DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Drawings
The drawings submitted on February 9, 2024 have been considered and accepted.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966), that are applied for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-19 are rejected under 35 U.S.C. 103 as being unpatentable over Ohta et al. (Pub.t No. US 2008/0155509), hereinafter Ohta; in view of Riley (Pub. No. US 2022/0083673), hereinafter Riley.
Claim 1. Ohta discloses a system for automatic generation of a whitelist for computer security, the system comprising:
computer instructions running on a processor opens the list; the computer instructions running on the processor reads an installation file, calculates a calculated check value for the installation file, and compare the calculated check value to a stored check value, the stored check value is within the installation file (See Parag. [0090]; receive a file of a monitoring target software program or a software update package. See Parag. [0169]; the integrity monitoring unit 42 is a subsystem of the monitoring unit 37 and is configured to calculate a hash value of a monitoring target software program (a memory or file) in accordance with the parameter setting information (the address at which the monitoring target software program is stored, or the size of the monitoring target software program).The integrity monitoring unit 42 is configured to then compare the calculated hash value of the monitoring target software program with a original hash value included in the monitoring setting information, of the monitoring target software program); and
the computer instructions parse the installation file into elements and for each element of the elements, the computer instructions decompress the each element and when the each element is a program, the computer instructions calculate a check value for the program and adds an entry to the list comprising a name of the program and the check value for the program (See Parag. [0090]; the monitoring setting information input unit 11 may be configured to receive a file of a monitoring target software program or a software update package, then to calculate the hash value of or size of the monitoring target software program by itself, and thus to obtain the result of the calculation as the monitoring setting information. See Parag. [0092-0094]; the monitoring setting information management unit 12 is configured to store monitoring setting information corresponding to a plurality of monitoring target software programs. The monitoring setting information management unit 12 is configured to store the monitoring setting information obtained by the monitoring setting input unit 11 in a memory or file system as an arbitrary format such as a table format or list format. It should be noted that the monitoring setting information management unit 12 is configured to update (overwrite) monitoring setting information to newly obtained monitoring setting information in a case where the monitoring setting information management unit 12 already stores monitoring setting information including the same identifier of the monitoring target software program as the identifier of the monitoring target software program included in the monitoring setting information obtained by the monitoring setting information input unit 11. See Parag. [0076-0077]; FIG. 2 is monitoring setting information includes an identifier of the monitoring target software program, a hash value of the monitoring target software program, an address in which the monitoring target software program is stored, a size of the monitoring target software program and monitoring scheduling information. The identifier of the monitoring target software program may be the identification number of the monitoring target software program or a character string (for example, a file name) for identifying a file constituting the monitoring target software program. See Parag. [0150]; in a case where the file constituting the monitoring information is compressed, the monitoring setting information management unit 36 decompresses the file for the same purpose. See also Figs 13, 18, 21).
Ohta doesn’t explicitly disclose the list comprising the name of the program and the check value for the program is a whitelist.
However, Riley discloses a whitelist comprising the name of the program and the check value for the program (See Parag. [0068]; Each entry of the whitelist 15 includes information regarding the approved program or directory such as the date of approval, the name of the program 602, a hash value of the program 604, and a signature of the program 606).
It would have been obvious to one of ordinary skill in the art at the time before the effective filling date of the claimed invention to modify the teaching, taught by Ohta, to include a whitelist comprising the name of the program and the check value for the program, as taught by Riley. This would be convenient to provides an automated way to prevent execution of software containing code that is potentially contaminated (e.g., contains or is malicious software) (Riley, Parag. [0027]).
