Prosecution Insights
Last updated: April 19, 2026
Application No. 18/640,467

SYSTEMS AND METHODS FOR ENHANCING THE SECURITY OF ISOLATED EXECUTION ENVIRONMENTS OF AN AUTHORIZED USER

Final Rejection §103
Filed
Apr 19, 2024
Examiner
SHEHNI, GHAZAL B
Art Unit
2499
Tech Center
2400 — Computer Networks
Assignee
Ao Kaspersky Lab
OA Round
2 (Final)
87%
Grant Probability
Favorable
3-4
OA Rounds
2y 8m
To Grant
99%
With Interview

Examiner Intelligence

Grants 87% — above average
87%
Career Allow Rate
932 granted / 1068 resolved
+29.3% vs TC avg
Moderate +12% lift
Without
With
+12.4%
Interview Lift
resolved cases with interview
Typical timeline
2y 8m
Avg Prosecution
27 currently pending
Career history
1095
Total Applications
across all art units

Statute-Specific Performance

§101
12.1%
-27.9% vs TC avg
§103
38.5%
-1.5% vs TC avg
§102
20.6%
-19.4% vs TC avg
§112
12.9%
-27.1% vs TC avg
Black line = Tech Center average estimate • Based on career data from 1068 resolved cases

Office Action

§103
DETAILED ACTION Notice of Pre-AIA or AIA Status The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . The following is a final office action in response to communications received 12/08/2025. Claims 1, 3, 4, 8, 9, 10, 11, 13, 18-21 have been amended. Claims 7, 17 have been cancelled. Therefore, claims 1-6, 8-16, 18-21 are pending and addressed below. Response to Arguments Applicant’s arguments filed 12/08/2025 have been fully considered but they are moot in view of new grounds of rejections. Allowable Subject Matter Claims 9-10 (claim 10 depends on claim 9), 19-20 (claim 20 depends on claim 19) are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims. Claim Rejections - 35 USC § 103 The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. Claims 1-8, 10-18, 20-21 are rejected under 35 U.S.C. 103 as being unpatentable over Barton et al (EP 3422237) (from Applicant’s IDS) in view of Bukurak et al (Pub. No. US 2014/0007254). As per claim 1, Barton discloses a method for enhancing the security of isolated execution environments of an authorized user (…see par. 5, 521), the method comprising: identifying at least one computer system on which a user is authorized (…mobile device may be identified…enterprises allow users to access the enterprise network via mobile device, such as smartphones…see par. 3, 25); forming an isolated execution environment for an execution of a security application on the at least one identified computer system (…the enterprise agent can be installed onto the mobile device as a condition of the mobile device’s enrollment with the mobile device management system…the enterprise can employ an automated subsystem for installing enterprise agents onto the mobile devices associated with the enterprise…see par. 169); detecting at least two other isolated execution environments using the isolated execution environment for the security application on the at least one identified computer system (…a first application of the set of managed applications to provide data to a second application installed on the mobile device…the enterprise agent collects information about the mobile device’s configuration…the enterprise agent can similarly query the operating system for a list of mobile applications that are currently running…see par. 122, 171…Examiner further notes lack of clarification as to if there is any difference for “at least two other isolated execution environments using the isolated execution environment”). Barton does not explicitly disclose wherein the detecting comprises detecting at least two applications that are running in the at least two other detected isolated execution environments after the security application was launched; and forming a secure integration of the at least two other detected isolated execution environments using integration rules. However Bukurak discloses wherein the detecting comprises detecting at least two applications that are running in the at least two other detected isolated execution environments after the security application was launched (see par. 70-72); and forming a secure integration of the at least two other detected isolated execution environments using integration rules (…a hybrid application is a trusted application that is capable of and permitted to concurrently access files from more than one sandbox…the hybrid application is permitted to access data from a plurality of sandboxes…the hybrid application may access files from a sandbox in which the hybrid application was initiated and may also access files from another sandbox…the ability to access files from a plurality of sandboxes at the same time may be provided to the hybrid application by higher-level system components, such as a sandbox management application or module which manages the sandboxes and administers a set of access rules for the sandboxes…see par. 53-54). Therefore one ordinary skill in the art would have found it obvious before the effective filling date of the claimed invention to use Bukurak in Barton for including the above limitations because one ordinary skill in the art would recognize it would further improve the security of files on electronic devices for different operational contexts…see Bukurak, par. 3, 4. As per claim 11, Barton discloses a system for enhancing the security of isolated execution environments of an authorized user, comprising: at least one memory; and at least one hardware processor coupled with the at least one memory (see fig.1) and configured, individually or in combination, to: identifies at least one computer system on which a user is authorized (…mobile device may be identified…enterprises allow users to access the enterprise network via mobile device, such as smartphones…see par. 3, 25); forms an isolated execution environment for an execution of a security application on the at least one identified computer system (…the enterprise agent can be installed onto the mobile device as a condition of the mobile device’s enrollment with the mobile device management system…the enterprise can employ an automated subsystem for installing enterprise agents onto the mobile devices associated with the enterprise…see par. 169); detects at least two other isolated execution environments using the isolated execution environment for the security application on the at least one identified computer system (…a first application of the set of managed applications to provide data to a second application installed on the mobile device…the enterprise agent collects information about the mobile device’s configuration…the enterprise agent can similarly query the operating system for a list of mobile applications that are currently running…see par. 122, 171…Examiner further notes lack of clarification as to if there is any difference for “at least two other isolated execution environments using the isolated execution environment”). Barton does not explicitly disclose wherein the detecting comprises detecting at least two applications that are running in the at least two other detected isolated execution environments after the security application was launched; and forming a secure integration of the at least two other detected isolated execution environments using integration rules. However Bukurak discloses wherein the detecting comprises detecting at least two applications that are running in the at least two other detected isolated execution environments after the security application was launched (see par. 70-72); and forming a secure integration of the at least two other detected isolated execution environments using integration rules (…a hybrid application is a trusted application that is capable of and permitted to concurrently access files from more than one sandbox…the hybrid application is permitted to access data from a plurality of sandboxes…the hybrid application may access files from a sandbox in which the hybrid application was initiated and may also access files from another sandbox…the ability to access files from a plurality of sandboxes at the same time may be provided to the hybrid application by higher-level system components, such as a sandbox management application or module which manages the sandboxes and administers a set of access rules for the sandboxes…see par. 53-54). Therefore one ordinary skill in the art would have found it obvious before the effective filling date of the claimed invention to use Bukurak in Barton for including the above limitations because one ordinary skill in the art would recognize it would further improve the security of files on electronic devices for different operational contexts…see Bukurak, par. 3, 4. As per claim 21, Barton discloses a non-transitory computer readable medium storing thereon computer executable instructions for enhancing the security of isolated execution environments of an authorized user, including instructions for: identifying at least one computer system on which a user is authorized (…mobile device may be identified…enterprises allow users to access the enterprise network via mobile device, such as smartphones…see par. 3, 25); forming an isolated execution environment of a security application on the at least one identified computer system (…the enterprise agent can be installed onto the mobile device as a condition of the mobile device’s enrollment with the mobile device management system…the enterprise can employ an automated subsystem for installing enterprise agents onto the mobile devices associated with the enterprise…see par. 169); detecting at least two other isolated execution environments using the isolated execution environment of the installed security application on the at least one identified computer system (…a first application of the set of managed applications to provide data to a second application installed on the mobile device…the enterprise agent collects information about the mobile device’s configuration…the enterprise agent can similarly query the operating system for a list of mobile applications that are currently running…see par. 122, 171…Examiner further notes lack of clarification as to if there is any difference for “at least two other isolated execution environments using the isolated execution environment”). Barton does not explicitly disclose wherein the detecting comprises detecting at least two applications that are running in the at least two other detected isolated execution environments after the security application was launched; and forming a secure integration of the at least two other detected isolated execution environments using integration rules. However Bukurak discloses wherein the detecting comprises detecting at least two applications that are running in the at least two other detected isolated execution environments after the security application was launched (see par. 39, 70-72); and forming a secure integration of the at least two other detected isolated execution environments using integration rules (…a hybrid application is a trusted application that is capable of and permitted to concurrently access files from more than one sandbox…the hybrid application is permitted to access data from a plurality of sandboxes…the hybrid application may access files from a sandbox in which the hybrid application was initiated and may also access files from another sandbox…the ability to access files from a plurality of sandboxes at the same time may be provided to the hybrid application by higher-level system components, such as a sandbox management application or module which manages the sandboxes and administers a set of access rules for the sandboxes…see par. 53-54). Therefore one ordinary skill in the art would have found it obvious before the effective filling date of the claimed invention to use Bukurak in Barton for including the above limitations because one ordinary skill in the art would recognize it would further improve the security of files on electronic devices for different operational contexts…see Bukurak, par. 3, 4. As per claims 2, 12, the combination of Barton and Bukurak discloses wherein at least one computer system of the at least one computer system on which the user is authorized comprises a mobile computer system (Barton: see par. 3, 25). As per claims 3, 13, the combination of Barton and Bukurak discloses wherein the identification of the at least one computer system on which the user is authorized is performed by detecting a computer system that receives and transmits calls over a mobile network (Barton: see par. 105-106). As per claims 4, 14, the combination of Barton and Bukurak discloses wherein the forming of the isolated execution environment for the execution of the security application is performed by installing the security application on the at least one identified computer system (Barton: see par. 169). As per claims 5, 15, the combination of Barton and Bukurak discloses wherein when forming the isolated execution environment, the security application is provided with a maximum possible number of permissions and accesses (Barton: see par. 237, 361). As per claims 6, 16, the combination of Barton and Bukurak discloses wherein, after the isolated execution environment is formed, the security application activates the isolated execution environment by running the security application (Barton: see par. 168-169). As per claims 8, 18, the combination of Barton and Bukurak discloses the method further comprises: after the detection of the at least two applications that are running after the security application was launched, identifying parameters of the at least two other detected isolated execution environments that are generated for operation of the at least two applications (Bukurak: see par. 39, 70-72). The motivation for claims 8, 18 is the same motivation as in claims 1, 11 above. Conclusion The prior art made of record and not relied upon is considered pertinent to applicant's disclosure (see PTO-form 892). The following Patents and Papers are cited to further show the state of the art at the time of Applicant’s invention with respect to improving the security of isolated execution environments of an authorized user. Nadgowda et al (Pub. No. US 2020/0137091); “Cloud-Native Extensibility Provided to Security Analytics”; -Teaches the execution component can apply the instance of the encapsulated security application to a simulated system state of a computing device…see par. 35. Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action. Any inquiry concerning this communication or earlier communications from the examiner should be directed to GHAZAL B SHEHNI whose telephone number is (571)270-7479. The examiner can normally be reached Mon-Fri 9am-5pm PCT. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Philip Chea can be reached at 5712723951. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /GHAZAL B SHEHNI/Primary Examiner, Art Unit 2499
Read full office action

