Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
1. This Office Action is in response to the amendment filed on 01/02/2026. Claims 1-14 are pending in this application. Claims 1, 13 and 14 are independent claims. This Office Action is made Final.
Claim Rejections - 35 USC § 101
2. 35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
3. Claims 1-14 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. The independent claims 1, 13 and 14 are corresponding to one of four statutory categories including method, system, and method respectively under step 1. The claims 1, 13 and 14 similarly recites “a processor-based method of runtime identification of a loading of a software-module, in a computer system, the software- module being associated with a first application framework, the method comprising: a) detecting, by a first interposition function, an invocation of a first function of loading of software-modules within the first application framework; b) responsive to the detected invocation, identifying a software- module being loaded, the identifying utilizing, at least one of: i) parameter data supplied in the invocation of the first function, ii) context of an operating system process invoking the first function, and iii) data that was stored responsive to detecting, by a respective interposition function, one or more prior invocations of respective functions associated with loading of software-modules within the first application framework”.
The limitation of the claims 1, 13 and 14 of “a) detecting, by a first interposition function, an invocation of a first function of loading of software-modules within the first application framework” as a drafted is a mental process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind such as “detecting”. For example, a human may detect an invocation of a first function from the source code or log file where the function is of loading of software-modules within the first application framework with a pen and paper or in a human mind. If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it falls within the “Mental Processes” grouping of abstract ideas. Accordingly, the claim recites an abstract idea under Step 2A Prong I.
The limitation of the claims 1, 13 and 14 of “b) responsive to the detected invocation, identifying a software- module being loaded, the identifying utilizing, at least one of:: i) parameter data supplied in the invocation of the first function, ii) context of an operating system process invoking the first function, and iii) data that was stored responsive to detecting, by a respective interposition function, one or more prior invocations of respective functions associated with loading of software-modules within the first application framework” as a drafted is a mental process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind such as “identifying”. For example, a human may identify a software-module being loaded, the identifying utilizing, at least one of: i) parameter data supplied in the invocation of the first function, ii) context of an operating system process invoking the first function, and iii) data that was stored responsive to detecting, by a respective interposition function, one or more prior invocations of respective functions associated with loading of software-modules within the first application framework with a pen and paper or in a human mind. If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it falls within the “Mental Processes” grouping of abstract ideas. Accordingly, the claim recites an abstract idea under Step 2A Prong I.
This judicial exception is not integrated into a practical application. In particular, the claim 2 recites additional elements such as “c) adding the identified software-module to a list of software- modules”.
Examiner would like to point out that with the broad reasonable interpretation, this element amounts to apply it under MPEP § 2106.05(f): Mere Instructions to Apply an Exception, which does not impose any meaningful limits on practicing the mental process (insignificant additional element). Accordingly, this additional element does not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea. The claim is directed to insignificant additional elements under Step 2A Prong 2 and Step 2B.
This judicial exception is not integrated into a practical application. In particular, the claim 3 recites additional elements such as “decoding data that is located at an offset from a memory address that is comprised in the parameter data”.
Examiner would like to point out that with the broad reasonable interpretation, this element
especially “a computer readable storage medium having program instructions embodied therewith, the program instructions readable by a device to cause the device” amount to additional elements such as insignificant extra-solution such as “field of use” as in MPEP § 2106.05(h): Field of Use and Technological Environment, which does not impose any meaningful limits on practicing the mental process. Accordingly, this additional element does not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea. The claim is directed to an abstract idea under step 2B.
This judicial exception is not integrated into a practical application. In particular, the claim 4 recites additional elements such as “a) a process identifier of an invoking operating system process context, and b) an element of the invoking operating system process context indicative of a result returned by the first function”.
Examiner would like to point out that with the broad reasonable interpretation, this element
especially “a computer readable storage medium having program instructions embodied therewith, the program instructions readable by a device to cause the device” amount to additional elements such as insignificant extra-solution such as “field of use” as in MPEP § 2106.05(h): Field of Use and Technological Environment, which does not impose any meaningful limits on practicing the mental process. Accordingly, this additional element does not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea. The claim is directed to an abstract idea under step 2B.
The limitation of the claim 5 of “A) detecting, by a second interposition function, an invocation of a second function associated with loading of software-modules within the first application framework” as a drafted is a mental process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind such as “identifying”. For example, a human may detect by a second interposition function, an invocation of a second function associated with loading of software-modules within the first application framework with a pen and paper or in a human mind. If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it falls within the “Mental Processes” grouping of abstract ideas. Accordingly, the claim recites an abstract idea under Step 2A Prong I.
This judicial exception is not integrated into a practical application. In particular, the claim 5 recites additional elements such as “B) storing data that comprises, at least, at least one of: i) parameter data supplied in the invocation of the second function, and ii) context of an operating system process invoking the second function”.