Claim 2. Ohta in view of Riley discloses the system for automatic generation of the whitelist for computer security of claim 1,
Ohta further discloses the system further comprising: until all installation files are processed, the computer instructions running on the processor reads a next installation file, calculates the calculated check value for the next installation file, and compares the calculated check value to a stored check value, the stored check value is within the next installation file (See Parag. [0090]; the monitoring setting information input unit 11 may be configured to receive a file of a monitoring target software program or a software update package, then to calculate the hash value of or size of the monitoring target software program by itself, and thus to obtain the result of the calculation as the monitoring setting information. See Parag. [0092]; the monitoring setting information management unit 12 is configured to store monitoring setting information corresponding to a plurality of monitoring target software programs. See Parag. [0169]; The integrity monitoring unit 42 is a subsystem of the monitoring unit 37 and is configured to calculate a hash value of a monitoring target software program (a memory or file) in accordance with the parameter setting information (the address at which the monitoring target software program is stored, or the size of the monitoring target software program). The integrity monitoring unit 42 is configured to then compare the calculated hash value of the monitoring target software program with a original hash value included in the monitoring setting information, of the monitoring target software program, then to determine that anomaly has occurred in the monitoring target software program when the two hash values do not match with each other, and thus to call the anomaly state handling unit 38);
when the calculated check value does not match the stored check value, the computer instructions stop (See Parag. [0169-0170]; determine that anomaly has occurred in the monitoring target software program when the two hash values do not match with each other, and thus to call the anomaly state handling unit 38. The integrity monitoring unit 42 is assumed to be called periodically or at the time of an occurrence of a predetermined event); and
the computer instructions parse the next installation file into the elements and for the each element of the elements, the computer instructions decompresses the each element and when the each element is the program, the computer instructions calculate the check value for the program and adds another entry to the list comprising the name of the program and the check value for the program (See Parag. [0090]; the monitoring setting information input unit 11 may be configured to receive a file of a monitoring target software program or a software update package, then to calculate the hash value of or size of the monitoring target software program by itself, and thus to obtain the result of the calculation as the monitoring setting information. See Parag. [0092-0094]; the monitoring setting information management unit 12 is configured to store monitoring setting information corresponding to a plurality of monitoring target software programs. The monitoring setting information management unit 12 is configured to store the monitoring setting information obtained by the monitoring setting input unit 11 in a memory or file system as an arbitrary format such as a table format or list format. It should be noted that the monitoring setting information management unit 12 is configured to update (overwrite) monitoring setting information to newly obtained monitoring setting information in a case where the monitoring setting information management unit 12 already stores monitoring setting information including the same identifier of the monitoring target software program as the identifier of the monitoring target software program included in the monitoring setting information obtained by the monitoring setting information input unit 11. See Parag. [0076-0077]; FIG. 2 is monitoring setting information includes an identifier of the monitoring target software program, a hash value of the monitoring target software program, an address in which the monitoring target software program is stored, a size of the monitoring target software program and monitoring scheduling information. The identifier of the monitoring target software program may be the identification number of the monitoring target software program or a character string (for example, a file name) for identifying a file constituting the monitoring target software program. See Parag. [0150]; in a case where the file constituting the monitoring information is compressed, the monitoring setting information management unit 36 decompresses the file for the same purpose. See also Figs 13, 18, 21).
Riley further discloses a whitelist comprising the name of the program and the check value for the program (See Parag. [0068]; Each entry of the whitelist 15 includes information regarding the approved program or directory such as the date of approval, the name of the program 602, a hash value of the program 604, and a signature of the program 606).
It would have been obvious to one of ordinary skill in the art at the time before the effective filling date of the claimed invention to modify the teaching, taught by Ohta, to include a whitelist comprising the name of the program and the check value for the program, as taught by Riley. This would be convenient to provides an automated way to prevent execution of software containing code that is potentially contaminated (e.g., contains or is malicious software) (Riley, Parag. [0027]).
