DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 41-60 are pending.
Specification
The title of the invention is not descriptive. A new title is required that is clearly indicative of the invention to which the claims are directed.
The use of the term QNX, ARM, which is a trade name or a mark used in commerce, has been noted in this application. The term should be accompanied by the generic terminology; furthermore the term should be capitalized wherever it appears or, where appropriate, include a proper symbol indicating use in commerce such as ™, SM , or ® following the term.
Although the use of trade names and marks used in commerce (i.e., trademarks, service marks, certification marks, and collective marks) are permissible in patent applications, the proprietary nature of the marks should be respected and every effort made to prevent their use in any manner which might adversely affect their validity as commercial marks.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
Claims 41-60 are rejected under 35 U.S.C. 112 (b) as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or joint inventor regards as the invention.
The following terms lack proper antecedent basis:
-- the second system call -- in claim 53
The following claim language is not clearly understood:
Claim 1 recites “ first function is readable and executable for processes in user mode and …second function”. It is unclear if the second function is also readable and executable for processes in user mode or non-user (kernel) mode.
Claim 1 recites “triggering, by a first process, a first system call according to a first function” and later recites “first function triggers the first system call”. It is unclear if the first process or first function triggers the first system call.
Claim 53 recite “a second access permission” without clearly reciting second access permission is permission to access what and if second access permission is enabled or not enabled.
Claim 53 recites “first function not to enable the second system call” and later recites “ first function triggers the first system call, calls the second function, and triggers the second system call”. It is unclear if the first function (which is not to enable the second system call) enabled to or the second function is triggering the second system call.
Claims 48 and 54 recite elements of claim 41 and have similar deficiency as claim 54. Therefore, they are rejected for the same rational. Remaining dependent claims 42-47, 49-53 and 55-60 are also rejected due to similar deficiency inherited from the rejected independent claims.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 41-60 is/are rejected under 35 U.S.C. 103 as being unpatentable over Agarwal et al. (US 2017/0091473 A1, hereafter Agarwal) in view of Ganapathy et al. (US 2006/0230157 A1).
As per claim 41, Agarwal teaches the invention substantially as claimed including A method, applied to a computer device (fig. 3 ), the method comprising:
triggering, by a first process, a first system call according to a first function, wherein the first function is readable and executable for processes in user mode ([0023] agent i.e. first process, retrieve a file i.e. first function [0022] system runtime memory 140 host process instances 142 e.g. file system process i.e. system call, controls read and writes to a file system [0015] agent may be another process [0020] user mode, kernel mode [0029] process request, execute a first process, user; fig 2 210),
the first function triggers the first system call ([0023] agent, retrieve a file; fig. 2 210 [0022] system runtime memory 140 host process instances 142 e.g. file system process i.e. system call, controls read and writes to a file system) and calls a second function of a first system service process ([0030] request from a first process to second process; fig. 2 250),
the first system call instruct a kernel to configure a first access permission with which the first process accesses physical memory address space of the first system service process ([0003] one or more access control rules related to the agent [0012] access control mechanism, grant and deny access to computer hardware e.g. segments of random access memory, software objects, document / files / operations [0014] communication between existing programs, kernel, access control module [0015] processes, need, access, one another, controller, facilitate these accesses by applying one or more rules, implement rules controlling the ability of a subject process, executed by an agent, to access an object process; for example in a situation where an image editor process calls an image viewer process, the image editor process could be an agent and the image viewer process could be the subject process, if the image viewer process tries to access a file system process (an object process), the rules may be in part based on the privileges of and the permissions given to the image editor process [0016] implement rules for a subject process to access an object process [0020] user runtime memory 150, system runtime memory 140), the physical memory address space stores the second function ([0027] second process instance, second binary code, stored in directory), and
the second function implements a functionality of the first system service process ( [0004] second process instance, second program, first process instance, attempting to access second process instance [0016] first process, access, request, read, second process, role, subject-object process);
receiving, by the first process, indication information that is sent by the kernel and that responds to the first system call ([0016] process’s request to read a second process [0023] receive a request from agent to retrieve a file i.e. system call, kernel, grant / deny the agent access to the file i.e. giving access is an indication information) , wherein the indication information indicates whether the first access permission is enabled ([0015] rules, privileges / permissions, image editor process [0016] first process, selectively granting / denying firs process’s request to read a second process [0023] kernel, grant / deny the agent access to the requested file i.e. an indication of permission being enabled or not [0024] kernel, permit, first process, to access, second process); and
executing, by the first process, the second function according to the first function ([0024] kernel, permit, first process, to access second process [0003] second process instance, second program, fig. 2 grant inter-process access 280 [0016] second process, e.g. launch, execute, kill, terminate, request status, update status [0026] kernel, grant, process 142A, access, process 142B, e.g. process 142 A may terminate process 142B, rule granting termination permission) when it is determined that the indication information indicates that the first access permission is enabled ([0024] kernel, permit, first process, to access second process [0026] if an entry that contains the permission for the type of access requested is found in the entries (e.g., process 142A may terminate process 142B if the kernel 120 finds a rule granting termination permission of process 142B to process 142A).