Examiner would like to point out that with the broad reasonable interpretation, this element amounts to mere data storing under MPEP § 2106.05(g): Insignificant Extra-Solution Activity, which does not impose any meaningful limits on practicing the mental process (insignificant additional element). Accordingly, this additional element does not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea. The claim is directed to insignificant additional elements under Step 2A Prong 2 and Step 2B.
This judicial exception is not integrated into a practical application. In particular, the claim 6 recites additional elements such as “C) repeating A)-B) for one or more additional functions associated with loading of software-modules within the first application framework, and respective interposition functions.”.
Examiner would like to point out that with the broad reasonable interpretation, this element
especially “a computer readable storage medium having program instructions embodied therewith, the program instructions readable by a device to cause the device” amount to additional elements such as insignificant extra-solution such as “field of use” as in MPEP § 2106.05(h): Field of Use and Technological Environment, which does not impose any meaningful limits on practicing the mental process. Accordingly, this additional element does not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea. The claim is directed to an abstract idea under step 2B.
This judicial exception is not integrated into a practical application. In particular, the claim 7 recites additional elements such as “d) performing a)-c) repeatedly, thereby giving rise to a runtime software bill-of-materials (RBOM)”.
Examiner would like to point out that with the broad reasonable interpretation, this element
especially “a computer readable storage medium having program instructions embodied therewith, the program instructions readable by a device to cause the device” amount to additional elements such as insignificant extra-solution such as “field of use” as in MPEP § 2106.05(h): Field of Use and Technological Environment, which does not impose any meaningful limits on practicing the mental process. Accordingly, this additional element does not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea. The claim is directed to an abstract idea under step 2B.
This judicial exception is not integrated into a practical application. In particular, the claim 8 recites additional elements such as “e) repeating a) - d) for one or more additional application frameworks, thereby giving rise to an RBOM comprising modules of multiple application frameworks”.
Examiner would like to point out that with the broad reasonable interpretation, this element
especially “a computer readable storage medium having program instructions embodied therewith, the program instructions readable by a device to cause the device” amount to additional elements such as insignificant extra-solution such as “field of use” as in MPEP § 2106.05(h): Field of Use and Technological Environment, which does not impose any meaningful limits on practicing the mental process. Accordingly, this additional element does not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea. The claim is directed to an abstract idea under step 2B.
The limitation of the claim 9 of “the first application framework is of an application framework type selected from a list consisting of: interpreted language, intermediate language, and compiled language” as a drafted is a mental process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind such as “selecting”. For example, a human select the first application framework of an application framework type from a list consisting of: interpreted language, intermediate language, and compiled language with a pen and paper or in a human mind. If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it falls within the “Mental Processes” grouping of abstract ideas. Accordingly, the claim recites an abstract idea under Step 2A Prong I.
The limitation of the claim 10 of “the first application framework is selected from a list consisting of: Python, Java, Node.js, C, C++, and C#” as a drafted is a mental process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind such as “selecting”. For example, a human select the first application framework from a list consisting of: Python, Java, Node.js, C, C++, and C# with a pen and paper or in a human mind. If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it falls within the “Mental Processes” grouping of abstract ideas. Accordingly, the claim recites an abstract idea under Step 2A Prong I.
The limitation of the claim 11 of “comparing the RBOM to a given list of software modules of the first application framework, wherein the given list is derivative of an at least partial static analysis of the computer system; and responsive to a presence of a software module in the RBOM that is absent from the given list, raising an alert” as a drafted is a mental process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind such as “comparing”. For example, a human compare the RBOM to a given list of software modules of the first application framework, wherein the given list is derivative of an at least partial static analysis of the computer system; and responsive to a presence of a software module in the RBOM that is absent from the given list, raising an alert with a pen and paper or in a human mind. If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it falls within the “Mental Processes” grouping of abstract ideas. Accordingly, the claim recites an abstract idea under Step 2A Prong I.
This judicial exception is not integrated into a practical application. In particular, the claim 12 recites additional elements such as “receiving an alert pertaining to a first software module”.
Examiner would like to point out that with the broad reasonable interpretation, this element amounts to mere data gathering under MPEP § 2106.05(g): Insignificant Extra-Solution Activity, which does not impose any meaningful limits on practicing the mental process (insignificant additional element). Accordingly, this additional element does not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea. The claim is directed to insignificant additional elements under Step 2A Prong 2 and Step 2B.
The limitation of the claim 12 of “determining a priority of the alert in accordance with whether the first software module is present in the RBOM” as a drafted is a mental process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind such as “comparing”. For example, a human determine a priority of the alert in accordance with whether the first software module is present in the RBOM with a pen and paper or in a human mind. If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components, then it falls within the “Mental Processes” grouping of abstract ideas. Accordingly, the claim recites an abstract idea under Step 2A Prong I.
Dependent claims 2-12 are also similar rejected under same rationale as cited above wherein these claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception. These claims are merely further elaborate the mental process itself or providing additional definition of process which does not impose any meaningful limits on practicing the abstract idea. Claims 2-12 is also rejected for incorporating the deficiency of their independent claim 1.
