Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This is the initial office action based on the application filed on April 1st 2024, which claims 1-20 are presented for examination.
Status of Claims
Claims 1-20 are pending in the application and have been examined below, of which, claims 1, 9, and 17 are presented in independent form.
Examiner Notes
Examiner cites particular columns and line numbers in the references as applied to the claims below for the convenience of the applicant. Although the specified citations are representative of the teachings in the art and are applied to the specific limitations within the individual claim, other passages and figures may apply as well. It is respectfully requested that, in preparing responses, the applicant fully consider the references in entirety as potentially teaching all or part of the claimed invention, as well as the context of the passage as taught by the prior art or disclosed by the examiner.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Internet E-mail
A written authorization by Applicant is required for the Examiner to respond via
internet e-mail to any Internet correspondence which contains information subject to the
confidentiality requirement as set forth in 35 U3.0. 122, such as proposed Examiner’s
Amendments or interview agenda items (MPEP 502.03; See Internet Usage Policy, 64
PR 33056 (June 21, 1999)). To authorize e-mail communications from the Examiner
(e.g. proposed Examiner’s Amendments), the Applicant must place a written
authorization in the record. Applicant may authorize electronic and email communication
by the Examiner via PTO Automated Interview Request web service. To schedule an
interview, applicant is encouraged to use the USPTO Automated Interview Request
(AER) at http://www.uspto.gov/interviewpractice.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention recites a judicial exception, is directed to that judicial exception, an abstract idea, as it has not been integrated into practical application and the claims further do not recite significantly more than the judicial exception. Examiner has evaluated the claims under the framework provided in the 2019 Patent Eligibility Guidance published in the Federal Register 01/07/2019 and has provided such analysis below.
Step 1: Claims 1-8 are directed to methods and fall within the statutory category of processes; Claims 9-16 are directed to non-transitory computer-readable medium and fall within the statutory category of articles of manufacture; and Claims 17-20 are directed to systems and fall within the statutory category of machines. Therefore, “Are the claims to a process, machine, manufacture or composition of matter?” Yes.
In order to evaluate the Step 2A inquiry “Is the claim directed to a law of nature, a natural phenomenon or an abstract idea?” we must determine, at Step 2A Prong 1, whether the claim recites a law of nature, a natural phenomenon or an abstract idea and further whether the claim recites additional elements that integrate the judicial exception into a practical application.
Claims 1, 9, and 17: recite the limitations of “
receiving, by one or more processors and from a user, a request associated with upgrading a software program of a computing device from a first version to a second version of the software program, wherein the second version is newer than the first version; and
in response to receiving the request: determining, by the one or more processors, a package difference between the second version and a third version of the software program, wherein the package difference is a change to a package associated with the software program, and wherein the third version is newer than the second version; and
outputting, by the one or more processors, and prior to the computing device being upgraded from the first version to the second version of the software program, a notification indicating the package difference.”
Step 2A Prong 1:
Steps (a) and (b) as drafted, can be done in human mind with the aid of pen and paper (mental process).
Step 2A Prong 2:
Claims 1, 9, and 17: The judicial exception is not integrated into a practical application. In particular, the claims recite the following additional elements – “one or more processors,” “software program,” “computing device,” “operating system,” “software library,” “package evolution database,” “non-transitory machine-readable medium,” “system,” “one or more memories,” and “program code,” which are merely recitations of generic computing components and functions merely applying the abstract idea using (see MPEP § 2106.05(f)) which does not integrate a judicial exception into practical application. Furthermore, step (c) is insignificant extra-solution activity.
Therefore, “Do the claims recite additional elements that integrate the judicial exception into a practical application? No, these additional elements do not integrate the abstract idea into a practical application and they do not impose any meaningful limits on practicing the abstract idea. The claim is directed to an abstract idea.
After having evaluating the inquires set forth in Steps 2A Prong 1 and 2, it has been concluded that claims 1, 9, and 17 not only recite a judicial exception but that the claim is directed to the judicial exception as the judicial exception has not been integrated into practical application.
Step 2B:
Claims 1, 9, and 17: The additional elements, considering them both individually and in combination, do not amount to significantly more than the judicial exception.
Therefore, “Do the claims recite additional elements that amount to significantly more than the judicial exception? No, these additional elements, alone or in combination, do not amount to significantly more than the judicial exception.
Having concluded analysis within the provided framework, claims 1, 9, and 17 do not recite patent eligible subject matter under 35 U.S.C. § 101.
