DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Remarks
Claims 1-19 and 23 are pending.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-19 and 23 are rejected under 35 U.S.C. 103 as being unpatentable over LORESKAR et al. (‘LORESKAR’ hereinafter) (Publication Number 20200259668) in view of Leone (Patent Number 8474004).
As per claim 1, LORESKAR teaches
An installation control device comprising: at least one memory storing a set of instructions; and at least one processor configured to execute the set of instructions to: (paragraph [0041])
receive verification certification data including first authenticity information of target software and indicating that safety of the target software has been verified,
compare the first authenticity information included in the verification certification data with second authenticity information of the target software; (software provider certificate hash verified by comparing against hash of application code to be installed, paragraph [0040], where application code can include application certificate, see paragraphs [0037]-[0038])
and perform control in such a way that the target software is installed when the first authenticity information is same as the second authenticity information
LORESKAR does not explicitly indicate “the verification certification data further including information on a severity degree indicating a degree of severity of a detected vulnerability” and “and the verification certification data includes the severity degree being lower than a predetermined severity degree”.
However, Leone discloses “the verification certification data further including information on a severity degree indicating a degree of severity of a detected vulnerability” (analyze vulnerabilities by security level evaluator that gathers information regarding security level of applications, column 9, line 50 through column 10, line 12, see also claim 1), and “and the verification certification data includes the severity degree being lower than a predetermined severity degree” (assesses whether the security level of the software application to be installed is sufficiently high, i.e. it is not below a predetermined, minimum security level, and may prevent installation of the software in the negative case, column 11, lines 20-30; note that in Leone the security/severity level/degrees are inverted when compared to the instant claims but the result is the same insofar as when the installation is performed).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine LORESKAR and Leone because using the steps claimed would have given those skilled in the art the tools to improve the invention by providing for security at the application layer that allows the installation of third-party applications by better understanding their potential vulnerabilities (see Leone, background). This gives the user the advantage of not having critical devices and/or data to exposed to potentially unsafe software applications.
As per claim 2, LORESKAR teaches
receive the verification certification data in response to receiving an instruction to install the target software” (installation command, paragraph [0032]; before installing the certificate is provided, paragraph [0040]).
As per claim 3, LORESKAR teaches
perform control in such a way that installation of the target software is not executed when the verification certification data is not obtained (before installing the certificate is provided, paragraph [0040]).
As per claim 4, LORESKAR teaches
perform control in such a way that installation of the target software is not executed when the first authenticity information and the second authenticity information do not match. (software provider certificate hash verified by comparing against hash of application code to be installed, paragraph [0040], where application code can include application certificate, see paragraphs [0037]-[0038]; install corresponding application, paragraph [0040])
As per claim 5, LORESKAR teaches
acquire the verification certification data, the target software, and the second authenticity information; and receive the verification certification data from a sharing system that holds the verification certification data. (software provider certificate, application, application certificate, paragraphs [0040],[0045])
As per claim 6, LORESKAR teaches
execute installation of the target software according to control by the installation control device. (install application, paragraph [0040])
As per claim 7, LORESKAR teaches
A system including a sharing system and the installation control device according to claim 1, the sharing system comprising: at least one second memory storing a set of instructions and at least one second processor configured to execute the set of instructions to: receive verification certification data including first authenticity information of target software and indicating that safety of the target software has been verified; notify the installation control device of the verification certification data. (third party who manages the certificates associated with the chain of trust, paragraph [0036])
As per claim 8, LORESKAR teaches
notify the installation control device of the verification certification data in response to receiving a request for the verification certification data from the installation control device. (paragraph [0046],[0050])
As per claim 9, LORESKAR teaches
receive the target software and the first authenticity information; provide the target software and the first authenticity information to a verification device that verifies safety of the target software; and receive the verification certification data from the verification device. (software provider certificate, application, application certificate, paragraphs [0040],[0045]; validate the specified application using the software provider certificate, to determine whether the provider of the application can be trusted or the application code can be trusted, paragraph [0040)
As per claim 10, LORESKAR teaches
store the received target software and the received first authenticity information in the information storage; provide the target software and the first authenticity information read from the information storage; store the received verification certification data in the information storage; and notify the installation control device of the verification certification data read from the information storage. (receive application code, paragraph [0040]; store application certificate locally and make available later, paragraph [0037])
As per claim 11, LORESKAR teaches
the installation control device executes installation of the target software when determining that installation of the target software is permitted. (application code installation, paragraph [0040])
As per claims 12-19
These claims are rejected on grounds corresponding to the reasons given above for rejected claims 1-8 and are similarly rejected.
As per claim 23
This claim is rejected on grounds corresponding to the reasons given above for rejected claim 1 and is similarly rejected.
Response to Arguments
Applicant’s arguments with respect to claims 1-19 and 23 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument. The newly added Leone reference, in combination with the previously cited reference, teaches the argued claims as shown above.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JAY A MORRISON whose telephone number is (571)272-7112. The examiner can normally be reached on Monday - Friday, 8:00 am - 4:00 pm ET.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Trujillo K James, can be reached at telephone number (571)272-3677. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from Patent Center and the Private Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from Patent Center or Private PAIR. Status information for unpublished applications is available through Patent Center and Private PAIR for authorized users only. Should you have questions about access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) Form at https://www.uspto.gov/patents/uspto-automated- interview-request-air-form.
/Jay A Morrison/
Primary Examiner, Art Unit 2151
Prosecution Insights