Claim Rejections - 35 USC § 103
4. In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
5. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
6. Claims 1, 5, 13 and 14 are rejected under 35 U.S.C. 103 as being unpatentable over Jawa (US PGPub 20140059573), in view of Baumann (US PGPub 20130151846).
As per Claim 1, Jawa teaches of a processor-based method of runtime identification of a loading of a software-module, in a computer system, the software-module being associated with a first application framework, the method comprising: a) detecting, by a first interposition function, an invocation of a first function of loading of software-modules within the first application framework; (Par 69, After the function calls have been properly interposed or replaced, the operating system then runs the executable code for the program in the application binary (operation 618). Par 91, Upon launch of a modified application, the loader loads the hook and injection manager module, the hook and injection manager 201 dynamically loads the interposition library 203, and the hook and injection manager 201 may interpose on one or more functions by calling an interposition function. Par 92, The process described in FIG. 10 can be implemented as an interposition function in the interposition library 203. Such an interposition function may accept, as input, a function name (e.g., symbol representing the function) and an address for customized function code (e.g., hook_api ("printf", hook_printf)). The interposition function performs a series of steps to determine which function pointer entry in the import table is associated with the function name.)
b) responsive to the detected invocation, identifying a software-module being loaded, the identifying utilizing, at least one of: (Par 72, FIG. 7B illustrates an exemplary loading order for the modules. Module G contains the executable code for interposing system calls. The loader determines that module G 716 has no dependencies, and therefore module G 716 should be loaded first. Application A 702 is loaded last. Note that since module F does not make any library calls, the loader can also load module F before loading module G.)
Jawa does not specifically teach, however Baumann teaches of the identifying utilizing, at least one of: i) parameter data supplied in the invocation of the first function, ii) context of an operating system process invoking the first function, and iii) data that was stored responsive to detecting, by a respective interposition function, one or more prior invocations of respective functions associated with loading of software-modules within the first application framework. (Par 19, wherein the request includes a parameter indicating one or more application components to be loaded into the secure execution environment, and wherein the activation state includes one or more of the parameter and the application. Par 43, The request is accompanied by an indication of a loader module 116 and one or more parameters 118. The indication of the loader module 116 may be an identifier for the loader module 116, or it may be an application binary of the loader module 116 itself, or some other indicator. In embodiments where the indication of the loader module 116 is an identifier, it may be a uniform resource identifier (URI), such as a uniform resource locator (URL), identifying the loader module 116 and possibly a location where the loader module 116 can be found. Par 60, Alternatively, the application 142 is pre-identified by the parameters 118 and is loaded by the loader module 116 upon establishment of the encrypted channel. In still other embodiments, the parameters 118 include an application binary of the application 142, and the loader module 116 receives a command via the encrypted channel to execute the application 142. Par 76, The one or more parameters provided by the establishment module 314 in the request sent to the application hosting service may identify the application 324 for execution within the secure execution environment. The parameters may include a URI, URL, or other identifier of the application 324. Alternatively, the parameters may include an application binary for the application 324 that is directly loaded into the secure execution environment upon instantiation.)
Therefore, it would have been obvious for one of the ordinary skill in the art before the effective filing date of the claimed invention to add the identifying utilizing, at least one of: i) parameter data supplied in the invocation of the first function, ii) context of an operating system process invoking the first function, and iii) data that was stored responsive to detecting, by a respective interposition function, one or more prior invocations of respective functions associated with loading of software-modules within the first application framework, as conceptually seen from the teaching of Baumann, into that of Jawa because this modification can help provide flexibility, reusability and simplicity by identifying and selecting software modules to be loaded.
As per Claim 5, Jawa teaches of the method of claim 1, the method further comprising, prior to step a): A) detecting, by a second interposition function, an invocation of a second function associated with loading of software-modules within the first application framework; and (Par 72, FIG. 7B illustrates an exemplary loading order for the modules. Module G contains the executable code for interposing system calls. The loader determines that module G 716 has no dependencies, and therefore module G 716 should be loaded first. Application A 702 is loaded last. Note that since module F does not make any library calls, the loader can also load module F before loading module G. Par 92, The process described in FIG. 10 can be implemented as an interposition function in the interposition library 203.)
