DETAILED ACTION
This Office action is in response to the amendment filed on April 24, 2026.
Claims 1-20 are pending.
Claims 1, 5, 7, 11, 13, and 17 are currently amended.
The 35 U.S.C. § 101 rejections of Claims 1-4, 7-10, 13-16, 19, and 20 are withdrawn in view of the Applicant’s arguments and amendments to the claims.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Internet Communications
Without a written authorization for Internet communications by the Applicant in place, the USPTO cannot communicate with the Applicant via email and will not respond via email to any Internet correspondence which contains information subject to the confidentiality requirement as set forth in 35 U.S.C. § 122, such as claimed subject matter in an interview agenda or proposed claim amendments for an Examiner’s Amendment.
Therefore, in the interest of facilitating compact prosecution, the Examiner kindly asks the Applicant to authorize Internet communications with the USPTO by using Form PTO/SB/439 (available at https://www.uspto.gov/patents/apply/forms). The form may be submitted via the USPTO patent electronic filing system (Patent Center) using the document description “Internet Communications Authorized” to facilitate processing. The written authorization for Internet communications must be submitted on a separate paper to be entitled to acceptance in accordance with 37 CFR § 1.4(c). The separate paper will facilitate processing and avoid confusion. The written authorization for Internet communications may not be submitted via an email. See MPEP § 502.03(II).
Response to Amendment
<<>> • × • <<>>
Specification
The title of the invention is not descriptive. A new title is required that is clearly indicative of the invention to which the claims are directed.
The following title is suggested: PROCESSOR ENVIRONMENT ARCHITECTURE AGNOSTIC FIRMWARE UPDATE MANAGEMENT OPERATION FOR FIXING A VULNERABILITY.
Claim Objections
Claims 1, 2-8, 12-14, and 18 are objected to because of the following informalities:
Claim 1 recites “performing a firmware management operation” in the preamble. It should read -- performing a processor environment agnostic firmware update management operation --.
<<>> + <<>> + <<>> • × • <<>> + <<>> + <<>>
Claims 1, 7, and 13 recite “the plurality of processing environments.” It should read -- the plurality of processor environments --.
<<>> + <<>> + <<>> • × • <<>> + <<>> + <<>>
Claims 1, 7, and 13 contain a typographical error: the word “and” should be added after the “identifying” step.
<<>> + <<>> + <<>> • × • <<>> + <<>> + <<>>
Claims 1, 7, and 13 recite “each of the plurality of processor environments.” It should read -- each processor environment of the plurality of processor environments --.
<<>> + <<>> + <<>> • × • <<>> + <<>> + <<>>
Claims 2, 8, and 14 contain a typographical error: the comma (,) after the word “and” should be deleted.
<<>> + <<>> + <<>> • × • <<>> + <<>> + <<>>
Claims 2-6 recite “[t]he method.” It should read -- The computer-implementable method --.
<<>> + <<>> + <<>> • × • <<>> + <<>> + <<>>
Claims 6, 12, and 18 recite “the single information handling system update.” It should read -- the single information handling system firmware update --.
Appropriate correction is required.
Claim Rejections - 35 U.S.C. § 103
The following is a quotation of 35 U.S.C. § 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 2, 7, 8, 13, 14, 19, and 20 are rejected under 35 U.S.C. § 103 as being unpatentable over US 2014/0007067 (hereinafter “Nelson”) in view of US 2023/0333755 (hereinafter “Poosapalli”).
EXAMINER’S REMARKS
In order for a reference to be proper for use in an obviousness rejection under 35 U.S.C. § 103, the reference must be analogous art to the claimed invention. In re Bigio, 381 F.3d 1320, 1325, 72 USPQ2d 1209, 1212 (Fed. Cir. 2004). A reference is analogous art to the claimed invention if: (1) the reference is from the same field of endeavor as the claimed invention (even if it addresses a different problem); or (2) the reference is reasonably pertinent to the problem faced by the inventor (even if it is not in the same field of endeavor as the claimed invention). See MPEP § 2141.01(a)(I).
The claimed invention is generally directed to performing a firmware management operation (specification, paragraph [0001]). As for the “same field of endeavor” test, Nelson is generally directed to firmware updates for hardware resources of a computing device (Abstract). As for the “reasonably pertinent” test, Poosapalli is generally directed to providing a storage extension system and method for secure and seamless access by various boot architectures (Abstract). Thus, Nelson and Poosapalli are both analogous art to the claimed invention (even if they address different problems or are not in the same field of endeavor as the claimed invention).
