Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . The present Final office action is responsive to communication received 5/11/2026.
Claims 1, 15, 18, and 20 have been amended.
Claims 1-20 are pending.
Response to Arguments
The amendments to the claims helped obviate the claim objections
Applicant’s arguments with respect to claims 1, 15, and 20 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument. The examiner brings in reference Mahanta to read on the newly amended limitations “software bill of materials information for the external application programming interface and the software bill of materials information being indicative of one or more software components of the external application programming interface”. Mahanta [0020] discloses a BOM can be dynamically generated based on a received API call, where the BOM comprises BOM components from a plurality of applications.
Claim objections
Claims 1, 6-8, 15, and 18-20 objected to because of the following informalities:
The claims should recite “Software bill of materials of an API endpoint” rather than “software bill of materials of API”.
Appropriate correction is required.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-10, and 12-20 are rejected under 35 U.S.C. 103 as being unpatentable over Jain et al. (US 20200302050) in view of Greene et al. (US 20230222225) in further view of Mahanta et al. (US 20230342357).
Regarding claim 1,
Jain discloses a method, comprising:
detecting, by a process, usage of an external application programming interface in execution of an application;
[process 1000 can connect with external services to augment agent's functionality. For example, a distributed proxy agent can connect with an external security service such as threat intelligence, anti-virus, anti-malware or reputation service etc. that enhances agent's security related functions. (Jain et al., paragraph 91, proxy agent being able to connect with external api and process 1000 being mapped to the process)]
[In step 502, the proxy agent captures the network traffic entering and exiting application process. (Jain et al. ,paragraph 62, detecting traffic/api usage during application execution)]
[Example extracted information includes, inter alia: information about active services; URL of the API (e.g. the API endpoint); type of the API (e.g. JSON, XML, GRPC, etc.); schema of the API; etc. It is noted that the schema of the API can define the structure of the information carried in API's payload, headers or URLs. (Jain et al., paragraph 105, API usage and active services being mapped to application)]
an endpoint exposed by the external application programming interface of one or more components of the external application programming interface
[the proxy agent deploys the use of deep packet inspection to operate on the input and output network traffic for the services or applications that are being protected by the proxy agent. In step 1404, the proxy agent performs a deep parsing of the network traffic and extracts the information. Example extracted information includes, inter alia: information about active services; URL of the API (e.g. the API endpoint); type of the API (e.g. JSON, XML, GRPC, etc.); schema of the API; etc. (Jain et al., paragraph 105, list of components being mapped to extracted information and process 1400 being mapped to the process)]
[process 2000 for implementing a discovery/learning phase, according to some embodiments. Process 2000 can use learned APIs to create a mapping of known and allowed services and APIs in step 2002. In step 2004, the proxy agent, adapter and controller learns APIs and associated schema thereof and compiles a mapping of the APIs being used between various segments of a distributed application. In step 2006, the solution can be deployed in a discovery or learning mode. In this mode, in step 2008, the solution continues to learn APIs and update its database to create a mapping of APIs being used by different services that constitutes application. (Jain et al., paragraph 118, discovery/learning phase)]
and performing, by the process, one or more mitigation actions
[Once a deviation has been observed, system can take an action specified by the administrator of the system in step 2204. Example actions can include, inter alia: logging the deviation; sending an alert to the administrator using specified alert mechanism such as email, text or any other mechanism; generating an event that integrates with another system; blocking the API requests in the network such that the APIs are not allowed to complete; etc. (Jain et al., paragraph 164, process 2200 being mapped to the process)]
Jain fails to explicitly disclose transmitting, by the process and to the external application programming interface, a query for software bill of materials information for the external application programming interface, the software bill of materials information being indicative of one or more software components of the external application programming interface, the query being an explicit application-layer request to the endpoint, receiving, by the process and from the endpoint, a response to the query including the software bill of materials information for the external application programming interface, the software bill of materials information being indicative of the one or more software components of the external application programming interface and generating, by the process, a vulnerability assessment for the application based on the software bill of materials information returned in the response to the query.
