DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-20 are pending in this office action.
Claims 1, 9 and 16 are amended.
Response to Arguments
Applicant’s arguments, with respect to the rejection(s) of claims 1-20 have been fully considered and are persuasive. Therefore, the rejection has been withdrawn. However, upon further consideration, a new ground(s) of rejection is made in view of LIU et al.
Claims 1-20 objection is withdrawn in view of the amendment.
Claims 16-20 rejection under 35 USC 101 for signal per see is withdrawn in view of the amendment.
Applicant’s argument:
Applicant respectfully submits that no prior art of record in the present case teaches or suggests the emphasized features of amended claim 1. In particular, there exists no teaching or disclosure within the entirety of Kosaka and/or Hsieh that teaches or suggests comparing a reference symbol table with the build time symbol table from the software image, and when the build time symbol table and the reference symbol table do not match, determine that at least one of the source code files used to build the executable image have been changed from when the executable image was originally built to be malicious.
In rejecting claim 1, the Office Action asserts that Kosaka teaches that, when a build time symbol table and a reference symbol table do not match, perform at least one remedial action. (Office Action, pages 10-11). Without acquiescing to the propriety of this assertion, Applicant respectfully submits that Kosada does not teach or suggest that, when a first symbol table (e.g., build time symbol table) does not match a second symbol table (e.g., reference symbol table), determine that at least one of the source code files used to build the executable image have been changed from when the executable image was originally built to be malicious.
Examiner response:
The issue in the argument is that none of arts of record teaches the amended limitations and specifically referencing symbol table and reference table to determine any malicious(file) due to modification.
During development of a program, an original program is created , the original program is compiled and deployed to runtime execution. A symbol table for that program is created and as original file symbols associated with the program and used as the runtime table of the original program( first symbol table):
[0042] In the first phase, symbol tables are used to identify symbols that are suitable for equipping with redirection ability. Potentially every symbol in a program is susceptible for re-direction, as desired. Symbol names referencing computer program instruction, data or other items can all be prepared for redirection. A default method of the first phase provides an executable object version of the original program that behaves in an identical manner with the original program. The symbols are mapped through a table to achieve the desired added level of indirection, thus providing re-directability”;
Programs may need patch and the program may be edited: including new files, modified files or deleted files, so the symbol table(second symbol table) my include symbols not in the original program(comparison steps):
[0083] “ Although the preferred embodiment envisions that a programmer modifies the original code, it is also possible to develop new add-on code from scratch. However, starting with working portions of the original code is often the more efficient approach. At substep 308, the existing code or data structures can be modified, new code or data structures can be introduced, existing code or data structures can be disabled, etc.”;
[0087] Either at startup or during run-time, the symbol references of the original program are modified to "point" to new items provided by the new modules. The redirection of symbol references can take place just once at startup, prior to executing the program code, or can take place numerous times, dynamically, as the program code is executed by means of mechanisms such as concurrently executing script instructions”;
The symbol are modified because the old file is changed(malicious) for executing within the program. more clarification from LIU by generating patch to fix an error in a file used in a program by:
Comparing the symbol tables and while detecting difference generate a patch .and the patch is generated to fix the error in an original file(old file).
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to a judicial exception (i.e., a law of nature, a natural phenomenon, or an abstract idea) without significantly more.
the claimed invention is directed to an abstract Idea without significantly more.
Claims 1, 9, and 16 recite:
“…compare a reference symbol table with the build time symbol table from the software image;
and when the build time symbol table and the reference symbol table do not match, determine that at least one of the source code files used to build the executable image have been changed from when the executable image was originally built to be malicious, and perform at least one remedial action….”;
that are certainly a mental process that a person can carry out mentally through observation, evaluation, judgment and/or opinion, or even with the aid of pen and paper.
Claims 1, 9 and 16 additionally recite:
“…obtain(/ing) an executable image comprising a build time symbol table that was generated when the executable image was built from one or more source code files, the executable image configured to be installed on the BMC and comprising at least one open-source file that when built comprises a Desktop Bus (D-Bus)interface…”.
While claims 1 additionally recite:
“…a Baseboard Management Controller (BMC); at least one processor; and at least one memory…”.