Jawa does not specifically teach, however Baumann teaches of B) storing data that comprises, at least, at least one of: i) parameter data supplied in the invocation of the second function, and ii) context of an operating system process invoking the second function. (Par 19, wherein the request includes a parameter indicating one or more application components to be loaded into the secure execution environment, and wherein the activation state includes one or more of the parameter and the application. Par 43, The request is accompanied by an indication of a loader module 116 and one or more parameters 118. The indication of the loader module 116 may be an identifier for the loader module 116, or it may be an application binary of the loader module 116 itself, or some other indicator. In embodiments where the indication of the loader module 116 is an identifier, it may be a uniform resource identifier (URI), such as a uniform resource locator (URL), identifying the loader module 116 and possibly a location where the loader module 116 can be found. Par 60, Alternatively, the application 142 is pre-identified by the parameters 118 and is loaded by the loader module 116 upon establishment of the encrypted channel. In still other embodiments, the parameters 118 include an application binary of the application 142, and the loader module 116 receives a command via the encrypted channel to execute the application 142. Par 76, The one or more parameters provided by the establishment module 314 in the request sent to the application hosting service may identify the application 324 for execution within the secure execution environment. The parameters may include a URI, URL, or other identifier of the application 324. Alternatively, the parameters may include an application binary for the application 324 that is directly loaded into the secure execution environment upon instantiation.)
Therefore, it would have been obvious for one of the ordinary skill in the art before the effective filing date of the claimed invention to add B) storing data that comprises, at least, at least one of: i) parameter data supplied in the invocation of the second function, and ii) context of an operating system process invoking the second function, as conceptually seen from the teaching of Baumann, into that of Jawa because this modification can help provide flexibility, reusability and simplicity by identifying and selecting software modules to be loaded.
Re Claim 13, it is the system claim, having similar limitations of claim 1. Thus, claim 13 is also rejected under the similar rationale as cited in the rejection of claim 1.
Re Claim 14, it is the product claim, having similar limitations of claim 1. Thus, claim 14 is also rejected under the similar rationale as cited in the rejection of claim 1.
7. Claim 2 is rejected under 35 U.S.C. 103 as being unpatentable over Jawa (US PGPub 20140059573), in view of Baumann (US PGPub 20130151846), and further in view of Thomas (US PGPub 20050076064).
As per Claim 2, neither Jawa nor Baumann specifically teaches, however Thomas teaches of the method of claim 1, additionally comprising: c) adding the identified software-module to a list of software-modules. (Par 36, The developer interface 62 also has access to a second memory 70, which stores a framework or application component list 71. The application component list 71 includes the available components that may be used to create and develop a desired application. As new components become available they are added to the application component list 71. The scanner interface 60 may have access to the second memory 70, such as when the scanner interface 60 and the developer interface 62 are incorporated into a single interface.)
Therefore, it would have been obvious for one of the ordinary skill in the art before the effective filing date of the claimed invention to add c) adding the identified software-module to a list of software-modules, as conceptually seen from the teaching of Thomas, into that of Jawa and Baumann because this modification can help provide flexibility, reusability and simplicity by identifying and selecting software modules to be loaded.
8. Claim 3 is rejected under 35 U.S.C. 103 as being unpatentable over Jawa (US PGPub 20140059573), in view of Baumann (US PGPub 20130151846), and further in view of Liu (US PGPub 20140177729).
As per Claim 3, neither Jawa nor Baumann specifically teaches, however Liu teaches of the method of claim 1, wherein the identifying the software module utilizes the parameter data, and wherein the utilizing comprises: decoding data that is located at an offset from a memory address that is comprised in the parameter data, (Par 3, Known transcoding techniques store the decoded data blocks 100 and 102, in memory 106 by storing the same rows (lines) from differing decoded data blocks into a linear address space generally shown as memory address line 108 or they scatter the rows in differing memory locations using offsets. A block may include, for example, a 256 pixel block containing pixel data from 16 display lines and 16 columns of pixels. Sixteen bytes may make up one row of a block (assuming 8 bit pixel depth).)
Therefore, it would have been obvious for one of the ordinary skill in the art before the effective filing date of the claimed invention to add decoding data that is located at an offset from a memory address that is comprised in the parameter data, as conceptually seen from the teaching of Liu, into that of Jawa and Baumann because this modification can help provide flexibility, reusability and simplicity by identifying and selecting software modules to be loaded.
9. Claims 4 and 6 are rejected under 35 U.S.C. 103 as being unpatentable over Jawa (US PGPub 20140059573), in view of Baumann (US PGPub 20130151846), and further in view of Chawla (US PGPub 20120159578).
As per Claim 4, neither Jawa nor Baumann specifically teaches, however Chawla teaches of the method of claim 1, wherein the identifying the software module utilizes at least one of: a) a process identifier of an invoking operating system process context, and b) an element of the invoking operating system process context indicative of a result returned by the first function. (Par 8, A disclosed example method includes assigning a process identifier to an application on a mobile device, the process identifier generated by an operating system of the mobile device. The example method also includes determining via a digital certificate that the application is authorized to be executed on the mobile device and that the application is authorized to access a network interface of the mobile device. Par 61, The example process 400 of FIG. 4A continues by the example application execution unit 302 and/or an operating system assigning a process identifier to the application (block 406). The example certificate processor 304 and/or the policy processor 308 then determines if the application is identified within a digital certificate as an authorized application (block 408). Par 40, To grant certain applications access, an operating system within the OS layer 206 assigns a unique process identifier to each of the applications APP 01-03. For example, the operating system assigns process identifier PID1 to the application APP 01 and assigns process identifier PID3 to the VPN client 210. The process identifiers PID1-3 are numbers and/or names assigned to the respective applications APP 01-03. An operating system, the MAC module 212, and/or the App Policy Engine 104 may use the process identifiers PID1-3 to locate, identify, and/or access the appropriate applications APP 01-03. In some instances, the process identifiers PID1-3 may be used in a function call to access the applications APP 01-03.)