As per Claim 1, Nelson discloses:
A computer-implementable method (Claim 11: “A method implemented by a computing device […].”) for performing a firmware management operation, comprising:
EXAMINER’S REMARKS
The limitation “for performing a firmware management operation” in the preamble of the claim is not given any patentable weight because it is merely a statement of purpose or intended use of the claimed invention. See MPEP § 2111.02.
identifying a processor environment installed on an information handling system from the plurality of processor environments (paragraph [0013], “The firmware update system may be configured to handle firmware updates in a consistent manner across different computing platforms/architectures.”; paragraph [0020], “The computing device 102 shown in FIG. 2 includes system firmware 202 that may be associated with the particular processing system, architecture, and/or platform for the device, which in this example is depicted as being a system on chip (SoC) processor 124(1) [a processor environment installed on an information handling system].”; paragraph [0068], “[…] identifiers that are associated with resources as described above may be configured as platform specific identifiers. In this approach, the platform specific identifiers may reflect both the identity of the resource and the particular platform [identifying a processor environment installed on an information handling system from the plurality of processor environments] (emphasis added).”);
performing a processor environment agnostic firmware update management operation (paragraph [0057], “Firmware updates available for one or more of the resources are detected (block 506) and the detected firmware updates are distributed to corresponding resources to initiate firmware updates by the resources (block 508) (emphasis added).”), the processor environment agnostic firmware update management operation managing firmware updates associated with each of the plurality of processor environments (paragraph [0022], “Management of firmware updates by the firmware manager 126 may include, but is not limited to, discovery of resources and detection, analysis, acquisition, distribution, installation, and tracking of firmware updates for particular resources that are registered or otherwise designated to obtain firmware updates through the firmware update system (emphasis added).”; paragraph [0066], “The described mechanisms to discover hardware resources and distribute firmware updates may be employed across heterogeneous platforms that may have different respective computing architectures, hardware, configurations, capabilities, and so forth [the processor environment agnostic firmware update management operation managing firmware updates associated with each of the plurality of processor environments].”).
EXAMINER’S REMARKS
Applicant’s specification expressly states that “[a]s used herein, a processor environment agnostic firmware update management operation broadly refers to a firmware management operation, described in greater detail herein, performed directly, or indirectly, within a multi-processor operating environment 200 to manage firmware updates associated with a plurality of processing environments” (paragraph [0073], emphasis added). Thus, under the broadest reasonable interpretation (BRI), the plain meaning of the limitation “a processor environment agnostic firmware update management operation” includes a firmware management operation, which is consistent with the specification. Therefore, the limitation “a processor environment agnostic firmware update management operation,” given its plain meaning consistent with the specification, is mapped to Nelson’s distribution of firmware updates. See MPEP § 2173.01(I).
Nelson does not explicitly disclose:
providing an information handling system with a distributed BIOS, the distributed BIOS including a BIOS component and a BIOS variable, the distributed BIOS being implemented to function with any of a plurality of processor environments, each of the plurality of processing environments implementing a respective processor architecture.
However, Poosapalli discloses:
providing an information handling system with a distributed BIOS, the distributed BIOS including a BIOS component and a BIOS variable (paragraph [0004], “[…] an Information Handling System (IHS) may include a processor and a BIOS coupled to the processor […] (emphasis added).”; paragraph [0047], “FIGS. 6A and 6B illustrate an example PEI phase BIOS storage extension method 600 that may be provided for allocating an extended storage space for BIOS variables used by the drivers of the IHS according to one embodiment of the present disclosure (emphasis added).”), the distributed BIOS being implemented to function with any of a plurality of processor environments (paragraph [0041], “FIG. 4 illustrates an example BIOS storage extension system 400 that may be used for secure and seamless access by various boot architectures according to one embodiment of the present disclosure [the distributed BIOS being implemented to function with any of a plurality of processor environments]. The system 400 generally includes a boot process 402, such as a UEFI boot process, that takes place in multiple phases, such as a Security (SEC) phase performed by a SEC module 404, a Pre-EFI Initialization (PEI) phase performed by a PEI module 406, a driver execution environment (DXE) phase performed by a DXE module 408, and a Systems Management Mode (SMM) phase performed by a SMM module 410 on an IHS, such as IHS 100 of FIG. 1.”), each of the plurality of processing environments implementing a respective processor architecture (paragraph [0022], “[…] the IHS includes a baseboard or motherboard 100, which is a printed circuit board (PCB) to which components or devices are mounted to by way of a bus or other electrical communication path. For example, Central Processing Unit (CPU) 102 operates in conjunction with a chipset 104. CPU 102 is a processor that performs arithmetic and logic necessary for the operation of the IHS.”; paragraph [0033], “It is also contemplated that the IHS may not include all of the components shown in FIG. 1, may include other components that are not explicitly shown in FIG. 1, or may utilize a different architecture [each of the plurality of processing environments implementing a respective processor architecture].”).
