DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendment / Arguments
Regarding claim interpretation under 35 USC 112(f):
Applicant's arguments have been fully considered but they are not persuasive.
Applicant argues that “the claim language recites the "algorithm for performing the claimed function" and that a person "skilled in the part would be able to identify the acts for performing the recited function" as required by the MPEP.² Accordingly, Applicant submits that there is sufficient structure described to avoid the 35 U.S.C. § 112(f) interpretation because the claims recite the necessary steps for performing the functions. Applicant respectfully requests that the 35 U.S.C. § 112(f) interpretation be withdrawn.”
In response, it noted that the claims are not rejected under 35 USC 112(b) for failing to disclose a corresponding algorithm. It is further noted that MPEP 2181 I.A provides a list of non-structural generic placeholders that may invoke 112(f), including “component for.” MPEP 2181 additionally states that “means for” may be replaced “another linking word or phrase, such as ‘configured to.’”
Claims 8-9 and 11-14 of the instant application recite “a receiving component,” “a security component,” “a parsing component,” and “a decryption component” where the components are followed by a linking phrase and functional language. The examiner finds that these components are generic placeholders (e.g., “[X] component”) modified by functional language (“receive [a] message …; perform [a] security check …; [etc.]”). These placeholders are not modified by sufficient structure for performing the respective claimed functions. Even if applicant is correct in their assertion that the claim recites an algorithm to achieve the function, an algorithm alone is not sufficient structure for the claimed component unless the component itself is merely an algorithm and then there would be a different issue; the claims would need to modify the placeholder with sufficient structure to preempt invocation of 112f. The courts have found that structure such as a general purpose processor and memory need include disclosure of the algorithmic steps for achieving the claimed function in order to be considered ‘sufficient’. Thus, the claims reciting the algorithm without tethering the placeholder to at least general purpose computing structure fails to recite ‘sufficient’ structure. See MPEP 2181.
Regarding claims rejected under 35 USC 112(b);
Applicant’s amendment is considered to have overcome the applied rejection. As such, the rejection has been withdrawn.
Regarding claims rejected under 35 USC 103:
Applicant’s arguments with respect to the Ambaljeri-Kuroyanagi-Jain-Jakobsson combination have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Where Applicant argues that “[i]n the present claims, an unauthorized sender is blocked without considering the content of the message,” it is noted that (1) the claim merely recites “determining whether a sender of the electronic message is an authorized sender” without any limitations specifying the protocol of identifying the sender from the received message. In the trivial case, the receiver can just read sender information from the received message. It is also noted that (2) the claim explicitly recites “determining whether the sender is authorized to access one or more workflows to be performed at the receiver device, wherein each of the one or more workflows is identified by a different address of the electronic message at the receiver device.” This appears to include reading address information to determine a workflow. It is noted that the features upon which applicant relies (i.e., “an unauthorized sender is blocked without considering the content of the message”) are not recited in the rejected claim(s). Although the claims are interpreted in light of the specification, limitations from the specification are not read into the claims. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993).
Additionally in response to Applicant’s arguments stating that “Jakobsson describes an embodiment in which incoming emails are blocked based on the content of those emails,” one cannot show nonobviousness by attacking references individually where the rejections are based on combinations of references. See In re Keller, 642 F.2d 413, 208 USPQ 871 (CCPA 1981); In re Merck & Co., 800 F.2d 1091, 231 USPQ 375 (Fed. Cir. 1986). In this case, the Jakobsson reference has been relied upon to disclose remedial actions such as blocking or quarantining messages. Even still, Jakobsson is not limited to reading message contents. For example, 1002 in FIG. 2 and the corresponding description of Jakobsson state that “information about a message is received. In some embodiments, the information is received at analysis server 102 of FIG. 1. The information may include information about a sender of the message. For example, the information includes email address header information including an email address and a display name of the sender of the message. In some embodiments, the information about the message includes contents of the message. Examples of the message include an electronic mail (i.e., email), an instant message, a chat message, and any other forms of electronic messages.” Jakobsson includes validating message contents, but may also review header information or obtained sender information.