Regarding claims 2, 10, and 18, they recite additional element recitation of “wherein the package difference includes a list of multiple packages for which there are differences between the second version and the third version of the software program” which is merely a field of use/technological environment (see MPEP § 2106.05(h)) which does not integrate the judicial exception into practical application. Moreover, claims 2, 10, and 18 do not recite any other additional elements and for the same reasons as above with regard to integration into practical application and whether additional elements amount to significantly more, claims 2, 10, and 18 also fail both Step 2A prong 2, thus the claims are directed to the judicial exception as they have not been integrated into practical application, and fail Step 2B as not amounting to significantly more. Therefore, claims 2, 10, and 18 do not recite patent eligible subject matter under 35 U.S.C. § 101.
Regarding claims 3 and 11, they recite additional element recitation of “wherein the software program is an operating system” which is merely a field of use/technological environment (see MPEP § 2106.05(h)) which does not integrate the judicial exception into practical application. Moreover, claims 3 and 11 do not recite any other additional elements and for the same reasons as above with regard to integration into practical application and whether additional elements amount to significantly more, claims 3 and 11 also fail both Step 2A prong 2, thus the claims are directed to the judicial exception as they have not been integrated into practical application, and fail Step 2B as not amounting to significantly more. Therefore, claims 3 and 11 do not recite patent eligible subject matter under 35 U.S.C. § 101.
Regarding claims 4 and 12, they recite additional element recitation of “wherein the package is a software library” which is merely a field of use/technological environment (see MPEP § 2106.05(h)) which does not integrate the judicial exception into practical application. Moreover, claims 4 and 12 do not recite any other additional elements and for the same reasons as above with regard to integration into practical application and whether additional elements amount to significantly more, claims 4 and 12 also fail both Step 2A prong 2, thus the claims are directed to the judicial exception as they have not been integrated into practical application, and fail Step 2B as not amounting to significantly more. Therefore, claims 4 and 12 do not recite patent eligible subject matter under 35 U.S.C. § 101.
Regarding claims 5, 13, and 19, they recite additional element recitation of “wherein determining the package difference involves accessing a package evolution database, wherein the package evolution database indicates changes to packages between two or more versions of the software program” which is merely a field of use/technological environment (see MPEP § 2106.05(h)) which does not integrate the judicial exception into practical application. Moreover, claims 5, 13, and 19 do not recite any other additional elements and for the same reasons as above with regard to integration into practical application and whether additional elements amount to significantly more, claims 5, 13, and 19 also fail both Step 2A prong 2, thus the claims are directed to the judicial exception as they have not been integrated into practical application, and fail Step 2B as not amounting to significantly more. Therefore, claims 5, 13, and 19 do not recite patent eligible subject matter under 35 U.S.C. § 101.
Regarding claims 6, 14, and 19, they recite additional element recitation of “wherein the package evolution database includes an entry indicating the change to the package” which is merely a field of use/technological environment (see MPEP § 2106.05(h)) which does not integrate the judicial exception into practical application. Moreover, claims 6, 14, and 19 do not recite any other additional elements and for the same reasons as above with regard to integration into practical application and whether additional elements amount to significantly more, claims 6, 14, and 19 also fail both Step 2A prong 2, thus the claims are directed to the judicial exception as they have not been integrated into practical application, and fail Step 2B as not amounting to significantly more. Therefore, claims 6, 14, and 19 do not recite patent eligible subject matter under 35 U.S.C. § 101.
Regarding claims 7 and 15, they recite additional element recitation of “determining that the change to the package is incompatible with a hardware component of the computing device; and generating an output indicating the incompatibility” which is merely a field of use/technological environment (see MPEP § 2106.05(h)) which does not integrate the judicial exception into practical application. Moreover, claims 7 and 15 do not recite any other additional elements and for the same reasons as above with regard to integration into practical application and whether additional elements amount to significantly more, claims 7 and 15 also fail both Step 2A prong 2, thus the claims are directed to the judicial exception as they have not been integrated into practical application, and fail Step 2B as not amounting to significantly more. Therefore, claims 7 and 15 do not recite patent eligible subject matter under 35 U.S.C. § 101.
Regarding claims 8 and 16, they recite additional element recitation of “identifying a vulnerability in the second version of the software program resulting from the package difference, wherein the vulnerability is absent from the second version of the software program and present in the third version of the software program; and generating an output indicating the vulnerability” which is merely a field of use/technological environment (see MPEP § 2106.05(h)) which does not integrate the judicial exception into practical application. Moreover, claims 8 and 16 do not recite any other additional elements and for the same reasons as above with regard to integration into practical application and whether additional elements amount to significantly more, claims 8 and 16 also fail both Step 2A prong 2, thus the claims are directed to the judicial exception as they have not been integrated into practical application, and fail Step 2B as not amounting to significantly more. Therefore, claims 8 and 16 do not recite patent eligible subject matter under 35 U.S.C. § 101.