And claim 16 additionally recites:
“…A non-transitory memory storage device having program instructions stored thereon that, upon execution by one or more processors of a client Information Handling System (IHS)…”
The additional elements “a processor”, “Baseboard Management Controller”, “ non-transitory memory storage device” and “ memory” are directed to generic computer components which are recited at a high level of generality, but to nothing more than an instruction implement “to apply” the abstract idea using a generic computer. See MPEP 2106.05(f).
The additional elements “…obtain(/ing) an executable image comprising a build time symbol table that was generated when the executable image was built from one or more source code files, the executable image configured to be installed on the BMC and comprising at least one open-source file that when built comprises a Desktop Bus (D-Bus)interface…”, that is a data explanation of what the executable image is or include,
are directed to storing, retrieving and manipulating data, that is mere data gathering/storing and does nothing more than adding insignificant extra solution activity to the judicial exception, that is a mere data gathering. See MPEP 2106.05(g).
Claims 1, 9, 16 additional elements do not add meaningful limits to practicing the abstract idea, but to nothing more than an instruction to apply the abstract idea using a generic computer. Thus, the additional elements fail to integrate the judicial exception into a practical application.
Claims 1, 9, 16 does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with regard to integration of the abstract idea into a practical application, The additional elements “a processor”, “Baseboard Management Controller”, “memory storage device” and “ memory” are generic computer components used as a tool to perform the abstract idea.
With regard to the additional element “…obtain(/ing) an executable image comprising a build time symbol table that was generated when the executable image was built from one or more source code files, the executable image configured to be installed on the BMC and comprising at least one open-source file that when built comprises a Desktop Bus (D-Bus)interface…”, the court have found and identified retrieving/storing/manipulating information as well understood, routine conventional activity in the art. See MPEP 2106.05(d).
Accordingly, the additional elements do not provide an inventive concept, thus claims 1, 9, 16 are not patent eligible.
Dependent claims 2-8, 11-15 and 17-20:
Claims 2, 10, 17 recite: “..obtaining the symbol table from a compiler when the executable image is built; and storing the build time symbol table in the executable image..” that are data retrieving and storing, and as discussed above it fails to integrate the judicial exception into a practical application nor sufficient to amount to significantly more than the judicial exception.
Claims 3, 11, 18 recite: “..compress the build time symbol table..” that is data manipulation and as discussed above it fails to integrate the judicial exception into a practical application nor sufficient to amount to significantly more than the judicial exception.
Claims 4-5, 12-13 recite: “…when the acts of obtaining an executable image, comparing the reference symbol table with the build time symbol table and performing at least one remedial action are performed by the BMC, obtain the executable image from an external source…”. In relation to “comparing and performing..” that is a mental process. And with respect to “obtaining …and obtain” that are data retrieving and storing, and as discussed above it fails to integrate the judicial exception into a practical application nor sufficient to amount to significantly more than the judicial exception.
Claim 6 recites:”… wherein the remedial action comprises at least one of inhibiting operation of the BMC or sending an alert message..” that is data manipulation and as discussed above it fails to integrate the judicial exception into a practical application nor sufficient to amount to significantly more than the judicial exception.
Claims 7, 14, 19 recite: “..monitor a source code repository for a new or updated open-source file; generate a new symbol table from the open-source file, and store the new symbol table in the reference symbol table..” with respect to “ monitor ..and generate..” that is a mental process, and in relation to “..store..” that are data retrieving and storing, and as discussed above it fails to integrate the judicial exception into a practical application nor sufficient to amount to significantly more than the judicial exception.
Claims 8, 19, 20 recite:”.. verify the authenticity of the open- source file prior to storing the new symbol table in the reference symbol table” that is a mental process.
Claims 17-20 recite : “…non-transitory memory storage device..” and Claims 2-8 recite:”.. the Information Handling System (HIS)..” that are generic computer components and as discussed above, it fails to integrate the judicial exception into a practical application nor sufficient to amount to significantly more than the judicial exception.
Dependents claims Dependent claims 2-8, 11-15 and 17-20 are not patent eligible.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Kosaka et al US20020100028A1 in view of Hsieh et al US20060184924A1 and LIU et al US20190146777A1.
