DETAILED ACTION
In a communication received on 21 January 2026, applicants amended claims 1, 8 and 9.
Claims 1-10 are pending.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant’s arguments with respect to claim(s) 1, 8, 9, and 10 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1, 9, and 10 is/are rejected under 35 U.S.C. 103 as being unpatentable over Hwang et al. (US 2013/0097707 A1) in view of Brennan (US 2007/0028110 A1), and further in view of Joshi et al. (WO 2005/043360 A1).
With respect to claim 1, Hwang discloses: a method (i.e., method implemented as program instructions on a computer readable memory in Hwang, ¶0111) of managing an externally imported file (i.e., tracing a distributor and distribution route for a file transferred to a terminal, using cached file IDs, distributor information, and new-file detection, file may be imported from outside such as a from a URL in Hwang, ¶0001, ¶0004, ¶0009-¶0012, ¶0020-0022);
a file information collection step of collecting file information of a file in response to the file being determined as the monitoring target file (i.e., after the file is determined, it collects a header/whole-file identifier or hash and associated URL, IP, port, and process/distributor information, in Hwang, ¶0047-¶0049, ¶0068);
an externally imported file determination step of determining whether the file is the externally imported file based on the file information and network traffic information, wherein the network traffic information is input/output traffic information periodically collected from the target process (i.e., comparing generated-file information with network-filter packet/transaction information, cached URL/IP/port data, and matching file/hash data to identify network-transferred files in Hwang, ¶0039, ¶0049-¶0053); and
an import information recording step of recording import information in the file information in response to the file being determined as the externally imported file (i.e., caches/stores file identification, distributor information, route information, and network information, then extracts distributor data when the generated file is identified in Hwang, ¶0029, ¶0031, ¶0049-¶0050, ¶0099),
wherein the externally imported file identifier information is stored in a database (i.e., DB storing file identification values and distributor information used to identify externally imported/distributed files in Hwang, ¶0011, ¶0099).
Hwang discloses at terminal receiving a new file and compare identification value with files that are cached to extract distributor information (¶0036). Hwang do(es) not explicitly disclose the following. Brennan, in order to improve enterprise security through server-configured file monitoring and state records (¶0013), discloses: the method comprising:
a monitoring target determination step of determining whether a created file is a monitoring target file based on a target process and a target extension of management policy information received from a management server (i.e., server-configured policies analyze file-system activity by file class/extension and process name, so a created file can be screened against target process and target extension in Brennan, ¶0009, ¶0031, ¶0042, ¶0126),
wherein the file information includes storage location information identifying a specific folder in which the file is currently stored, device identification information identifying a specific terminal or identifying a specific file server in which the file is currently stored, and externally imported file identifier information indicating whether the file is an externally imported file (i.e., explicit metadata: status/state, file path, first/last host file path, host IP, first-seen host, host ID, and file type; see host file name/path/extension last seen, host IP address and FindFile returns the file path, name of host, ip address in Brennan, ¶0091, ¶0113, ¶0146-¶0159),
wherein the externally imported file identifier information is associated at least with the storage location information and the device identification information (i.e., keeping status/state in the same metadata context as file path, host path, host IP, first-seen host, host ID, and file type in Brennan, ¶0091, ¶0113, ¶0146).
Based on Hwang in view of Brennan, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Brennan to improve upon those of Hwang in order to improve enterprise security through server-configured file monitoring and state records.
Hwang discloses new files distributed from another file may be traced including their route, tracking the distribution chain (¶0081). Hwang and Brennan do(es) not explicitly disclose the following. Joshi, in order to preserve the persistence of classification information for files to prevent content flowing across restricted boundaries (¶0046), discloses:
wherein the storage location information and the device identification information are stored in the file (i.e., storing that information in the file itself by persistently tagging external-origin content through alternate streams, attributes, or an informational header/footer carrying origin details; "original classification persists with the content" in Joshi, ¶0046, ¶0051-¶0052, ¶0055, ¶0083).
Based on Hwang in view of Brennan, and further in view of Joshi, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Joshi to improve upon those of Hwang in order to preserve the persistence of classification information for files to prevent content flowing across restricted boundaries.