However in an analogous art Greene discloses transmitting, by the process and to the external application programming interface, a query for software bill of materials information f
[Based on scanning and monitoring the software and communications of a business, the SASP 102 can provide a real-time data flow diagram, as well as generating a catalog of components and their interactions, sometimes referred to as a software bill of materials (SBOM).) (Greene et al., paragraphs 14, 15)]
receiving, by the process and from the endpoint, a response to the query including the software bill of materials information information being indicative of the one or more software components [The analysis module 320 may compare the data of the SBOM 314 against the known vulnerabilities, privacy concerns, or compliance requirements of database 315 to determine if any of the client systems conflicts with the database information. (Greene et al., paragraph 33)]
generating, by the process, a vulnerability assessment for the application based on the software bill of materials information returned in the response to the query;
[and generating, by the process, a vulnerability assessment for the application based on the software bill of materials information returned in the response to the query; (Greene et al., paragraph 33)]
Jain and Greene are considered to be analogous to the claimed invention because they are in the same field of vulnerability monitoring. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention of the instant application to have modified the teachings of Jain to incorporate the teachings of Greene et al. to include transmitting, by the process and to the external application programming interface, a query for software bill of materials information, the software bill of materials information being indicative of one or more software components, the query being an explicit application-layer request to the endpoint, receiving, by the process and from the endpoint, a response to the query including the software bill of materials information, the software bill of materials information being indicative of the one or more software components and generating, by the process, a vulnerability assessment for the application based on the software bill of materials information returned in the response to the query, in order to identify vulnerabilities and security risks of a software ecosystem using the SBOM, (Greene et al., paragraph 13)], and recommend mitigation such as update to software code, library … for different elements of the ecosystem (Greene et al., paragraph 25).
Jain in view of Greene fails to explicitly disclose a software bill of materials information for the external application programming interface.
However in an analogous art Mahanta discloses a software bill of materials information for the external application programming interface.
[a BOM can be dynamically generated based on a received API call (Mahanta et al., paragraph 20)]
[where the BOM comprises BOM components from a plurality of applications (Mahanta et al., paragraph 6)]
Jain, Greene, and Mahanta are considered to be analogous to the claimed invention because they are in the same field of vulnerability monitoring. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention of the instant application to have modified the teachings of Jain and Greene to incorporate the teachings of Mahanta et al. to include a software bill of materials information for the external application programming interface, in order to optimize the various database queries for a given API call resulting in a more efficient processing of the given API call. (Mahanta et al., paragraph 21)].
Therefore the combination of Jain, Greene, and Mahanta discloses the limitations recited in claim 1 and particularly:
transmitting, by the process and to the external application programming interface, a query for software bill of materials information for the external application programming interface, the software bill of materials information being indicative of one or more software components of the external application programming interface, the query being an explicit application-layer request to the endpoint;
receiving, by the process and from the endpoint, a response to the query including the software bill of materials information for the external application programming interface, the software bill of materials information being indicative of the one or more software components of the external application programming interface;
generating, by the process, a vulnerability assessment for the application based on the software bill of materials information returned in the response to the query.
Regarding 15,
Jain discloses a tangible, non-transitory, computer-readable medium having computer-executable instructions stored thereon that, when executed by a processor on a computer, cause the computer to perform a method comprising:
[In some embodiments, the machine-readable medium can be a non-transitory form of machine-readable medium. (Jain et al., paragraph 188)]
Please refer to claim 1 rejection for the teachings of the additional limitations.
Regarding claims 2 and 16,
Jain in view of Greene in further view of Mahanta discloses the method as in claim 1 and the tangible, non-transitory, computer-readable medium as in claim 15, wherein detecting usage of the external application programming interface in execution of the application comprises:
monitoring activity of the application;
[ the proxy agent deploys the use of deep packet inspection to operate on the input and output network traffic for the services or applications that are being protected by the proxy agent. In step 1404, the proxy agent performs a deep parsing of the network traffic and extracts the information. Example extracted information includes, inter alia: information about active services; URL of the API (e.g. the API endpoint); type of the API (e.g. JSON, XML, GRPC, etc.); schema of the API; etc. It is noted that the schema of the API can define the structure of the information carried in API's payload, headers or URLs. In step 1406, for each element of the schema, process 1400 determine the type of various elements (e.g. string, int, object, array, etc.). In step 1408, for each element of the schema, process 1400 determines the value range of various elements. (Jain et al., paragraph 105)]
and determining a new call made to the external application programming interface during
execution of app,
[The schema of the API changes. For example, for a given API, a new schema parameter is observed that was not part of learned schema; when, for a given API, an existing parameter with a different value is observed, such that the new value is not matching with the learned schema either in terms of its type or its value; when, for a given API, a new behavior is observed; etc. [0159] The amount of data that is transmitted or received by the API changes; [0160] The rate at which the API is being invoked changes; [0161] The invocation sequence in which the API is being invoked changes; [0162] The request origin (geo-location) changes; and [0163] if the user IDs that is associated with the API requests changes (e.g. a new user starts to use the API). (Jain et al., paragraph 158)]
wherein the query is transmitted in response to the new call to the external application programming interface.