EXAMINER’S REMARKS
Applicant’s specification expressly states that “[a]s used herein, a distributed BIOS 116 broadly refers to a BIOS 116 that includes a plurality of BIOS 116 components, or a plurality of BIOS 116 variables, or a plurality of BIOS 116 storage locations, or a combination thereof” (paragraph [0024], emphasis added). Thus, under the broadest reasonable interpretation (BRI), the plain meaning of the limitation “a distributed BIOS” includes a plurality of BIOS variables, which is consistent with the specification. Therefore, the limitation “a distributed BIOS,” given its plain meaning consistent with the specification, is mapped to Poosapalli’s BIOS variables. See MPEP § 2173.01(I).
As pointed out hereinabove, Nelson and Poosapalli are both analogous art to the claimed invention. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the teaching of Poosapalli into the teaching of Nelson to include “providing an information handling system with a distributed BIOS, the distributed BIOS including a BIOS component and a BIOS variable, the distributed BIOS being implemented to function with any of a plurality of processor environments, each of the plurality of processing environments implementing a respective processor architecture.” The modification would be obvious because one of ordinary skill in the art would be motivated to utilize a BIOS storage extension system for secure and seamless access by various boot architectures (Poosapalli, paragraph [0041]).
As per Claim 2, the rejection of Claim 1 is incorporated; and Nelson further discloses:
wherein:
the information handling system includes an information handling system platform architecture (paragraph [0020], “The computing device 102 shown in FIG. 2 includes system firmware 202 that may be associated with the particular processing system, architecture, and/or platform for the device, which in this example is depicted as being a system on chip (SoC) processor 124(1).”); and,
the processor environment agnostic firmware update management operation manages firmware updates associated with at least one component of the information handling system platform architecture (paragraph [0022], “Management of firmware updates by the firmware manager 126 may include, but is not limited to, discovery of resources and detection, analysis, acquisition, distribution, installation, and tracking of firmware updates for particular resources that are registered or otherwise designated to obtain firmware updates through the firmware update system.”; paragraph [0066], “The described mechanisms to discover hardware resources and distribute firmware updates may be employed across heterogeneous platforms that may have different respective computing architectures, hardware, configurations, capabilities, and so forth.”).
Claims 7 and 8 are system claims corresponding to the computer-implementable method claims hereinabove (Claims 1 and 2, respectively). Therefore, Claims 7 and 8 are rejected for the same reasons set forth in the rejections of Claims 1 and 2, respectively.
Claims 13 and 14 are non-transitory, computer-readable storage medium claims corresponding to the computer-implementable method claims hereinabove (Claims 1 and 2, respectively). Therefore, Claims 13 and 14 are rejected for the same reasons set forth in the rejections of Claims 1 and 2, respectively.
As per Claim 19, the rejection of Claim 13 is incorporated; and Nelson further discloses:
wherein:
the computer executable instructions are deployable to a client system from a server system at a remote location (Figure 7; paragraph [0057], “[…] the detected firmware updates are distributed to corresponding resources to initiate firmware updates by the resources (block 508).”; paragraph [0092], “In the example system 700, multiple devices are interconnected through a central computing device. The central computing device may be local to the multiple devices or may be located remotely from the multiple devices. In one embodiment, the central computing device may be a cloud of one or more server computers that are connected to the multiple devices through a network, the Internet, or other data communication link.”).