With respect to claim 9, the limitation(s) of claim 9 are similar to those of claim(s) 1. Therefore, claim 9 is rejected with the same reasoning as claim(s) 1.
With respect to claim 10, the limitation(s) of claim 10 are similar to those of claim(s) 1. Therefore, claim 10 is rejected with the same reasoning as claim(s) 1.
Claim(s) 2-4 and 6-8 is/are rejected under 35 U.S.C. 103 as being unpatentable over Hwang et al. (US 2013/0097707 A1) in view of Brennan (US 2007/0028110 A1) and Joshi et al. (WO 2005/043360 A1), and further in view of Kronenberg et al. (US 2007/0174911 A1).
With respect to claim 2, Hwang discloses tracing distribution route of new file by extracting information about the distributor (¶0081). Hwang, Brennan, and Joshi do(es) not explicitly disclose the following. Kronenberg, in order to improved tracing of monitored file-origins including information on container files (¶0010), discloses: the method of claim 1, wherein: the monitoring target determination step is performed in response to occurrence of an event that the file is created at a kernel level (i.e., process monitoring at the kernel-level for logging an event, file relationship and process to trace back a file to a particular source; system actions identified as file origin events such as a file created by a download in Kronenberg, ¶0018, ¶0028).
Based on Hwang in view of Brennan and Joshi, and further in view of Kronenberg, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Kronenberg to improve upon those of Hwang in order to improved tracing of monitored file-origins including information on container files.
With respect to claim 3, Hwang discloses tracing distribution route of new file by extracting information about the distributor (¶0081). Hwang, Brennan, and Joshi do(es) not explicitly disclose the following. Kronenberg, in order to improved tracing of monitored file-origins including information on container files (¶0010), discloses: the method of claim 2, wherein: the monitoring target determination step is performed by determining that the file is the monitoring target file in response to a case in which a process of the file is the same as the target process (i.e., identifying file origin events corresponding to e-mail clients, web browsers, installers to record a relationship with the file and the source program and source location in Kronenberg, ¶0019-0020)
and an extension of the file is the same as the target extension. (i.e., a container type file such as .zip is a defined event to trigger monitoring and creation of record and source location relationship among the extracted file and the .zip file in Kronenberg, ¶0036).
Based on Hwang in view of Brennan and Joshi, and further in view of Kronenberg, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Kronenberg to improve upon those of Hwang in order to improved tracing of monitored file-origins including information on container files.
With respect to claim 4, Hwang discloses tracing distribution route of new file by extracting information about the distributor (¶0081). Hwang, Brennan, and Joshi do(es) not explicitly disclose the following. Kronenberg, in order to improved tracing of monitored file-origins including information on container files (¶0010), discloses: the method of claim 3, wherein: the externally imported file determination step is performed by determining that the file is the externally imported file in response to the case in which the file information is related to the network traffic information (i.e., tracing the origin of a file in response to an event to determine the URL external location of the file indicating that the file originates from an external location corresponding to container files that were downloaded; the network traffic information corresponding to a network download of an origin file from a website in Kronenberg, ¶0009-0010, ¶0033).
Based on Hwang in view of Brennan and Joshi, and further in view of Kronenberg, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Kronenberg to improve upon those of Hwang in order to improved tracing of monitored file-origins including information on container files.
With respect to claim 6, Hwang discloses tracing distribution route of new file by extracting information about the distributor (¶0081). Hwang, Brennan, and Joshi do(es) not explicitly disclose the following. Kronenberg, in order to improved tracing of monitored file-origins including information on container files (¶0010), discloses: the method of claim 1, wherein:
recording of the import information is performed by changing pre-recorded last import information of the file information in response to a case in which there is pre-recorded import information in the file information (i.e., iteratively adding new precursor file and source location to the origin path list corresponding to the file of interest until a chain leads to recording the original file and its source to the file of interest in Kronenberg, ¶0029-0030),
recording of the import information is performed by recording initial import information (i.e., indication of the file of interest involved in the original event in Kronenberg, ¶0020)
and last import information (i.e., creating a record including the precursor file which may be in a chain of files leading to source location in Kronenberg, ¶0020)
of the file information in response to the case in which there is no pre-recorded import information in the file information (i.e., upon initial creation of file and an event, adding a new record for a file download to record the relationship of file, precursor file/program and source location of file in Kronenberg, ¶0020).