[Once a deviation has been observed, system can take an action specified by the administrator of the system in step 2204. (Jain et al., paragraph 164)]
Regarding claim 3,
Jain in view of Greene in further view of Mahanta discloses the method as in claim 1,
wherein detecting usage of the external application programming interface in execution of the application is performed during development of the application, during deployment of the application, and/or during runtime of the application.
[process 1000 can connect with external services to augment agent's functionality. For example, a distributed proxy agent can connect with an external security service such as threat intelligence, anti-virus, anti-malware or reputation service etc. that enhances agent's security related functions. (Jain et al., paragraph 91, proxy agent being able to connect with external api)]
[An event can include when an application behind a specific proxy agent is making a request to another application behind another proxy-agent. (Jain et al., paragraph 60, application)]
[In step 502, the proxy agent captures the network traffic entering and exiting application process application process. (Jain et al. ,paragraph 62, detecting traffic/api usage during application execution)]
[Example extracted information includes, inter alia: information about active services; URL of the API (e.g. the API endpoint); type of the API (e.g. JSON, XML, GRPC, etc.); schema of the API; etc. It is noted that the schema of the API can define the structure of the information carried in API's payload, headers or URLs. (Jain et al., paragraph 105, API usage)]
Regarding claim 4 and 17,
Jain in view of Greene in further view of Mahanta discloses the method as in claim 1 and the tangible, non-transitory, computer-readable medium as in claim 15, further comprising:
learning of a new vulnerability associated with a specific component; determining whether the application has any external application programming interfaces that have that specific component; and updating the vulnerability assessment based on whether the application has any external application programming interfaces that have that specific component.
[in step 2008, the solution continues to learn APIs and update its database to create a mapping of APIs being used by different services that constitutes application. (Jain et al., paragraph 118)]
[Accepting the deviation implies that the observed deviation is an acceptable behavior and system should update its learned state. Once a deviation has been overridden by admins, from that point onward, system updates its learned state and consider the behavior that caused deviation to be an acceptable or expected behavior and do not raise any alerts or notifications for the accepted behavior. (Jain et al., paragraph 173)]
Regarding claim 5,
Jain in view of Greene in further view of Mahanta discloses the method as in claim 4, further comprising:
determining whether it is known that a given external application programming interface of the application has that specific component;
[Process 2000 can use learned APIs to create a mapping of known and allowed services and APIs in step 2002. (Jain et al., paragraph 118)]
and in response to determining that is unknown whether the given external application programming interface of the application has that specific component, querying the given external application programming interface of the application for presence of the specific component.
[in step 2008, the solution continues to learn APIs and update its database to create a mapping of APIs being used by different services that constitutes application. (Jain et al., paragraph 118)]
[Accepting the deviation implies that the observed deviation is an acceptable behavior and system should update its learned state. Once a deviation has been overridden by admins, from that point onward, system updates its learned state and consider the behavior that caused deviation to be an acceptable or expected behavior and do not raise any alerts or notifications for the accepted behavior. (Jain et al., paragraph 173)]
Regarding claims 6,
Jain in view of Greene in further view of Mahanta discloses the method as in claim 1 and the tangible,
wherein the software bill of materials information comprises, for the external application programming interface, a list of software ingredients including one or more of underlying software components, libraries in use, dependencies in use, or open-source code in use.
[An SBOM may identify the elements in a business' computer ecosystem, such as code libraries and OS (operating system) libraries and associated version indicators, service requests generated in a computing system such as third party- and internal-facing API (application program interface) calls, what data is being shared or exchanged, third party vendors for software systems, and other information. (Greene et al., paragraph 18)]
Jain, Greene, and Mahanta are considered to be analogous to the claimed invention because they are in the same field of vulnerability monitoring. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention of the instant application to have modified the teachings of Jain and Mahanta to incorporate the teachings of Greene et al. to include wherein the software bill of materials information comprises, for the external application programming interface, a list of software ingredients including one or more of underlying software components, libraries in use, dependencies in use, or open-source code in use, in order to identify vulnerabilities and security risks of a software ecosystem using the SBOM. (Greene et al., paragraph 13)] and recommend mitigation such as update to software code, library … for different elements of the ecosystem (Greene et al., paragraph 25).
Regarding claim 7 and 19,
Jain in view of Greene in further view of Mahanta discloses the method as in claim 1 and the tangible, non-transitory, computer-readable medium as in claim 15, wherein the query to the external application programming interface for the software bill of materials information indicative of the list of one or more components of the external application programming interface comprises a query for a full list of all components of the external application programming interface.