Claim Rejections - 35 U.S.C § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-20 are rejected under 35 U.S.C. § 103 as being unpatentable over Hussain et al. (Patent No.: US 10,466,991 – hereinafter, Hussain) in view of Bertrand et al. (Pub. No.: US 2013/0104115 – hereinafter, Bertrand).
Regarding claim 1:
Hussain discloses a method comprising:
receiving, by one or more processors and from a user, a request associated with upgrading a software program of a computing device from a first version to a second version of the software program, wherein the second version is newer than the first version (“the single issuance of the request may allow installation, uninstallation and/or updating of potentially different versions of software package… For an installation request, an agent on a given computing instance may process the request by accessing a manifest (e.g., at the specified source or other known location) for the software package that indicates various computing instance characteristics (e.g., operating system types, architecture types, etc.) and various respective available versions of the software package. The agent may then select, based on characteristics of the computing instance, a package type for the computing instance, such as a package type corresponding to an appropriate version of the software package that is suitable for installation on an operating system type and architecture type of the computing instance” (See Col.3, lines 1-32). FIG. 1 and associated text, such as, “As shown in FIG. 1, user 100 may issue a configuration request 105, such as to install or uninstall a software package on computing instances 120A-D. In the particular example of FIG. 1, configuration request 105 is for installation or uninstallation of Version 2.0 of Software Package ABC.” (See Col. 4, lines 40-65)); and
in response to receiving the request: determining, by the one or more processors, a package difference between the second version and a third version of the software program, wherein the package difference is a change to a package associated with the software program, and wherein the third version is newer than the second version (FIG. 4 and associated text, such as, “As shown in FIG. 4, upon receiving request 410, agents 121A-D are configured to access manifest 400 in order to select a package type associated with the requested Software Package XYZ for installation on their respective computing instances 120A-D. A package type is a type of a software package that may be installed, such as a particular version that is suitable for installation on a particular type of operating system and/or architecture…The agents 121A-D may next search for an appropriate version for installation. In this example, since no version is indicated in the request 410, the agents 121A-D may select the most recently released (e.g., typically the highest number) available version suitable for their respective computing instance. For example, manifest 400 indicates that the most recently released available version for Operating System XX and Architecture AA is Version 2. Accordingly, in this example, agent 121A may select package type 411 (corresponding to Version 2 for Operating System XX and Architecture AA) for installation on computing instance 120A. Manifest 400 also indicates that the most recently released available version for Operating System XX and Architecture BB is Version 2. Accordingly, in this example, agent 121B may select package type 413 (corresponding to Version 2 for Operating System XX and Architecture BB) for installation on computing instance 120B. Manifest 400 also indicates that the most recently released available version for Operating System YY and Architecture AA is Version 3. Accordingly, in this example, agent 121C may select package type 415 (corresponding to Version 3 for Operating System YY and Architecture AA) for installation on computing instance 120C. Manifest 400 also indicates that the most recently released available version for Operating System YY and Architecture BB is Version 3” (See Col. 6 line 42 – Col. 7, line 31)); and
But Hussain does not explicitly teach:
outputting, by the one or more processors, and prior to the computing device being upgraded from the first version to the second version of the software program, a notification indicating the package difference.
However, Bertrand discloses:
outputting, by the one or more processors, and prior to the computing device being upgraded from the first version to the second version of the software program, a notification indicating the package difference (FIG. 1 and associated text, such as, “The difference tool 120 compares some or all of a cached file, for example, an interface definition file, with its newly installed counterpart of the new software 116, and generates a set of differences, which can be written to a file and stored in the data storage 106. The file can be a text-based file for creating upgrade scripts and the like. The comparison can be performed by a string compare utility or related tool at install time. The difference tool 122 can generate a path to the file. The generated path can be displayed, for example, via a user interface (not shown), permitting a user to examine the differences” (See para [0024])).
It would have been obvious to one having ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Bertrand into the teachings of Hussain because that would have yielded a reliable and comprehensive list of changes that is specific to current and target software configurations at an enterprise site, thereby conveniently enabling script and application developers to work with the changes that are generated, which can be applied to scripts, configuration files, or other programs with confidence, i.e., less prone to error, and with a minimum investment of time as suggested by Bertrand (See par. [0017]).
Regarding claim 2:
The rejection of claim 1 is incorporated, Hussain further discloses wherein the package difference includes a list of multiple packages for which there are differences between the second version and the third version of the software program (See FIG. 4).
