Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
The Action is responsive to the Amendments and Remarks filed on 8/22/2025. Claims 1-20 are pending claims. Claims 1, 8, and 15 are written in independent form.
Priority
Applicant's claim for benefit of prior-filed provisional applications 63/504,705, filed 5/26/2023, under 35. U.S.C. 119(e) or under 35 U.S.C. 120, 121, or 365(c) is acknowledged.
Claim Objections
Claim 7 is objected to because of the following informalities:
Claim 7 appears to recite a typographical error by not ending the claim with a period.
Appropriate correction is required.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to non-patentable subject matter. The claimed invention is directed to one or more abstract ideas without significantly more. The judicial exception is not integrated into a practical application. The claims do not include additional elements that are sufficient to amount to significantly more than judicial exception. The eligibility analysis in support of these findings is provided below.
As per Claims 1, 8, and 15,
STEP 1:In accordance with Step 1 of the eligibility inquiry (as explained in MPEP 2106), the claimed method (claims 1-7), device (claims 8-14), and system (claims 15-20) are directed to one of the eligible categories of subject matter and therefore satisfies Step 1.
STEP 2A Prong One:The independent claims 1, 8, and 15 recites the following limitations directed to an abstract idea:
Creating a file descriptor upon a request to open a first file;
The limitation recites a mental process of observation, evaluation, judgement, and/or opinion capable of being performed by the human mind, or by a human using a pen and paper, by making an observation that a request to open a first file has been made, and based on the observation of the request, making a judgement and/or opinion to create a file descriptor.
Identifying a close() system call requesting closure of the file descriptor that is opened with the first file;
The limitation recites a mental process of observation, evaluation, judgement, and/or opinion capable of being performed by the human mind, or by a human using a pen and paper, by making an observation and evaluation of a system call, and based on the observation and evaluation, making a judgement and/or opinion to identify the system call as a close() system call requesting closure of the file descriptor that is opened with the first file.
Generating, based on the close() system call, prior to closing a file descriptor, a dup2() system call for the file descriptor;
The limitation recites a mental process of observation, evaluation, judgement, and/or opinion capable of being performed by the human mind, or by a human using a pen and paper, by observing and evaluating the close() system call, and based on the observation and evaluation, making a judgement and/or opinion to generate a dup2() system call for the file descriptor prior to closing a file descriptor.
Releasing, based on the dup2() system call, the first file from the file descriptor;
The limitation recites a mental process of observation, evaluation, judgement, and/or opinion capable of being performed by the human mind, or by a human using a pen and paper, by making an observation and evaluation of the dup2() system call, and based on the observation and evaluation, making a judgement and/or opinion to release the first file from the file descriptor.
Opening, based on the dup2() system call, the file descriptor to a second file;
The limitation recites a mental process of observation, evaluation, judgement, and/or opinion capable of being performed by the human mind, or by a human using a pen and paper, by making an observation and evaluation of the dup2() system call, and based on the observation and evaluation, making a judgement and/or opinion to open the file descriptor to a second file.
Determining that a threshold delay from receipt of the close() system call has expired; and
The limitation recites a mental process of observation, evaluation, judgement, and/or opinion capable of being performed by the human mind, or by a human using a pen and paper, by observing and evaluating a threshold delay and the receipt of the close() system call, and based on the observation and evaluation, making a judgement and/or opinion that the threshold delay from receipt of the close() system call has expired.
Closing, based on the expiration of the threshold delay, the file descriptor.
The limitation recites a mental process of observation, evaluation, judgement, and/or opinion capable of being performed by the human mind, or by a human using a pen and paper, by observing and evaluating the expiration of the threshold delay, and based on the observation and evaluation, making a judgement and/or opinion to close the file descriptor.
STEP 2A Prong Two:Claim 1 recites that the steps are performed using “at least one processor of a device”, which is a high-level recitation of generic computer components and represents mere instructions to apply on a computer as in MPEP 2106.05(f), which does not provide integration into a practical application.
Claim 8 recites that the steps are performed using “a device” and “memory coupled to at least one processor”, which is a high-level recitation of generic computer components and represents mere instructions to apply on a computer as in MPEP 2106.05(f), which does not provide integration into a practical application.
Claim 15 recites that the steps are performed using “a system” and “at least one processor coupled to memory”, which is a high-level recitation of generic computer components and represents mere instructions to apply on a computer as in MPEP 2106.05(f), which does not provide integration into a practical application.