Claim 3. Ohta in view of Riley discloses the system for automatic generation of the whitelist for computer security of claim 2,
Riley further discloses the system further comprising: the computer instructions save the whitelist and the computer instructions transmit the whitelist to one or more target computer systems (See Parag. [0035-0036]; server computer 500 transacts with computer security system software that runs on the target computer 10 through the network(s) 506. The computer security system software 17 runs on the target computer 10 and monitors any activation of programs/applications/scripts (e.g., running of a program) and provides or denies permission for running the program/application/script on the target computer 10. The server computer 500 transacts with the computer security system software 17 that runs on the target computer 10 as needed, for example, to update the whitelists 15 stored on the target computer 10).
It would have been obvious to one of ordinary skill in the art at the time before the effective filling date of the claimed invention to modify the teaching, taught by Ohta, to include saving the whitelist and transmitting the whitelist to one or more target computer systems, as taught by Riley. This would be convenient to provides an automated way to prevent execution of software containing code that is potentially contaminated (e.g., contains or is malicious software) (Riley, Parag. [0027]).
Claim 4. Ohta in view of Riley discloses the system for automatic generation of the whitelist for computer security of claim 3,
Riley further discloses the system further comprising: after receiving the whitelist at the one or more target computer systems, security software running on each of the one or more target computer systems installs the whitelist (See Parag. [0035-0036]; server computer 500 transacts with computer security system software that runs on the target computer 10 through the network(s) 506. The computer security system software 17 runs on the target computer 10 and monitors any activation of programs/applications/scripts (e.g., running of a program) and provides or denies permission for running the program/application/script on the target computer 10. The server computer 500 transacts with the computer security system software 17 that runs on the target computer 10 as needed, for example, to update the whitelists 15 stored on the target computer 10).
It would have been obvious to one of ordinary skill in the art at the time before the effective filling date of the claimed invention to modify the teaching, taught by Ohta, to include installing the whitelist at the one or more target computer systems, as taught by Riley. This would be convenient to provides an automated way to prevent execution of software containing code that is potentially contaminated (e.g., contains or is malicious software) (Riley, Parag. [0027]).
Claim 5. Ohta in view of Riley discloses the system for automatic generation of the whitelist for computer security of claim 4,
Riley further discloses the system further comprising: after the security software running on each of the one or more target computer systems installs the whitelist, upon an attempt to run a program that is installed from the installation file on a target system of the one or more target computer systems from the installation file, the security software calculates the check value for the program and compares a name of the program and the check value for the program to an entry in the whitelist for the program and when the name of the program and the check value for the program match the entry in the whitelist for the program, the security software allows the program to run on the target system (See Parag. [0074-0076]; the flow starts by a program 14 attempting to start 200 on the target computer 10… The computer security system determines 202 if the program 14 is in the whitelist 15 using any searching mechanism, including linear searching, binary searching, hash searching, etc. For example, the name of the program is searched and if found, the search is successful. If the name is not found, then a hash value is calculated for the program and the hash value is searched and if not found, other searches are performed. If it is determined 202 that the program 14 is in the whitelist 15 (e.g., the program is trusted) the program 14 is run 204).
It would have been obvious to one of ordinary skill in the art at the time before the effective filling date of the claimed invention to modify the teaching, taught by Ohta, to include , the security software calculates the check value for the program and compares a name of the program and the check value for the program to an entry in the whitelist for the program and when the name of the program and the check value for the program match the entry in the whitelist for the program, the security software allows the program to run on the target system, as taught by Riley. This would be convenient to provides an automated way to prevent execution of software containing code that is potentially contaminated (e.g., contains or is malicious software) (Riley, Parag. [0027]).