Regarding claim 3:
The rejection of claim 1 is incorporated, Hussain further discloses wherein the software program is an operating system (FIG. 4 and associated text, such as, “As shown in FIG. 4, upon receiving request 410, agents 121A-D are configured to access manifest 400 in order to select a package type associated with the requested Software Package XYZ for installation on their respective computing instances 120A-D. A package type is a type of a software package that may be installed, such as a particular version that is suitable for installation on a particular type of operating system and/or architecture” (See Col. 6, lines 42-50)).
Regarding claim 4:
The rejection of claim 1 is incorporated, Hussain further discloses wherein the package is a software library (FIG. 4 and associated text, such as, “As shown in FIG. 4, upon receiving request 410, agents 121A-D are configured to access manifest 400 in order to select a package type associated with the requested Software Package XYZ for installation on their respective computing instances 120A-D. A package type is a type of a software package that may be installed, such as a particular version that is suitable for installation on a particular type of operating system and/or architecture” (See Col. 6, lines 42-50)).
Regarding claim 5:
The rejection of claim 1 is incorporated, Hussain further discloses wherein determining the package difference involves accessing a package evolution database, wherein the package evolution database indicates changes to packages between two or more versions of the software program (FIG. 4 and associated text, such as, “As shown in FIG. 4, upon receiving request 410, agents 121A-D are configured to access manifest 400 in order to select a package type associated with the requested Software Package XYZ for installation on their respective computing instances 120A-D. A package type is a type of a software package that may be installed, such as a particular version that is suitable for installation on a particular type of operating system and/or architecture…The agents 121A-D may next search for an appropriate version for installation. In this example, since no version is indicated in the request 410, the agents 121A-D may select the most recently released (e.g., typically the highest number) available version suitable for their respective computing instance. For example, manifest 400 indicates that the most recently released available version for Operating System XX and Architecture AA is Version 2. Accordingly, in this example, agent 121A may select package type 411 (corresponding to Version 2 for Operating System XX and Architecture AA) for installation on computing instance 120A. Manifest 400 also indicates that the most recently released available version for Operating System XX and Architecture BB is Version 2. Accordingly, in this example, agent 121B may select package type 413 (corresponding to Version 2 for Operating System XX and Architecture BB) for installation on computing instance 120B. Manifest 400 also indicates that the most recently released available version for Operating System YY and Architecture AA is Version 3. Accordingly, in this example, agent 121C may select package type 415 (corresponding to Version 3 for Operating System YY and Architecture AA) for installation on computing instance 120C. Manifest 400 also indicates that the most recently released available version for Operating System YY and Architecture BB is Version 3” (See Col. 6 line 42 – Col. 7, line 31)).
Regarding claim 6:
The rejection of claim 5 is incorporated, Hussain further discloses wherein the package evolution database includes an entry indicating the change to the package (FIG. 4 and associated text, such as, “As shown in FIG. 4, upon receiving request 410, agents 121A-D are configured to access manifest 400 in order to select a package type associated with the requested Software Package XYZ for installation on their respective computing instances 120A-D. A package type is a type of a software package that may be installed, such as a particular version that is suitable for installation on a particular type of operating system and/or architecture…The agents 121A-D may next search for an appropriate version for installation. In this example, since no version is indicated in the request 410, the agents 121A-D may select the most recently released (e.g., typically the highest number) available version suitable for their respective computing instance. For example, manifest 400 indicates that the most recently released available version for Operating System XX and Architecture AA is Version 2. Accordingly, in this example, agent 121A may select package type 411 (corresponding to Version 2 for Operating System XX and Architecture AA) for installation on computing instance 120A. Manifest 400 also indicates that the most recently released available version for Operating System XX and Architecture BB is Version 2. Accordingly, in this example, agent 121B may select package type 413 (corresponding to Version 2 for Operating System XX and Architecture BB) for installation on computing instance 120B. Manifest 400 also indicates that the most recently released available version for Operating System YY and Architecture AA is Version 3. Accordingly, in this example, agent 121C may select package type 415 (corresponding to Version 3 for Operating System YY and Architecture AA) for installation on computing instance 120C. Manifest 400 also indicates that the most recently released available version for Operating System YY and Architecture BB is Version 3” (See Col. 6 line 42 – Col. 7, line 31)).
Regarding claim 7:
The rejection of claim 1 is incorporated, Hussain further comprising:
determining that the change to the package is incompatible with a hardware component of the computing device (See FIG. 4); and
generating an output indicating the incompatibility (See FIG. 4).