[Based on scanning and monitoring the software and communications of a business, the SASP 102 can provide a real-time data flow diagram, as well as generating a catalog of components and their interactions, sometimes referred to as a software bill of materials (SBOM).) (Greene et al., paragraph 14)]
Jain, Greene, and Mahanta are considered to be analogous to the claimed invention because they are in the same field of vulnerability monitoring. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention of the instant application to have modified the teachings of Jain and Mahanta to incorporate the teachings of Greene et al. to include wherein the query to the external application programming interface for the software bill of materials information indicative of the list of one or more components of the external application programming interface comprises a query for a full list of all components of the external application programming interface, in order to identify vulnerabilities and security risks of a software ecosystem using the SBOM. (Greene et al., paragraph 13)] and recommend mitigation such as update to software code, library … for different elements of the ecosystem (Greene et al., paragraph 25).
Regarding claim 8,
Jain in view of Greene in further view of Mahanta discloses the method as in claim 1,
wherein the query to the external application programming interface for the software bill of materials information indicative of the one or more components of the external application programming interface comprises a query for presence of one or more specifically queried components of the external application programming interface.
[Based on scanning and monitoring the software and communications of a business, the SASP 102 can provide a real-time data flow diagram, as well as generating a catalog of components and their interactions, sometimes referred to as a software bill of materials (SBOM).) (Greene et al., paragraph 14)]
Jain, Greene, and Mahanta are considered to be analogous to the claimed invention because they are in the same field of vulnerability monitoring. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention of the instant application to have modified the teachings of Jain and Mahanta to incorporate the teachings of Greene et al. to include wherein the query to the external application programming interface for the software bill of materials information indicative of the one or more components of the external application programming interface comprises a query for presence of one or more specifically queried components of the external application programming interface, in order to identify vulnerabilities and security risks of a software ecosystem using the SBOM. (Greene et al., paragraph 13)], and recommend mitigation such as update to software code, library … for different elements of the ecosystem (Greene et al., paragraph 25).
Regarding claim 9,
Jain in view of Greene in further view of Mahanta discloses the method as in claim 1, wherein the application is selected from a group consisting of: an application; an application micro service; a workload; a containerized workload; an image; a container; a local application; and a virtual application.
[ the proxy agent deploys the use of deep packet inspection to operate on the input and output network traffic for the services or applications that are being protected by the proxy agent. (Jain et al., paragraph 105, application being selected for traffic inspection)]
Regarding claim 10,
Jain in view of Greene in further view of Mahanta discloses the method as in claim 1,
wherein the vulnerability assessment corresponds to one or more of the external application programming interface in its entirety, one or more individual components of the external application programming interface, or a plurality of external application programming interfaces of the application.
[In step 2304, for a given API, a possible deviation from the learned state can be determined. (Jain et al., paragraph 157, assessment of API)]
[The schema of the API changes. For example, for a given API, a new schema parameter is observed that was not part of learned schema; when, for a given API, an existing parameter with a different value is observed, such that the new value is not matching with the learned schema either in terms of its type or its value; when, for a given API, a new behavior is observed; etc. The amount of data that is transmitted or received by the API changes; The rate at which the API is being invoked changes; The invocation sequence in which the API is being invoked changes; The request origin (geo-location) changes; and if the user IDs that is associated with the API requests changes (e.g. a new user starts to use the API). (Jain et al., paragraphs 158-163)]
Regarding claim 12,
Jain in view of Greene in further view of Mahanta discloses the method as in claim 1, wherein the process is part of a cloud-native application protection platform.
[a software only solution that can be run in either a publicly available computer hosting environment (e.g. a cloud-computing platform) and/or in the customer's environment. (Jain et al., paragraph 49)]
Regarding claim 13,
Jain in view of Greene in further view of Mahanta discloses the method as in claim 1, wherein performing the one or more mitigation actions based on the vulnerability assessment comprises: triggering a customized policy action based on the vulnerability assessment.
[Once a deviation has been observed, system can also allow an option to create a policy that either allows, denies or reject the behavior that caused the deviation. Administrators can review the deviation observed and administrator then can create the policy for action on the current and future occurrence of the deviation. In one embodiment, the policy can be auto-generated by the system with appropriate controls as desired by the administrator to either accept or deny the deviating behavior. (Jain et al ., paragraph 174)]
Regarding claim 14,
Jain in view of Greene in further view of Mahanta discloses the method as in claim 1, wherein the one or more mitigation actions are selected from a group consisting of: sending an alert regarding the external application programming interface; sending a report regarding the external application programming interface; blocking certain components of the external application programming interface; blocking the external application programming interface; blocking the application; and redirecting calls to the external application programming interface.