As per Claim 20, the rejection of Claim 13 is incorporated; and Nelson further discloses:
wherein:
the computer executable instructions are provided by a service provider to a user on an on-demand basis (Figure 7; paragraph [0057], “Firmware updates available for one or more of the resources are detected (block 506) and the detected firmware updates are distributed to corresponding resources to initiate firmware updates by the resources (block 508). Again a variety of techniques to detect available updates may be employed. For example, the firmware manager 126 may automatically check for updates upon start-up and/or periodically after system boot-up. In addition, firmware manager 126 may check for updates on-demand responsive to an explicit selection to check for updates by user input, an application request, or otherwise. Updates may be accessed and downloaded from a server over a network on an individual basis (e.g., navigation of a browser to obtain selected updates) and/or automatically as part of an overall software update management scheme implemented by the OS. In addition or alternatively, at least some updates may be transferred to a computing device using some form of computer-readable media, such as a compact disk, flash drive, or other media device.”).
Claims 3, 4, 9, 10, 15, and 16 are rejected under 35 U.S.C. § 103 as being unpatentable over Nelson in view of Poosapalli as applied to Claims 1, 7, and 13 above, and further in view of US 2023/0205508 (hereinafter “Arakkal”).
EXAMINER’S REMARKS
In order for a reference to be proper for use in an obviousness rejection under 35 U.S.C. § 103, the reference must be analogous art to the claimed invention. In re Bigio, 381 F.3d 1320, 1325, 72 USPQ2d 1209, 1212 (Fed. Cir. 2004). A reference is analogous art to the claimed invention if: (1) the reference is from the same field of endeavor as the claimed invention (even if it addresses a different problem); or (2) the reference is reasonably pertinent to the problem faced by the inventor (even if it is not in the same field of endeavor as the claimed invention). See MPEP § 2141.01(a)(I).
The claimed invention is generally directed to performing a firmware management operation (specification, paragraph [0001]). As for the “reasonably pertinent” test, Arakkal is generally directed to automatically updating one or more firmware versions based on corresponding device driver versions of a server device (Abstract). Thus, Arakkal is an analogous art to the claimed invention (even if it is not in the same field of endeavor as the claimed invention).
As per Claim 3, the rejection of Claim 1 is incorporated; and the combination of Nelson and Poosapalli discloses “the plurality of processor environments,” but the combination of Nelson and Poosapalli does not explicitly disclose:
wherein:
the processor environment agnostic firmware update management operation accesses a remote storage location when managing firmware updates associated with the plurality of processor environments.
However, Arakkal discloses:
wherein:
the processor environment agnostic firmware update management operation accesses a remote storage location when managing firmware updates […] (paragraph [0023], “[…] one or more of the host computing devices 102 can have one or more associated host manufacturer catalog databases 120 configured to store, for example, a firmware catalog comprising a mapping of a latest version of each device driver used in the respective host computing device 102 to a corresponding version of firmware that should be employed. In some embodiments, the firmware catalog may comprise a mapping one or more versions of each device driver to one or more corresponding compatible versions of firmware.” and “The host manufacturer catalog database 120 may be accessed by the disclosed techniques for firmware update. Typically, manufacturers and/or vendors of the host computing devices 102 publish such a catalog.”).
As pointed out hereinabove, Arakkal is an analogous art to the claimed invention. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the teaching of Arakkal into the combined teachings of Nelson and Poosapalli to include “wherein: the processor environment agnostic firmware update management operation accesses a remote storage location when managing firmware updates associated with the plurality of processor environments.” The modification would be obvious because one of ordinary skill in the art would be motivated to access a host manufacturer catalog database for firmware updates (Arakkal, paragraph [0023]).
As per Claim 4, the rejection of Claim 3 is incorporated; and the combination of Nelson and Poosapalli does not explicitly disclose:
wherein:
the remote storage location maintains a catalog of a plurality of firmware component updates.
However, Arakkal discloses:
wherein:
the remote storage location maintains a catalog of a plurality of firmware component updates (paragraph [0023], “[…] one or more of the host computing devices 102 can have one or more associated host manufacturer catalog databases 120 configured to store, for example, a firmware catalog comprising a mapping of a latest version of each device driver used in the respective host computing device 102 to a corresponding version of firmware that should be employed. In some embodiments, the firmware catalog may comprise a mapping one or more versions of each device driver to one or more corresponding compatible versions of firmware.” and “The host manufacturer catalog database 120 may be accessed by the disclosed techniques for firmware update. Typically, manufacturers and/or vendors of the host computing devices 102 publish such a catalog.”).
