DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-6 and 9-13 are pending. Claims 7 and 8 are cancelled.
Response to Amendment
The amendments to the specification filed on October 17th, 2025, are approved and the objection with respect to the title is withdrawn.
Applicant's remaining arguments filed October 17th, 2025, have been fully considered but they are not persuasive.
Applicant argues against the rejection on under 35 U.S.C. § 101 as satisfying the requirements of the statute in light of the most recent amendments, which now include “displaying” safety information including an inspection result and a specified product or manufacturer of a device. Applicant argues that this is analogous to Example 37 of the USPTO’s Subject Matter Eligibility Examples and integrates the alleged mental process into a practical application.
In response to Applicant’s argument, generic “displaying” of information on a “display”, without more, amounts to recitation of a generic computer function. The display is recited at a high level of generality, i.e., as a generic display performing a generic computer function of showing available information (i.e. safety information and manufacturer data). This generic display limitation is no more than mere instructions to apply the exception using a generic computer component. Accordingly, this additional element does not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea.
Further, Example 37 of the Eligibility Examples deals with manipulating GUI icon positioning rather than the instant application’s “display” of information. The GUI manipulation of Example 37 was described as “determining the amount of use of each icon by tracking how much memory has been allocated to each application associated with each icon over a predetermined period of time” and therefore “is not practically performed in the human mind, at least because it requires a processor accessing computer memory indicative of application usage.” The display of information in the instant application does not appear to be analogous in this regard, as there is no distinct connection with application usage.
Applicant’s remaining arguments with respect to claims 1-6 and 9-13 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
Claim 13 is rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
Claim 13 describes “controlling a target industrial equipment using the displayed safety information together with or in association with the relationship information.” The instant specification, e.g., as per pgs. 26-29 of the specification and figs. 7-9, show the information in example form such as “NAME: Standard server” and “Manufacturer: S Company Inspection.” It is unclear how one of ordinary skill in the art would use text-based information to effectuate control of targeted industrial equipment as it does not contain commands or other clear linkage to how the equipment would be controlled. Further, figures 2, 3, 5, and 7 show a “display unit” that ends a control process with “displaying relationship information and safety information.” No further subject matter in the specification appears to describe using the displayed safety information to control industrial equipment.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-6 and 9-12 are rejected under 35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter. The claimed invention is directed to a judicial exception (i.e., a law of nature, a natural phenomenon, or an abstract idea) without significantly more.
The analysis is guided by the Supreme Court's two-step framework. First, determined if the claims are directed to a process, machine, manufacture, or composition of matter. In the instant case, the claims are directed to a process, machine, and manufacture. Second, determining if the claims are directed to a law of nature, a natural phenomenon, or an abstract idea, i.e., a judicially recognized exception (both individually and as an ordered combination). In the instant case, the claims are directed to an abstract idea of a mental process identified by the courts as concepts capable of being performed in the human mind.
Further analysis of Step 2B determines if the claims recite additional elements that amount to significantly more than the judicial exceptions. In the instant case, the claims do not transform the subject matter into a patent-eligible application of the abstract idea (i.e., significantly more than the abstract idea implemented using generic computer components).
More specifically, the claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception because the additional elements when considered both individually and as an ordered combination do not amount to significantly more than the abstract idea. The claim recites the additional limitations of “acquiring,” “collecting,” and “displaying” “information” which are recited as performing generic computing and functions routinely used in computing applications. Such generic functions that are well-understood, routine, and conventional activities amount to no more than implementing the abstract idea with a computerized system. The use of generic network components for the steps do not provide a provide a practical application to deal with implementation of the abstract idea. Thus, taken alone, the additional elements do not amount to significantly more than the above-identified judicial exception (the abstract idea). Looking at the limitations as an ordered combination does not add that beyond which is already present when looking at the elements taken individually.
Claims 2-6, 10, and 12 are dependent claims that depend on independent claims 1, 9 and 11. The dependent claims additional steps of “displaying,” “acquiring,” “setting,” “designating”, etc. fail to resolve the above problems. Therefore, dependent claims 2-6, 10, and 12 are also rejected under 35 U.S.C. 101.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-6 and 9-13 is/are rejected under 35 U.S.C. 103 as being unpatentable over Al Ghazo et al. (U.S. Patent 12,309,188) in view of Patel (U.S. PGPub 2018/0351987).
As per claims 1, 9, and 11, Al Ghazo teaches an information providing device comprising:
a memory configured to store instructions: and at least one processor configured to run the instructions to perform: acquiring identification information for identifying a specific constituent device of a communication system; (Al Ghazo, see fig. 2. mapping, component scan, fig. 3 learning stage 304 with the specific device identification steps; col. 18, lines 20-36)
collecting, by using the identification information, relationship information indicating a constituent component having a connection or a relationship with the specific constituent device and safety information related to safety in terms of information security of the specific constituent device and the constituent component; and (Al Ghazo, see fig. 2. mapping, component scan, fig. 3 learning stage 304 where the relationships are built followed by the recognition stage 314 identifying and mapping safety and vulnerability information; see col. 27, lines 17-36 mapping the connections/relationships with safety i.e. vulnerability assessment information; see also col. 19, lines 4-37 attack assessment)
displaying, on a display, the safety information together with or in association with the relationship information, (Al Ghazo, see col. 27, lines 17-36 mapping the connections/relationships with safety; col. 46, lines 33-54 visual display of attack-graph results and relationships; see also col. 32, lines 38-41; col. 33, lines 56-66)
Al Ghazo teaches the above, including displaying safety relationship information and recognizing device manufacturer/model (see fig. 2. mapping, component scan, fig. 3 learning stage 304 with the specific device identification steps; col. 18, lines 20-36 identifying all devices on network system; also col. 20, lines 16-48 including determining manufacturer/product information), but is silent to the detail of combining the safety information to include:
wherein the displayed safety information includes an inspection result of an information security inspection for the specific constituent device, and
wherein the displayed safety information includes information specifying a product or a manufacturer of the specific constituent device.