Claim 6. Ohta discloses a system for automatic generation of a whitelist for computer security, the system comprising:
computer instructions running on a processor opens the list; the computer instructions read an installation release package and determines if the installation release package is valid (See Parag. [0090]; receive a file of a monitoring target software program or a software update package. See Parag. [0169]; the integrity monitoring unit 42 is a subsystem of the monitoring unit 37 and is configured to calculate a hash value of a monitoring target software program (a memory or file) in accordance with the parameter setting information (the address at which the monitoring target software program is stored, or the size of the monitoring target software program). The integrity monitoring unit 42 is configured to then compare the calculated hash value of the monitoring target software program with a original hash value included in the monitoring setting information, of the monitoring target software program, then to determine that anomaly has occurred in the monitoring target software program when the two hash values do not match with each other); and
when the installation release package is valid, the computer instructions generate a list of install packages from the installation release package (See Parag. [0090-0092]; he monitoring setting information input unit 11 may be configured to receive a file of a monitoring target software program or a software update package, then to calculate the hash value of or size of the monitoring target software program by itself, and thus to obtain the result of the calculation as the monitoring setting information. The monitoring setting information management unit 12 is configured to store monitoring setting information corresponding to a plurality of monitoring target software programs. See also Parag. [0186]);
for each install package in the list of install packages: the computer instructions running on the processor reads the install package, calculates a calculated check value for the install package, and compares the calculated check value to a stored check value, the stored check value is within the install package (See Parag. [0169]; the integrity monitoring unit 42 is a subsystem of the monitoring unit 37 and is configured to calculate a hash value of a monitoring target software program (a memory or file) in accordance with the parameter setting information (the address at which the monitoring target software program is stored, or the size of the monitoring target software program).The integrity monitoring unit 42 is configured to then compare the calculated hash value of the monitoring target software program with a original hash value included in the monitoring setting information, of the monitoring target software program);;
when the calculated check value does not match the stored check value, the computer instructions continue with a next installation file; and when the calculated check value matches the stored check value, the computer instructions parse the install package into elements and for each element of the elements, the computer instructions decompress the each element and when the each element is a program, the computer instructions calculate a check value for the program and adds an entry to the list comprising a name of the program and the check value for the program (See Parag. [0090]; the monitoring setting information input unit 11 may be configured to receive a file of a monitoring target software program or a software update package, then to calculate the hash value of or size of the monitoring target software program by itself, and thus to obtain the result of the calculation as the monitoring setting information. See Parag. [0092-0094]; the monitoring setting information management unit 12 is configured to store monitoring setting information corresponding to a plurality of monitoring target software programs. The monitoring setting information management unit 12 is configured to store the monitoring setting information obtained by the monitoring setting input unit 11 in a memory or file system as an arbitrary format such as a table format or list format. It should be noted that the monitoring setting information management unit 12 is configured to update (overwrite) monitoring setting information to newly obtained monitoring setting information in a case where the monitoring setting information management unit 12 already stores monitoring setting information including the same identifier of the monitoring target software program as the identifier of the monitoring target software program included in the monitoring setting information obtained by the monitoring setting information input unit 11. See Parag. [0076-0077]; FIG. 2 is monitoring setting information includes an identifier of the monitoring target software program, a hash value of the monitoring target software program, an address in which the monitoring target software program is stored, a size of the monitoring target software program and monitoring scheduling information. The identifier of the monitoring target software program may be the identification number of the monitoring target software program or a character string (for example, a file name) for identifying a file constituting the monitoring target software program. See Parag. [0150]; in a case where the file constituting the monitoring information is compressed, the monitoring setting information management unit 36 decompresses the file for the same purpose. See also Figs 13, 18, 21).
Ohta doesn’t explicitly disclose the list comprising the name of the program and the check value for the program is a whitelist.
However, Riley discloses a whitelist comprising the name of the program and the check value for the program (See Parag. [0068]; Each entry of the whitelist 15 includes information regarding the approved program or directory such as the date of approval, the name of the program 602, a hash value of the program 604, and a signature of the program 606).
It would have been obvious to one of ordinary skill in the art at the time before the effective filling date of the claimed invention to modify the teaching, taught by Ohta, to include a whitelist comprising the name of the program and the check value for the program, as taught by Riley. This would be convenient to provides an automated way to prevent execution of software containing code that is potentially contaminated (e.g., contains or is malicious software) (Riley, Parag. [0027]).
Claim 7. The applicant is directed to the rejection to claim 3 set forth above, as it is rejected based on the same rationale.