The claims recite the following additional limitation(s):
Wherein the second file is an innocuous file;
The limitation recites an insignificant extra-solution activity as selecting a particular type of file being used to represent the second file as identified in MPEP 2106.05(g) and does not provide integration into a practical application.
Viewing the additional limitations together and the claim as a whole, nothing provides integration into a practical application.
STEP 2B:
The conclusions for the mere implementation using a computer are carried over and does not provide significantly more.
With respect to “Wherein the second file is an innocuous file” identified as insignificant extra-solution activity above this is also WURC when claimed in a merely generic manner as court-identified see MPEP 2106.05(d)(II)(iv).
Looking at the claim as a whole does not change this conclusion and the claim is ineligible.
As per Dependent Claims 2-7, 9-14, and 16-20,
STEP 1:In accordance with Step 1 of the eligibility inquiry (as explained in MPEP 2106), the claimed method (claims 1-7), device (claims 8-14), and system (claims 15-20) are directed to one of the eligible categories of subject matter and therefore satisfies Step 1.
STEP 2A Prong One:The dependent claims 2-7, 9-14, and 16-20 recite the following limitations directed to an abstract idea:
The limitation(s) of Dependent Claims 4, 11, and 18 includes the step(s) of:
Generating, based on the second close() system call, prior to closing the second file descriptor, a second dup2() system call for the second file descriptor;
The limitation recites a mental process of observation, evaluation, judgement, and/or opinion capable of being performed by the human mind, or by a human using a pen and paper, by observing and evaluating the second close() system call, and based on the observation and evaluation, making a judgement and/or opinion to generate a second dup2() system call for the second file descriptor prior to closing the second file descriptor.
Wherein determining that the threshold delay from the receipt of the close() system call has expired comprises determining that a sum of dup2() system calls exceeds the threshold delay.
The limitation recites a mental process of observation, evaluation, judgement, and/or opinion capable of being performed by the human mind, or by a human using a pen and paper, by observing and evaluating a sum of dup2() system calls and the threshold delay, and based on the observation and evaluation, making a judgement and/or opinion that the sum of dup2() system calls exceeds the threshold delay, and thus making the judgement and/or opinion that the threshold delay from the receipt of the close() system call has expired.
The limitation(s) of Dependent Claims 7 and 14 includes the step(s) of:
Determining that the file descriptor is the least-recently-used file descriptor among recently-used file descriptors that have been duplicated using dup2() system calls,
The limitation recites a mental process of observation, evaluation, judgement, and/or opinion capable of being performed by the human mind, or by a human using a pen and paper, by observing and evaluating recently-used filed descriptors that have been duplicated using dup2() system calls, and based on the observation and evaluation, making a judgement and/or opinion as to the lease-recently-used file descriptor.
Wherein closing the file descriptor is further based on the file descriptor being the least-recently-used file descriptor.
The limitation recites a mental process of observation, evaluation, judgement, and/or opinion capable of being performed by the human mind, or by a human using a pen and paper, by observing and evaluating that the file descriptor is the least-recently-used file descriptor, and based on the observation and evaluation, making a judgement and/or opinion to close the file descriptor.
STEP 2A Prong Two:The claim(s) recite the following additional elements:
The limitation(s) of Dependent Claims 2, 9, and 16 includes the step(s) of:
Wherein the threshold delay is a threshold amount of time.
The limitation recites an insignificant extra-solution activity as selecting a particular type of data being used to represent the threshold delay as identified in MPEP 2106.05(g) and does not provide integration into a practical application.
The limitation(s) of Dependent Claims 3, 10, and 17 includes the step(s) of:
Wherein the threshold delay is a number of dup2() system calls generated in response to close() system calls.
The limitation recites an insignificant extra-solution activity as selecting a particular type of data being used to represent the threshold delay as identified in MPEP 2106.05(g) and does not provide integration into a practical application.
The limitation(s) of Dependent Claims 4, 11, and 18 includes the step(s) of:
Receiving a second close() system call requesting closure of a second file descriptor;
The limitation recites an insignificant extra solution activity as sending/receiving data (ie. Mere data
gathering) as identified in MPEP 2106.05(g) and does not provide integration into a practical application.
The sum of dup2() system calls comprising the dup2() system call and the second dup2() system call.
The limitation recites an insignificant extra-solution activity as selecting a particular type of data being included in the sum of dup2() system calls, as identified in MPEP 2106.05(g) and does not provide integration into a practical application.
