Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
DETAILED ACTION
Claims 1-22 are pending in this office action. Claims 9-10 and 19 have been cancelled.
Applicants’ arguments, filed 06/10/2026, have been fully considered but they are not persuasive.
Continued Examination under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant’s submission filed on 06/10/2026 has been entered.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-3, 11-13, 20-21 are rejected under 35 U.S.C. 103 as being unpatentable over Martin et al. (US 2021/0026960 A1, hereinafter Martin), in view of Horev et al. (US 2023/0205889 A1, hereinafter Horev).
For claim 1, Martin teaches a computer-implemented method for detection of malware, said method comprising: obtaining a deduplication signature of a file stored in a first location, wherein the deduplication signature includes a plurality of suspect signature blocks (para 0015-0016, 0028-0033 - deduplication signature or fingerprints associated with file blocks and virus definitions, storing the plurality of potential suspect signature blocks in a searchable format by deduplication process and used by virus detection process);
storing the plurality of suspect signature blocks in a suspect signature block store (para 0028-0033, 0035 - deduplication fingerprint blocks associated with suspect files are stored in searchable format such as indexes at another memory location such that further referencing to those can be made for virus detection); and
identifying a suspect signature block in a second location using the suspect signature block store (Fig. 1; para 0015-0016, 0028-0029, 0033-0035, 0038 - making available deduplication fingerprint blocks associated with malicious or suspect files for search by virus detection process, for comparison of deduplication fingerprint with the deduplication index stored in one memory, wherein the data is received by a storage device (e.g., device 12 of FIG. 1) from a host (e.g. hosts 14a-n); i.e. comparing by a virus detection process the deduplication fingerprints for the I/O data blocks with virus deduplication fingerprints contained in the virus fingerprint data structure).
Martin does not appear to explicitly disclose, however Horev teaches obtaining, in response to identifying a file as being suspicious based on a malware scan of data of the file, a deduplication signature (para 0031, 0055-0056 – when a malware scan by anti-malware application detects a suspicious file, similar files are searched to obtain similarity signature or hash from a location as deduplication signature for the purpose of preventing duplicate malware scanning; para 0095-0099 – similar process of utilizing deduplication upon detection of suspicious files). Based on Martin in view of Horev, it would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to utilize teachings of Horev in the system of Martin, in order to incorporate techniques to prevent redundant or duplicate object scanning by using similarity check associated with signature such as hash, thereby looking up objects for sanity only as needed and improving system’s efficiency.
For claim 2, Martin in view of Horev teaches the claimed subject matter as discussed above. Martin further teaches wherein the suspect signature block in the second location is identified using a deduplication pointer (para 0028, 0033-0035 - deduplication fingerprint blocks pointers or indexes associated with malicious or potential suspect files for referencing and search).
For claim 3, Martin in view of Horev teaches the claimed subject matter as discussed above. Martin further teaches wherein the second location is a second client and wherein the first location is a first client (para 0001, 0015, 0034-0035 - fingerprint referencing or identification of suspicious files in real-time or as it is being opened; Fig. 1; para 0015-0016, 0028-0029, 0033-0035, 0038 - making available deduplication fingerprint blocks associated with malicious or suspect files for search by virus detection process, for comparison of deduplication fingerprint with the deduplication index stored in one memory, wherein the data is received by a storage device (e.g., device 12 of FIG. 1) from a host (e.g. hosts 14a-n); i.e. comparing by a virus detection process the deduplication fingerprints for the I/O data blocks with virus deduplication fingerprints contained in the virus fingerprint data structure, wherein the data storages pertaining to indexes or I/O data blocks with incoming virus signature data for comparison are on different hosts or clients).
For claim 11, Martin teaches a system comprising a processor set; one or more computer-readable storage media; and program instructions stored on the one or more computer-readable media to cause the processor set to perform operations (Fig. 1-3; para 0016, 0018, 0023) comprising: obtaining a deduplication signature of a file stored in a first location and identified as being suspicious, wherein the deduplication signature includes a plurality of suspect signature blocks (para 0015-0016, 0028-0033 - deduplication signature or fingerprints associated with file blocks and virus definitions, storing the plurality of potential suspect signature blocks in a searchable format by deduplication process and used by virus detection process); storing the plurality of suspect signature blocks in a suspect signature block store (para 0028-0033, 0035 - deduplication fingerprint blocks associated with suspect files are stored in searchable format such as indexes at another memory location such that further referencing to those can be made for virus detection); and identifying a suspect signature block in a second location using the suspect signature block store (Fig. 1; para 0015-0016, 0028-0029, 0033-0035, 0038 - making available deduplication fingerprint blocks associated with malicious or suspect files for search by virus detection process, for comparison of deduplication fingerprint with the deduplication index stored in one memory, wherein the data is received by a storage device (e.g., device 12 of FIG. 1) from a host (e.g. hosts 14a-n); i.e. comparing by a virus detection process the deduplication fingerprints for the I/O data blocks with virus deduplication fingerprints contained in the virus fingerprint data structure).
