause the processor to receive posture data from the mobile device;).
acquire, at a first time using one or more programs executing in a kernel space of an operating system, (¶0012: The host can be a user device having an agent operating thereon to perform the determining. The host can be any of a server, virtual machine, and a container. The cloud service can include microsegmentation of the host. The cloud service can be configured to match a unique identifier of the host of host with the fingerprint for the enrollment and management. The plurality of hardware parameters can be obtained through any of assembly code and operating system. ¶0249: The agent, residing partially in the kernel, hooks into attempts to send and read from the network. The agent can send related information to the cloud-based system, so we can understand what’s happening on the network; also, after policies have started being enforced, the agent receives those policies and then can prevent other apps from sending and receiving from certain other hosts, as the policies direct.).
first fingerprinting data (¶0246: In an embodiment the network can include cryptographic identity of workloads for identifying communications, authorizing communications, etc. The cryptographic identity is used to verify software and / or machine identity, i.e., the identity of the application and the identity of the devices, hosts. The cryptographic identity can be referred to as a device or application fingerprint. Importantly, the cryptographic identity is based on multiple characteristics to ensure unique identification and prevent spoofing. As seen in Table 11 (below ¶0246) shows the cryptographic identity can be based on process identifiers.) associated with a target application process in a user space of the operating system responsive to detecting an execution of the target application process, (¶0247: Also, the cryptographic identity can include values based on Software Reputation, Behavioral Scoring, Capabilities, and the like. Figure 25 the block diagram of two systems communicating to one another and their example cryptographic identities, i.e., fingerprints).
share, using the one or more programs, (¶0077: As seen in Figure 2, the data inspection engines 116, processing node manager 118, authority node manager 128, user interface manager 132, logging node manager 148, and authority agent 180 may be realized by instructions that upon execution cause one or more processing devices to carry out the processes and functions described above.) the first fingerprinting data with a user space monitoring application executing in the user space of the operating system; (¶0251: In this manner, the various fingerprinting techniques described herein can be used to uniquely identify a host on which the agent (application 600 as seen in Figure 6) is operating on, and this unique fingerprint can be used by cloud-shared by the cloud-based system 100 (sharing) , as seen in Figure 1, to manage the device, assign policy, and the like).
Singh does not disclose:
the first fingerprinting data comprising mount namespace information associating the target application process with a first mount namespace;
However, Degioanni teaches:
the first fingerprinting data comprising mount namespace information associated with the target application process with a first mount namespace; (¶053-0054: As seen in Figure 1, first namespace(s) 102 constrains first application process 104. Example namespaces includes process identifier (PID) namespaces, network namespaces, and mount namespaces. First programmatic container 100 includes first namespace(s) 102. Thus, if first namespace(s) 102 includes a PID namespace and first programmatic container 100 is migrated, then first application program process 104 continues to be referenced as PID 1);
It would have been obvious, before the effective filing date, to modify Singh’s fingerprinting method to substitute and/or augment Singh’s fingerprint fields (e.g., process identifiers and other fingerprint attributes) with Degioanni’s mount namespace identifier, such that the first fingerprinting data includes mount namespace information associating the target application process with a first mount namespace, because both process identifiers and namespace identifiers were known in the art as process-context identifiers and a person of ordinary skill would have recognized that using a mount namespace identifier in the fingerprint is a predictable variation that improves the precision and efficiency of monitoring containerized applications and their execution environments (Degioanni ¶0007).
Singh in view of Degioanni does not disclose:
acquire, by the user space monitoring application, second fingerprinting data associated with the target application process at a second time; and
determine, using the user space monitoring application, a validity of the hash value based on the fingerprinting data by comparing the first fingerprint data with the second fingerprint data,
However, Kim teaches:
acquire, by the user space monitoring application, second fingerprinting data associated with the target application process at a second time; (¶0083: The derived electronic file generation apparatus 300 may generate a second identifier for a device together with a derived electronic fingerprint of a derived electronic file, and transmit the second identifier together with the derived electronic fingerprint to the electronic fingerprint management apparatus 100. The electronic fingerprint management apparatus 100 may receive the derived electronic fingerprint and the second identifier, and store the derived electronic fingerprint and the second identifier in the memory unit RM to be mapped to each other.).
and determine, using the user space monitoring application, a validity of the hash value based on the fingerprinting data by comparing the first fingerprint data with the second fingerprint data, (¶0095: For example, when the electronic file linked to the electronic fingerprint management apparatus 100 is an electronic file of a contract image, whether the authenticity of the contract image of the linked electronic file may be quickly verified by generating a hash value of the contract image and comparing the hash value with that stored in the electronic fingerprint management apparatus 100.).