Agarwal doesn’t specifically teach first system call instructs the kernel to configure a first access permission.
Ganapathy, however, teaches first system call instructs the kernel to configure a first access permission ([0032] application, make request i.e. system call, of the kernel interface module to allow access).
It would have been obvious to one of the ordinary skills in the art to combine the teachings of Agarwal with the teachings of Ganapathy of application making system call to the kernel to allow access to improve security and efficiency and allow first system call instructs the kernel to configure a first access permission to the method of Agarwal as in the instant invention.
The combination would have been obvious because applying the known method of the system call to the kernel for allowing access as taught by Ganapathy to the method of Agarwal to yield expected results of system call instructing the kernel to configure access with improved security and efficiency.
As per claim 42, Agarwal teaches wherein the first function further triggers a second system call ([0023] agent to retrieve a file, read a file, kernel, coordinate with the security subsystem i.e. another system call); and
after executing, by the first process, the second function ([0024] kernel, permit, first process, to access second process [0003] second process instance, second program, fig. 2 grant inter-process access 280 [0016] second process, e.g. launch, execute, kill, terminate, request status, update status [0026] kernel, grant, process 142A, access, process 142B, e.g. process 142 A may terminate process 142B, rule granting termination permission), the method further comprises:
triggering, by the first process, the second system call according to the first function, wherein the second system call instructs the kernel to cancel the first access permission ([0023] agent to retrieve a file, read a file, kernel, coordinate with the security subsystem i.e. another system call [0012] create rules or permissions relating to operations that subject wish to perform upon objects i.e. can also cancel the permission [0015] controller may implement rules controlling the ability of a subject process, executed by an agent, to access an object process [0018] denied permission to access the process A).
As per claim 43, Agarwal teaches wherein the first access permission comprises a read and execute permission for a code segment in the first system service process and a read and write permission for a data segment in the first system service process ([0016] access, object process, e.g. read/write, granting/denying [0021] program code, collection of various programs, file system, containing, objects e.g. files, folders, documents, images), and the first system call further triggers the kernel to configure a read and execute permission for a code segment in the first process and a read and write permission for a data segment in the first process ([0023] kernel, grant / deny the agent access to the requested file i.e. an indication of permission being enabled or not [0024] kernel, permit, first process, to access, second process [0021] program code, collection of various programs, file system, containing, objects e.g. files, folders, documents, images).
Ganapathy teaches remaining claim elements of the first system call further triggers the kernel to configure a read and execute permission ([0032] application, make request i.e. system call, of the kernel interface module to allow access).
As per claim 44, Agarwal teaches before triggering, by the first process, the first system call according to the first function ([0023] agent, retrieve a file; fig. 2 210 [0022] system runtime memory 140 host process instances 142 e.g. file system process i.e. system call, controls read and writes to a file system), obtaining, by the first process, a first task, wherein the first task comprises executing, by the first process, the second function ([0013] task, broken into multiple smaller tasks / processes [0025] task, to perform process A and process B).
As per claim 45, Agarwal teaches wherein the first process is a user process ([0020] user program) or a second system service process ([0015] agent may be another process).
