DETAILED ACTION
1. Pending claims for reconsideration are claims 1-19.
Response to Arguments
2. Applicant's arguments filed 12/02/2025 have been fully considered but they are not persuasive.
In the remarks, applicant argues in substance:
That- Salmon does not teach or suggest, inter alia, "generating a protected
data package from an initial file"
In response to arguments – The claims were examined in the broadest most reasonable interpretation in light of the applicant’s specification. Under the broadest reasonable interpretation Salmon discloses “generating a protected data package from an initial file” by teaching that an original application file (e.g., executable code such as a DEX/APK file) is processed to generate integrity information (such as checksums or cryptographic signatures) and then packaged together with that information so the application is protected against unauthorized modification, Salmon explains that an integrity value is generated for the original code and stored with the application so that later verification can detect tampering (Salmon [par.0007-0009]), further describes embedding or associating signed checksum data with the application package for deployment and execution (Salmon[par.0025-0027]), and teaches that the resulting package containing both the code and integrity metadata is used to validate authenticity runtime (Salmon[par.0036-0037]). Thus, Salmon broadly teaches transforming an initial file (application code) into a protected data package by adding security and verification data, which corresponds to the claim language reciting “generating a protected data package from an initial file.”
That- Ganapathy does not disclose "wherein the modification is arranged
to cause a failure when a reader for the predetermined file format tries to load the code portion from the modified file"
In response to arguments – Ganapathy discloses a return error in fig.5/item 502 which discloses Figure 5. In step 501, the injection mechanism determines the type of the executable file. Then, in step 502, if it is a known executable file type, the injection mechanism continues in step 503, else returns an error.
Allowable Subject Matter
Claim 15 is objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
4. Claims 16 and 17 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
5. Claim 19 is objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
6. Claims 1-14, and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Pub.No.: US 2017/0262658 A1 to SALMON-LEGAGNEUR et al(hereafter referenced as SALMON) in view of WO-9833106-A1 to Ganapathy
Regarding claim 1, SALMON discloses “a method of generating a protected data package from an initial file”(checksum is generated [par.0018]) , “the initial file having a predetermined file format”(the source acquisition module 232 retrieves the original DEX code ( e . g . from the APK file ) and compares this with the ODEX or ELF file code to determine if the difference between the two correspond to legitimate transformations due to optimization[par.0044]) , “the method comprising: identifying a code portion of the initial file to be protected”(verify a checksum for the unmodified code [Fig.3/item s306]) ; “generating a supplementary file comprising a copy of the code portion”(generate a checksum for the code corresponding to the unmodified application [par.0018]).
SALMON does not explicitly disclose “and modifying the initial file, wherein the modifying comprises replacing at least the code portion of the initial file with replacement data to thereby provide a modified file, wherein the modified file has the same predetermined file format as the initial file, and wherein the modification is arranged to cause a failure when a reader for the predetermined file format tries to load the code portion from the modified file; wherein the protected data package comprises the modified file and the supplementary file”
However, GANAPATHY in an analogous art discloses “and modifying the initial file, wherein the modifying comprises replacing at least the code portion of the initial file with replacement data to thereby provide a modified file”(injection mechanism provides the automatic loading 20 of the DLL by either modifying a table used by the underlying system to automatically load DLLs or by inserting code that knows how to load the DLL GANAPATHY [pg.6/lines 19-21]) , “wherein the modified file has the same predetermined file format as the initial file”(see executable injected file GANAPATHY [Fig.6]) , “and wherein the modification is arranged to cause a failure when a reader for the predetermined file format tries to load the code portion from the modified file (return error GANAPATHY [Fig.5/item 502]) ; “wherein the protected data package comprises the modified file and the supplementary file”(add DDL to import table and inject security code GANAPATHY [Fig.5]).
Therefore, it would have been obvious to one of ordinary skill in the art at the time the invention was filed to modify SALMON’s device execution of modified code in a device with GANAPATHY’s system for injecting new code into existing application code in order to provide additional security. One of ordinary skill in the art would have been motivated to combine because SALMON discloses a device which modifies code in order to verify application integrity, GANAPATHY teaches a process to inject new coding in into an existing code, and both are from the same field of endeavor.
Regarding claim 2 in view of claim 1, the references combined disclose “wherein the replacement data comprises random data and/or null data” (Figure 9 is an overview flow diagram of the steps performed by the injection mechanism for injecting security code and data into an executable file GANAPATHY [pg.9/lines 3-4]).