The limitation(s) of Dependent Claims 5, 12, and 19 includes the step(s) of:
Wherein the second file is a /dev/null file.
The limitation recites an insignificant extra-solution activity as selecting a particular type of file for the claimed second file, as identified in MPEP 2106.05(g) and does not provide integration into a practical application.
The limitation(s) of Dependent Claims 6, 13, and 20 includes the step(s) of:
Wherein the threshold delay is proportional to a rate at which new file descriptors are required and a number of supported file descriptors comprising the file descriptor.
The limitation recites an insignificant extra-solution activity as selecting a particular type of data being used to represent the threshold delay as identified in MPEP 2106.05(g) and does not provide integration into a practical application.
Viewing the additional limitations together and the claim as a whole, nothing provides integration into a practical application.
STEP 2B:
The conclusions for the mere implementation using a computer are carried over and does not provide significantly more.
With respect to Claims 2, 9, and 16 reciting “Wherein the threshold delay is a threshold amount of time.” identified as insignificant extra-solution activity above this is also WURC as court-identified see MPEP 2106.05(d)(II)(iv).
With respect to Claims 3, 10, and 17 reciting “Wherein the threshold delay is a number of dup2() system calls generated in response to close() system calls.” identified as insignificant extra-solution activity above this is also WURC as court-identified see MPEP 2106.05(d)(II)(iv).
With respect to Claims 4, 11, and 18 reciting “Receiving a second close() system call requesting closure of a second file descriptor;” identified as insignificant extra-solution activity above this is also WURC as court-identified see MPEP 2106.05(d)(II)(i).
With respect to Claims 4, 11, and 18 reciting “The sum of dup2() system calls comprising the dup2() system call and the second dup2() system call.” identified as insignificant extra-solution activity above this is also WURC as court-identified see MPEP 2106.05(d)(II)(iv).
With respect to Claims 5, 12, and 19 reciting “Wherein the second file is a /dev/null file.” identified as insignificant extra-solution activity above this is also WURC as court-identified see MPEP 2106.05(d)(II)(iv).
With respect to Claims 6, 13, and 20 reciting “Wherein the threshold delay is proportional to a rate at which new file descriptors are required and a number of supported file descriptors comprising the file descriptor.” identified as insignificant extra-solution activity above this is also WURC as court-identified see MPEP 2106.05(d)(II)(iv).
Looking at the claim as a whole does not change this conclusion and the claim is ineligible.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-6, 8-13, and 15-20 are rejected under 35 U.S.C. 103 as being unpatentable over Meth (U.S. Pre-Grant Publication No. 2002/0087916) and further in view of Pope et al. (U.S. Pre-Grant Publication No. 2008/0065839, hereinafter referred to as Pope), Cangini et al. (U.S. Pre-Grant Publication No. 2007/0107052, hereinafter referred to as Cangini), and Shukla et al. (U.S. Pre-Grant Publication NO. 2022/0311832, hereinafter referred to as Shukla).
Regarding Claim 1:
Meth teaches a method of preventing multiple closures of a file descriptor, the method comprising:
Creating a file descriptor upon a request to open a first file;
Meth teaches “Information about the file descriptors 30 is obtained by the user-level checkpoint mechanism, which in a known manner intercepts the system calls that are used to open and close files, e.g., open( ), close( ), and dup( ).” (Para. [0039]) where “Consistency in the values of the file descriptors can be assured by use of the dup2( ) system call. The dup2( ) system call takes two parameters as input: an old file descriptor number and a new file descriptor number.” (Para. [0060]) where “then a duplicate file descriptor is created at step 90, using the system call dup2( ) or its equivalent” (Para.[0062]).
Identifying, by at least one processor of a device, a close() system call requesting closure of the file descriptor that is opened with the first file;
Meth teaches “Information about the file descriptors 30 is obtained by the user-level checkpoint mechanism, which in a known manner intercepts the system calls that are used to open and close files, e.g., open( ), close( ), and dup( )” (Para. [0039])
Generating, by the at least one processor, based on the close() system call, prior to closing a file descriptor, a dup2() system call for the file descriptor;
Meth teaches “After invoking the dup2( ) system call on the file descriptor to obtain the correct value, the file descriptor having an incorrect number is no longer needed and is closed.” (Para. [0060]) thereby teaching generating the dup2() call for the file descriptor prior to closing the file descriptor.