Claim 8. The applicant is directed to the rejection to claim 3 set forth above, as it is rejected based on the same rationale.
Claim 9. The applicant is directed to the rejection to claim 4 set forth above, as it is rejected based on the same rationale.
Claim 10. The applicant is directed to the rejection to claim 5 set forth above, as it is rejected based on the same rationale.
Claim 11. Ohta in view of Riley discloses the system for automatic generation of the whitelist for computer security of claim 6,
Ohta further discloses wherein the computer instructions read the installation release package after the installation release package is downloaded and stored on a storage that is operatively coupled to the processor (See Parag. [0127]; After the monitoring setting information update file is downloaded, the monitoring setting information update file is saved in the device by use of an arbitrary storage device such as a flash memory, hard disk drive, or such as an external storage including an SD memory card or the like. See Parag. [0129]; software program update module of the device downloads, via a radio network, from a device management server storing the monitoring setting information file or the software update package, the monitoring setting information file along with the software update package into a device, and then writes the monitoring setting information file into a flash memory).
Claim 12. Ohta in view of Riley discloses the system for automatic generation of the whitelist for computer security of claim 6,
Ohta further discloses wherein the computer instructions read the installation release package through a network that is operatively coupled to the processor (See Parag. [0127]; After the monitoring setting information update file is downloaded, the monitoring setting information update file is saved in the device by use of an arbitrary storage device such as a flash memory, hard disk drive, or such as an external storage including an SD memory card or the like. See Parag. [0129]; software program update module of the device downloads, via a radio network, from a device management server storing the monitoring setting information file or the software update package, the monitoring setting information file along with the software update package into a device, and then writes the monitoring setting information file into a flash memory).
Claim 13. Ohta in view of Riley discloses the system for automatic generation of the whitelist for computer security of claim 6,
Ohta further discloses wherein the computer instructions running on the processor reads the install package after the installation release package is downloaded and stored on a storage that is operatively coupled to the processor (See Parag. [0127]; After the monitoring setting information update file is downloaded, the monitoring setting information update file is saved in the device by use of an arbitrary storage device such as a flash memory, hard disk drive, or such as an external storage including an SD memory card or the like. See Parag. [0129]; software program update module of the device downloads, via a radio network, from a device management server storing the monitoring setting information file or the software update package, the monitoring setting information file along with the software update package into a device, and then writes the monitoring setting information file into a flash memory).
Claim 14. Ohta in view of Riley discloses the system for automatic generation of the whitelist for computer security of claim 6,
Ohta further discloses wherein the computer instructions running on the processor reads the install package through a network that is operatively coupled to the processor (See Parag. [0127]; After the monitoring setting information update file is downloaded, the monitoring setting information update file is saved in the device by use of an arbitrary storage device such as a flash memory, hard disk drive, or such as an external storage including an SD memory card or the like. See Parag. [0129]; software program update module of the device downloads, via a radio network, from a device management server storing the monitoring setting information file or the software update package, the monitoring setting information file along with the software update package into a device, and then writes the monitoring setting information file into a flash memory).