Therefore, it would have been obvious for one of the ordinary skill in the art before the effective filing date of the claimed invention to add a) a process identifier of an invoking operating system process context, and b) an element of the invoking operating system process context indicative of a result returned by the first function, as conceptually seen from the teaching of Chawla, into that of Jawa and Baumann because this modification can help provide flexibility, reusability and simplicity by identifying and selecting software modules to be loaded.
As per Claim 6, Jawa teaches of the method of claim 4, the method further comprising: C) repeating A)-B) for one or more additional functions associated with loading of software-modules within the first application framework, and respective interposition functions. (Par 91, Upon launch of a modified application, the loader loads the hook and injection manager module, the hook and injection manager 201 dynamically loads the interposition library 203, and the hook and injection manager 201 may interpose on one or more functions by calling an interposition function)
10. Claims 7-8 are rejected under 35 U.S.C. 103 as being unpatentable over Jawa (US PGPub 20140059573), in view of Baumann (US PGPub 20130151846), and further in view of Bosch (US Patent 11809571).
As per Claim 7, neither Jawa nor Baumann specifically teaches, however Bosch teaches of the method of claim 1, the method further comprising: d) performing a)-c) repeatedly, thereby giving rise to a runtime software bill-of-materials (RBOM). (Claim 1, the load map indicating loaded modules of the application, the load map being a dynamic software bill of material (SBOM); Col 1, lines 13-26, A software bill of material (SBOM) may be used to identify a set of vulnerabilities in a software package, a package composition, or a complete application. Vulnerabilities may allow for intrusions, theft of CPU, Distributed Denial-of-Service (DDoS) attacks, data snooping, infiltration or exfiltration of data, or other nefarious uses. Unfortunately, knowing the SBOM of an application alone may not be sufficient to understand whether an application has vulnerabilities or has already been breached. This is because an application may download code dynamically from third parties for integration into its base application, thereby changing the application from the SBOM. Alternatively, an application may have been subverted and its code dynamically updated, also falling outside the scope of the SBOM.)
Therefore, it would have been obvious for one of the ordinary skill in the art before the effective filing date of the claimed invention to add d) performing a)-c) repeatedly, thereby giving rise to a runtime software bill-of-materials (RBOM), as conceptually seen from the teaching of Bosch, into that of Jawa and Baumann because this modification can help provide flexibility, reusability and simplicity by identifying and selecting software modules to be loaded.
As per Claim 8, neither Jawa nor Baumann specifically teaches, however Bosch teaches of the method of claim 6, the method further comprising: e) repeating a)-d) for one or more additional application frameworks, thereby giving rise to an RBOM comprising modules of multiple application frameworks. (Claim 1, the load map indicating loaded modules of the application, the load map being a dynamic software bill of material (SBOM); Col 1, lines 13-26, A software bill of material (SBOM) may be used to identify a set of vulnerabilities in a software package, a package composition, or a complete application. Vulnerabilities may allow for intrusions, theft of CPU, Distributed Denial-of-Service (DDoS) attacks, data snooping, infiltration or exfiltration of data, or other nefarious uses. Unfortunately, knowing the SBOM of an application alone may not be sufficient to understand whether an application has vulnerabilities or has already been breached. This is because an application may download code dynamically from third parties for integration into its base application, thereby changing the application from the SBOM. Alternatively, an application may have been subverted and its code dynamically updated, also falling outside the scope of the SBOM.)
Therefore, it would have been obvious for one of the ordinary skill in the art before the effective filing date of the claimed invention to add e) repeating a)-d) for one or more additional application frameworks, thereby giving rise to an RBOM comprising modules of multiple application frameworks, as conceptually seen from the teaching of Bosch, into that of Jawa and Baumann because this modification can help provide flexibility, reusability and simplicity by identifying and selecting software modules to be loaded.
11. Claim 9 is rejected under 35 U.S.C. 103 as being unpatentable over Jawa (US PGPub 20140059573), in view of Baumann (US PGPub 20130151846), and further in view of Mayer (US PGPub 20190247680).