As pointed out hereinabove, Arakkal is an analogous art to the claimed invention. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the teaching of Arakkal into the combined teachings of Nelson and Poosapalli to include “wherein: the remote storage location maintains a catalog of a plurality of firmware component updates.” The modification would be obvious because one of ordinary skill in the art would be motivated to provide a mapping of a latest firmware version of each component of an IHS to a corresponding version of firmware that should be employed (Arakkal, paragraph [0023]).
Claims 9 and 10 are system claims corresponding to the computer-implementable method claims hereinabove (Claims 3 and 4, respectively). Therefore, Claims 9 and 10 are rejected for the same reasons set forth in the rejections of Claims 3 and 4, respectively.
Claims 15 and 16 are non-transitory, computer-readable storage medium claims corresponding to the computer-implementable method claims hereinabove (Claims 3 and 4, respectively). Therefore, Claims 15 and 16 are rejected for the same reasons set forth in the rejections of Claims 3 and 4, respectively.
Claims 5, 6, 11, and 12 are rejected under 35 U.S.C. § 103 as being unpatentable over Nelson in view of Poosapalli as applied to Claims 1 and 7 above, and further in view of US 2024/0095012 (hereinafter “Jain”) and US 2023/0239317 (hereinafter “Ganesan”).
EXAMINER’S REMARKS
In order for a reference to be proper for use in an obviousness rejection under 35 U.S.C. § 103, the reference must be analogous art to the claimed invention. In re Bigio, 381 F.3d 1320, 1325, 72 USPQ2d 1209, 1212 (Fed. Cir. 2004). A reference is analogous art to the claimed invention if: (1) the reference is from the same field of endeavor as the claimed invention (even if it addresses a different problem); or (2) the reference is reasonably pertinent to the problem faced by the inventor (even if it is not in the same field of endeavor as the claimed invention). See MPEP § 2141.01(a)(I).
The claimed invention is generally directed to performing a firmware management operation (specification, paragraph [0001]). As for the “reasonably pertinent” test, Jain is generally directed to automated firmware recommendation systems that inject the intelligence of machine learning into the firmware recommendation process (Abstract). And Ganesan is generally directed to identifying and mitigating security vulnerabilities in multi-layer infrastructure stacks (Abstract). Thus, Jain and Ganesan are both analogous art to the claimed invention (even if they are not in the same field of endeavor as the claimed invention).
As per Claim 5, the rejection of Claim 1 is incorporated; and the combination of Nelson and Poosapalli does not explicitly disclose:
wherein:
the processor environment agnostic firmware update management operation accesses a vulnerability chain accelerator when managing firmware updates, the vulnerability chain accelerator dynamically interpolating all reported firmware updates for a platform and recommending a single information handling system firmware update.
However, Jain discloses:
wherein:
the processor environment agnostic firmware update management operation accesses a vulnerability chain accelerator when managing firmware updates, the vulnerability chain accelerator dynamically interpolating all reported firmware updates for a platform and recommending a single information handling system firmware update (paragraph [0078], “[…] prior to making the recommendation of instruction 420, hardware processor 412 can identify, as insecure, one or more of the compatible prospective update firmware versions (e.g., hardware processor 412 can measure a level of security for a prospective update firmware version according to a numerical score, and all prospective update firmware versions which do not meet a ‘security threshold’ may be identified as insecure). In these examples, hardware processor 412 may execute instruction 420 to recommend, for the group of network devices, the compatible prospective update firmware version having the highest aggregate firmware version score among compatible prospective update firmware versions, that has not been identified as insecure.”).
As pointed out hereinabove, Jain is an analogous art to the claimed invention. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the teaching of Jain into the combined teachings of Nelson and Poosapalli to include “wherein: the processor environment agnostic firmware update management operation accesses a vulnerability chain accelerator when managing firmware updates, the vulnerability chain accelerator dynamically interpolating all reported firmware updates for a platform and recommending a single information handling system firmware update.” The modification would be obvious because one of ordinary skill in the art would be motivated to recommend, to a processor environment, an update to an available update firmware version having the highest aggregate firmware update likelihood score among available update firmware versions compatible on a plurality of processor environments (Jain, paragraph [0019]).