Claim 15. Ohta discloses a method of automatic generation of a whitelist for computer security, the method comprising:
reading an installation release package and generating a list of installation files (See Parag. [0090]; receive a file of a monitoring target software program or a software update package. See Parag. [0169]; the integrity monitoring unit 42 is a subsystem of the monitoring unit 37 and is configured to calculate a hash value of a monitoring target software program (a memory or file) in accordance with the parameter setting information (the address at which the monitoring target software program is stored, or the size of the monitoring target software program).The integrity monitoring unit 42 is configured to then compare the calculated hash value of the monitoring target software program with a original hash value included in the monitoring setting information, of the monitoring target software program); and
for each installation file in the list of installation files: parsing the installation file into elements and for each element of the elements, when the each element is a program, calculating a check value for the program and adding an entry to the list comprising a name of the program and the check value for the program (See Parag. [0090]; the monitoring setting information input unit 11 may be configured to receive a file of a monitoring target software program or a software update package, then to calculate the hash value of or size of the monitoring target software program by itself, and thus to obtain the result of the calculation as the monitoring setting information. See Parag. [0092-0094]; the monitoring setting information management unit 12 is configured to store monitoring setting information corresponding to a plurality of monitoring target software programs. The monitoring setting information management unit 12 is configured to store the monitoring setting information obtained by the monitoring setting input unit 11 in a memory or file system as an arbitrary format such as a table format or list format. It should be noted that the monitoring setting information management unit 12 is configured to update (overwrite) monitoring setting information to newly obtained monitoring setting information in a case where the monitoring setting information management unit 12 already stores monitoring setting information including the same identifier of the monitoring target software program as the identifier of the monitoring target software program included in the monitoring setting information obtained by the monitoring setting information input unit 11. See Parag. [0076-0077]; FIG. 2 is monitoring setting information includes an identifier of the monitoring target software program, a hash value of the monitoring target software program, an address in which the monitoring target software program is stored, a size of the monitoring target software program and monitoring scheduling information. The identifier of the monitoring target software program may be the identification number of the monitoring target software program or a character string (for example, a file name) for identifying a file constituting the monitoring target software program. See Parag. [0150]; in a case where the file constituting the monitoring information is compressed, the monitoring setting information management unit 36 decompresses the file for the same purpose. See also Figs 13, 18, 21).
Ohta doesn’t explicitly disclose the list comprising the name of the program and the check value for the program is a whitelist.
However, Riley discloses a whitelist comprising the name of the program and the check value for the program (See Parag. [0068]; Each entry of the whitelist 15 includes information regarding the approved program or directory such as the date of approval, the name of the program 602, a hash value of the program 604, and a signature of the program 606).
It would have been obvious to one of ordinary skill in the art at the time before the effective filling date of the claimed invention to modify the teaching, taught by Ohta, to include a whitelist comprising the name of the program and the check value for the program, as taught by Riley. This would be convenient to provides an automated way to prevent execution of software containing code that is potentially contaminated (e.g., contains or is malicious software) (Riley, Parag. [0027]).
Claim 16. The applicant is directed to the rejection to claim 3 set forth above, as it is rejected based on the same rationale.
Claim 17. The applicant is directed to the rejection to claim 3 set forth above, as it is rejected based on the same rationale.
Claim 18. The applicant is directed to the rejection to claim 4 set forth above, as it is rejected based on the same rationale.
Claim 19. The applicant is directed to the rejection to claim 5 set forth above, as it is rejected based on the same rationale.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure (see PTO-form 892).
The following Patent is cited to further show the state of the art at the time of Applicant’s invention with respect to secure cashing of namespace keys.
Komatsubara (Pub. No. US 2025/0378170); “Information Processing Apparatus, Information Processing System, and Information Processing method”;
Teaches An information processing apparatus includes: an internal storage configured to store one or more programs; a controller configured to execute the one or more programs; and an interface configured to receive information from an external storage containing a whitelist. The whitelist includes determination information indicating whether to allow the controller to execute each of the one or more programs. The controller is configured to acquire the whitelist from the external storage through the interface, verify an integrity of the acquired whitelist, and in response to a determination that the acquired whitelist is complete, store the acquired whitelist in the internal storage as an active whitelist to be used for determining whether to allow the controller to execute each of the one or more programs stored in the internal storage (Abstract).
Any inquiry concerning this communication or earlier communications from the examiner should be directed to GHIZLANE MAAZOUZ whose telephone number is (571)272-8118. The examiner can normally be reached Telework M-F 7:30-5 PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Philip J Chea can be reached on 571-272-3951. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/GHIZLANE MAAZOUZ/Examiner, Art Unit 2499 /PHILIP J CHEA/Supervisory Patent Examiner, Art Unit 2499