Regarding claim 9:
This is a non-transitory computer-readable medium version of the rejected method claim 1 above, wherein all the limitations of this claim have been noted in the rejection of claim 1 and is therefore rejected under similar rationale.
Regarding claim 10:
The rejection of base claim 9 is incorporated. All the limitations of this claim have been noted in the rejection of claim 2, and is therefore rejected under similar rationale.
Regarding claim 11:
The rejection of base claim 9 is incorporated. All the limitations of this claim have been noted in the rejection of claim 3, and is therefore rejected under similar rationale.
Regarding claim 12:
The rejection of base claim 9 is incorporated. All the limitations of this claim have been noted in the rejection of claim 4, and is therefore rejected under similar rationale.
Regarding claim 13:
The rejection of base claim 9 is incorporated. All the limitations of this claim have been noted in the rejection of claim 5, and is therefore rejected under similar rationale.
Regarding claim 14:
The rejection of base claim 9 is incorporated. All the limitations of this claim have been noted in the rejection of claim 6, and is therefore rejected under similar rationale.
Regarding claim 15:
The rejection of base claim 9 is incorporated. All the limitations of this claim have been noted in the rejection of claim 7, and is therefore rejected under similar rationale.
Regarding claim 17:
This is a system version of the rejected method claim 1 above, wherein all the limitations of this claim have been noted in the rejection of claim 1, and is therefore rejected under similar rationale.
Regarding claim 18:
The rejection of base claim 17 is incorporated. All the limitations of this claim have been noted in the rejection of claim 2, and is therefore rejected under similar rationale.
Regarding claim 19:
The rejection of base claim 17 is incorporated. All the limitations of this claim have been noted in the rejection of claims 5 and 6, and is therefore rejected under similar rationale.
Regarding claim 20:
The rejection of claim 17 is incorporated, Hussain further discloses wherein the package difference includes a name change to the package, a merger of the package with another package, a deletion of the package, a replacement of the package with another package, or a split of a portion of the package into a separate package (See FIG. 4).
Claims 8 and 16 are rejected under 35 U.S.C. 103 as being unpatentable over Hussain in view of Bertrand as applied to claims 1 and 9 above, and further in view of Mishra et al. (Pub. No.: US 2021/0216643 – hereinafter, Mishra).
Regarding claim 8:
The rejection of claim 1 is incorporated, but Hussain and Bertrand do not explicitly teach:
identifying a vulnerability in the second version of the software program resulting from the package difference, wherein the vulnerability is absent from the second version of the software program and present in the third version of the software program; and
generating an output indicating the vulnerability.
However, Mishra discloses:
identifying a vulnerability in the second version of the software program resulting from the package difference, wherein the vulnerability is absent from the second version of the software program and present in the third version of the software program (FIG. 2 and associated text, such as, “Software package analyzer 218 controls the process of predicting exploitability of software vulnerabilities and recommending alternate software packages to install on a computer system using machine learning and natural language generation capabilities. In this example, software package analyzer 218 includes machine learning component 220 and natural language generation component 222. Machine learning component 220 may include, for example, one or more regression algorithms. Software package analyzer 218 utilizes machine learning component 220 to, for example, analyze vulnerability descriptions, learn software vulnerability patterns, evaluate levels of exploitability of software vulnerabilities, identify whether any related alternative software packages exist for a software package having a vulnerability, calculate an exploitability score for the vulnerability of the software package and any related alternative software packages, calculate a probability of the vulnerability being exploited by a threat actor, recommend a best alternative software package, and the like.” (See para [0030])); and
generating an output indicating the vulnerability (FIG. 2 and associated text, such as, “Software package analyzer 218 utilizes natural language generation component 222 to generate natural language textual insights regarding installation of the software package based on the analysis and recommendations provided by machine learning component 220. By providing the insights, natural language generation component 222 enables a user to make an informed decision as to whether to install the software package or install an alternative software package” (See para [0030])).
It would have been obvious to one having ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Mishra into the teachings of Hussain and Bertrand because that would have predicting exploitability of software vulnerabilities and recommending alternate software packages to install using machine learning and natural language generation capabilities as suggested by Mishra (See par. [0001]).
Regarding claim 16:
The rejection of base claim 9 is incorporated. All the limitations of this claim have been noted in the rejection of claim 8, and is therefore rejected under similar rationale.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to HANH THI MINH BUI whose telephone number is (571)270-1976. The examiner can normally be reached Monday - Friday: 7-3.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Hyung S. Sough can be reached at 571-272-6799. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/HANH THI-MINH BUI/Primary Examiner, Art Unit 2192 March 23rd, 2026