Claim Interpretation
The following is a quotation of 35 U.S.C. 112(f):
(f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph:
An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
This application includes one or more claim limitations that do not use the word “means,” but are nonetheless being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because the claim limitation(s) uses a generic placeholder that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. Such claim limitation(s) is/are: “a receiving component,” “a security component,” “a parsing component,” and “a decryption component” in claims 8-14.
Because this/these claim limitation(s) is/are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, it/they is/are being interpreted to cover the corresponding structure described in the specification as performing the claimed function, and equivalents thereof. For instance, [0032] of the instant specification defines the components as follows: “components 310-320 may be implemented as hardware (e.g., an application specific integrated circuit (ASIC) or a field programmable gate array (FPGA)), as software, or as a combination of hardware and software.”
If applicant does not intend to have this/these limitation(s) interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, applicant may: (1) amend the claim limitation(s) to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph (e.g., by reciting sufficient structure to perform the claimed function); or (2) present a sufficient showing that the claim limitation(s) recite(s) sufficient structure to perform the claimed function so as to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-2, 4-9, 11-16, and 18-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Soundararajan (US 2013/0159428 A1) in view of Jakobsson (US 11,757,914 B1) and Kuroyanagi (US 2021/0144113 A1).
Regarding claim 1, Soundararajan discloses: A method for a receiver device to parse programming code contained in an electronic message, the method comprising:
receiving the electronic message;
Refer to at least [0050] and [0040] of Soundararajan with respect to receiving a command email.
performing a first security check on the electronic message, including determining whether a sender of the electronic message is an authorized sender;
Refer to at least [0051] of Soundararajan with respect to performing one or more authentication procedures on the command email to verify the identity of the sender and/or verify the authenticity of the command email.
rejecting the electronic message on a condition that the first security check does not pass, [whereby error handling is performed];
Refer to at least [0051] of Soundararajan with respect to error handling in the case of authentication procedure failure.
on a condition that the first security check passes, performing a second security check on the electronic message, including determining whether the sender is authorized to access one or more workflows to be performed at the receiver device,
Refer to at least [0051] of Soundararajan with respect to the “one or more authentication procedures,” and to at least [0052]-[0060] of Soundararajan with respect to example authentication procedures including validating access roles and requiring further approval from a supervisor. For instance, it is authenticated whether sender is authorized to execute commands on components identified in the command email.
on a condition that the second security check passes:
parsing the programming code; performing the workflow at the receiver device based on the programming code; and
Refer to at least [0065]-[0069] of Soundararajan with respect to parsing and executing the commands on the identified components.
sending a response to the sender, the response including content created by performing the workflow; and
Refer to at least [0070]-[0071] and [0075] of Soundararajan with respect to sending a completion message to the sender, where the completion message includes a summary of actions taken and post-execution status.
on a condition that the second security check does not pass, [performing error handling].
Refer to at least [0051] of Soundararajan with respect to error handling in the case of authentication procedure failure.
Soundararajan does not specify: the error handling further comprising whereby the electronic message is not processed by the receiver device; the error handling further comprising not processing the electronic message by the receiver device; wherein each of the one or more workflows is identified by a different address of the electronic message at the receiver device; the workflow further identified by the address of the electronic message. However, Soundararajan in view of Jakobsson discloses: the error handling further comprising whereby the electronic message is not processed by the receiver device; the error handling further comprising not processing the electronic message by the receiver device;
Refer to at least Col. 13, Ll. 23-40 and Col. 15, Ll. 56-60 of Jakobsson with respect to security actions taken in response to failed sender authorization, including blocking the message, quarantine, and/or censoring message content.
The teachings of Jakobsson likewise concern secure electronic messaging, authorization, and securing message contents, and are considered to be within the same field of endeavor and combinable as such.
Therefore it would have been obvious to one of ordinary skill in the art before the filing date of Applicant’s invention to further modify the teachings of Soundararajan to include security actions blocking message processing following authorization failure for at least the purpose of improving security and quality of use by preventing the accumulation of malicious messages in an inbox (i.e., users having less spam and phishing attempt messages crowding out useful messages). For instance, malicious messages may masquerade as command messages in Soundararajan and should therefore be filtered for security reasons.