Releasing, by the at least one processor, based on the dup2() system call, the first file from the file descriptor;
Meth teaches “The dup2( ) system call takes two parameters as input: an old file descriptor number and a new file descriptor number. The user uses dup2( ) to choose the new file descriptor number that he wants to use to reference the file object that is currently referenced by the old file descriptor number. After invoking the dup2( ) system call on the file descriptor to obtain the correct value, the file descriptor having an incorrect number is no longer needed and is closed.” (Para. [0060]) thereby teaching releasing the first file from the old file descriptor.
Closing, by the at least one processor, the file descriptor.
Meth teaches “After invoking the dup2( ) system call on the file descriptor to obtain the correct value, the file descriptor having an incorrect number is no longer needed and is closed.” (Para. [0060]) thereby teaching closing the file descriptor upon the system call completing and no longer needing it.
Meth explicitly teaches all of the elements of the claimed invention as recited above except:
Opening, by the at least one processor, based on the dup2() system call, the file descriptor to a second file, wherein the second file is an innocuous file;
Determining, by the at least one processor, that a threshold delay from receipt of the close() system call has expired;
Closing, by the at least one processor, based on the expiration of the threshold delay, the file descriptor.
However, in the related field of endeavor of processing syscalls using file descriptors, Pope teaches:
Opening, by the at least one processor, based on the dup2() system call, the file descriptor to a second file;
Pope teaches “File descriptors can be re-used within a computer system, but at any given time a descriptor uniquely identifies an open file or other resource. Thus, when a resource (such as a file) is closed down, the descriptor will be destroyed, and when another resource is subsequently opened the descriptor can be re-used to identify the new resource” (Para. [0036]).
Thus, it would have been obvious to one of ordinary skill in the art, having the teachings of Pope and Meth at the time that the claimed invention was effectively filed, to have combined the use of privilege levels, as taught by Pope, with the systems and methods for checkpointing and restoring a family of programs, as taught by Meth.
One would have been motivated to make such combination because Pope teaches “The kernel executes in kernel mode, also sometimes called trusted mode or a privileged mode, whereas application level processes (also called user level processes) execute in a user mode. Typically it is the processor subsystem hardware itself which ensures that only trusted code, such as the kernel code, can access the hardware directly. The processor enforces this in at least two ways: certain sensitive instructions will not be executed by the processor unless the current privilege level is high enough, and the processor will not allow user level processes to access memory locations (including memory mapped addresses associated with specific hardware resources) which are outside of a user-level physical or virtual address space already allocated to the process” (Para. [0057]) and it would have been obvious to a person having ordinary skill in the art that limiting only trusted code that can access the hardware directly would increase the security of the system hardware.
Pope and Meth explicitly teach all of the elements of the claimed invention as recited above except:
Wherein the second file is an innocuous file;
Determining, by the at least one processor, that a threshold delay from receipt of the close() system call has expired;
Closing, by the at least one processor, based on the expiration of the threshold delay, the file descriptor.
However, in the related field of endeavor of monitoring operation of processing systems, Cangini teaches:
Determining, by the at least one processor, that a threshold delay from receipt of the close() system call has expired; and
Cangini teaches “The knowledge base modules 105 differs one from another for their different views of the system: some are wide and generic while others are "focused" and specialized. They monitor different aspect of the system, so they have different variables and they use different ways of counting or taking into accounts the events that occur on the system.” (Para.[008]) where “a counting mechanism is used to track all the occurrences of certain events, such as the number of processes that a certain user is executing” (Para. [0092]) and dup2 is understood as a system call being monitored and counted (Para. [0075] & Table 1).
Cangini further teaches a threshold delay expiring by teaching “some possible fuzzy sets adopted to map specific alerts” (Para. [0113]) including “An application exceeds its maximum number of concurrent instances” (Para. [0119]).
Closing, by the at least one processor, based on the expiration of the threshold delay, the file descriptor.
Cangini in combination with Meth teaches the limitation because Cangini teaches a threshold delay expiring by teaching “some possible fuzzy sets adopted to map specific alerts” (Para. [0113]) including “An application exceeds its maximum number of concurrent instances” (Para. [0119]) and “a detection component, which represents the core of the monitoring system, carries out the data analysis. It performs anomaly detection by revealing differences between the current state of the system and the state recorded during a previous period of time when the system is assumed to be safe. These anomalies consist in suspicious events that could represent an intrusion, so they can cause the emission of an alert” (Para. [0030]) which triggers the alert of suspicious events and Meth teaches “After invoking the dup2( ) system call on the file descriptor to obtain the correct value, the file descriptor having an incorrect number is no longer needed and is closed.” (Para. [0060]).