It would have been obvious, before the effective filing date, to modify Singh in view of Degioanni such that the user-space monitoring application acquires second fingerprinting data associated with the same target application at a later time and determines a validity of a hash value by comparing the first and second fingerprinting data, as taught by Kim, to yield the predictable result of verifying the authenticity and integrity of the monitored application file using a known re-fingerprinting and comparison technique applied to the application files monitored in the Singh–Degioanni system.
Singh in view of Degioanni and Kim does not disclose:
generate a hash value of a target application file associated with the target application process by accessing a mapping between the first mount namespace and one or more process identifiers maintained in a shared memory by a mount namespace tracking program executing in the kernel space
However, Halim teaches by accessing a mapping between the first mount namespace and one or more process identifiers maintained in a shared memory by a mount namespace tracking program executing in the kernel space (4.2.2 Verifier, Page 297-298: The core data structure of the Verifier component can be viewed as a table of tuples in the form ⟨Kernel path, FileID, MAC, Authenticated bit⟩ representing the allowed binaries. It is indexed on Kernel path and FileID for fast lookup… • The Kernel path is Windows kernel (internal) pathname representation of a file. In Window’s user space, a file can have multiple absolute pathnames, due to: (i) 8.3 file naming format, e.g. “C:\Program Files\” and “C:\progra∼1\ ” are the same; (ii) symbolic links (reparse points is similar); (iii) hard links; (iv) volume mount points; or (v) the SUBST and APPEND DOS commands. The Kernel path is a unique representation for all the possible pathnames. When the system loads ⟨path name, software digest⟩ from Digest file during the startup, path name is converted to Kernel path since all subsequent checks by Verifier in the kernel all use the latter…The MAC is same as a software digest entry in Digest file. Our prototype implements the HMAC-MD5 [4], HMAC-SHA-1 and HMAC-SHA-256 [16] hash algorithms (generating hash value based on mapping). );
switch the user space monitoring application to the first mount namespace based on the mount namespace information and a process identifier from the mapping, and accessing the target application file in the first mount namespace; and (4.2.2 Verifier, Page 299: The cached MAC verifier needs to ensure that binaries which have been already authenticated are not modified. However, the uncached verifier will not need to perform file monitoring. A binary with pathname P is considered modified, if the following occurs: • P is created: Hence, we monitor system call NtCreateFile() and NtOpenFile(). • P is opened with write access mode: the previous two system calls are also intercepted for this purpose. • Another file is renamed to P: We monitor file renaming(NtSetInformation File(FileRenameInformation)) system call. •A drive containing P is mounted: We monitor drive mounting IRP_MJ_VOLUME-MOUNT. Upon modification of P, we reset the Authenticated bit of binary P, and update the FileID in the table if it is changed. Should FAT file system be used, pathname is used to identify the binary as FileID is not supported but neither are hard and soft links. Since FileID is optional and can be removed, we monitor FileID removal (NtFsControlFile(FSCTL_DELETE_OBJECT_ID)) (processor identifier) and deny the removal if the FileID is in the table.);
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention utilize the teachings of Halim with regards to using the mapping of process identifier and mount namespace to calculate hash value to the method of Singh in view of Degioanni and Kim in order to prevent TOCTTOU (Time-Of-Check-Time-Of-Use) and increase kernel protection (Halim 1 Introduction Page 291 & 4.3 Security Analysis Page 301).
Singh in view of Degioanni, Kim, and Halim does not disclose:
wherein the validity of the hash value indicates whether the hash value is a correct representation of instructions executing in the target application process.
However, Bivans teaches:
wherein the validity of the hash value indicates whether the hash value is a correct representation of instructions executing in the target application process. (¶0152: Additionally or alternatively, the security agent can access a configuration profile defining a security policy defining a periodic verification of an application—based on other validation information, such as a cryptographic hash value, associated with a valid set of instructions representing the application—at the predefined time interval (or another time interval) during runtime execution of the application. The security agent can: periodically calculate a value based on a cryptographic hash of the application; and execute the action in response to detecting a difference between the value and the cryptographic hash value.)
It would have been obvious to a person having ordinary skill in the art, before the effective filing date, to modify the combined teaching of Singh in view of Degioanni, Kim, and Onoue by further configuring the user-space monitoring application to interpret the result of the comparison between the first and second fingerprinting data (including the generated hash value) as an indication of whether the hash value corresponds to a valid set of instructions for the monitored application, as taught by Bivans’ use of a cryptographic hash associated with a valid set of application instructions for runtime verification, thereby applying a known hash-based code-validation technique to the monitored application in the Singh–Degioanni–Kim–Halim system according to known methods to yield the predictable result of detecting when the executing application’s instructions deviate from the expected valid instructions so as to prevent access violations and mitigate security vulnerabilities.