Prosecution Timeline

Apr 19, 2024
Application Filed
Aug 06, 2025
Non-Final Rejection — §103
Dec 08, 2025
Response Filed
Mar 02, 2026
Final Rejection — §103 (current)

Precedent Cases

Applications granted by this same examiner with similar technology

Patent 12602479
MEASURING CONTAINERS
2y 5m to grant Granted Apr 14, 2026
Patent 12596810
AUTOMATED APPLICATION PROGRAMMING INTERFACE (API) TESTING
2y 5m to grant Granted Apr 07, 2026
Patent 12591682
AUTOMOTIVE SECURE BOOT WITH SHUTDOWN MEASURE
2y 5m to grant Granted Mar 31, 2026
Patent 12591660
DEVICE SECURITY MANAGER ARCHITECTURE FOR TRUSTED EXECUTION ENVIRONMENT INPUT/OUTPUT (TEE-IO) CAPABLE SYSTEM-ON-A-CHIP INTEGRATED DEVICES
2y 5m to grant Granted Mar 31, 2026
Patent 12585741
PASSWORD PROMPT FOR SECURE CAMERA ACTIVATION
2y 5m to grant Granted Mar 24, 2026
Study what changed to get past this examiner. Based on 5 most recent grants.

AI Strategy Recommendation

Get an AI-powered prosecution strategy using examiner precedents, rejection analysis, and claim mapping.
Powered by AI — typically takes 5-10 seconds

Prosecution Projections

3-4
Expected OA Rounds
87%
Grant Probability
99%
With Interview (+12.4%)
2y 8m
Median Time to Grant
Moderate
PTA Risk
Based on 1068 resolved cases by this examiner. Grant probability derived from career allow rate.

Sign in with your work email

Enter your email to receive a magic link. No password needed.

Personal email addresses (Gmail, Yahoo, etc.) are not accepted.

Free tier: 3 strategy analyses per month