However, Patel discloses a device vulnerability management system that models and calculates threats and vulnerability relationship information (fig 3 workflow, abstract overview). The system of Patel collects manufacturer information, model, versioning, device type, and further details as part of the vulnerability assessment (paragraph 0061). Patel generates a safety inspection result for the device at issue (paragraphs 0056, 0059-0064, fig 4 steps 402, 404 results). Inspection safety information including inspection results for a specific constituent device and that further includes a product or manufacturer of the specific device is displayed (paragraphs 0089 and GUI of fig. 3, paragraph 0097 display of cyber-vulnerability detected, device and location, etc.).
It would have been obvious for one of ordinary skill in the art before the effective filing date of the invention to modify the teaching of Al Ghazo by the system of Patel, because the combination would improve the process for identifying device vulnerabilities, evaluating risk, and controlling the deployment and monitoring of special-purpose industrial devices (Patel, see paragraph 0021).
As per claim 2, Al Ghazo-Patel teaches the system further wherein the at least one processor is configured to run the instructions to perform:
displaying the safety information in a manufacturing process diagram of the communication system (Al Ghazo, fig. 1 manufacturing process context; see col. 46, lines 33-54 visual display of attack-graph results and relationships; see also col. 32, lines 38-41; col. 33, lines 56-66).
As per claim 3, Al Ghazo-Patel teaches the system further wherein the at least one processor is configured to run the instructions to perform: displaying the manufacturing process diagram in which the safety information is displayed together with a network configuration diagram of the communication system (Al Ghazo, fig. 1 manufacturing process context; see col. 46, lines 33-54 visual display of attack-graph results and relationships; see also col. 32, lines 38-41; col. 33, lines 56-66).
As per claim 4, Al Ghazo-Patel teaches the system further wherein the at least one processor is configured to run the instructions to perform: acquiring the identification information for identifying the specific constituent device selected from among constituent devices displayed on the network configuration diagram of the communication system (Al Ghazo, see fig. 2. mapping, component scan, fig. 3 learning stage 304 with the specific device identification steps; col. 18, lines 20-36 identifying all devices on network system; also col. 20, lines 16-48 further analysis to identify the devices).
As per claim 5, Al Ghazo-Patel teaches the system wherein: the at least one processor is configured to run the instructions to perform: setting an attack path or an attack scenario of a cyberattack obtained through risk analysis for the communication system; and wherein selecting or designating the specific constituent device from among constituent devices related to the attack path or the attack scenario (Al Ghazo, see col. 27, lines 17-36 mapping the connections/relationships with safety i.e. vulnerability assessment information; see col. 19, lines 4-37 attack assessment that binds an attack path to a specific constituent device on the attack pathing; more on designating a scenario via see col. 46, lines 33-54 visual display of attack-graph results and relationships; see also col. 32, lines 38-41; col. 33, lines 56-66).
As per claim 6, Al Ghazo-Patel teaches the system further wherein the specific constituent device includes hardware and software, and parts and modules configuring the hardware and the software (Al Ghazo, see fig. 2. mapping, component scan, fig. 3 learning stage 304 with the specific device identification steps; col. 18, lines 20-36 identifying all devices on network system; also col. 20, lines 16-48 further analysis to identify the devices).
As per claims 10 and 12, Al Ghazo-Patel teaches the system further wherein comprising:
setting an attack path or an attack scenario assumed in a case where there is a cyberattack on the communication system; and displaying the relationship information and the safety information related to the attack path or the attack scenario (Al Ghazo, see col. 27, lines 17-36 mapping the connections/relationships with safety i.e. vulnerability assessment information; see col. 19, lines 4-37 attack assessment that binds an attack path to a specific constituent device on the attack pathing; more on designating a scenario via see col. 46, lines 33-54 visual display of attack-graph results and relationships; see also col. 32, lines 38-41; col. 33, lines 56-66).
As per claim 13, Al Ghazo-Patel teaches the system further wherein the at least one processor is configured to run the instructions to perform: controlling a target industrial equipment using the displayed safety information together with or in association with the relationship information (Patel, see paragraphs 0100, 0101, 171-0177 using the safety information and other relationship information to determine required remediation control and remediation steps of fig. 4, where the system controls a target industrial equipment by initiating a patch process update 0183-0186 and step 418; note the applicability to non-medical industrial devices as per paragraph 0187).
Conclusion
Applicant's amendment necessitated the new grounds of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Nicholas Taylor whose telephone number is (571) 272-3889. The examiner can normally be reached Mon-Fri (9:00am - 5:00pm).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/NICHOLAS R TAYLOR/Supervisory Patent Examiner, Art Unit 2443