As pe claim, 1, Kosaka discloses an Information Handling System (IHS) comprising:
at least one processor; and at least one memory coupled to the at least one processor, the at least one memory having program instructions stored thereon that, upon execution by the at least one processor:
[0015] “As with the interpreted code case, the executable object can be transferred on any computer-readable media, transferred over a communication link such as the Internet, or stored in the user's computer by other means. Executable image 34 is accessed by the processor in the user's computer to execute the compiled instructions to provide functionality according to the original source code instructions.”;
cause the IHS to: obtain an executable image comprising a build time symbol table that was generated when the executable image was built from one or more source code files:
[0015]“As with the interpreted code case, the executable object can be transferred on any computer-readable media, transferred over a communication link such as the Internet, or stored in the user's computer by other means. Executable image 34 is accessed by the processor in the user's computer to execute the compiled instructions to provide functionality according to the original source code instructions.”;
[0089]“Because some functions of the process of the invention are performed on object code modules and compiler-generated files such as symbol tables, it is not necessary to have the original source code on hand.”;
the executable image configured to be installed on the BMC:
[0139] “The user must install the files by extracting the dyp file, executing a "dynainstall.exe" program (provided as an extracted file) and running the installed program”;
and comprising at least one open-source file that when built comprises a Desktop bus(D-Bus ) interface:
[0034] “Dynamic linking allows linking to occur at startup time or during run-time execution of the program. The basic method of a DLL is to declare certain symbols as "exported" or "imported" symbols to be resolved at execution time. The code that resolves the symbols (i.e., associates each symbol reference to a symbol definition) is "DLL linking"code which is, itself, linked into the program during the program build and becomes part of executing image 60. At run-time the DLL linking code is executed to provide the executing program with access to items contained in the DLL”;
and when the build time symbol table and the reference symbol table do not match determine that at least one of the source code files used to build the executable image have been changed from when the executable image was originally built to be malicious:
[0114]“For example, in FIG. 3E, the reference from WN4 (corresponding to the reference to the symbol string_ptr at module Example of Table I) which originally was through VF3 to WN7 is shown, instead, to refer to WN9 via VF3. Similarly, the reference from WN3 via VF4 to WN8 has been modified to instead reference WN7. Note that the object starting with WN9 can be program code, data, etc. that has been added at run-time and linked to a symbol reference via Table 362. The new module 364 of FIG. 3E behaves differently from DLL 342 of FIG. 3C in that new module 364 need not have been referred to in the initial program code. In other words, new module 364 can have a symbol such as "new_funct" which is not defined or declared in the source code shown in Table I”;
[0114] For example, in FIG. 3E, the reference from WN4 (corresponding to the reference to the symbol string_ptr at module Example of Table I) which originally was through VF3 to WN7 is shown, instead, to refer to WN9 via VF3. Similarly, the reference from WN3 via VF4 to WN8 has been modified to instead reference WN7. Note that the object starting with WN9 can be program code, data, etc. that has been added at run-time and linked to a symbol reference via Table 362. The new module 364 of FIG. 3E behaves differently from DLL 342 of FIG. 3C in that new module 364 need not have been referred to in the initial program code. In other words, new module 364 can have a symbol such as "new_funct" which is not defined or declared in the source code shown in Table I”;
and perform at least one remedial action:
[0115] Alternatively, the object beginning with word WN9 can be a modified, substituted, or changed version of an original object such as string_ptr originally defined starting at WN7. In this manner, new objects can be substituted under the same name as an original object in the original program. By substituting a "null" function for an existing function, that function can be effectively removed. By removing all data bytes in, for example, a bit map image, that image can be effectively deleted from the original program. By substituting a different image and using the same symbolic name as in the original program, that original image is effectively replaced. By providing a new symbol as a table entry for a newly-defined object that is loaded in from a new module, items can be added to the compiled program's run-time image.”;
But not explicitly:
compare a reference symbol table with the build time symbol table from the software image;
a Baseboard Management Controller (BMC);
Hsieh discloses:
a Baseboard Management Controller (BMC):
[0004] “The hardware architecture is a piece of platform management hardware, usually a microcontroller with a built-in baseboard management controller (BMC).”;
Hsieh also discloses:
Exchanging messages:
[0026] “The channel center 200 uses a channel application interface to transmit or receive a channel message from the message source, and obtains an address pointer corresponding to the channel message. The channel table 202, which is coupled to the channel center 200, defines the channel application interface of the channel center 200 for updating the communication interface between the channel application interface and the outer hardware management unit 210”;
[0027] The IPMI core subsystem 204, which is coupled with the channel center 200, processes the channel messages. More particularly, the IPMI core subsystem 204 comprises a central message buffer unit, a message execution module and a memory control unit (not shown).