With respect to claim 10, the combination of Singh in view of Degioanni, Kim, Halim, and Bivans teaches system of claim 8 (see rejection of claim 8 above), wherein to determine the validity of the hash value, the processing device is to compare elements of the first fingerprinting data acquired at the first time with corresponding elements of the second fingerprinting data acquired at the second time. (Kim: ¶0013: Here, the original electronic fingerprint may include a first original electronic fingerprint generated by the original electronic file generation apparatus during the generation of the original electronic file, and a second original electronic fingerprint generated when the original electronic file generated by the original electronic file generation apparatus is changed or deleted. And as further demonstrated ¶0131 and Figure 5, when receiving the image copy authenticity verification request (S690), the electronic fingerprint managing apparatus generates an image hash value and image meta information regarding the image copy received from the court server and searches for the presence of the same image on the basis of the image hash value and image meta information stored in a database (S700, S710). The electronic fingerprint managing apparatus determines the authenticity of the image on the basis of whether the same image hash value as the image copy exists and transmits a result thereof to the court server (S720).).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention utilize the teachings of Kim with regards to validity of hash value to the method of Singh in view of Degioanni, Halim, and Bivans in order to ensure confidence in verification of the authenticity and integrity of data and effectively prevent illegal, alteration, and use of data thereby ensuring objective and transparent of confidential information (Kim ¶0023).
With respect to claim 11, the combination of Singh in view of Kim, Degioanni, Halim, and Bivans teaches system of claim 8 (see rejection of claim 8 above), wherein the first fingerprinting data comprises at least one of: a file change time indicating when file contents of the target application file are changed; a device identifier (Singh: ¶0066: Such instances may include, for example, whether a given file has been virus scanned, whether content at a given URL has been scanned for inappropriate (e.g., pornographic) content, whether a given fingerprint matches any of a set of stored documents, and whether a checksum corresponds to any of a set of stored documents. ¶0129: The mobile admin (agent management cloud 606) performs inventory lookup with device fingerprints at the MDM server to authorize the user and the device 604 (step 806) as seen in Figure 16. Singh: ¶0246: The cryptographic identity is used to verify software and/or machine identity, i.e., the identity of the applications and the identity of the devices, hosts.) indicating a storage location of the target application file; a file inode number of the target application file; or a device mount count indicating a number of times a storage device with the device identifier was changed. (Kim ¶0127-0129:As seen in Figure 5, the image information processor generates and stores one or more image files (S620). When an image file is generated by the image information processor, an image hash value and additional information, including but not limited to, an image storing path, device identification information (IP address, MAC address, model name, installation apparatus, installation purpose) and image meta information (hash value generation date and time, and generation date and time, name, type, size, and generation coordinates of the image file) are generated together (S630). The image hash value may be transmitted together with at least one from the group consisting of an image storing path, device identification information, and image meta information.).
Although Singh does mention the fingerprinting data being correlated to the device identifier indicating an inventory and target application (the implication of use in ¶0066 & 0129) , but Singh does not explicitly disclose that the device identifier indicating a storage location of the target application file. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention utilize the teachings of Kim with regards to second fingerprinting data to the method of Singh in view of Degioanni, Halim, and Bivans in order to maintain protection while verifying authenticity and integrity of newly introduced data (Kim ¶0002).
With respect to claim 12, the combination of Singh in view of Degioanni, Kim, Halim, and Bivans teaches system of claim 11 (see rejection of claim 11 above) but does not disclose, wherein the processing device is further to: execute a second program of the one or more programs in the kernel space of the operating system (Singh: ¶0139-0141: Specifically, FIG. 19 illustrates activity between the client applications 864, the TUN interface 852, a UDP listening socket 862, a VPN listening socket 864, and the VPN/broker server 860. First, the client application 854 sends a DNS query for an internal domain (step 902). The TUN interface 852 receives the IP packet corresponding to the DNS request and changes the packet's destination to the UDP listening socket 862 and writes the packet back (step 904).) to maintain the device mount count indicating the number of times the storage device with the device identifier was changed. (Singh: ¶0146-0147: The client application listens for security critical events such as Operating System (OS) upgrades, abrupt geolocation changes, device information deviation, and changes in the installed application list, and updates the cloud-based security system. The cloud-based security system evaluates the changes and computes a new risk index for the device. Specifically, the cloud-based security system creates a device fingerprint and a risk index for the mobile device based on the nature of applications installed on the system, operating system vulnerabilities, anti-virus status, patch level, device configuration, and the like (maintain the device mount count indicating the number of times the storage device with the device identifier was changed) . As seen in Figure 21, the multidimensional risk profiling process 1000 includes threat data management where the cloud-based security system collects information related to threats (step 1010)).