Martin does not appear to explicitly disclose, however Horev teaches obtaining, in response to identifying a file as being suspicious based on a malware scan of data of the file, a deduplication signature (para 0031, 0055-0056 – when a malware scan by anti-malware application detects a suspicious file, similar files are searched to obtain similarity signature or hash as deduplication signature for the purpose of preventing duplicate malware scanning; para 0095-0099 – similar process of utilizing deduplication upon detection of suspicious files). Based on Martin in view of Horev, it would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to utilize teachings of Horev in the system of Martin, in order to incorporate techniques to prevent redundant or duplicate object scanning by using similarity check associated with signature such as hash, thereby looking up objects for sanity only as needed and improving system’s efficiency.
For claim 12, Martin in view of Horev teaches the claimed subject matter as discussed above. Martin further teaches wherein the suspect signature block in the second location is identified using a deduplication pointer (para 0028, 0033-0035 - deduplication fingerprint blocks pointers or indexes associated with malicious or potential suspect files for referencing and search).
For claim 13, Martin in view of Horev teaches the claimed subject matter as discussed above. Martin further teaches wherein the second location is a second client and wherein the first location is a first client (para 0001, 0015, 0034-0035 - fingerprint referencing or identification of suspicious files in real-time or as it is being opened; Fig. 1; para 0015-0016, 0028-0029, 0033-0035, 0038 - making available deduplication fingerprint blocks associated with malicious or suspect files for search by virus detection process, for comparison of deduplication fingerprint with the deduplication index stored in one memory, wherein the data is received by a storage device (e.g., device 12 of FIG. 1) from a host (e.g. hosts 14a-n); i.e. comparing by a virus detection process the deduplication fingerprints for the I/O data blocks with virus deduplication fingerprints contained in the virus fingerprint data structure, wherein the data storages pertaining to indexes or I/O data blocks with incoming virus signature data for comparison are on different hosts or clients).
For claim 20, Martin teaches a computer program product comprising: one or more computer-readable storage media; and program instructions stored on the one or more computer-readable media to perform operations (Fig. 1-3; para 0016, 0018, 0023), comprising: obtaining a deduplication signature of a file stored in a first location and identified as being suspicious, wherein the deduplication signature includes a plurality of suspect signature blocks (para 0015-0016, 0028-0033 - deduplication signature or fingerprints associated with file blocks and virus definitions, storing the plurality of potential suspect signature blocks in a searchable format by deduplication process and used by virus detection process);
storing the plurality of suspect signature blocks in a suspect signature block store (para 0028-0033, 0035 - deduplication fingerprint blocks associated with suspect files are stored in searchable format such as indexes at another memory location such that further referencing to those can be made for virus detection); and
identifying a suspect signature block in a second location using the suspect signature block store (Fig. 1; para 0015-0016, 0028-0029, 0033-0035, 0038 - making available deduplication fingerprint blocks associated with malicious or suspect files for search by virus detection process, for comparison of deduplication fingerprint with the deduplication index stored in one memory, wherein the data is received by a storage device (e.g., device 12 of FIG. 1) from a host (e.g. hosts 14a-n); i.e. comparing by a virus detection process the deduplication fingerprints for the I/O data blocks with virus deduplication fingerprints contained in the virus fingerprint data structure).
Martin does not appear to explicitly disclose, however Horev teaches obtaining, in response to identifying a file as being suspicious based on a malware scan of data of the file, a deduplication signature (para 0031, 0055-0056 – when a malware scan by anti-malware application detects a suspicious file, similar files are searched to obtain similarity signature or hash as deduplication signature for the purpose of preventing duplicate malware scanning; para 0095-0099 – similar process of utilizing deduplication upon detection of suspicious files). Based on Martin in view of Horev, it would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to utilize teachings of Horev in the system of Martin, in order to incorporate techniques to prevent redundant or duplicate object scanning by using similarity check associated with signature such as hash, thereby looking up objects for sanity only as needed and improving system’s efficiency.