Regarding claim 3 in view of claim 1, the references combined disclose “wherein identifying the code portion of the initial file to be protected comprises parsing the initial file to identify the code portion” (The executable 10 file may be comprised of multiple memory segments, which are not necessarily contiguous GANAPATHY [pg.11/lines 9-11])
Regarding claim 4 in view of claim 1, the references combined disclose “wherein identifying the code portion of the initial file to be protected comprises parsing the initial file to identify a pointer referencing a location of the code portion in the initial file”(determine the modified code that corresponds to the unmodified code SALMON[Fig.3/item s304])
Regarding claim 5 in view of claim 1, the references combined disclose “wherein the supplementary file further comprises a pointer which references a location of the code portion in the supplementary file” (The header section 205 includes pointers to the application executable code section 202, the import data section 203, and the relocatable data section 204 GANAPATHY [pg.10/line 28- pg.11 line 2)
Regarding claim 6 in view of claim 1, the references combined disclose “wherein the initial file is a dex file, wherein the code portion is associated with a particular class of the .dex file. (The archive file contains the entire program code in a single DEX (Dalvik Executable code SALMON[par.0008]).
Regarding claim 7 in view of claim 1, the references combined disclose “wherein the initial file is a .dex file, wherein the code portion is associated with a particular method of a particular class of the dex file.” (The archive file contains the entire program code in a single DEX (Dalvik Executable code SALMON[par.0008])
Regarding claim 8 in view of claim 1, the references combined disclose “wherein the initial file is a Java class file associated with a particular class, and wherein the code portion is associated with a particular method of the particular class” (applications distributed in the of interpreted code such as code written in Java , Android DEX code , etc. . — comprise intermediate instructions that must be passed through an interpreter before it is executed SALMON[par.0007]
Regarding claim 9, SALMON discloses “a protected data package generated by: identifying a code portion of an initial file”(checksum is generated [par.0018]) , to be protected, the initial file having a predetermined file format(the source acquisition module 232 retrieves the original DEX code ( e . g . from the APK file ) and compares this with the ODEX or ELF file code to determine if the difference between the two correspond to legitimate transformations due to optimization[par.0044]): generating a supplementary file comprising a copy of the code portion; and modifying the initial file” (generate a checksum for the code corresponding to the unmodified application [par.0018])
SALMON does not explicitly disclose “wherein the modifying comprises replacing at least the code portion of the initial file with replacement data to thereby provide a modified file, wherein the modified file has the same predetermined file format as the initial file, and wherein the modification is arranged to cause a failure when a reader for the predetermined file format tries to load the code portion from the modified file; wherein the protected data package comprises the modified file and the supplementary file.”
However, GANAPATHY in an analogous art disclose “wherein the modifying comprises replacing at least the code portion of the initial file with replacement data to thereby provide a modified file”(injection mechanism provides the automatic loading 20 of the DLL by either modifying a table used by the underlying system to automatically load DLLs or by inserting code that knows how to load the DLL GANAPATHY [pg.6/lines 19-21]) wherein the modified file has the same predetermined file format as the initial file” (see executable injected file GANAPATHY [Fig.6]), “and wherein the modification is arranged to cause a failure when a reader for the predetermined file format tries to load the code portion from the modified file(return error GANAPATHY [Fig.5/item 502]); wherein the protected data package comprises the modified file and the supplementary file.” (add DDL to import table and inject security code GANAPATHY [Fig.5]).
Therefore, it would have been obvious to one of ordinary skill in the art at the time the invention was filed to modify SALMON’s device execution of modified code in a device with GANAPATHY’s system for injecting new code into existing application code in order to provide additional security. One of ordinary skill in the art would have been motivated to combine because SALMON discloses a device which modifies code in order to verify application integrity, GANAPATHY teaches a process to inject new coding in into an existing code, and both are from the same field of endeavor.
Regarding claim 10, SALMON discloses “a method for a reader of a predetermined file format to execute a protected data package, the protected data package comprising a modified file and a supplementary file” (the source acquisition module 232 retrieves the original DEX code ( e . g . from the APK file ) and compares this with the ODEX or ELF file code to determine if the difference between the two correspond to legitimate transformations due to optimization[par.0044]).