With respect to claim 15, Singh teaches a non-transitory computer-readable storage medium including instructions that, when executed by a processing device, cause the processing device to: (¶0253-0254: Moreover, some embodiments may include a non-transitory computer-readable storage medium having computer readable code stored thereon for programming a computer, server, appliance, device, processor, circuit, etc. each of which may include a processor to perform functions as described and claimed herein. When stored in the non-transitory computer readable medium, software can include instructions executable by a processor or device (e.g., any type of programmable circuitry or logic) that, in response to such execution, cause a processor or the device to perform a set of operations, steps, methods, processes, algorithms, functions, techniques, etc. as described herein for the various embodiments.);
acquire, at a first time using one or more programs executing in a kernel space of an operating system, (¶0012: The host can be a user device having an agent operating thereon to perform the determining. The host can be any of a server, virtual machine, and a container. The cloud service can include microsegmentation of the host. The cloud service can be configured to match a unique identifier of the host of host with the fingerprint for the enrollment and management. The plurality of hardware parameters can be obtained through any of assembly code and operating system. ¶0249: The agent, residing partially in the kernel, hooks into attempts to send and read from the network. The agent can send related information to the cloud-based system, so we can understand what’s happening on the network; also, after policies have started being enforced, the agent receives those policies and then can prevent other apps from sending and receiving from certain other hosts, as the policies direct.) first fingerprinting data (¶0246: In an embodiment the network can include cryptographic identity of workloads for identifying communications, authorizing communications, etc. The cryptographic identity is used to verify software and / or machine identity, i.e., the identity of the application and the identity of the devices, hosts. The cryptographic identity can be referred to as a device or application fingerprint. Importantly, the cryptographic identity is based on multiple characteristics to ensure unique identification and prevent spoofing. As seen in Table 11 (below ¶0246) shows the cryptographic identity can be based on process identifiers.) associated with a target application process in a user space of the operating system responsive to detecting an execution of the target application process, (¶0247: Also, the cryptographic identity can include values based on Software Reputation, Behavioral Scoring, Capabilities, and the like. Figure 25 the block diagram of two systems communicating to one another and their example cryptographic identities, i.e., fingerprints).
share, by the processing device (¶0077: As seen in Figure 2, the data inspection engines 116, processing node manager 118, authority node manager 128, user interface manager 132, logging node manager 148, and authority agent 180 may be realized by instructions that upon execution cause one or more processing devices to carry out the processes and functions described above.) using the one or more programs, the first fingerprinting data with a user space monitoring application executing in the user space of the operating system; (¶0251: In this manner, the various fingerprinting techniques described herein can be used to uniquely identify a host on which the agent (application 600 as seen in Figure 6) is operating on, and this unique fingerprint can be used by cloud-shared by the cloud-based system 100 (sharing) , as seen in Figure 1, to manage the device, assign policy, and the like).
Singh does not disclose:
the first fingerprinting data comprising mount namespace information associating the target application process with a first mount namespace;
However, Degioanni teaches
the first fingerprinting data comprising mount namespace information associated with the target application process with a first mount namespace; (¶053-0054: As seen in Figure 1, first namespace(s) 102 constrains first application process 104. Example namespaces includes process identifier (PID) namespaces, network namespaces, and mount namespaces. First programmatic container 100 includes first namespace(s) 102. Thus, if first namespace(s) 102 includes a PID namespace and first programmatic container 100 is migrated, then first application program process 104 continues to be referenced as PID 1);
It would have been obvious, before the effective filing date, to modify Singh’s fingerprinting method to substitute and/or augment Singh’s fingerprint fields (e.g., process identifiers and other fingerprint attributes) with Degioanni’s mount namespace identifier, such that the first fingerprinting data includes mount namespace information associating the target application process with a first mount namespace, because both process identifiers and namespace identifiers were known in the art as process-context identifiers and a person of ordinary skill would have recognized that using a mount namespace identifier in the fingerprint is a predictable variation that improves the precision and efficiency of monitoring containerized applications and their execution environments (Degioanni ¶0007).
Singh in view of Degioanni does not disclose:
acquire, by the user space monitoring application, second fingerprinting data associated with the target application process at a second time;
determine, using the user space monitoring application, a validity of the hash value based on the fingerprinting data by comparing the first fingerprint data with the second fingerprint data,
However, Kim teaches:
acquire, by the user space monitoring application, second fingerprinting data associated with the target application process at a second time; (¶0083: The derived electronic file generation apparatus 300 may generate a second identifier for a device together with a derived electronic fingerprint of a derived electronic file, and transmit the second identifier together with the derived electronic fingerprint to the electronic fingerprint management apparatus 100. The electronic fingerprint management apparatus 100 may receive the derived electronic fingerprint and the second identifier, and store the derived electronic fingerprint and the second identifier in the memory unit RM to be mapped to each other.).
determine, using the user space monitoring application, a validity of the hash value based on the fingerprinting data by comparing the first fingerprint data with the second fingerprint data, (¶0095: For example, when the electronic file linked to the electronic fingerprint management apparatus 100 is an electronic file of a contract image, whether the authenticity of the contract image of the linked electronic file may be quickly verified by generating a hash value of the contract image and comparing the hash value with that stored in the electronic fingerprint management apparatus 100.).