Thus, it would have been obvious to one of ordinary skill in the art, having the teachings of Canginin, Pope, and Meth at the time that the claimed invention was effectively filed, to have combined the monitoring (e.g. analyzing) operation of processing systems and intrusion detection systems, as taught by Cangini, with the use of privilege levels, as taught by Pope, and the systems and methods for checkpointing and restoring a family of programs, as taught by Meth.
One would have been motivated to make such combination because Cangini teaches “The module 105d can also combine the standard anomaly detection mechanism with few misuse detection techniques tailored to improve the overall efficiency.” (Para. [0096]).
Cangini, Pope, and Meth explicitly teach all of the elements of the claimed invention as recited above except:
Wherein the second file is an innocuous file;
However, in the related field of endeavor of intercepting file operations, Cangini teaches:
Wherein the second file is an innocuous file;
Shukla teaches “the space of virtual file-descriptor for socket does not have any overlapping with the file descriptor space of the training job. When the user creates a new socket, two handles are created. The first can be opening an arbitrary file (say/dev/null)” (Para. [0130]) thereby teaching a file as an innocuous file in the form of /dev/null.
Thus, it would have been obvious to one of ordinary skill in the art, having the teachings of Shukla, Canginin, Pope, and Meth at the time that the claimed invention was effectively filed, to have combined the use of specialized architecture of the GPU, as taught by Shukla, with the monitoring (e.g. analyzing) operation of processing systems and intrusion detection systems, as taught by Cangini, the use of privilege levels, as taught by Pope, and the systems and methods for checkpointing and restoring a family of programs, as taught by Meth.
One would have been motivated to make such combination because Shukla teaches “Such execution then takes advantage of specialized architecture of the GPU 388, such as the GPU 388 having many cores enabling parallel processing of data to a significant degree beyond the capabilities of the compute resources 380.” (Para. [0046]) and it would be obvious to a person having ordinary skill in the art that enabling parallel processing beyond the capabilities of compute resources would be an improvement to operation speeds.
Regarding Claim 2:
Shukla, Cangini, Pope, and Meth further teach:
Wherein the threshold delay is a threshold amount of time.
Cangini teaches “The knowledge base modules 105 differs one from another for their different views of the system: some are wide and generic while others are "focused" and specialized. They monitor different aspect of the system, so they have different variables and they use different ways of counting or taking into accounts the events that occur on the system.” (Para.[0088]) where “a counting mechanism is used to track all the occurrences of certain events, such as the number of processes that a certain user is executing” (Para. [0092]) and dup2 is understood as a system call being monitored and counted (Para. [0075] & Table 1).
Cangini further teaches a threshold delay expiring by teaching “some possible fuzzy sets adopted to map specific alerts” (Para. [0113]) including “a network connection exceeds its maximum observed bandwidth” (Para. [0120]). Since bandwidth is the amount of data that can be transmitted in a given amount of time,, Cangini teaches the threshold delay being a threshold amount of time for a specific amount of data in the maximum bandwidth.
Regarding Claim 3:
Shukla, Cangini, Pope, and Meth further teach:
Wherein the threshold delay is a number of dup2() system calls generated in response to close() system calls.
Cangini teaches “The knowledge base modules 105 differs one from another for their different views of the system: some are wide and generic while others are "focused" and specialized. They monitor different aspect of the system, so they have different variables and they use different ways of counting or taking into accounts the events that occur on the system.” (Para.[0088]) where “a counting mechanism is used to track all the occurrences of certain events, such as the number of processes that a certain user is executing” (Para. [0092]) and dup2 is understood as a system call being monitored and counted (Para. [0075] & Table 1).
Cangini further teaches a threshold delay expiring by teaching “some possible fuzzy sets adopted to map specific alerts” (Para. [0113]) including “An application exceeds its maximum number of concurrent instances” (Para. [0119]).