SALMON does not explicitly disclose “the modified file comprising replacement data that has replaced at least a code portion of an initial file on which the modified file is based, the modified file and the initial file having the predetermined file format, the supplementary file comprising a copy of the code portion, and the method comprising, at runtime: responsive to a failure when trying to load the code portion from the modified file, processing the supplementary file so as to load the code portion from the supplementary file.”
However, GANAPATHY in an analogous art discloses “the modified file comprising replacement data that has replaced at least a code portion of an initial file on which the modified file is based, the modified file (injection mechanism provides the automatic loading 20 of the DLL by either modifying a table used by the underlying system to automatically load DLLs or by inserting code that knows how to load the DLL GANAPATHY [pg.6/lines 19-21]) and the initial file having the predetermined file format” (return error GANAPATHY [Fig.5/item 502]); “the supplementary file comprising a copy of the code portion, and the method comprising, at runtime: responsive to a failure when trying to load the code portion from the modified file” (return error GANAPATHY [Fig.5/item 502]);, processing the supplementary file so as to load the code portion from the supplementary file.” (add DDL to import table and inject security code GANAPATHY [Fig.5]).
Therefore, it would have been obvious to one of ordinary skill in the art at the time the invention was filed to modify SALMON’s device execution of modified code in a device with GANAPATHY’s system for injecting new code into existing application code in order to provide additional security. One of ordinary skill in the art would have been motivated to combine because SALMON discloses a device which modifies code in order to verify application integrity, GANAPATHY teaches a process to inject new coding in into an existing code, and both are from the same field of endeavor.
Regarding claim 11 in view of claim 10, the references combined discloser “wherein the replacement data comprises random data and/or null data.” (Figure 9 is an overview flow diagram of the steps performed by the injection mechanism for injecting security code and data into an executable file GANAPATHY [pg.9/lines 3-4]).
Regarding claim 12 in view of claim 10, the references combined discloses “wherein the replacement data in the modified file comprises first replacement data that replaces the code portion of the initial file, and wherein the failure is caused by the reader for the predetermined file format detecting that the first replacement data includes invalid data for the code portion” ( In step 903, the inject security code routine calls an incremental encryption routine to encrypt portions of the executable code stored in the executable file. The amount of the executable code to be encrypted is preferably 10 not publicized, is small, and can be modified by the programmer using the injection mechanism GANAPATHY [pg.20/lines 7-11])
Regarding claim 13 in view of claim 10, the references combined disclose “wherein a pointer in the initial file references a location of the code portion in the initial file, and wherein the replacement data in the modified file comprises second replacement data that replaces the pointer such that the failure is caused by one of: the reader for the predetermined file format detecting that the second replacement data includes data other than a reference to a file location in the modified file” ( In step 903, the inject security code routine calls an incremental encryption routine to encrypt portions of the executable code stored in the executable file. The amount of the executable code to be encrypted is preferably 10 not publicized, is small, and can be modified by the programmer using the injection mechanism GANAPATHY [pg.20/lines 7-11]) ; or the reader for the predetermined file format detecting that the second replacement data includes a reference to a file location in the modified file, wherein the file location in the modified file includes invalid data for the code portion” (add DDL to import table and inject security code GANAPATHY [Fig.5]).
Regarding claim 14 in view of claim 10, the references combined disclose “wherein the initial file is a .dex file, wherein the code portion is associated with a particular class of the .dex file, and wherein the failure occurs when the reader for the predetermined file format uses a default class loader to try to load the code portion from the modified file” (The archive file contains the entire program code in a single DEX (Dalvik Executable code SALMON[par.0008]).
Regarding claim 18 in view of claim 10, the references combined disclose “wherein the initial file is a Java class file associated with a particular class, wherein the code portion is associated with a particular method of the particular class, and wherein the failure occurs when using the default class loader to try to load the code portion from the modified file” (applications distributed in the of interpreted code such as code written in Java , Android DEX code , etc. . — comprise intermediate instructions that must be passed through an interpreter before it is executed SALMON[par.0007]).
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MICHAEL D ANDERSON whose telephone number is (571)270-5159. The examiner can normally be reached Mon-Fri 9am-6pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Pwu can be reached at (571) 272-6798. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MICHAEL D ANDERSON/Examiner, Art Unit 2433
/JEFFREY C PWU/Supervisory Patent Examiner, Art Unit 2433