It would have been obvious, before the effective filing date, to modify Singh in view of Degioanni such that the user-space monitoring application acquires second fingerprinting data associated with the same target application at a later time and determines a validity of a hash value by comparing the first and second fingerprinting data, as taught by Kim, to yield the predictable result of verifying the authenticity and integrity of the monitored application file using a known re-fingerprinting and comparison technique applied to the application files monitored in the Singh–Degioanni system.
Singh in view of Degioanni and Kim does not disclose:
generate a hash value of a target application file associated with the target application process by accessing a mapping between the first mount namespace and one or more process identifiers maintained in a shared memory by a mount namespace tracking program executing in the kernel space
switching the user space monitoring application to the first mount namespace based on the mount namespace information and a process identifier from the mapping, and the accessing the target application file in the first mount namespace; and
However, Halim teaches generate a hash value of a target application file associated with the target application process by accessing a mapping between the first mount namespace and one or more process identifiers maintained in a shared memory by a mount namespace tracking program executing in the kernel space (4.2.2 Verifier, Page 297-298: The core data structure of the Verifier component can be viewed as a table of tuples in the form ⟨Kernel path, FileID, MAC, Authenticated bit⟩ representing the allowed binaries. It is indexed on Kernel path and FileID for fast lookup… • The Kernel path is Windows kernel (internal) pathname representation of a file. In Window’s user space, a file can have multiple absolute pathnames, due to: (i) 8.3 file naming format, e.g. “C:\Program Files\” and “C:\progra∼1\ ” are the same; (ii) symbolic links (reparse points is similar); (iii) hard links; (iv) volume mount points; or (v) the SUBST and APPEND DOS commands. The Kernel path is a unique representation for all the possible pathnames. When the system loads ⟨path name, software digest⟩ from Digest file during the startup, path name is converted to Kernel path since all subsequent checks by Verifier in the kernel all use the latter…The MAC is same as a software digest entry in Digest file. Our prototype implements the HMAC-MD5 [4], HMAC-SHA-1 and HMAC-SHA-256 [16] hash algorithms (generating hash value based on mapping). );
switching the user space monitoring application to the first mount namespace based on the mount namespace information and a process identifier from the mapping, and the accessing the target application file in the first mount namespace; and (4.2.2 Verifier, Page 299: The cached MAC verifier needs to ensure that binaries which have been already authenticated are not modified. However, the uncached verifier will not need to perform file monitoring. A binary with pathname P is considered modified, if the following occurs: • P is created: Hence, we monitor system call NtCreateFile() and NtOpenFile(). • P is opened with write access mode: the previous two system calls are also intercepted for this purpose. • Another file is renamed to P: We monitor file renaming(NtSetInformation File(FileRenameInformation)) system call. •A drive containing P is mounted: We monitor drive mounting IRP_MJ_VOLUME-MOUNT. Upon modification of P, we reset the Authenticated bit of binary P, and update the FileID in the table if it is changed. Should FAT file system be used, pathname is used to identify the binary as FileID is not supported but neither are hard and soft links. Since FileID is optional and can be removed, we monitor FileID removal (NtFsControlFile(FSCTL_DELETE_OBJECT_ID)) (processor identifier) and deny the removal if the FileID is in the table.);
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention utilize the teachings of Halim with regards to using the mapping of process identifier and mount namespace to calculate hash value to the method of Singh in view of Degioanni and Kim in order to prevent TOCTTOU (Time-Of-Check-Time-Of-Use) and increase kernel protection (Halim 1 Introduction Page 291 & 4.3 Security Analysis Page 301).
Singh in view of Degioanni, Kim, and Halim does not disclose:
wherein the validity of the hash value indicates whether the hash value is a correct representation of instructions executing in the target application process.
However, Bivans teaches:
wherein the validity of the hash value indicates whether the hash value is a correct representation of instructions executing in the target application process. (¶0152: Additionally or alternatively, the security agent can access a configuration profile defining a security policy defining a periodic verification of an application—based on other validation information, such as a cryptographic hash value, associated with a valid set of instructions representing the application—at the predefined time interval (or another time interval) during runtime execution of the application. The security agent can: periodically calculate a value based on a cryptographic hash of the application; and execute the action in response to detecting a difference between the value and the cryptographic hash value.)