As per claim 46, Agarwal teaches wherein the first system service process integrates at least two subsystem service processes in the user mode ([0022] user runtime, process instance 152, image editor process, file viewer process, web browser [0013] task, broken into multiple smaller tasks / processes [0025] task, to perform process A and process B ), each of the at least two subsystem service processes is respectively a driver process, a network management process, or a file system management process ([0022] example process instance 142 network card process that controls a network card, file system process, graphics card process [0016] processes, launch, execute, kill, terminate, request, status, update status), the second function is a function of one subsystem service process of the at least two subsystem service processes ([0022] example process instance 142 network card process that controls a network card, file system process, graphics card process [0016] processes, launch, execute, kill, terminate, request, status, update status), a third function is readable and executable for processes in the user mode ([0012] operations, read directory, write to network disk [0022] [0016] [0023] retrieve a file [0020] user mode), and the third function is used to call a function of another subsystem service process of the at least two subsystem service processes ([0024] kernel, permit, first process, to access second process [0003] second process instance, second program, fig. 2 grant inter-process access 280 [0016] second process, e.g. launch, execute, kill, terminate, request status, update status [0026] kernel, grant, process 142A, access, process 142B, e.g. process 142 A may terminate process 142B); and
wherein executing, by the first process, the second function in the physical memory address space according to the first function comprises ([0024] kernel, permit, first process, to access second process [0003] second process instance, second program, fig. 2 grant inter-process access 280 [0016] second process, e.g. launch, execute, kill, terminate, request status, update status [0026] kernel, grant, process 142A, access, process 142B, e.g. process 142 A may terminate process 142B):
calling and executing, by the first process, the third function according to the second function, wherein before the first process returns to the first function, the first access permission remains unchanged ([0024] kernel, permit, first process, to access second process [0016] second process, e.g. launch, execute, kill, terminate, request status, update status; no change in access permission unless triggered by system call).
As per claim 47, Agarwal teaches wherein the method is used in a microkernel architecture ([0014] software platform, microkernel), and the first system service process is a driver process, a network management process, or a file system management process ([0022] network card process, file system process, controls reads and writes to a file system); and
wherein the physical memory address space is address space managed by memory management unit (MMU) hardware, memory protection unit (MPU) hardware, or physical memory protection (PMP) hardware ([0034] fig. 3 memory controller 322, facilitate storage and retrieval of information in the memory 320 ).
As per claim 48, Agarwal teaches the invention substantially as claimed including a method, applied to a computer device (fig. 3), the method comprising:
responding, by a kernel, to a first system call triggered by a first process ([0023] receive a request from agent to retrieve a file i.e. system call, kernel; fig. 2 210 [0022] system runtime memory 140 host process instances 142 e.g. file system process i.e. system call, controls read and writes to a file system [0016] process’s request to read a second process [0023] grant / deny the agent access to the file i.e. giving access is an indication information), and configuring a first access permission with which the first process accesses physical memory address space of a first system service process ([0003] one or more access control rules related to the agent [0012] access control mechanism, grant and deny access to computer hardware e.g. segments of random access memory, software objects, document / files / operations [0014] [0015] processes, need, access, one another, controller, facilitate these accesses by applying one or more rules, implement rules controlling the ability of a subject process, executed by an agent, to access an object process; for example in a situation where an image editor process calls an image viewer process, the image editor process could be an agent and the image viewer process could be the subject process, if the image viewer process tries to access a file system process (an object process), the rules may be in part based on the privileges of and the permissions given to the image editor process [0016] implement rules for a subject process to access an object process [0020] user runtime memory 150, system runtime memory 140), wherein the physical memory address space stores a second function ( [0027] second process instance, second binary code, stored in directory), the second function implements a functionality of the first system service process ( [0004] second process instance, second program, first process instance, attempting to access second process instance [0016] first process, access, request, read, second process, role, subject-object process), and the first system call instructs the kernel to configure the first access permission ([0004] second process instance, second program, first process instance, attempting to access second process instance [0016] first process, access, request, read, second process, role, subject-object process); and
sending, by the kernel, indication information to the first process ([0016] process’s request to read a second process [0023] receive a request from agent to retrieve a file i.e. system call, kernel, grant / deny the agent access to the file i.e. access grant /deny to the file, indicates sending indication of access information), wherein the indication information indicates whether the first access permission is enabled ([0015] rules, privileges / permissions, image editor process [0016] first process, selectively granting / denying firs process’s request to read a second process [0023] kernel, grant / deny the agent access to the requested file i.e. an indication of permission being enabled or not [0024] kernel, permit, first process, to access, second process), and the first access permission is used by the first process to execute the second function ([0024] kernel, permit, first process, to access second process [0026] if an entry that contains the permission for the type of access requested is found in the entries (e.g., process 142A may terminate process 142B if the kernel 120 finds a rule granting termination permission of process 142B to process 142A).
Agarwal doesn’t specifically teach first system call instructs the kernel to configure a first access permission.
Ganapathy, however, teaches first system call instructs the kernel to configure a first access permission ([0032] application, make request i.e. system call, of the kernel interface module to allow access).
It would have been obvious to one of the ordinary skills in the art to combine the teachings of Agarwal with the teachings of Ganapathy of application making system call to the kernel to allow access to improve security and efficiency and allow first system call instructs the kernel to configure a first access permission to the method of Agarwal as in the instant invention.