For claim 21, Martin in view of Horev teaches the claimed subject matter as discussed above. Martin further teaches wherein the first location is a first client, wherein the file is identified as suspicious by a malware scan, wherein the second location is a second client (para 0001, 0015, 0034-0035 - fingerprint referencing or identification of suspicious files in real-time or as it is being opened; Fig. 1; para 0015-0016, 0028-0029, 0033-0035, 0038 - making available deduplication fingerprint blocks associated with malicious or suspect files for search by virus detection process, for comparison of deduplication fingerprint with the deduplication index stored in one memory, wherein the data is received by a storage device (e.g., device 12 of FIG. 1) from a host (e.g. hosts 14a-n); i.e. comparing by a virus detection process the deduplication fingerprints for the I/O data blocks with virus deduplication fingerprints contained in the virus fingerprint data structure, wherein the data storages pertaining to indexes or I/O data blocks with incoming virus signature data for comparison are on different hosts or clients), and wherein the suspect signature block is identified in the second client using a deduplication pointer (para 0028, 0033-0035 - deduplication fingerprint blocks pointers or indexes associated with malicious or potential suspect files for referencing and search).
Claim 22 is rejected under 35 U.S.C. 103 as being unpatentable over Martin et al. (US 2021/0026960 A1, hereinafter Martin), in view of Horev et al. (US 2023/0205889 A1, hereinafter Horev), and further in view of Jindal et al. (US 2024/0143759 A1, hereinafter Jindal).
For claim 22, Martin in view of Horev teaches the claimed subject matter as discussed above. Martin teaches signature comparison for virus detection and identifying suspect signature block by signature comparison (Fig. 1; para 0015-0016, 0028-0029, 0033-0035, 0038-0041 - making available deduplication fingerprint blocks associated with malicious or suspect files for search by virus detection process, for comparison of deduplication fingerprint with the deduplication index stored in one memory, i.e. comparing by a virus detection process the deduplication fingerprints for the I/O data blocks with virus deduplication fingerprints contained in the virus fingerprint data structure). Martin in view of Horev does not appear to explicitly disclose, however Jindal teaches wherein the operations further comprise: comparing a number of dereferenced signatures of the file to a number of still-referenced signatures of the file; and determining that a client storing the file is infected in response to the number of dereferenced signatures of the file and the number of still-referenced signatures of the file not matching (para 0154-0155, 0214-0215, 0237 - signature blocks associated with data files including suspect files that stored in resources and needed to be updated resulting in index updates which are all stored in record management database, i.e., new incoming data is compared with corresponding portions that are already in secondary storage, and only new/changed portions are stored, wherein a deduplicated secondary copy may comprise actual data portions copied from primary data and may further comprise pointers to already-stored data, which is generally more storage-efficient than a full copy. To streamline the comparison process, system may calculate and/or store signatures (e.g., hashes or cryptographically unique IDs) corresponding to the individual source data portions and compare the signatures to already-stored data signatures where all signatures need to match for determination of file integrity). Based on Martin in view of Horev and Jindal, it would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to utilize teachings of Jindal in the system of Martin in view of Horev, in order to incorporate matching of received and stored signatures associated with signature such as hash and pertaining to the object being scanned, thereby improving malware prevention process and securing the system.
Allowable Subject Matter
Claims 4-8 and 14-18 are objected to as being dependent upon rejected base claims but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims in addition to overcoming the above-mentioned rejections associated with their parent claims.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. (1) Cohen - US-20240406160-A1 (performing a security action with regard to an access token); (2) Tran - US-20260067335-A1 (method for governing risk actions); (3) Squire - US-20210306320-A1 (client application requesting to access a resource based on access tokens) - are cited to show methods, computer program products and systems pertinent to privileges and token-based access.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JAYESH JHAVERI whose telephone number is (571)270-7584. The examiner can normally be reached on Mon-Fri 9 AM to 5 PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, Applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Pwu can be reached on (571)272-6798. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/JAYESH M JHAVERI/Primary Examiner, Art Unit 2433
Prosecution Insights