The combination of Nelson, Poosapalli, and Jain does not explicitly disclose:
the vulnerability chain accelerator maintaining a database of vulnerabilities along with corresponding fixed firmware versions of the vulnerabilities.
However, Ganesan discloses:
the vulnerability chain accelerator maintaining a database of vulnerabilities along with corresponding fixed firmware versions of the vulnerabilities (paragraph [0065], “The infrastructure stack vulnerability mitigation server 500 may interact over the network 104, for example, to access a vulnerability catalog database 520 configured to store, for example, one or more vulnerability catalogs, as discussed further below.”; paragraph [0082], “[…] one or more vulnerability catalogs (e.g., glossaries that classify vulnerabilities) are employed that comprise details about known vulnerabilities per infrastructure component. In addition, update catalogs comprise information for each component of the fixes and/or other mitigation actions related to such vulnerabilities (e.g., identifying which version of an infrastructure component (e.g., a driver) fixes an identified security vulnerability). Thus, given an infrastructure component, it is possible to extract one or more potential vulnerabilities, as well as the updates that will fix or mitigate such vulnerabilities.”).
As pointed out hereinabove, Ganesan is an analogous art to the claimed invention. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the teaching of Ganesan into the combined teachings of Nelson, Poosapalli, and Jain to include “the vulnerability chain accelerator maintaining a database of vulnerabilities along with corresponding fixed firmware versions of the vulnerabilities.” The modification would be obvious because one of ordinary skill in the art would be motivated to extract one or more potential vulnerabilities, as well as updates that will fix or mitigate such vulnerabilities (Ganesan, paragraph [0082]).
As per Claim 6, the rejection of Claim 5 is incorporated; and the combination of Nelson, Poosapalli, and Ganesan does not explicitly disclose:
wherein:
the single information handling system update is provided to the information handling system via a fully interpolated firmware module update array.
However, Jain discloses:
wherein:
the single information handling system update is provided to the information handling system via a fully interpolated firmware module update array (paragraph [0078], “[…] prior to making the recommendation of instruction 420, hardware processor 412 can identify, as insecure, one or more of the compatible prospective update firmware versions (e.g., hardware processor 412 can measure a level of security for a prospective update firmware version according to a numerical score, and all prospective update firmware versions which do not meet a ‘security threshold’ may be identified as insecure). In these examples, hardware processor 412 may execute instruction 420 to recommend, for the group of network devices, the compatible prospective update firmware version having the highest aggregate firmware version score among compatible prospective update firmware versions, that has not been identified as insecure.”).
As pointed out hereinabove, Jain is an analogous art to the claimed invention. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the teaching of Jain into the combined teachings of Nelson, Poosapalli, and Ganesan to include “wherein: the single information handling system update is provided to the information handling system via a fully interpolated firmware module update array.” The modification would be obvious because one of ordinary skill in the art would be motivated to recommend, to a processor environment, an update to an available update firmware version having the highest aggregate firmware update likelihood score among available update firmware versions compatible on a plurality of processor environments (Jain, paragraph [0019]).
Claims 11 and 12 are system claims corresponding to the computer-implementable method claims hereinabove (Claims 5 and 6, respectively). Therefore, Claims 11 and 12 are rejected for the same reasons set forth in the rejections of Claims 5 and 6, respectively.
Claims 17 and 18 are rejected under 35 U.S.C. § 103 as being unpatentable over Nelson in view of Poosapalli and Arakkal as applied to Claim 16 above, and further in view of US 2024/0095012 (hereinafter “Jain”) and US 2023/0239317 (hereinafter “Ganesan”).
EXAMINER’S REMARKS
In order for a reference to be proper for use in an obviousness rejection under 35 U.S.C. § 103, the reference must be analogous art to the claimed invention. In re Bigio, 381 F.3d 1320, 1325, 72 USPQ2d 1209, 1212 (Fed. Cir. 2004). A reference is analogous art to the claimed invention if: (1) the reference is from the same field of endeavor as the claimed invention (even if it addresses a different problem); or (2) the reference is reasonably pertinent to the problem faced by the inventor (even if it is not in the same field of endeavor as the claimed invention). See MPEP § 2141.01(a)(I).