The combination would have been obvious because applying the known method of the system call to the kernel for allowing access as taught by Ganapathy to the method of Agarwal to yield expected results of system call instructing the kernel to configure access with improved security and efficiency.
As per claim 49, Agarwal teaches wherein configuring the first access permission with which the first process accesses the physical memory address space of the first system service process comprises ([0003] one or more access control rules related to the agent [0012] access control mechanism, grant and deny access to computer hardware e.g. segments of random access memory, software objects, document / files / operations [0014] [0015] processes, need, access, one another, controller, facilitate these accesses by applying one or more rules, implement rules controlling the ability of a subject process, executed by an agent, to access an object process [0016] implement rules for a subject process to access an object process):
configuring, by the kernel, the first access permission ([0012][0016] implement rules for a subject process to access an object process [0015] [0027] doesn’t find entries related to process, determine rules related to process based on program from which they were invoked) when it is determined that the first process has a second access permission and the first access permission is not enabled ([0026] kernel, determine, based on entries whether process 142A has permission to access [0027] does not find any entries related to process), wherein the indication information indicates that the first access permission is enabled ([0015] rules, privileges / permissions, image editor process [0016] first process, selectively granting / denying firs process’s request to read a second process [0023] kernel, grant / deny the agent access to the requested file i.e. an indication of permission being enabled or not ), and the second access permission is a permission for calling the second function ( [0024] kernel, permit, first process, to access, second process).
Claim 50 recites elements similar to claim 42. Therefore, it is rejected for the same rationale.
Claim 51 recites elements similar to claim 43. Therefore, it is rejected for the same rationale.
Claim 52 recites elements similar to claim 45. Therefore, it is rejected for the same rationale.
Claim 53 recites elements similar to part of the elements of claim 41, 42 and 46. Therefore, it is rejected for the same rationale.
Claim 54 recites a computer device, comprising: at least one processor; and at least one memory storing instructions that are executable by the at least one processor, (fig. 3) the instructions comprising instructions to perform elements similar to claim 41. Therefore, it is rejected for the same rationale.
Claim 55 recites elements similar to claim 42. Therefore, it is rejected for the same rationale.
Claim 56 recites elements similar to claim 43. Therefore, it is rejected for the same rationale.
Claim 57 recites elements similar to some of the elements of claim 44. Therefore, it is rejected for the same rationale.
Claim 58 recites elements similar to claim 45. Therefore, it is rejected for the same rationale.
Claim 59 recites elements similar to claim 46. Therefore, it is rejected for the same rationale.
Claim 60 recites elements similar to claim 47. Therefore, it is rejected for the same rationale.
Examiners Note
Applicant is further reminded of that the cited paragraphs and in the references as applied to the claims above for the convenience of the applicant(s) and although the specified citations are representative of the teachings of the art and are applied to the specific limitations within the individual claim, other passages and figures may apply as well. It is respectfully requested from the applicant in preparing responses, to fully consider all of the references in entirety as potentially teaching all or part of the claimed invention, as well as the context of the passage as taught by the prior art or disclosed by the examiner.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Andrus et al. (US 2021/0365389 A1) teaches executive space agnostic device drivers.
Klee et al. (US 11,029,968 B1) teaches operating system with a single kernel stack per processor.
Frolikov (US 2019/0303223 A1) teaches grouping requests to reduce inter-process communication in memory systems.
Lari et al. (US 2007/0094674 A1) teaches method for making inter-process procedure calls through shared memory.
Authorization for Internet Communication
Applicant is encouraged to submit an authorization to communicate with the Examiner via the internet by making the following statement (MPEP 502.03)
“Recognizing that internet communications are not secure, I hereby authorize the USPTO to communicate with the undersigned and practitioners in accordance with 37 CFR 1.33 and 37 CFR 1.34 concerning any subject matter of this application by video conferencing, instant messaging, or electronic mail. I understand that a copy of these communications will be made of record in the application file.”
Please note that the above statement can only by submitted via Central Fax (not Examiner’s Fax), Regular postal mail, or EFS Web using PTO/SB/439.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ABU ZAR GHAFFARI whose telephone number is (571)270-3799. The examiner can normally be reached on Monday-Thursday 9:00 - 17:00 Hrs.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Aimee Lee can be reached on 571-272-4169. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ABU ZAR GHAFFARI/ Primary Examiner, Art Unit 2195
Prosecution Insights