As per Claim 9, neither Jawa nor Baumann specifically teaches, however Mayer teaches of the method of claim 1, wherein the first application framework is of an application framework type selected from a list consisting of: interpreted language, intermediate language, and compiled language. (Par 326, Any type algorithm is useful in the present invention. For example, the algorithm can be machine code (i.e. executed directly by the controller) or can be written in any programming language (e.g. BASIC, Lua, Java, or FORTH) for which an interpreter is provided local to the controller. Optionally, the algorithm is provided as any of: a binary image directly by the console controller; dynamically linked libraries, e.g. binary images executable by the console controller, but do so by being ‘called’ by the software of a pre-existing higher-level application or framework; a textual representation (e.g. XML or plain-text script file), which specifies the operations to be performed to a pre-existing higher-level application or framework; a programming language; and an intermediate language which is compiled into an efficient machine-readable format which is not the native instructions of the console controller, such as p-code or Java bytecode, and is interpreted by a virtual machine pre-existing on the console.)
Therefore, it would have been obvious for one of the ordinary skill in the art before the effective filing date of the claimed invention to add the first application framework is of an application framework type selected from a list consisting of: interpreted language, intermediate language, and compiled language, as conceptually seen from the teaching of Mayer, into that of Jawa and Baumann because this modification can help provide flexibility, reusability and simplicity by identifying and selecting software modules to be loaded.
12. Claim 10 is rejected under 35 U.S.C. 103 as being unpatentable over Jawa (US PGPub 20140059573), in view of Baumann (US PGPub 20130151846), and further in view of Sharma (US PGPub 20170371504).
As per Claim 10, neither Jawa nor Baumann specifically teaches, however Sharma teaches of the method of claim 1, wherein the first application framework is selected from a list consisting of: Python, Java, Node.js, C, C++, and C#. (Par 76, The technology may be a software application framework such as node.js, .NET, python, PHP, Ruby, Go, Swift, Perl, C++, Java, C, or other known software application framework.)
Therefore, it would have been obvious for one of the ordinary skill in the art before the effective filing date of the claimed invention to add the first application framework is selected from a list consisting of: Python, Java, Node.js, C, C++, and C#, as conceptually seen from the teaching of Sharma, into that of Jawa and Baumann because this modification can help provide flexibility, reusability and simplicity by identifying and selecting software modules to be loaded.
13. Claim 11 is rejected under 35 U.S.C. 103 as being unpatentable over Jawa (US PGPub 20140059573), in view of Baumann (US PGPub 20130151846), in view of Chawla (US PGPub 20120159578), and further in view of Steckler (US PGPub 20050015762).
As per Claim 11, none of Jawa, Baumann and Chawla specifically teaches, however Steckler teaches of the method of claim 6, the method additionally comprising: comparing the RBOM to a given list of software modules of the first application framework, wherein the given list is derivative of an at least partial static analysis of the computer system; and responsive to a presence of a software module in the RBOM that is absent from the given list, raising an alert. (Par 38, A deployer 326, which is either a development team 310 member (in development environment 162 (shown in FIG. 3)) or operations team 302 member (in staging environments 164 and production environments 166 (shown in FIG. 3)), starts 328 build by invoking a builder client utility. Automated build process 330 extracts source code from the version control repository, verifies promotion groups, generates bill of materials (BOM) (also referred to as a build of materials), builds compiled modules, deploys application, generates change/match report, and sends notifications to deployer 326, and mailing list defined in project properties 308. The mailing list typically includes key development team 310 members. This process results in a deployed application 332, a build history 334 such as build log files, and a build notifications 336.)
Therefore, it would have been obvious for one of the ordinary skill in the art before the effective filing date of the claimed invention to add comparing the RBOM to a given list of software modules of the first application framework, wherein the given list is derivative of an at least partial static analysis of the computer system; and responsive to a presence of a software module in the RBOM that is absent from the given list, raising an alert, as conceptually seen from the teaching of Steckler, into that of Jawa, Baumann and Chawla because this modification can help provide flexibility, reusability and simplicity by identifying and selecting software modules to be loaded.
14. Claim 12 is rejected under 35 U.S.C. 103 as being unpatentable over Jawa (US PGPub 20140059573), in view of Baumann (US PGPub 20130151846), in view of Chawla (US PGPub 20120159578), and further in view of Twigg (US PGPub 20230075355).
As per Claim 12, none of Jawa, Baumann and Chawla specifically teaches, however Twigg teaches of the method of claim 6, the method additionally comprising: receiving an alert pertaining to a first software module; and determining a priority of the alert in accordance with whether the first software module is present in the RBOM. (Par 711, In some implementations, the generating the alert may include determining a type of alert based on the operational status for the vulnerable software component and prioritizing the alert (e.g., based on a level of use and/or severity). Par 690-691, The method of statement 4 or 5, further comprising prioritizing the type of alert based on the operational status for the vulnerable software component. 7. The method of statement 6, wherein a first type of alert for a first vulnerable software component having an active operational status is prioritized over a second type of alert for a second vulnerable software component having a dormant operational status.)
