CTNF 18/217,341 CTNF 79928 Notice of Pre-AIA or AIA Status 07-03-aia AIA 15-10-aia The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA. DETAILED ACTION Claims 1-20 are pending in this office action. Claim Rejections - 35 USC § 101 07-04-01 AIA 07-04 35 U.S.C. 101 reads as follows: Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title. Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to a non-patent-eligible abstract idea without an inventive concept sufficient to transform the abstract idea into a patent-eligible application. Claim 1 is directed to the abstract idea of verifying and authorizing data based on a policy. Specifically, the claim recites: receiving a workload (data); determining if the workload has valid attestation (verifying credentials); establishing attestation if missing (generating credentials); determining compliance with a policy (comparing to a rule); and executing the workload based on compliance (acting on a result). These steps describe a series of information-based activities: collecting data, checking its status, updating that status, and comparing the result to a set of rules. Such activities are fundamental "mental processes" or "methods of organizing human activity" that can be performed by a person with a pen and paper. Courts have routinely classified these types of "if- then" verification logic as abstract ideas. The claim does not integrate the abstract idea into a practical application. The hardware recited—"a processor" and "memory"—is generic and performs only its standard functions of storage and execution. The claim does not provide a specific technical improvement to the computer's underlying operation or the network's efficiency. Instead, it uses the computer as a tool to automate the abstract verification process. The focus of the claim remains the result (a verified workload) rather than a specific technical solution to a computer-centric problem. The claim fails to recite an "inventive concept" that is "significantly more" than the abstract idea itself. The steps of receiving, determining, and executing data are well-understood, routine, and conventional activities in the field of computing. The hardware limitations (processor and memory) do not add anything beyond the generic computer environment. Limiting the claim to "workload migration" serves only as a field-of-use restriction, which is insufficient to provide an inventive concept. Accordingly, claims 1, 16, and 19, are directed to an abstract idea and lacks an inventive concept, rendering them ineligible under 35 U.S.C. § 101. Claim Rejections - 35 USC § 102 07-07-aia AIA 07-07 The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action: A person shall be entitled to a patent unless – 07-12-aia AIA (a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention. 07-15-03-aia AIA Claim s 1-4, 6, 12-16, and 18-20 are rejected under 35 U.S.C. 102(a)(2) as being anticipated by Boyapalle et al. (U.S. Patent Pub. No. 2023/0134096) . Regarding claims 1, 16, and 19 , Boyapalle et al. teaches a computing device comprising: a processor (fig. 1, ref. num 101); and memory to store instructions, which when executed by the processor, cause the computing device to (fig. 1, ref. num 105): receive a workload as part of a workload migration process, from a source computing device over a network shared with the computing device (paragraph 0140); determine whether the workload has valid attestation (paragraph 0081 and 0083); establish attestation for the workload when the workload does not have valid attestation (paragraph 0073); determine whether the attestation is compliant with a policy (paragraph 0070); and execute the workload when the attestation is compliant with the policy (paragraph 0131). Regarding claim 2 , Boyapalle et al. teaches wherein the workload migration process is to migrate the workload from a cloud device to an edge device, or from an edge device to a cloud device (paragraph 0136). Regarding claim 3 , Boyapalle et al. teaches wherein the computing device is a centralized computing device that is designated as an attestation server for multiple computing devices in the network (fig. 2, ref. num 206 and paragraph 0056). Regarding claim 4 , Boyapalle et al. teaches wherein to determine whether the workload has valid attestation, the computing device is to verify the attestation with a centralized attestation service (paragraph 0040). Regarding claims 6, 18, and 20 , Boyapalle et al. teaches wherein to establish attestation for the workload, the computing device is to: perform forensic analysis on the workload; classify the workload to produce a workload classification; and generate an attestation stamp for the workload, wherein the attestation stamp