CTNF 18/486,981 CTNF 83789 DETAILED ACTION This office action is in reply to applicant communication filed on May 27, 2026. Notice of Pre-AIA or AIA Status 07-03-aia AIA 15-10-aia The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA. Continued Examination Under 37 CFR 1.114 07-42-04 A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on May 27, 2026. Claim 12 has been cancelled. Claims 1-11 and 13-15 have been presented. Claims 1-11 and 13-15 are pending. 12-261 AIA Response to Argument Applicant’s arguments filed on January 30, 2026 with respect to the 35 U.S.C. rejections have been fully considered but are moot in view of new ground(s) of rejection. Applicant’s argues that the prior art on record fails to teach the limitation, “the vulnerability countermeasure information includes a countermeasure necessity indicator indicating whether to update a setting value in the information processing apparatus”. However, upon further consideration, a new ground(s) of rejection is made using the newly find prior arts to Goldberg (US Pub. No. 2007/0016955). Claim Rejections - 35 USC § 103 07-06 AIA 15-10-15 In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status. 07-20-aia AIA The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. . 07-20-02-aia AIA This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention. 07-21-aia AIA Claim s 1-11 and 13-15 are rejected under 35 U.S.C. 103 as being unpatentable over Ueda (US Pub. No. 2023/0018096) in view of Basavapatna (US Pub. No. 2013/0191919) . As per claim 1 Ueda discloses: A server apparatus comprising: one or more memories; and one or more processors, wherein the one or more processors and the one or more memories are configured to: (paragraph 122 of Ueda, each apparatus and each function (processing) may be implemented by a computer 20 including a processor 21 such as a CPU (Central Processing Unit) and a memory 22 as a storage device ). Acquire vulnerability information about an information processing apparatus; (paragraph 43 of Ueda, vulnerability information of the information system is collected (S102) ). Acquire information about a network to which the information processing apparatus is connected; (paragraph 42 of Ueda, in the recognition of the vulnerability (S110), a configuration of the information system is acquired (S101) ) and (paragraph 60 of Ueda, the system configuration information includes hardware information, software information, network information , various setting information, and the like of node devices (terminals) constituting the information system ). Transmit, to the information processing apparatus, vulnerability countermeasure information based on the vulnerability information and the information about the network. (Paragraph 44 of Ueda , it is determined whether or not the vulnerability needs to be addressed (S103). Based on the collected vulnerability information, it is determined whether or not the vulnerabilities of the software and the hardware should be addressed in the information system ) and (paragraph 45 of Ueda, when it is determined that a countermeasure is needed, detection and analysis (S104) of an attack exploiting the vulnerability are performed as a countermeasure against the vulnerability (S120). By referring to a log of the information system, it is confirmed whether there is any trace of the attack which exploited the corresponding vulnerability. Depending on a result of the detection of the attack exploiting the vulnerability and the details of the vulnerability, necessary countermeasures such as prevention (mitigation measure) (S105), containment/eradication/recovery (S106), and prevention (permanent measure) (S107) shall be taken. In the prevention (mitigation measure) (S105), filtering of IP (Internet Protocol) addresses and URLs (Uniform Resource Locators) is set in the information system. The containment/eradication/recovery (S106) involve incident handling. In the prevention (permanent measure) (S107), a patch is installed in the information system ) and (paragraph 82 of Ueda, the output unit 150 outputs all the results when all the determination results of the temporal value determination unit 120, the environmental value determination unit 130, and the base value determination unit 140 indicate that a countermeasure is needed. Alternatively, the output unit may output only the result indicating that a countermeasure is needed if any one of the determination results indicates so. The output method is not limited, and the determination result may be displayed on a display unit (display device) by a GUI (Graphical User Interface), or the user may be notified of data in any format indicating the determination result ). Ueda teaches the method of collecting vulnerability information and providing a countermeasure (see paragraphs 43 and 44 of Ueda) but fails to disclose: Wherein the vulnerability countermeasure information indicates a vulnerability, among a plurality of vulnerabilities, against which the information processing apparatus is to take measures. However, in the same field of endeavor, Basavapatna teaches this limitation as, (paragraph 14 of Basavapatna, one aspect of the subject matter described in this specification can be embodied in methods that include the actions of receiving vulnerability definition data including, for each of a plurality of vulnerabilities, an indication of the vulnerability, an identification of one or more countermeasures that reduce a risk associated with possession of the vulnerability by an asset, an indication of a level of protection potentially afforded by each countermeasure for the vulnerability, and applicability information describing one or more configurations of assets to which the vulnerability applies ). Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teaching of Ueda to include the above limitation using the teaching of Basavapatna in order to enhance the security of computing system by providing appropriate countermeasure based on the type of vulnerability (see paragraph 14 of Basavapatna). The combination of Ueda and Basavapatna teaches the method of collecting vulnerability information and providing a countermeasure (see paragraphs 43 and 44 of Ueda) but fails to disclose: The vulnerability countermeasure information includes a countermeasure necessity indicator indicating whether to update a setting value in the information processing apparatus. However, in the same field of endeavor, Goldberg teaches this limitation as, (paragraph 144 of Goldberg, the optimization process is performed on a complete threat model by setting the "implemented" flag IF to "True" for various combinations of countermeasures and learning the changes in the value of the system's current risk according to the output of the calculation method. The process is performed in an iterative fashion by using the mitigation results reported by the calculation method on previous steps for choosing the set of countermeasures for the next guess. The iterative process can be done manually by the analyst or automatically by the software that calculates the mitigation results for the most promising combinations of countermeasures ). Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teaching of Ueda and Basavapatna to include the above limitation using the teaching of Goldberg in order to enhance the security of computing system by managing threats and countermeasure and mitigate the threat (see paragraph 1 of Goldberg). Claim 14 is rejected under the same reason set forth in rejection of claim 1. As per claim 2 Ueda in view of Basavapatna discloses: The server apparatus according to claim 1, wherein the information about the network is an identifier configured to identify security of the network to which the information processing apparatus is connected. (Paragraph 105 of Ueda, based on the determination of the complexity of the attack condition, it is confirmed whether or not information (configuration information, sequence number, shared key, etc.) necessary for a successful attack in the base value of the vulnerability matches that of the policy of the information system (whether or not information necessary for a successful attack in the base value of the vulnerability is included in the policy) ) and (paragraph 42 of Ueda, in the recognition of the vulnerability (S110), a configuration of the information system is acquired (S101) ) and (paragraph 60 of Ueda, the system configuration information includes hardware information, software information, network information , various setting information, and the like of node devices (terminals) constituting the information system ). As per claim 3 Ueda in view of Basavapatna discloses: The server apparatus according to claim 1, wherein the one or more processors and the one or more memories are further configured to acquire the information about the network from a network device within the network to which the information processing apparatus is connected. (paragraph 42 of Ueda, in the recognition of the vulnerability (S110), a configuration of the information system is acquired (S101) ) and (paragraph 60 of Ueda, the system configuration information includes hardware information, software information, network information , various setting information, and the like of node devices (terminals) constituting the information system ). As per claim 4 Ueda in view of Basavapatna discloses: The server apparatus according to claim 1, wherein the one or more processors and the one or more memories are further configured to acquire the vulnerability information, based on information about at least one of a protocol, a port, software, and hardware that are used in the information processing apparatus. (Paragraph 42 of Ueda, in the recognition of the vulnerability (S110), a configuration of the information system is acquired (S101). Software and hardware included in the information system are acquired by referring to a detailed design document of the information system and obtaining system configuration information of the information system ). As per claim 5 Ueda in view of Basavapatna discloses: The server apparatus according to claim 1, wherein the one or more processors and the one or more memories are further configured to acquire the vulnerability information, based on information about at least one of a vendor name, a device name, and a model number of the information processing apparatus. (Paragraph 105 of Ueda, based on the determination of the complexity of the attack condition, it is confirmed whether or not information (configuration information, sequence number, shared key, etc.) necessary for a successful attack in the base value of the vulnerability matches that of the policy of the information system (whether or not information necessary for a successful attack in the base value of the vulnerability is included in the policy) ) and (paragraph 42 of Ueda, in the recognition of the vulnerability (S110), a configuration of the information system is acquired (S101) ) and (paragraph 60 of Ueda, the system configuration information includes hardware information, software information, network information , various setting information, and the like of node devices (terminals) constituting the information system ). As per claim 6 Ueda in view of Basavapatna discloses: The server apparatus according to claim 1, wherein the one or more processors and the one or more memories are further configured to generate the vulnerability countermeasure information, based on attack information about the vulnerability information and a vulnerability severity in the vulnerability information. (Paragraph 8 of Ueda, an analysis apparatus according to the present disclosure includes: environment assessment means for assessing environmental metrics of a Common Vulnerability Scoring System (CVSS) as regards a vulnerability in an information system based on an attack path extracted from the information system to which the vulnerability to be analyzed is applied; base assessment means for assessing base metrics of the CVSS as regards the vulnerability in the information system based on obtained CVSS base value information of the vulnerability and a predetermined base value countermeasure determination condition of the information system; and determination means for determining whether or not the vulnerability in the information system needs to be addressed