Therefore, it would have been obvious for one of the ordinary skill in the art before the effective filing date of the claimed invention to add receiving an alert pertaining to a first software module; and determining a priority of the alert in accordance with whether the first software module is present in the RBOM, as conceptually seen from the teaching of Twigg, into that of Jawa, Baumann and Chawla because this modification can help provide flexibility, reusability and simplicity by identifying and selecting software modules to be loaded.
Response to Arguments
Applicant's arguments with respect to claims 1, 13 and 14 and their dependent claims have been fully considered but they are not persuasive.
Regarding the first argument of the remark that the claim limitations such as detecting and identifying cannot be performed as mental processes, the examiner would like to point out that the claim limitations that can be performed in a human mind but requires a general-purpose computer to execute those operations may be still mental processes as follows. Specifically with BRI, detecting invocation of a function of loading software module, the examiner interprets the limitation as detecting or identifying a function call in the source code or a human-readable file, where the function is loading software module by invocation of that function. Thus, the examiner maintains that the detection step can be performed as a mental process. And also identifying a software module being loaded using/utilizing parameter data, the examiner would like to point out that a user may identify a trace or code line of software module being loaded based on parameter data in source code or a human-readable file. Thus, the examiner maintains that the identifying step can be performed as a mental process.
C. A Claim That Requires a Computer May Still Recite a Mental Process
Claims can recite a mental process even if they are claimed as being performed on a computer. The Supreme Court recognized this in Benson, determining that a mathematical algorithm for converting binary coded decimal to pure binary within a computer’s shift register was an abstract idea. The Court concluded that the algorithm could be performed purely mentally even though the claimed procedures “can be carried out in existing computers long in use, no new machinery being necessary.” 409 U.S at 67, 175 USPQ at 675. See also Mortgage Grader, 811 F.3d at 1324, 117 USPQ2d at 1699 (concluding that concept of “anonymous loan shopping” recited in a computer system claim is an abstract idea because it could be “performed by humans without a computer”).
In evaluating whether a claim that requires a computer recites a mental process, examiners should carefully consider the broadest reasonable interpretation of the claim in light of the specification. For instance, examiners should review the specification to determine if the claimed invention is described as a concept that is performed in the human mind and applicant is merely claiming that concept performed 1) on a generic computer, or 2) in a computer environment, or 3) is merely using a computer as a tool to perform the concept. In these situations, the claim is considered to recite a mental process.
1. Performing a mental process on a generic computer. An example of a case identifying a mental process performed on a generic computer as an abstract idea is Voter Verified, Inc. v. Election Systems & Software, LLC, 887 F.3d 1376, 1385, 126 USPQ2d 1498, 1504 (Fed. Cir. 2018). In this case, the Federal Circuit relied upon the specification in explaining that the claimed steps of voting, verifying the vote, and submitting the vote for tabulation are “human cognitive actions” that humans have performed for hundreds of years. The claims therefore recited an abstract idea, despite the fact that the claimed voting steps were performed on a computer. 887 F.3d at 1385, 126 USPQ2d at 1504. Another example is Versata, in which the patentee claimed a system and method for determining a price of a product offered to a purchasing organization that was implemented using general purpose computer hardware. 793 F.3d at 1312-13, 1331, 115 USPQ2d at 1685, 1699. The Federal Circuit acknowledged that the claims were performed on a generic computer, but still described the claims as “directed to the abstract idea of determining a price, using organizational and product group hierarchies, in the same way that the claims in Alice were directed to the abstract idea of intermediated settlement, and the claims in Bilski were directed to the abstract idea of risk hedging.” 793 F.3d at 1333; 115 USPQ2d at 1700-01.
2. Performing a mental process in a computer environment. An example of a case identifying a mental process performed in a computer environment as an abstract idea is Symantec Corp., 838 F.3d at 1316-18, 120 USPQ2d at 1360. In this case, the Federal Circuit relied upon the specification when explaining that the claimed electronic post office, which recited limitations describing how the system would receive, screen and distribute email on a computer network, was analogous to how a person decides whether to read or dispose of a particular piece of mail and that “with the exception of generic computer-implemented steps, there is nothing in the claims themselves that foreclose them from being performed by a human, mentally or with pen and paper”. 838 F.3d at 1318, 120 USPQ2d at 1360. Another example is FairWarning IP, LLC v. Iatric Sys., Inc., 839 F.3d 1089, 120 USPQ2d 1293 (Fed. Cir. 2016). The patentee in FairWarning claimed a system and method of detecting fraud and/or misuse in a computer environment, in which information regarding accesses of a patient’s personal health information was analyzed according to one of several rules (i.e., related to accesses in excess of a specific volume, accesses during a pre-determined time interval, or accesses by a specific user) to determine if the activity indicates improper access. 839 F.3d. at 1092, 120 USPQ2d at 1294. The court determined that these claims were directed to a mental process of detecting misuse, and that the claimed rules here were “the same questions (though perhaps phrased with different words) that humans in analogous situations detecting fraud have asked for decades, if not centuries.” 839 F.3d. at 1094-95, 120 USPQ2d at 1296.