Based on Hwang in view of Brennan and Joshi, and further in view of Kronenberg, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Kronenberg to improve upon those of Hwang in order to improved tracing of monitored file-origins including information on container files.
With respect to claim 7, Hwang discloses tracing distribution route of new file by extracting information about the distributor (¶0081). Hwang, Brennan, and Joshi do(es) not explicitly disclose the following. Kronenberg, in order to improved tracing of monitored file-origins including information on container files (¶0010), discloses: the method of claim 1, wherein:
the recorded import information and detection information received from the management server is used to detect the externally imported file among files input/output in real time (i.e., upon detecting malicious behavior, the chain of file relationships can be identified for files of external origins; security rules trigger programmatic threat response in real time to specified files, network activity, and processes in Kronenberg, ¶0038, ¶0042),
the detected externally imported file is processed based on processing rule information received from the management server (i.e., central server distributing signatures to supplement and cause enforcement of security policies; rules for programmatic threat response in Kronenberg, ¶0031, ¶0042),
the processing is any one of classification, deletion or encryption (i.e., containment or removal of malicious file, categorize files based on origin as safe or malicious downloads to approve or block downloads in Kronenberg, ¶0011, ¶0039).
Based on Hwang in view of Brennan and Joshi, and further in view of Kronenberg, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Kronenberg to improve upon those of Hwang in order to improved tracing of monitored file-origins including information on container files.
With respect to claim 8, Hwang discloses tracing distribution route of new file by extracting information about the distributor (¶0081). Hwang, Brennan, and Joshi do(es) not explicitly disclose the following. Kronenberg, in order to improved tracing of monitored file-origins including information on container files (¶0010), discloses: the method of claim 1, wherein: the recorded import information is maintained as it is although the file is copied or moved to other terminal or other file server (i.e., the recorded information may be compiled into signatures and the information may be redistributed from a central server to maintain the source location of the file on other devices in Kronenberg, ¶0010).
Based on Hwang in view of Brennan and Joshi, and further in view of Kronenberg, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Kronenberg to improve upon those of Hwang in order to improved tracing of monitored file-origins including information on container files.
Claim(s) 5 is/are rejected under 35 U.S.C. 103 as being unpatentable over Hwang et al. (US 2013/0097707 A1) in view of Brennan (US 2007/0028110 A1), Joshi et al. (WO 2005/043360 A1) and Kronenberg et al. (US 2007/0174911 A1), and further in view of Monaco et al. (US 2018/0191755 A1).
With respect to claim 5, Hwang discloses storing the identification and network information together for monitoring files and their movement (¶0049-0050). Hwang, Brennan, Joshi, and Kronenberg do(es) not explicitly disclose the following. Monaco, in order to improve file monitoring by determining transfer of files based on calculated size threshold (¶0049), discloses: the method of claim 4, wherein: a determination of the relevance is performed by comparing a file size of the file information with a size of input/output data of the network traffic information at a time when the file is created (i.e., determining a file size being created and transferred from storage that corresponds algorithmically to the collected network traffic data suggesting a size of files within the network traffic in Monaco, ¶0049).
Based on Hwang in view of Brennan, Joshi and Kronenberg, and further in view of Monaco, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to utilize the teachings of Monaco to improve upon those of Hwang in order to improve file monitoring by determining transfer of files based on calculated size threshold.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SHERMAN L LIN whose telephone number is (571)270-7446. The examiner can normally be reached Monday through Friday 9:00 AM - 5:00 PM (Eastern).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Joon Hwang can be reached on 571-272-4036. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
Sherman Lin
5/23/2026
/S. L./Examiner, Art Unit 2447
/JOON H HWANG/Supervisory Patent Examiner, Art Unit 2447
Prosecution Insights