DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
1. This action is in response to the communication filed on June 25, 2024. Claims 1-10 were originally received for consideration. No preliminary amendments have been received.
2. Claims 1-10 are currently pending consideration.
Claim Interpretation
The following is a quotation of 35 U.S.C. 112(f):
(f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph:
An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
3. This application includes one or more claim limitations that do not use the word “means,” but are nonetheless being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because the claim limitation(s) uses a generic placeholder that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. Such claim limitation(s) is/are: “environment scanning unit”, “algorithm evaluation unit”, a risk evaluation unit, judgment module in claim 1, a “comparison module” in claim 8, “an environment scanning unit and “risk evaluation unit” in claim 9, and an “algorithm regrouping unit”, and “comparison unit” in claim 10.
Because this/these claim limitation(s) is/are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, it/they is/are being interpreted to cover the corresponding structure described in the specification as performing the claimed function, and equivalents thereof.
If applicant does not intend to have this/these limitation(s) interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, applicant may: (1) amend the claim limitation(s) to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph (e.g., by reciting sufficient structure to perform the claimed function); or (2) present a sufficient showing that the claim limitation(s) recite(s) sufficient structure to perform the claimed function so as to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
4. Claims 1-10 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
5. Claim limitation ““environment scanning unit”, “algorithm evaluation unit”, a risk evaluation unit, judgment module in claim 1, a “comparison module” in claim 8, and “risk evaluation unit” in claim 9, and an “algorithm regrouping unit”, and “comparison unit” in claim 10 invokes 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. However, the written description fails to disclose the corresponding structure, material, or acts for performing the entire claimed function and to clearly link the structure, material, or acts to the function. There is no proper linkage between the claim limitations delineated above and a sufficient structure. The scanning and evaluation units have no structure defined but merely list their functions or merely list more nested units. For example, the risk evaluation unit comprises a judgment module which is defined as algorithms and also provides no structure. The environmental scanning unit is defined as a monitor or an execution program, but this does not provide sufficient structure. The algorithm evaluation unit is provided with a joint continuous density function but does not provide any structure. Therefore, the claim is indefinite and is rejected under 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph.
Applicant may:
(a) Amend the claim so that the claim limitation will no longer be interpreted as a limitation under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph;
(b) Amend the written description of the specification such that it expressly recites what structure, material, or acts perform the entire claimed function, without introducing any new matter (35 U.S.C. 132(a)); or
(c) Amend the written description of the specification such that it clearly links the structure, material, or acts disclosed therein to the function recited in the claim, without introducing any new matter (35 U.S.C. 132(a)).
If applicant is of the opinion that the written description of the specification already implicitly or inherently discloses the corresponding structure, material, or acts and clearly links them to the function so that one of ordinary skill in the art would recognize what structure, material, or acts perform the claimed function, applicant should clarify the record by either:
(a) Amending the written description of the specification such that it expressly recites the corresponding structure, material, or acts for performing the claimed function and clearly links or associates the structure, material, or acts to the claimed function, without introducing any new matter (35 U.S.C. 132(a)); or
(b) Stating on the record what the corresponding structure, material, or acts, which are implicitly or inherently set forth in the written description of the specification, perform the claimed function. For more information, see 37 CFR 1.75(d) and MPEP §§ 608.01(o) and 2181.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
5. Claim(s) 1, and 3-9 is/are rejected under 35 U.S.C. 103 as being unpatentable over Lu et al. (U.S. Patent 12,306,738) in view of Chiarelli et al. (U.S. Patent Pub. No. Us 2021/0312058) further in view of Jalisatgi et al. (U.S. Patent Pub. No. US 2015/0271145) in further in view of Hampapur et al. (U.S. Patent Pub. No. US 2016/0210183).
Regarding claim 1, Lu discloses:
A security algorithm selection system comprising:
an electronic device comprising at least one runtime environment information (Fig. 8 and associate text; Fig. 10 and associated text, column 3, lines 3-20: a snapshot of the runtime environment is sent to the ML model);
an environment scanning unit used for scanning the electronic device and obtaining the runtime environment information (Fig. 8 and associate text; Fig. 10 and associated text, column 3, lines 3-20: a snapshot of the runtime environment is sent to the ML model).
Lu does not explicitly disclose a security algorithm database comprising a security algorithm and a security algorithm information, an algorithm evaluation unit equipped with at least one joint continuous density function, the algorithm evaluation unit receiving the runtime environment information from the environment scanning unit, receiving the security algorithm from the security algorithm database, and then using the joint continuous density function to operate the runtime environment information and the security algorithm to generate a first security algorithm information, a security algorithm instance database comprising at least one implementation security algorithm and an implementation security algorithm information, an instance risk database comprising at least one corresponding risk datum, the corresponding risk data being corresponding risk data of various instances of the security algorithm and the implementation security algorithm or a risk evaluation unit having at least one judgment module, the risk evaluation unit obtaining the first security algorithm information from the algorithm evaluation unit, obtaining the at least one corresponding risk datum from the instance risk database, generating at least one second security algorithm information through calculation by the judgment module, and then transmitting the second security algorithm information to the electronic device.