includes details of the forensic analysis and the workload classification (paragraph 0069). Regarding claim 12 , Boyapalle et al. teaches wherein the policy includes requirements related to one or more of: a requirement of the workload to have a certain security profile, a requirement that the workload have multiple attestations, a requirement that the workload have a new attestation created when crossing a network boundary, a requirement that the workload be locally attested, or a requirement that the workload be attested by a central controlling node (paragraph 0006 and 0029). Regarding claim 13 , Boyapalle et al. teaches wherein the source computing device is in the same network cluster as the computing device (paragraph 0136). Regarding claim 14 , Boyapalle et al. teaches wherein the source computing device is in a different network cluster from the computing device (paragraph 0116). Regarding claim 15 , Boyapalle et al. teaches wherein the memory comprises instructions to cause the computing device to: analyze a common vulnerabilities and exposures (CVE) report to determine whether the workload has likely been infected with a vulnerability; and invalidate the attestation of the workload when the workload has likely been infected with the vulnerability (paragraph 0080-0081) . Claim Rejections - 35 USC § 103 07-20-aia AIA The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. 07-21-aia AIA Claim s 5, 7-11, and 17 are rejected under 35 U.S.C. 103 as being unpatentable over Boyapalle et al. (U.S. Patent Pub. No. 2023/0134096) in view of Reses (U.S. Patent Pub. No. 2022/0058732) . Regarding claims 5 and 17 , Boyapalle et al. teaches wherein to determine whether the workload has valid attestation (paragraph 0084). However, Boyapalle et al. does not teach the computing device is to verify the attestation by querying an immutable ledger. Reses teaches the computing device is to verify the attestation by querying an immutable ledger (paragraph 0043). It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to combine an immutable ledger, as taught by Reses , with the method of Boyapalle et al. It would have been obvious for such modifications because using an immutable ledger ensures data integrity. Regarding claim 7 , Boyapalle et al. teaches all the limitations of claim 1 above. However, Boyapalle et al. does not teach wherein the attestation stamp is stored in a standardized language. Reses teaches wherein the attestation stamp is stored in a standardized language (paragraph 0094). It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to combine storing the stamp in a standardized language, as taught by Reses , with the method of Boyapalle et al. It would have been obvious for such modifications because the standardized language enables separate systems to communicate using a standard language. Regarding claim 8 , Boyapalle et al. as modified by Reses teaches wherein the standardized language is YAML (see paragraph 0094 of Reses). Regarding claim 9 , Boyapalle et al. as modified by Reses teaches wherein the standardized language is JavaScript Object Notation (JSON) (see paragraph 0094 of Reses). Regarding claim 10 , Boyapalle et al. teaches wherein to establish attestation for the workload, the computing device is to: generate an attestation stamp (paragraph 0022). Boyapalle et al. does not teach store the attestation stamp in an immutable ledger. Reses teaches store the attestation stamp in an immutable ledger (paragraph 0043). It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to combine an immutable ledger, as taught by Reses , with the method of Boyapalle et al. It would have been obvious for such modifications because using an immutable ledger ensures data integrity. Regarding claim 11 , Boyapalle et al. as modified by Reses teaches wherein the immutable ledger is a blockchain (see paragraph 0023 of Reses). Any inquiry concerning this communication or earlier communications from the examiner should be directed to BRANDON HOFFMAN whose telephone number is (571)272-3863. The examiner can normally be reached Monday-Friday 8:30AM-5:00PM. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Pwu can be reached at (571)272-6798. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /BRANDON HOFFMAN/Primary Examiner, Art Unit 2433 Application/Control Number: 18/217,341 Page 2 Art Unit: 2433 Application/Control Number: 18/217,341 Page 3 Art Unit: 2433 Application/Control Number: 18/217,341 Page 5 Art Unit: 2433 Application/Control Number: 18/217,341 Page 6 Art Unit: 2433 Application/Control Number: 18/217,341 Page 7 Art Unit: 2433 Application/Control Number: 18/217,341 Page 8 Art Unit: 2433 Application/Control Number: 18/217,341 Page 9 Art Unit: 2433
Prosecution Insights