3. Using a computer as a tool to perform a mental process. An example of a case in which a computer was used as a tool to perform a mental process is Mortgage Grader, 811 F.3d. at 1324, 117 USPQ2d at 1699. The patentee in Mortgage Grader claimed a computer-implemented system for enabling borrowers to anonymously shop for loan packages offered by a plurality of lenders, comprising a database that stores loan package data from the lenders, and a computer system providing an interface and a grading module. The interface prompts a borrower to enter personal information, which the grading module uses to calculate the borrower’s credit grading, and allows the borrower to identify and compare loan packages in the database using the credit grading. 811 F.3d. at 1318, 117 USPQ2d at 1695. The Federal Circuit determined that these claims were directed to the concept of “anonymous loan shopping”, which was a concept that could be “performed by humans without a computer.” 811 F.3d. at 1324, 117 USPQ2d at 1699. Another example is Berkheimer v. HP, Inc., 881 F.3d 1360, 125 USPQ2d 1649 (Fed. Cir. 2018), in which the patentee claimed methods for parsing and evaluating data using a computer processing system. The Federal Circuit determined that these claims were directed to mental processes of parsing and comparing data, because the steps were recited at a high level of generality and merely used computers as a tool to perform the processes. 881 F.3d at 1366, 125 USPQ2d at 1652-53.
Regarding the second argument of the remark that the claim limitations would integrate a judicial exception into a practical application, the examiner would like to point out that in order to determine if additional element is integrating the abstract idea into a practical application, 1) The specification should describe the claimed improvement to achieve the desired goal and 2) The claimed improvement should be reflected at least in the additional elements by specifying how the claimed improvement performs the additional element to improve functioning of a computer or existing technical field.
2106.05(a) Improvements to the Functioning of a Computer or To Any Other Technology or Technical Field [R-07.2022]
If it is asserted that the invention improves upon conventional functioning of a computer, or upon conventional technology or technological processes, a technical explanation as to how to implement the invention should be present in the specification. That is, the disclosure must provide sufficient details such that one of ordinary skill in the art would recognize the claimed invention as providing an improvement. The specification need not explicitly set forth the improvement, but it must describe the invention such that the improvement would be apparent to one of ordinary skill in the art.
I. RELEVANT CONSIDERATIONS FOR EVALUATING WHETHER ADDITIONAL ELEMENTS INTEGRATE A JUDICIAL EXCEPTION INTO A PRACTICAL APPLICATION
The Supreme Court and Federal Circuit have identified a number of considerations as relevant to the evaluation of whether the claimed additional elements demonstrate that a claim is directed to patent-eligible subject matter. The list of considerations here is not intended to be exclusive or limiting. Additional elements can often be analyzed based on more than one type of consideration and the type of consideration is of no import to the eligibility analysis. Additional discussion of these considerations, and how they were applied in particular judicial decisions, is provided in MPEP § 2106.05(a) through (c) and MPEP § 2106.05(e) through (h).
Limitations the courts have found indicative that an additional element (or combination of elements) may have integrated the exception into a practical application include:
• An improvement in the functioning of a computer, or an improvement to other technology or technical field, as discussed in MPEP §§ 2106.04(d)(1) and 2106.05(a);
Regarding the third argument that Jawa teaches of a method of manipulation of already-loaded software objects while this application is about runtime identification of a loading of a software module, the examiner would like to point out that as the preamble (run-time identification) of the claim does not have any patentable weight, the examiner believes Jawa teaches of the particular claim limitation such as a) detecting, by a first interposition function, an invocation of a first function of loading of software-modules within the first application framework; in Par 69, After the function calls have been properly interposed or replaced, the operating system then runs the executable code for the program in the application binary (operation 618). Par 91, Upon launch of a modified application, the loader loads the hook and injection manager module, the hook and injection manager 201 dynamically loads the interposition library 203, and the hook and injection manager 201 may interpose on one or more functions by calling an interposition function. Par 92, The process described in FIG. 10 can be implemented as an interposition function in the interposition library 203. Such an interposition function may accept, as input, a function name (e.g., symbol representing the function) and an address for customized function code (e.g., hook_api ("printf", hook_printf)). The interposition function performs a series of steps to determine which function pointer entry in the import table is associated with the function name.
Regarding the 4th argument of the remark that Baumann does not specifically teach of the claim limitation such as the identifying utilizing, at least one of: i) parameter data supplied in the invocation of the first function since Baumann concerns of interaction between a client and servicing system (server) while the application is about intra-operating system functions, the examiner would like to point out that it’s not clear and recited from the claim limitations that identifying utilizing parameter data supplied in the invocation of the function should be intra-operating system functions.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JAE UK JEON whose telephone number is (571)270-3649. The examiner can normally be reached 9am-6pm. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Chat Do can be reached at 571-272-3721. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/JAE U JEON/Primary Examiner, Art Unit 2193