The claimed invention is generally directed to performing a firmware management operation (specification, paragraph [0001]). As for the “reasonably pertinent” test, Jain is generally directed to automated firmware recommendation systems that inject the intelligence of machine learning into the firmware recommendation process (Abstract). And Ganesan is generally directed to identifying and mitigating security vulnerabilities in multi-layer infrastructure stacks (Abstract). Thus, Jain and Ganesan are both analogous art to the claimed invention (even if they are not in the same field of endeavor as the claimed invention).
As per Claim 17, the rejection of Claim 16 is incorporated; and the combination of Nelson, Poosapalli, and Arakkal does not explicitly disclose:
wherein:
the processor environment agnostic firmware update management operation accesses a vulnerability chain accelerator when managing firmware updates, the vulnerability chain accelerator dynamically interpolating all reported firmware updates for a platform and recommending a single information handling system firmware update.
However, Jain discloses:
wherein:
the processor environment agnostic firmware update management operation accesses a vulnerability chain accelerator when managing firmware updates, the vulnerability chain accelerator dynamically interpolating all reported firmware updates for a platform and recommending a single information handling system firmware update (paragraph [0078], “[…] prior to making the recommendation of instruction 420, hardware processor 412 can identify, as insecure, one or more of the compatible prospective update firmware versions (e.g., hardware processor 412 can measure a level of security for a prospective update firmware version according to a numerical score, and all prospective update firmware versions which do not meet a ‘security threshold’ may be identified as insecure). In these examples, hardware processor 412 may execute instruction 420 to recommend, for the group of network devices, the compatible prospective update firmware version having the highest aggregate firmware version score among compatible prospective update firmware versions, that has not been identified as insecure.”).
As pointed out hereinabove, Jain is an analogous art to the claimed invention. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the teaching of Jain into the combined teachings of Nelson, Poosapalli, and Arakkal to include “wherein: the processor environment agnostic firmware update management operation accesses a vulnerability chain accelerator when managing firmware updates, the vulnerability chain accelerator dynamically interpolating all reported firmware updates for a platform and recommending a single information handling system firmware update.” The modification would be obvious because one of ordinary skill in the art would be motivated to recommend, to a processor environment, an update to an available update firmware version having the highest aggregate firmware update likelihood score among available update firmware versions compatible on a plurality of processor environments (Jain, paragraph [0019]).
The combination of Nelson, Poosapalli, Arakkal, and Jain does not explicitly disclose:
the vulnerability chain accelerator maintaining a database of vulnerabilities along with corresponding fixed firmware versions of the vulnerabilities.
However, Ganesan discloses:
the vulnerability chain accelerator maintaining a database of vulnerabilities along with corresponding fixed firmware versions of the vulnerabilities (paragraph [0065], “The infrastructure stack vulnerability mitigation server 500 may interact over the network 104, for example, to access a vulnerability catalog database 520 configured to store, for example, one or more vulnerability catalogs, as discussed further below.”; paragraph [0082], “[…] one or more vulnerability catalogs (e.g., glossaries that classify vulnerabilities) are employed that comprise details about known vulnerabilities per infrastructure component. In addition, update catalogs comprise information for each component of the fixes and/or other mitigation actions related to such vulnerabilities (e.g., identifying which version of an infrastructure component (e.g., a driver) fixes an identified security vulnerability). Thus, given an infrastructure component, it is possible to extract one or more potential vulnerabilities, as well as the updates that will fix or mitigate such vulnerabilities.”).
As pointed out hereinabove, Ganesan is an analogous art to the claimed invention. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the teaching of Ganesan into the combined teachings of Nelson, Poosapalli, Arakkal, and Jain to include “the vulnerability chain accelerator maintaining a database of vulnerabilities along with corresponding fixed firmware versions of the vulnerabilities.” The modification would be obvious because one of ordinary skill in the art would be motivated to extract one or more potential vulnerabilities, as well as updates that will fix or mitigate such vulnerabilities (Ganesan, paragraph [0082]).
As per Claim 18, the rejection of Claim 17 is incorporated; and the combination of Nelson, Poosapalli, Arakkal, and Ganesan does not explicitly disclose:
wherein:
the single information handling system update is provided to the information handling system via a fully interpolated firmware module update array.