It would have obvious to one having ordinary skill in the art before the effective filling date of the claimed invention to combine the teachings of cited references. One of ordinary skill in the art before the effective filling date of the claimed invention would have been motivated to incorporate the teachings of Hsieh into teachings of Kosaka for selecting and customizing code for defining an additional environmental parameter is created. The source code corresponding to the selected hardware interface device and customized code are compiled together to form a firmware object code. The firmware object code is linked to the core code pre-stored in a memory for building the intelligent platform management interface (IPMI) firmware architecture.[Hsieh 0037].
But not explicitly:
compare a reference symbol table with the build time symbol table from the software image;
LIU discloses:
compare a reference symbol table with the build time symbol table from the software image;
[0082]”In the embodiment, the electronic device may determine a difference symbol between the first target file and the second target file using the first symbol table and the second symbol table”;
[0073] “In the implementation, the indicator is a non-difference indicator or a difference type indicator, the non-difference indicator is used for indicating the first symbol content being identical to the second symbol content, the difference type indicator is used for indicating a type of difference between the second symbol content and the first symbol content, and the type of difference includes addition, deletion and modification.
LIU also discloses:
a difference between symbol table as fixing an error in the first file used in the program:
[0099]“It should be noted that, the linking method not only simplifies the linking procedure, but also has following advantages: the target process may store a function pointer using a variable, and then call the function using the function pointer. If the called function has an error, then calling an old function by a function pointer can only be avoided by modifying the first instruction of the old function and allowing it to jump to a new function in the patch.
It would have obvious to one having ordinary skill in the art before the effective filling date of the claimed invention to combine the teachings of cited references. One of ordinary skill in the art before the effective filling date of the claimed invention would have been motivated to incorporate the teachings of LIU into teachings of Kosaka and Hsieh for the linking method not only simplifies the linking procedure, but also the target process may store a function pointer using a variable, and then call the function using the function pointer. If the called function has an error, then calling an old function by a function pointer can only be avoided by modifying the first instruction of the old function and allowing it to jump to a new function in the patch. [LIU 0099]
As per claim 2, the rejection of claim1 is incorporated and furthermore Kosaka discloses:
wherein the instructions, upon execution, cause the IHS to: obtain the symbol table from a compiler when the executable image is built; and store the build time symbol table in the executable image:
[0127] FIG. 4, shows flowchart 400 where files are shown in boxes and processes are shown in ovals. File Hangman32.cpp at 402 is a source code file that is processed by compiler 404. Compiler 404 can be a standard compiler. In the preferred embodiment, the compiler is directed to insert symbolic names in the output (.obj) files. These symbolic names are later substituted as discussed below. The result of the compilation process is an object file, Hangman32.obj, at 406. Note that although the example uses a single module and resulting single object file, any number of modules, object files, libraries, etc., can be used. The object files are submitted to linker 410 which can be any standard linker. The linker must be directed to generate a .map file so that a list of all symbols, and modules defining and using the symbols, is produced in a file such as the Hangman32.map file at 416.