based on an assessment result of the environmental metrics and an assessment result of the base metrics ). As per claim 7 Ueda in view of Basavapatna discloses: The server apparatus according to claim 1, wherein the one or more processors and the one or more memories are further configured to, in a case where network information specified by the vulnerability information matches the information about the network, transmit the vulnerability information to the information processing apparatus. (Paragraph 105 of Ueda, based on the determination of the complexity of the attack condition, it is confirmed whether or not information (configuration information, sequence number, shared key, etc.) necessary for a successful attack in the base value of the vulnerability matches that of the policy of the information system (whether or not information necessary for a successful attack in the base value of the vulnerability is included in the policy) ) and (paragraph 42 of Ueda, in the recognition of the vulnerability (S110), a configuration of the information system is acquired (S101) ) and (paragraph 60 of Ueda, the system configuration information includes hardware information, software information, network information , various setting information, and the like of node devices (terminals) constituting the information system ). As per claim 8 Ueda in view of Basavapatna discloses: The server apparatus according to claim 1, wherein the vulnerability countermeasure information includes a setting target in which a setting value is to be changed in the information processing apparatus, the setting value after a change, and necessity for a vulnerability countermeasure. (Paragraph 92 of Ueda, the attack path extraction unit 133 extracts the attack path (S233). The attack path extraction unit 133 generates the attack graph by using the attack graph generation technique based on the set and analyzed information, and extracts the attack path of the information system including a vulnerability of the analysis target. That is, by inputting the system configuration information to which the newly discovered vulnerability to be analyzed is applied in addition to existing vulnerabilities, the entry point, the attack target, and the like to the attack graph generation technique, the attack graph from the entry point to the attack target passing through the vulnerability of each node is generated ). As per claim 9 Ueda in view of Basavapatna discloses: The server apparatus according to claim 6, wherein the one or more processors and the one or more memories are further configured to, in a case where the vulnerability severity in the vulnerability information is greater than a predetermined value, transmit the vulnerability information to the information processing apparatus. (Paragraph 8 of Ueda, an analysis apparatus according to the present disclosure includes: environment assessment means for assessing environmental metrics of a Common Vulnerability Scoring System (CVSS) as regards a vulnerability in an information system based on an attack path extracted from the information system to which the vulnerability to be analyzed is applied; base assessment means for assessing base metrics of the CVSS as regards the vulnerability in the information system based on obtained CVSS base value information of the vulnerability and a predetermined base value countermeasure determination condition of the information system; and determination means for determining whether or not the vulnerability in the information system needs to be addressed based on an assessment result of the environmental metrics and an assessment result of the base metrics ). As per claim 10 Ueda in view of Basavapatna discloses: The server apparatus according to claim 1, wherein the one or more processors and the one or more memories are further configured to, in a case where authentication by the information processing apparatus is successful, transmit the vulnerability information to the information processing apparatus. (Paragraph 103 of Ueda, in the determination of the privilege level (S253), whether or not a countermeasure is needed is determined based on whether or not the “privilege level” of the base value information of the vulnerability matches the “privilege level” of the policy determination table (whether or not the “privilege level” of the base value information of the vulnerability is included in the policy). By determining the privilege level, it is confirmed whether or not the necessity of authentication and administrator privilege (whether or not access to secret information is needed or the like) of the base value of the vulnerability matches that of the policy of the information system (whether or not the necessity of authentication and administrator privilege of the base value of the vulnerability is included in the policy) ). As per claim 11 Ueda discloses: An information processing apparatus comprising: one or more memories; and one or more processors, wherein the one or more processors and the one or more memories are configured to: (paragraph 122 of Ueda, each apparatus and each function (processing) may be implemented by a computer 20 including a processor 21 such as a CPU (Central Processing Unit) and a memory 22 as a storage device ). Acquire vulnerability countermeasure information; (paragraph 84 of Ueda, as shown in FIG. 13, in the vulnerability information collection processing, the security information collection unit 110 obtains the vulnerability information from the vulnerability information DB 300, such as a public database (S211), and determines whether or not a new vulnerability has been discovered (S212) ). Acquire information about a network being connected; and determine whether to apply the vulnerability countermeasure information, based on the information about the network. (Paragraph 85 of Ueda, when a new vulnerability is discovered, the security information collection unit 110 obtains the system configuration information of the system configuration information DB 200 in order to analyze whether or not the new vulnerability in the user's information system needs to be addressed (S213) . In addition, the security information