It would have been obvious to a person having ordinary skill in the art, before the effective filing date, to modify the combined teaching of Singh in view of Degioanni, Kim, and Onoue by further configuring the user-space monitoring application to interpret the result of the comparison between the first and second fingerprinting data (including the generated hash value) as an indication of whether the hash value corresponds to a valid set of instructions for the monitored application, as taught by Bivans’ use of a cryptographic hash associated with a valid set of application instructions for runtime verification, thereby applying a known hash-based code-validation technique to the monitored application in the Singh–Degioanni–Kim–Halim system according to known methods to yield the predictable result of detecting when the executing application’s instructions deviate from the expected valid instructions so as to prevent access violations and mitigate security vulnerabilities.
With respect to claim 17, the combination Singh in view of Degioanni, Kim, Halim, and Bivans teaches a non-transitory computer-readable storage medium of claim 15 (see rejection of claim 15 above) , wherein to determine the validity of the hash value, the processing device is to compare elements of the first fingerprinting data acquired at the first time with corresponding elements of the second fingerprinting data acquired at the second time. (Kim: ¶0013: Here, the original electronic fingerprint may include a first original electronic fingerprint generated by the original electronic file generation apparatus during the generation of the original electronic file, and a second original electronic fingerprint generated when the original electronic file generated by the original electronic file generation apparatus is changed or deleted. And as further demonstrated ¶0131 and Figure 5, when receiving the image copy authenticity verification request (S690), the electronic fingerprint managing apparatus generates an image hash value and image meta information regarding the image copy received from the court server and searches for the presence of the same image on the basis of the image hash value and image meta information stored in a database (S700, S710). The electronic fingerprint managing apparatus determines the authenticity of the image on the basis of whether the same image hash value as the image copy exists and transmits a result thereof to the court server (S720).).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention utilize the teachings of Kim with regards to validity of hash value to the method of Singh in view of Degioanni, Halim , and Bivans in order to ensure confidence in verification of the authenticity and integrity of data and effectively prevent illegal, alteration, and use of data thereby ensuring objective and transparent of confidential information (Kim ¶0023).
With respect to claim 18, the combination Singh in view of Degioanni, Kim, Halim, and Bivans teaches a non-transitory computer-readable storage medium of claim 15 (see rejection of claim 15 above), wherein the first fingerprinting data comprises at least one of: a file change time indicating when file contents of the target application file are changed; a device identifier (Singh: ¶0066: Such instances may include, for example, whether a given file has been virus scanned, whether content at a given URL has been scanned for inappropriate (e.g., pornographic) content, whether a given fingerprint matches any of a set of stored documents, and whether a checksum corresponds to any of a set of stored documents. ¶0129: The mobile admin (agent management cloud 606) performs inventory lookup with device fingerprints at the MDM server to authorize the user and the device 604 (step 806) as seen in Figure 16. Singh: ¶0246: The cryptographic identity is used to verify software and/or machine identity, i.e., the identity of the applications and the identity of the devices, hosts.) indicating a storage location of the target application file; a file inode number of the target application file; or a device mount count indicating a number of times a storage device with the device identifier was changed. (Kim ¶0127-0129:As seen in Figure 5, the image information processor generates and stores one or more image files (S620). When an image file is generated by the image information processor, an image hash value and additional information, including but not limited to, an image storing path, device identification information (IP address, MAC address, model name, installation apparatus, installation purpose) and image meta information (hash value generation date and time, and generation date and time, name, type, size, and generation coordinates of the image file) are generated together (S630). The image hash value may be transmitted together with at least one from the group consisting of an image storing path, device identification information, and image meta information.).
Although Singh does mention the fingerprinting data being correlated to the device identifier indicating an inventory and target application (the implication of use in ¶0066 & 0129) , but Singh does not explicitly disclose that the device identifier indicating a storage location of the target application file. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention utilize the teachings of Kim with regards to second fingerprinting data to the method of Singh in view of Degioanni, Halim, and Bivans in order to maintain protection while verifying authenticity and integrity of newly introduced data (Kim ¶0002).
With respect to claim 19, the combination Singh in view of Degioanni, Kim, Halim, and Bivans teaches a non-transitory computer-readable storage medium of claim 18 (see rejection of claim 18 above) but does not disclose, wherein the processing device is further to: execute a second program of the one or more programs in the kernel space of the operating system (Singh: ¶0139-0141: Specifically, FIG. 19 illustrates activity between the client applications 864, the TUN interface 852, a UDP listening socket 862, a VPN listening socket 864, and the VPN/broker server 860. First, the client application 854 sends a DNS query for an internal domain (step 902). The TUN interface 852 receives the IP packet corresponding to the DNS request and changes the packet's destination to the UDP listening socket 862 and writes the packet back (step 904).) to maintain the device mount count indicating the number of times the storage device with the device identifier was changed. (Singh: ¶0146-0147: The client application listens for security critical events such as Operating System (OS) upgrades, abrupt geolocation changes, device information deviation, and changes in the installed application list, and updates the cloud-based security system. The cloud-based security system evaluates the changes and computes a new risk index for the device. Specifically, the cloud-based security system creates a device fingerprint and a risk index for the mobile device based on the nature of applications installed on the system, operating system vulnerabilities, anti-virus status, patch level, device configuration, and the like (maintain the device mount count indicating the number of times the storage device with the device identifier was changed) . As seen in Figure 21, the multidimensional risk profiling process 1000 includes threat data management where the cloud-based security system collects information related to threats (step 1010)).