As per claim 3, the rejection of claim1 is incorporated and furthermore Kosaka discloses:
wherein the instructions, upon execution, cause the IHS to compress the build time symbol table:
[0139] “After the program is dynamized by performing the steps shown in FIG. 4, a "deliverable" file is created. In the preferred embodiment, the deliverable file is a compressed file that expands into the executable object, hangman32.exe; the virtual file system file, hangman32.vfs; “;
As per claim 4, the rejection of claim1 is incorporated and furthermore Kosaka discloses:
wherein the instructions, upon execution, cause the IHS to when the acts of obtaining an executable image, comparing the reference symbol table with the build time symbol table and performing at least one remedial action are performed by the BMC, obtain the executable image from an external source:
[0015] “ Returning to FIG. 1B, the result of linking object files is executable object 30. Executable object 30 represents the deliverable product which is then transferred to the target, or user's, computer 32 for execution. Typically, executable object 30 is loaded by loader 32 which places the executable object into system random access memory (RAM) to produce an executable image 34. As with the interpreted code case, the executable object can be transferred on any computer-readable media, transferred over a communication link such as the Internet, or stored in the user's computer by other means. Executable image 34 is accessed by the processor in the user's computer to execute the compiled instructions to provide functionality according to the original source code instructions.”;
As per claim 5, the rejection of claim1 is incorporated and furthermore Kosaka discloses:
wherein the instructions, upon execution, cause the IHS to when the acts of obtaining an executable image, comparing the reference symbol table with the build time symbol table and performing at least one remedial action are performed external to the BMC, obtain the executable image from a local source:
[0015] “ Returning to FIG. 1B, the result of linking object files is executable object 30. Executable object 30 represents the deliverable product which is then transferred to the target, or user's, computer 32 for execution. Typically, executable object 30 is loaded by loader 32 which places the executable object into system random access memory (RAM) to produce an executable image 34. As with the interpreted code case, the executable object can be transferred on any computer-readable media, transferred over a communication link such as the Internet, or stored in the user's computer by other means. Executable image 34 is accessed by the processor in the user's computer to execute the compiled instructions to provide functionality according to the original source code instructions.”;
As per claim 6, the rejection of claim1 is incorporated and furthermore Kosaka discloses:
wherein the remedial action comprises at least one of inhibiting operation of the BMC or sending an alert message:
[0117] A feature of the present invention allows references to be changed while run-time image 380 is executing. That is, one embodiment of the invention provides an interpreted control language that specifies when symbol references are redirected. So, for example, the reference from WN1 through VF1 to WN5 can be switched to refer, instead, to WN8 at any point in the execution of run-time image 380. Such reference switching can be performed on different criteria such as (1) after a specified time interval, (2) when a specific instruction is executed, (3) when an interrupt is received or (4) when a pre-determined user input signal is detected. Other criteria are possible. Any arbitrary condition or state of the computer program or detected signal can be a criterion.
As per claim 7, the rejection of claim1 is incorporated and furthermore Kosaka discloses:
wherein the instructions, upon execution, cause the IHS to: monitor a source code repository for a new or updated open-source file; generate a new symbol table from the open-source file; and store the new symbol table in the reference symbol table:
[0115] “Alternatively, the object beginning with word WN9 can be a modified, substituted, or changed version of an original object such as string_ptr originally defined starting at WN7. In this manner, new objects can be substituted under the same name as an original object in the original program. By substituting a "null" function for an existing function, that function can be effectively removed. By removing all data bytes in, for example, a bit map image, that image can be effectively deleted from the original program. By substituting a different image and using the same symbolic name as in the original program, that original image is effectively replaced. By providing a new symbol as a table entry for a newly-defined object that is loaded in from a new module, items can be added to the compiled program's run-time image.
As per claim 8, the rejection of claim 7 is incorporated and furthermore Kosaka discloses:
wherein the instructions, upon execution, cause the IHS to verify the authenticity of the open-source file prior to storing the new symbol table in the reference symbol table.
[0167] “Thus, the .vfs file provides security to the manufacturer to prevent "hacking" of user's programs and to prevent other manufacturers from making add-on modules to be used with the original manufacturer's product unless permitted, e.g., by license.
Claims 9, 10, 11, 12, 13, 14, 15 are the method claim corresponding to system claims 1, 2, 3, 4, 5, 7, 8 and rejected under the same rational set forth in connection with the rejection of claims 1, 2, 3, 4, 5, 7, 8 above.
Claims 16, 17, 18, 19, 20 are the memory storage device claims corresponding to system claims 1, 2, 3, 7, 8 and rejected under the same rational set forth in connection with the rejection of claims 1, 2, 3, 7, 8 above.
Pertinent arts:
US8631390B2:
An archive storage stores archives 245. An archive 245 includes a manifest 250, a source code snapshot 255, a symbol table 260, and a build product 265. (Each of these items is described below in conjunction with the archive creator 280.) In one embodiment, each archive is stored in a different subdirectory so that the contents of the same archive can be easily identified.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Contact Information
Any inquiry concerning this communication or earlier communications from the examiner should be directed to BRAHIM BOURZIK whose telephone number is (571)270-7155. The examiner can normally be reached Monday-Friday (8-4:30).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Wei Y Mui can be reached at 571-270-2738. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/BRAHIM BOURZIK/Examiner, Art Unit 2191 /WEI Y MUI/Supervisory Patent Examiner, Art Unit 2191
Prosecution Insights