Regarding Claim 4:
Shukla, Cangini, Pope, and Meth further teach:
Receiving a second close() system call requesting closure of a second file descriptor;
Meth teaches “Information about the file descriptors 30 is obtained by the user-level checkpoint mechanism, which in a known manner intercepts the system calls that are used to open and close files, e.g., open( ), close( ), and dup( )” (Para. [0039])
Meth further teaches a second file descriptor by teaching “a child process can inherit file descriptors from its parent, with the result being that a parent and child process share the same file descriptor. The kernel arranges for the child to inherit and share the file descriptors of its parent at the time of the fork( ) operation that created the child process. If the child process, in turn, creates its own child process by calling fork( ), then the grandchild process can also inherit and share the file descriptor that originated in the grandparental process. Subsequently various members of the family of processes may individually close some of the inherited file descriptors and obtain new file descriptors.”
Generating, based on the second close() system call, prior to closing the second file descriptor, a second dup2() system call for the second file descriptor;
Meth teaches “After invoking the dup2( ) system call on the file descriptor to obtain the correct value, the file descriptor having an incorrect number is no longer needed and is closed.” (Para. [0060]) thereby teaching generating the dup2() call for the file descriptor prior to closing the file descriptor.
Wherein determining that the threshold delay from the receipt of the close() system call has expired comprises determining that a sum of dup2() system calls, comprising the dup2() system call and the second dup2() system call, exceeds the threshold delay.
Cangini teaches “The knowledge base modules 105 differs one from another for their different views of the system: some are wide and generic while others are "focused" and specialized. They monitor different aspect of the system, so they have different variables and they use different ways of counting or taking into accounts the events that occur on the system.” (Para.[008]) where “a counting mechanism is used to track all the occurrences of certain events, such as the number of processes that a certain user is executing” (Para. [0092]) and dup2 is understood as a system call being monitored and counted (Para. [0075] & Table 1).
Cangini further teaches a threshold delay expiring by teaching “some possible fuzzy sets adopted to map specific alerts” (Para. [0113]) including “An application exceeds its maximum number of concurrent instances” (Para. [0119]).
Regarding Claim 5:
Shukla, Cangini, Pope, and Meth further teach:
Wherein the second file is a /dev/null file.
Shukla teaches “the space of virtual file-descriptor for socket does not have any overlapping with the file descriptor space of the training job. When the user creates a new socket, two handles are created. The first can be opening an arbitrary file (say/dev/null)” (Para. [0130]).
Regarding Claim 6:
Shukla, Cangini, Pope, and Meth further teach:
Wherein the threshold delay is proportional to a rate at which new file descriptors are required and a number of supported file descriptors comprising the file descriptor.
It is also noted that setting the threshold at a particular calculated number, time, or proportion is merely a design choice without additional context.
However, Cangini teaches “The knowledge base modules 105 differs one from another for their different views of the system: some are wide and generic while others are "focused" and specialized. They monitor different aspect of the system, so they have different variables and they use different ways of counting or taking into accounts the events that occur on the system.” (Para. [0088]) where “a counting mechanism is used to track all the occurrences of certain events, such as the number of processes that a certain user is executing” (Para. [0092]) and dup2 is understood as a system call being monitored and counted (Para. [0075] & Table 1).
Cangini further teaches a threshold delay expiring by teaching “some possible fuzzy sets adopted to map specific alerts” (Para. [0113]) and “Another led alert is emitted whenever one of the counters for a specific object is exceeded (because of a creation or removal of the particular object)” (Para. [0096]) which would involve new file descriptors and a number of supported file descriptors.
Cangini also teaches “Each knowledge base can operate in two essential modes; in the learning mode, it updates itself accordingly to the events occurring in the system; in the analysis mode, it compares the current state of the system with the state observed during the learning stage.” (Para. [0039]) thereby teaching comparing to the current state to an expected threshold that is learned based on the rate at which new file descriptors are required and a number of supported file descriptors in past occurred events.
Regarding Claim 8:
Some of the limitations herein are similar to some or all of the limitations of Claim 1.
Shukla, Cangini, Pope, and Meth further teach:
Memory coupled to at least one processor (Meth – Para. [0037]);
Regarding Claim 9:
All of the limitations herein are similar to some or all of the limitations of Claim 2.
Regarding Claim 10:
All of the limitations herein are similar to some or all of the limitations of Claim 3.
Regarding Claim 11:
All of the limitations herein are similar to some or all of the limitations of Claim 4.
Regarding Claim 12:
All of the limitations herein are similar to some or all of the limitations of Claim 5.
Regarding Claim 13:
All of the limitations herein are similar to some or all of the limitations of Claim 6.
Regarding Claim 15:
All of the limitations herein are similar to some or all of the limitations of Claims 1 and 8.