However, Jain discloses:
wherein:
the single information handling system update is provided to the information handling system via a fully interpolated firmware module update array (paragraph [0078], “[…] prior to making the recommendation of instruction 420, hardware processor 412 can identify, as insecure, one or more of the compatible prospective update firmware versions (e.g., hardware processor 412 can measure a level of security for a prospective update firmware version according to a numerical score, and all prospective update firmware versions which do not meet a ‘security threshold’ may be identified as insecure). In these examples, hardware processor 412 may execute instruction 420 to recommend, for the group of network devices, the compatible prospective update firmware version having the highest aggregate firmware version score among compatible prospective update firmware versions, that has not been identified as insecure.”).
As pointed out hereinabove, Jain is an analogous art to the claimed invention. Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the teaching of Jain into the combined teachings of Nelson, Poosapalli, Arakkal, and Ganesan to include “wherein: the single information handling system update is provided to the information handling system via a fully interpolated firmware module update array.” The modification would be obvious because one of ordinary skill in the art would be motivated to recommend, to a processor environment, an update to an available update firmware version having the highest aggregate firmware update likelihood score among available update firmware versions compatible on a plurality of processor environments (Jain, paragraph [0019]).
Response to Arguments
Applicant’s arguments filed on April 24, 2026 with respect to the 35 U.S.C. § 103 rejections of the claims have been fully considered, but they are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the Applicant’s arguments.
Pertinent Prior Art
The prior art made of record and not relied upon is considered pertinent to the Applicant’s disclosure. They are as follows:
US 2014/0007069 (hereinafter “Cavalaris”) discloses handling firmware updates for hardware resources of a computing device.
<<>> + <<>> + <<>> • × • <<>> + <<>> + <<>>
US 2015/0242630 (hereinafter “Barkelew”) discloses securing BIOS variables.
<<>> + <<>> + <<>> • × • <<>> + <<>> + <<>>
US 2015/0333957 (hereinafter “James”) discloses improving configuration flexibility at a cluster compute server by distributing configuration parameters from a central management node of the server to multiple compute nodes.
<<>> + <<>> + <<>> • × • <<>> + <<>> + <<>>
US 2019/0087582 (hereinafter “Villatel”) discloses basic input/output system (BIOS) security.
<<>> + <<>> + <<>> • × • <<>> + <<>> + <<>>
US 2019/0236280 (hereinafter “Sheng”) discloses security verification in gaming machines that use a multi-core processor.
<<>> + <<>> + <<>> • × • <<>> + <<>> + <<>>
US 2023/0026664 (hereinafter “Catena”) discloses access filter for BIOS variables.
<<>> + <<>> + <<>> • × • <<>> + <<>> + <<>>
US 2023/0168901 (hereinafter “Hung”) discloses BIOS variable-based application deployments.
<<>> + <<>> + <<>> • × • <<>> + <<>> + <<>>
US 2023/0185481 (hereinafter “Jeansonne”) discloses BIOS variables storage.
<<>> + <<>> + <<>> • × • <<>> + <<>> + <<>>
US 2024/0143341 (hereinafter “Poornachandran”) discloses determining one or more configurable firmware variables of a computing system based on performance analysis data of the computing system executing a workload.
<<>> + <<>> + <<>> • × • <<>> + <<>> + <<>>
“Dell PowerEdge BIOS and UEFI Reference Guide,” 2020 (hereinafter “Dell_PowerEdge_BIOS_UEFI”) discloses the Dell PowerEdge BIOS and UEFI reference guide.
Conclusion
Applicant’s amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR § 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR § 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the date of this final action.
Any inquiry concerning this communication or earlier communications from the Examiner should be directed to Qing Chen whose telephone number is 571-270-1071. The Examiner can normally be reached on Monday through Friday from 9:00 AM to 5:00 PM ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, the Applicant is encouraged to use the USPTO Automated Interview Request (AIR) at https://www.uspto.gov/ interviewpractice.
If attempts to reach the Examiner by telephone are unsuccessful, the Examiner’s supervisor, Wei Mui, can be reached at 571-272-3708. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for more information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO customer service representative, call 800-786-9199 (in USA or Canada) or 571-272-1000.
/Qing Chen/
Primary Examiner, Art Unit 2191
Prosecution Insights