Claims 6, 13, and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Singh et al. (US PGPub No. 20200278948-A1) in view of Degioanni et al. (US PGPub No. 20160373327-A1), Kim et al. (US PGPub No. 20230156018-A1), Halim et al. (A lightweight binary authentication system for windows. In IFIP International Conference on Trust Management (pp. 295-310). Boston, MA: Springer US. (Year: 2008)) , Bivans et al. (US PGPub No. 20230351010-A1), and Gopalakrishnan et al. (US PGPub No. 20230156018-A1).
With respect to claim 6, the combination of Singh in view of Degioanni, Kim, Halim, and Bivans teaches method of claim 1 (see rejection of claim 1 above), but does not disclose wherein sharing, by the processing device using the one or more programs, the first fingerprinting data with the user space monitoring application comprises transmitting a notification message to the user space monitoring application utilizing a notification channel.
However, Gopalakrishnan wherein sharing, by the processing device using the one or more programs, the first fingerprinting data with the user space monitoring application comprises transmitting a notification message to the user space monitoring application utilizing a notification channel. (¶0099-0101: As seen in Figure 4, illustrates a process for collecting attributes and distributing context-based service rules and/or mapping records defined for data messages associated with confidential information, in some embodiments. The process starts by receiving (at 410) notification of a file event from a GI agent executing on a machine on the host computer. As described above for the process 300, the notification, in some embodiments, is an event identifier associated with a set of attributes pertaining to the file event. The process collects (at 420) contextual attributes for the file event. As described above, the context engine, in some embodiments, directs the GI agent (i.e., the GI agent from which the original event notification was received) to collect from the OS modules additional process parameters that are associated with the process identifier (ID) that it received with the network event.).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention utilize the teachings of Gopalakrishnan with regards to the sharing of fingerprinting data to the method of Singh in view of Degioanni, Kim, Halim , and Bivans in order to improve intrusion detection while maintaining the prevention of data loss (Gopalakrishnan ¶0001).
With respect to claim 13, the combination of Singh in view of Degioanni, Kim, Halim, and Bivans teaches system of claim 8 (see rejection of claim 8 above), but does not disclose wherein, to share, using the one or more programs, the first fingerprinting data with the user space monitoring application, the processing device is to transmit a notification message to the user space monitoring application utilizing a notification channel.
However, Gopalakrishnan teaches wherein, to share, using the one or more programs, the first fingerprinting data with the user space monitoring application, the processing device is to transmit a notification message to the user space monitoring application utilizing a notification channel. (¶0099-0101: As seen in Figure 4, illustrates a process for collecting attributes and distributing context-based service rules and/or mapping records defined for data messages associated with confidential information, in some embodiments. The process starts by receiving (at 410) notification of a file event from a GI agent executing on a machine on the host computer. As described above for the process 300, the notification, in some embodiments, is an event identifier associated with a set of attributes pertaining to the file event. The process collects (at 420) contextual attributes for the file event. As described above, the context engine, in some embodiments, directs the GI agent (i.e., the GI agent from which the original event notification was received) to collect from the OS modules additional process parameters that are associated with the process identifier (ID) that it received with the network event.).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention utilize the teachings of Gopalakrishnan with regards to the sharing of fingerprinting data to the method of Singh in view of Degioanni, Kim, Halim, and Bivans in order to improve intrusion detection while maintaining the prevention of data loss (Gopalakrishnan ¶0001).
With respect to claim 20, the combination Singh in view of Degioanni, Kim, Halim, and Bivans teaches a non-transitory computer-readable storage medium of claim 15 (see rejection of claim 15 above), but does not disclose wherein, to share, using the one or more programs, the first fingerprinting data with the user space monitoring application, the processing device is to transmit a notification message to the user space monitoring application utilizing a notification channel.