Soundararajan-Jakobsson does not specify: wherein each of the one or more workflows is identified by a different address of the electronic message at the receiver device; the workflow further identified by the address of the electronic message. However, Soundararajan-Jakobsson in view of Kuroyanagi discloses: wherein each of the one or more workflows is identified by a different address of the electronic message at the receiver device; the workflow further identified by the address of the electronic message.
Refer to at least the abstract, FIG. 7, FIG. 9, [0050]-[0051], [0053], and [0060]-[0068] of Kuroyanagi with respect to an email being the trigger for performing a workflow, where the sender and destination addresses are verified to determine authorization and a workflow ID. The workflow corresponding to the workflow ID is executed.
The teachings of Kuroyanagi likewise relate to securely triggering execution via emails, and are considered to be within the same field of endeavor and combinable as such.
Therefore it would have been obvious to one of ordinary skill in the art before the filing date of Applicant’s invention to modify the teachings of Soundararajan-Jakobsson to implement workflow selection information in the address fields because the substitution of one known element for another would have yielded predictable results to one of ordinary skill in the art at the time of the invention (i.e., where to include request data as part of the email).
Regarding claim 2, Soundararajan-Jakobsson-Kuroyanagi discloses: The method of claim 1, wherein: the first security check is based on a certificate-based trust mechanism; and the sender is determined to be an authorized sender on a condition that the sender possesses a valid certificate.
Refer to at least [0053] of Soundararajan with respect to validating the sender using cryptographic keys bound to certificates (i.e., if the signature matches a certificate key).
Regarding claim 4, it is rejected for substantially the same reasons as claim 1 above (e.g., FIG. 5 and FIG. 10 of Kuroyanagi).
Regarding claim 5, Soundararajan-Jakobsson-Kuroyanagi discloses: The method of claim 1, further comprising: storing message information in an audit trail on a condition that the sender is not determined to be authorized to access the one or more workflows.
Refer to at least [0082]-[0083] and [0089] of Soundararajan with respect to maintaining a record of alerts and corresponding responses (command emails); [0051] of Soundararajan concerning error messages to the sender.
Refer to at least [0084]-[0086] of Kuroyanagi with respect to transmitting emails to an administrator concerning failed verifications.
Therefore it would have been obvious to one of ordinary skill in the art before the filing date of Applicant’s invention to further modify the teachings of Soundararajan-Jakobsson-Kuroyanagi to implement sending a record of failed verifications to an administrator for at least the purpose of improving the security/error review process as in [0086] of Kuroyanagi (i.e., an analyst and/or analysis system is provided with better information to address errors or security issues).
Regarding claim 6, Soundararajan-Jakobsson-Kuroyanagi discloses: The method of claim 1, wherein parsing the programming code includes invoking one or more application programming interfaces.
Refer to at least [0017], [0019], and [0028] of Soundararajan with respect to APIs implemented by the target environment of the command emails (e.g., APIs for using the virtual machine; APIs for interacting with the email servers).
Regarding claim 7, Soundararajan-Jakobsson-Kuroyanagi discloses: The method of claim 1, wherein the electronic message is encrypted and the method further comprises: decrypting the electronic message before parsing the programming code.
Refer to at least [0053] of Soundararajan with respect to decrypting the command email.
Regarding independent claim 8, it is substantially similar to independent claim 1 above, and is therefore likewise rejected (i.e., the citations and obviousness rationale).
Regarding claims 9 and 11-14, they are substantially similar to claims 2 and 4-7 above, and are therefore likewise rejected.
Regarding independent claim 15, it is substantially similar to independent claim 1 above, and is therefore likewise rejected (i.e., the citations and obviousness rationale).
Regarding claims 16 and 18-20, they are substantially similar to claims 2 and 4-7 above, and are therefore likewise rejected.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to VADIM SAVENKOV whose telephone number is (571)270-5751. The examiner can normally be reached 12PM-8PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey L Nickerson can be reached at (469) 295-9235. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Jeffrey Nickerson/Supervisory Patent Examiner, Art Unit 2432
/V.S/Examiner, Art Unit 2432