collection unit 110 obtains the intelligence information about the vulnerability and the like from, for example, the vulnerability information DB 300 and the vendor) and (paragraph 42 of Ueda, in the recognition of the vulnerability (S110), a configuration of the information system is acquired (S101) ) and (paragraph 60 of Ueda, the system configuration information includes hardware information, software information, network information , various setting information, and the like of node devices (terminals) constituting the information system ). Ueda teaches the method of collecting vulnerability information and providing a countermeasure (see paragraphs 43 and 44 of Ueda) but fails to disclose: Wherein the vulnerability countermeasure information indicates a vulnerability, among a plurality of vulnerabilities, against which the information processing apparatus is to take measures. However, in the same field of endeavor, Basavapatna teaches this limitation as, (paragraph 14 of Basavapatna, one aspect of the subject matter described in this specification can be embodied in methods that include the actions of receiving vulnerability definition data including, for each of a plurality of vulnerabilities, an indication of the vulnerability, an identification of one or more countermeasures that reduce a risk associated with possession of the vulnerability by an asset, an indication of a level of protection potentially afforded by each countermeasure for the vulnerability, and applicability information describing one or more configurations of assets to which the vulnerability applies ). Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teaching of Ueda to include the above limitation using the teaching of Basavapatna in order to enhance the security of computing system by providing appropriate countermeasure based on the type of vulnerability (see paragraph 14 of Basavapatna). The combination of Ueda and Basavapatna teaches the method of collecting vulnerability information and providing a countermeasure (see paragraphs 43 and 44 of Ueda) but fails to disclose: The vulnerability countermeasure information includes a countermeasure necessity indicator indicating whether to update a setting value in the information processing apparatus. However, in the same field of endeavor, Goldberg teaches this limitation as, (paragraph 144 of Goldberg, the optimization process is performed on a complete threat model by setting the "implemented" flag IF to "True" for various combinations of countermeasures and learning the changes in the value of the system's current risk according to the output of the calculation method. The process is performed in an iterative fashion by using the mitigation results reported by the calculation method on previous steps for choosing the set of countermeasures for the next guess. The iterative process can be done manually by the analyst or automatically by the software that calculates the mitigation results for the most promising combinations of countermeasures ). Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teaching of Ueda and Basavapatna to include the above limitation using the teaching of Goldberg in order to enhance the security of computing system by managing threats and countermeasure and mitigate the threat (see paragraph 1 of Goldberg). Claim 15 is rejected under the same reason set forth in rejection of claim 11 As per claim 13 Ueda in view of Basavapatna discloses: The information processing apparatus according to claim 11, wherein the one or more processors and the one or more memories are further configured to acquire the vulnerability countermeasure information from a server apparatus. (Paragraph 98 of Ueda, in the information system 400, when the maintenance server 422, the monitoring control server 423, and the HMI 424 are important assets, it is assumed that a vulnerability is present in the monitoring control server 423. Although the monitoring control server 423 is an important asset, it cannot be directly accessed from the OA terminal 411 because of the FW2 and has no external connection. Thus, the attack graph is analyzed, and the attack path from the Internet 401 to the monitoring control server 423 is not extracted, and it is therefore determined that a countermeasure against the vulnerability is not needed (S241). That is, in this case, since the monitoring control server 423 is isolated by the FW2, the countermeasure is suspended ). Conclusion The prior art made or record and not relied upon is considered pertinent to applicant’s disclosure is McConnell (US Pub. No. 2011/0093786). McConnell’s reference discloses: Systems and methods for geographically mapping a vulnerability of a network having one or more network points include receiving vulnerability information identifying a vulnerability of a point of the network, correlating the vulnerability information with location information for the identified network point, and network identification information for the identified network point, and generating a map displaying a geographical location of the vulnerability. Any inquiry concerning this communication or earlier communications from the examiner should be directed to TESHOME HAILU whose telephone number is (571)270-3159. The examiner can normally be reached M-F 8 a.m. - 5 p.m.. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ali Shayanfar can be reached at (571) 270-1050. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /TESHOME HAILU/Primary Examiner, Art Unit 2434 Application/Control Number: 18/486,981 Page 2 Art Unit: 2434 Application/Control Number: 18/486,981 Page 3 Art Unit: 2434 Application/Control Number: 18/486,981 Page 4 Art Unit: 2434 Application/Control Number: 18/486,981 Page 5 Art Unit: 2434 Application/Control Number: 18/486,981 Page 6 Art Unit: 2434 Application/Control Number: 18/486,981 Page 7 Art Unit: 2434 Application/Control Number: 18/486,981 Page 8 Art Unit: 2434 Application/Control Number: 18/486,981 Page 9 Art Unit: 2434 Application/Control Number: 18/486,981 Page 10 Art Unit: 2434 Application/Control Number: 18/486,981 Page 11 Art Unit: 2434 Application/Control Number: 18/486,981 Page 12 Art Unit: 2434
Prosecution Insights