However, Gopalakrishnan wherein, to share, using the one or more programs, the first fingerprinting data with the user space monitoring application, the processing device is to transmit a notification message to the user space monitoring application utilizing a notification channel. (¶0099-0101: As seen in Figure 4, illustrates a process for collecting attributes and distributing context-based service rules and/or mapping records defined for data messages associated with confidential information, in some embodiments. The process starts by receiving (at 410) notification of a file event from a GI agent executing on a machine on the host computer. As described above for the process 300, the notification, in some embodiments, is an event identifier associated with a set of attributes pertaining to the file event. The process collects (at 420) contextual attributes for the file event. As described above, the context engine, in some embodiments, directs the GI agent (i.e., the GI agent from which the original event notification was received) to collect from the OS modules additional process parameters that are associated with the process identifier (ID) that it received with the network event.).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention utilize the teachings of Gopalakrishnan with regards to the sharing of fingerprinting data to the method of Singh in view of Degioanni, Kim, Halim, and Bivans in order to improve intrusion detection while maintaining the prevention of data loss (Gopalakrishnan ¶0001).
Claims 7 and 14 are rejected under 35 U.S.C. 103 as being unpatentable over Singh et al. (US PGPub No. 20200278948-A1) in view of Degioanni et al. (US PGPub No. 20160373327-A1), Kim et al. (US PGPub No. 20230156018-A1), Halim et al. (A lightweight binary authentication system for windows. In IFIP International Conference on Trust Management (pp. 295-310). Boston, MA: Springer US. (Year: 2008)) , Bivans et al. (US PGPub No. 20230351010-A1), and Du et al. (US PGPub No. 20230095870-A1 ).
With respect to claim 7, the combination of Singh in view of Degioanni, Kim, Halim, and Bivans teaches method of claim 1 (see rejection of claim 1 above) but does not disclose, wherein the one or more programs executing in the kernel space of the operating system execute within an extended Berkeley Packet Filter (eBPF) infrastructure.
However, Du teaches wherein the one or more programs executing in the kernel space of the operating system execute within an extended Berkeley Packet Filter (eBPF) infrastructure. (¶0121:Illustrated in Figure 7, as incoming packets arrive (710), they can be made available by the kernel for capture (e.g., via the Berkeley Packet Filter (BPF)). IoT server 134 performs a variety of tasks in conjunction with ring buffer 702.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention utilize the teachings of Du with regards to Berkeley Packet Filter (eBPF) infrastructure to the method of Singh in view of Degioanni, Kim, Halim, and Bivans in order to preserve traffic corresponding to the most interesting flows and (e.g., if an alert triggers) can provide a packets (e.g., as contextual information) for permanent storage and subsequent analysis (Du ¶0121 ).
With respect to claim 14, the combination of Singh in view of Degioanni, Kim, Halim, and Bivans teaches system of claim 8 (see rejection of claim 8 above), wherein the one or more programs executing in the kernel space of the operating system execute within an extended Berkeley Packet Filter (eBPF) infrastructure.
However, Du teaches wherein the one or more programs executing in the kernel space of the operating system execute within an extended Berkeley Packet Filter (eBPF) infrastructure. (¶0121:Illustrated in Figure 7, as incoming packets arrive (710), they can be made available by the kernel for capture (e.g., via the Berkeley Packet Filter (BPF)). IoT server 134 performs a variety of tasks in conjunction with ring buffer 702.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention utilize the teachings of Du with regards to Berkeley Packet Filter (eBPF) infrastructure to the method of Singh in view of Degioanni, Kim, Halim, and Bivans in order to preserve traffic corresponding to the most interesting flows and (e.g., if an alert triggers) can provide a packets (e.g., as contextual information) for permanent storage and subsequent analysis (Du ¶0121 ).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. Chen et al. (US PGPub No. 20200034170-A1) teaches a method involving parsing a module originating from container in computing environment by processors, and digest value is calculated as a unique identifier for the module file based on contents module file. Further, the identifying aspect of the module file and the digest value are stored in memory objects by the processor, where the memory object comprises a module content map to correlate the unique identifier for the module file with the content of the module. Kaczmarek et al. Operating system security by integrity checking and recovery using write-protected storage. IET Information Security, 8(2), 122-131. (Year: 2014) teaches a integrity checking and recovery system which protect file system integrity, and enabling files cryptographic hashes generation and verification, as well as configuration of security constraint to eliminate the threat of unauthorized modification. Sun et al. (Reliable and trustworthy memory acquisition on smartphones. IEEE Transactions on Information Forensics and Security, 10(12), 2547-2561. (Year: 2015)) teaches an integrity checking and rootkit detection that is capable of checking the integrity of kernel code and detecting of rootkits which includes rootkit that hide malicious processes by traversing the process list in the system.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to TAYLOR P VU whose telephone number is (703)756-1218. The examiner can normally be reached MON - FRI (7:30 - 5:00).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Alexander Lagor can be reached at (571) 270-5143. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/T.P.V./ Examiner, Art Unit 2437
/MENG LI/ Primary Examiner, Art Unit 2437
Prosecution Insights