[Once a deviation has been observed, system can take an action specified by the administrator of the system in step 2204. Example actions can include, inter alia: logging the deviation; sending an alert to the administrator using specified alert mechanism such as email, text or any other mechanism; generating an event that integrates with another system; blocking the API requests in the network such that the APIs are not allowed to complete; etc. (Jain et al., paragraph 164)]
Regarding claim 18,
Jain in view of Greene in further view of Mahanta discloses the tangible, non-transitory, computer-readable medium as in claim 15, wherein the query includes a software bill of materials query parameter exposed by the endpoint, the software bill of materials query parameter specifying the software bill of materials information to be returned in the response.
[Based on scanning and monitoring the software and communications of a business, the SASP 102 can provide a real-time data flow diagram, as well as generating a catalog of components and their interactions, sometimes referred to as a software bill of materials (SBOM).) (Greene et al., paragraphs 14, 15)]
Jain, Greene, and Mahanta are considered to be analogous to the claimed invention because they are in the same field of vulnerability monitoring. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention of the instant application to have modified the teachings of Jain and Mahanta to incorporate the teachings of Greene et al. to include wherein the query includes a software bill of materials query parameter exposed by the endpoint, the software bill of materials query parameter specifying the software bill of materials information to be returned in the response, in order to identify vulnerabilities and security risks of a software ecosystem using the SBOM, (Greene et al., paragraph 13)], and recommend mitigation such as update to software code, library … for different elements of the ecosystem (Greene et al., paragraph 25).
Regarding claim 20,
Jain discloses an apparatus, comprising:
one or more network interfaces to communicate with a network;
[Cloud computing can involve deploying groups of remote servers and/or software networks that allow centralized data storage and online access to computer services or resources. These groups of remote serves and/or software networks can be a collection of remote computing services. (Jain et al., paragraph 37)]
a processor coupled to the one or more network interfaces and configured to execute one or more processes;
[The controller also acts as an aggregation point for collecting telemetry data from distributed security mesh proxy agents and to execute various analytics to provide various insights into mesh's operation. (Jain et al., paragraph 38)]
and a memory configured to store a process that is executable by the processor, the process, when executed, configured to:
[Cloud computing can involve deploying groups of remote servers and/or software networks that allow centralized data storage and online access to computer services or resources. These groups of remote serves and/or software networks can be a collection of remote computing services. (Jain et al., paragraph 37)]
Please refer to claim 1 rejection for the teachings of the additional limitations.
Claim 11 are rejected under 35 U.S.C. 103 as being unpatentable over Jain et al. (US 20200302050) in view Greene et al. (US 20230222225) in further view of Mahanta et al. (US 20230342357) and in further view of Ye et al. (US 20210182031).
Regarding claim 11,
Jain in view of Greene in further view of Mahanta discloses the method as in claim 1, but fails to explicitly disclose wherein the vulnerability assessment is based on one or both of Common Vulnerability Scoring System scores and bug reports and fixes for specified components.
However in an analogous art Ye discloses wherein the vulnerability assessment is based on one or both of Common Vulnerability Scoring System scores and bug reports and fixes for specified components
[the software bug detector 230 is used to identify software bugs and potential root causes associated with the identified bugs, as described in connection with FIGS. 3-5. (Ye et al., paragraph 32; bug fixes paragraph 16)]
[The example report generator 345 generates a report indicating an identified software bug and/or a root cause of the bug. (Ye et al., paragraph 33)]
Jain, Greene, Mahanta, and Ye are considered to be analogous to the claimed invention because they are in the same field of vulnerability detection. Therefore, it would have been obvious to one of ordinary skill in the art before the instant application effective filing date of the claimed invention to have modified the teachings of Jain, Greene, and Mahanta to incorporate the teachings of Ye et al. to include wherein the vulnerability assessment is based on one or both of Common Vulnerability Scoring System scores and bug reports and fixes for specified components, in order automatically detect bugs to help increase software development productivity by saving developers time for debugging and improve software reliability . (Ye et al., paragraph 15)]
Conclusion
Applicant’s amendment necessitated the new ground(s) of rejection presented in this Office action. THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to DANIEL ELAHIAN whose telephone number is (703) 756-1284. The examiner can normally be reached on Monday – Friday from 7:30am to 5pm.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Catherine Thiaw can be reached at telephone number 571-270-1138. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from Patent Center and the Private Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from Patent Center or Private PAIR. Status information for unpublished applications is available through Patent Center and Private PAIR for authorized users only. Should you have questions about access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
/D.E./DANIEL ELAHIAN, Examiner, Art Unit 2407
/Catherine Thiaw/Supervisory Patent Examiner, Art Unit 2407 8/18/2026
Prosecution Insights