Regarding Claim 16:
All of the limitations herein are similar to some or all of the limitations of Claim 2.
Regarding Claim 17:
All of the limitations herein are similar to some or all of the limitations of Claim 3.
Regarding Claim 18:
All of the limitations herein are similar to some or all of the limitations of Claim 4.
Regarding Claim 19:
All of the limitations herein are similar to some or all of the limitations of Claim 5.
Regarding Claim 20:
All of the limitations herein are similar to some or all of the limitations of Claim 6.
Claim(s) 7 and 14 are rejected under 35 U.S.C. 103 as being unpatentable over Shukla, Cangini, Pope, and Meth, and further in view of Krywaniuk (U.S. Pre-Grant Publication No. 2007/0168547).
Regarding Claim 7:
Shukla, Cangini, Pope, and Meth explicitly teach all of the elements of the claimed invention as recited above except:
Determining that the file descriptor is the least-recently-used file descriptor among recently-used file descriptors that have been duplicated using dup2() system calls,
Wherein closing the file descriptor is further based on the file descriptor being the least-recently-used file descriptor.
However, in the related field of endeavor of computerized system and method for handling network traffic, Krywaniuk teaches:
Determining that the file descriptor is the least-recently-used file descriptor among recently-used file descriptors that have been duplicated using dup2() system calls,
Krywaniuk teaches “Because the number of active log files and sockets may exceed the limit of the operating system, an embodiment of the logging server 308 keeps a table of open file descriptors for each active log file, and closes the file descriptors of inactive log files, as dictated by an Least Recently Used (LRU) algorithm, well known to persons of skill in the art.” (Para. [0045]) and “the log manager opens and closes log file descriptors associated with the plurality of log files, such that least recently used log file descriptor is closed first.” (Claim 19). Therefore, Krywaniuk teaches that using a least-recently-used approach for closing file descriptors is “well known to persons of skill in the art”.
Wherein closing the file descriptor is further based on the file descriptor being the least-recently-used file descriptor.
Krywaniuk teaches “Because the number of active log files and sockets may exceed the limit of the operating system, an embodiment of the logging server 308 keeps a table of open file descriptors for each active log file, and closes the file descriptors of inactive log files, as dictated by an Least Recently Used (LRU) algorithm, well known to persons of skill in the art.” (Para. [0045]) and “the log manager opens and closes log file descriptors associated with the plurality of log files, such that least recently used log file descriptor is closed first.” (Claim 19). Therefore, Krywaniuk teaches that using a least-recently-used approach for closing file descriptors is “well known to persons of skill in the art”.
Thus, it would have been obvious to one of ordinary skill in the art, having the teachings of Krywaniuk, Shukla, Canginin, Pope, and Meth at the time that the claimed invention was effectively filed, to have combined the firewall system taught by Krywaniuk with the use of specialized architecture of the GPU, as taught by Shukla, the monitoring (e.g. analyzing) operation of processing systems and intrusion detection systems, as taught by Cangini, the use of privilege levels, as taught by Pope, and the systems and methods for checkpointing and restoring a family of programs, as taught by Meth.
One would have been motivated to make such combination because Krywaniuk teaches “In an embodiment of the inventive firewall system, some daemon processes may act as server processes, forking child processes to handle specific incoming connections. In certain well-known protocols (e.g. PPTP, L2TP, or HTTP), the child process may even fork further processes. In an embodiment of the inventive technique, in order to reduce process overhead on the system, it may be advantageous to aggregate not just the server processes for the virtual domains, but the child processes as well” (Para. [0049]).
Regarding Claim 14:
All of the limitations herein are similar to some or all of the limitations of Claim 7.
Response to Amendment
Applicant’s Amendments, filed on 8/22/2025, are acknowledged and accepted.
In light of the Amendments and Remarks filed on 8/22/2025, the Claim Objection to Claims 5, 12, and 19 has been withdrawn.
Response to Arguments
On page 10 of the Remarks filed on 8/22/2025, Applicant argues that in contrast to the amended independent claims, “Meth uses dup2() to restore file descriptors. More specifically, Meth teaches that when the descriptor file is inherited from the parent and there is no file descriptor to be restored (as is the case in independent claims 1, 8, and 15), then the ‘procedure simply terminates’ as is described in paragraphs [0060]-[0061] and Fig. 7, reproduced below”.Applicant’s argument is not convincing because the independent claims are not rejected just based on Meth, but based on the combination of Shukla, Cangini, Pope, and Meth. It is further noted that the argument does not specify which limitations or portions of the claims in particular are not being taught.
On page 10 of the Remarks filed on 8/22/2025, Applicant argues, with reference to Fig. 7 and Paras. [0050] – [0061] of Meth, that “the Office Action fails to explain why the procedure and goals in Meth would be changed. Applicant respectfully submits that Pope and Cangini do not remedy this deficiency, either”.Applicant’s argument is not convincing because motivations to combine each reference with the previously combined references are recited in the rejection. It is further noted that Applicant does not specify what change the Office action fails to explain.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Goyal et al. (U.S. Patent No. 6,976,258) teaches “Whenever a process calls the system close function 507, the close wrapper 605 executes. The close wrapper 605 uses the copy of the pointer 603 to the system close function 507 to call the system close function 507. The system close function 507 executes and closes the file. When the system close function 507 terminates, the close wrapper 605 resumes execution. The close wrapper 605 checks the plurality of read flags 501 for a flag concerning the combination of the process that called the close function 507 and the file descriptor of the file that the process is attempting to close. If there is no read flag 501 for the combination, the close wrapper 605 simply exits. The combination is not one pertaining to virtual host 115 communication, and the close wrapper 605 need not adjust the read flags 501. On the other hand, if a read flag 501 exists for the combination, the close wrapper 605 modifies it to indicate that quality of service has not been set for the combination. This is useful because the process that called the close function 507 may later utilize the same file descriptor to manage communication between a client 111 and a different virtual host 115, requiring a different quality of service guarantee. Thus, it is useful that the read flag 501 indicates quality of service is not set.” (Col. 16 Lines 4-25).
Nagaraja et al. (U.S. Pre-Grant Publication No. 2013/0066928) teaches caching socket connections while ensuring that there are file descriptors available for the applications. File descriptor references and their referenced objects are stored in a predefined memory region of the heap ("file descriptor heap"). Each time a socket connection is cached, a file descriptor reference may be created to be associated with the socket connection's file descriptor, where the file descriptor reference references the object of the cached socket connection. In order to ensure that there are available file descriptors for the applications, the file descriptor references and their referenced objects are collected by the garbage collector in response to various events (e.g., too many file descriptors are open) thereby freeing the file descriptors that were previously associated with the collected connection objects to be used by the applications.
Tolpin et al. (U.S. Pre-Grant Publication No. 2017/0032120) teaches a system for discovering programming variants. The system analyzes system calls from executing a program to generate programming code or executable for a particular OS and/or CPU that would perform the same or similar actions as the program. The code that is generated is then mutated, augmented, and/or changed to create variations of the program which still functions and/or obtains the same objectives as the original code.
Blaine et al. (U.S. Pre-Grant Publication No. 2013/0339313) teaches guarded file access operations are provided for creating and using guarded file descriptors, which can detect and prevent erroneous file access operations in computer programs. A file descriptor can be associated with a guard identifier to create a guarded file descriptor. The association can be established when the file is opened, and can be maintained independently of the computer program, which ordinarily maintains its own association between files, file descriptors, and guard identifiers. Subsequent file operations using the guarded file descriptor check that the guard identifier previously associated with that file descriptor is presented, and generate errors without performing the requested file operations if the correct guard identifier is not presented. This check serves as a validation of the computer program's use of file descriptors. An error and stack trace can be generated for use in analyzing a cause of the guard violation.
Allen (U.S. Patent No. 9,875,192) teaches receiving a call, from a thread, of a plurality of threads performing the same operations in parallel, in association with a virtual machine, to read a block of data from a file, allocating memory accessible by both the virtual machine and the plurality of threads for receiving the block, and providing the block by causing the block to be copied from the file associated with a file descriptor into the memory. A system and method that includes receiving a call from a thread of a plurality of threads executing the same instructions in parallel in association with a virtual machine, to write a block of data to a file, configuring a buffer accessible by the virtual machine to receive the block, writing the block to the configured buffer, and causing the block to be copied from the configured buffer to the file.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ROBERT F MAY whose telephone number is (571)272-3195. The examiner can normally be reached Monday-Friday 9:30am to 6pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Hosain Alam can be reached on 571-272-3978. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ROBERT F MAY/Examiner, Art Unit 2154 10/29/2025
/BORIS GORNEY/Supervisory Patent Examiner, Art Unit 2154