In an analogous art, Chiarelli discloses a vulnerability score determination system (paragraph 0029-0031) which comprises a risk score generating engine, a mitigation factor determination engine, a score processing engine, and a machine learning engine (paragraph 0030). The vulnerability score determination system communicates with external databases such as the CFSS, NVD, open source vulnerability database, and cybersecurity frameworks provided by NIST (paragraph 0074). This is analogous to the security algorithm database of the claims. These databases comprise vulnerabilities (e.g., corresponding risks) and allow the system to request information about vulnerabilities and risks in order to generate risk information (second security algorithm information) which is then sent to the requesting device. Furthermore, Chiarelli discloses using the machine learning model to update temporal scores (e.g., predicted post-revision version scores) from the pre-revision version scores (paragraph 0044). This is analogous to a joint continuous density function as it calculates probabilities. It would have been obvious to use the machine learning model and scoring system of Chiarelli in the system of Lu in order to provide access to a collection of vulnerabilities to allow an aggregated risk score for an organization (runtime environment) (Chiarelli: see Abstract).
The combination of Lu and Chiarelli does not explicitly disclose the selection of a security algorithm from a security algorithm instance database and transmitting the second security algorithm information to the electronic device. In an analogous art, Jalisatgi discloses a method of selecting a cipher from a suite (database) of ciphers (paragraphs 0022-0023, 0044) based on a set of predetermined data/thresholds (analogous to runtime information of Lu) (paragraphs 0044, 0048-0051). Jalisatgi further discloses that the selection module may select the cipher based on measured risk factor (paragraphs 0051-0053). It would have been obvious to one of ordinary skill in the art to use the selection module of Jalisatgi in the system of Lu and Chiarelli to allow a more efficient selection method of selecting ciphers which takes into consideration processing load and risk factors (Jalisatgi: paragraph 0010).
The combination of Lu, Chiarelli and Jalisatgi discloses using a machine learning model to update temporal scores by using probabilities (Chiarelli: paragraph 0044) which is analogous to a joint continuous density function (probability model) but there is no explicit mention of a joint continuous density function. In an analogous art, Hampapur discloses using a joint probability density function which calculates and predicts the risk of failure (paragraph 0039). It would have been obvious to one of ordinary skill in the art to use the joint probability density function of Hampapur in order to recalculate the risk of failure based on updated parameters (paragraph 0039).
Claim 3 is rejected as applied above in rejecting claim 1. Furthermore, Hampapur discloses:
The security algorithm selection system as claimed in claim 1, wherein the joint continuous density function can be either a probability model or an analytic function or a combination thereof corresponding to a latent space (paragraph 0039: joint probability density function).
Claim 4 is rejected as applied above in rejecting claim 1. Furthermore, Chiarelli discloses:
The security algorithm selection system as claimed in claim 1, wherein the first security algorithm information and the second security algorithm information comprise one of an equation, execution steps, effectiveness consumption, effectiveness requirements, implicit risks, exception detection, exception handling, or a combination thereof, which can be transformed into at least one instruction set based on information contained therein (paragraph 0029-0031, 0042: equations and ratings for calculating scores).
Claim 5 is rejected as applied above in rejecting claim 1. Furthermore, Chiarelli discloses:
The security algorithm selection system as claimed in claim 1, wherein the joint continuous density function is generated by using a retrospective database with at least one learning algorithm, the retrospective database comprises either at least one set of multi-dimensional information or an expected output of the learning algorithm, or a combination thereof (paragraph 0044: discloses using the machine learning model to update temporal scores (e.g., predicted post-revision version scores) from the pre-revision version scores).
Claim 6 is rejected as applied above in rejecting claim 5. Furthermore, Chiarelli discloses:
The security algorithm selection system as claimed in claim 5, wherein one of the security algorithm database, the retrospective database, the instance risk database, the security algorithm instance database, or a combination thereof is updated automatically or manually based on a joint continuous density function trained by a learning algorithm (paragraph 0044: the machine learning model is configured to learn the factors that have been updated).
Claim 7 is rejected as applied above in rejecting claim 1. Furthermore, Chiarelli discloses:
The security algorithm selection system as claimed in claim 1, wherein further comprising a storage unit (paragraph 0076: enterprise storage platform), the storage unit stores at least one runtime log information, the runtime log information comprises one or a combination of the runtime environment information, the security algorithm, the security algorithm information, the first security algorithm information, the implementation security algorithm, the implementation security algorithm information, the corresponding risk datum, the second security algorithm information, the instruction set (paragraphs 0074-0082: the system stores data, such as scoring systems, algorithms, metrics, and formulas, mitigation factor analysis, vulnerability systems, application data, etc.).
Claim 8 is rejected as applied above in rejecting claim 1. Furthermore, Chiarelli discloses:
The security algorithm selection system as claimed in claim 1, wherein the environment scanning unit further comprises a comparison module, when the environment scanning unit obtains the runtime environment information, the comparison module compares the runtime log information with the runtime environment information, if the runtime log information has historical runtime environment information corresponding to the runtime environment information, then the corresponding second security algorithm information or the instruction set is directly obtained from the runtime log information, and then the corresponding second security algorithm information or the instruction set is sent to electronic device (paragraphs 0070-0073: migration factor analysis system determines for each vulnerability one or more mitigations against the vulnerabilities, and a risk factor can vary based on the mitigation factor applied).
Regarding claim 9, Lu discloses:
A security algorithm selection method comprising following steps:
S1: using an environment scanning unit to scan an electronic device and obtaining a runtime environment information of at least one electronic device (Fig. 8 and associate text; Fig. 10 and associated text, column 3, lines 3-20: a snapshot of the runtime environment is sent to the ML model).
Lu does not explicitly disclose S2: inputting the runtime environment information, at least one security algorithm, and at least one security algorithm information into an algorithm evaluation unit, and generating at least one first security algorithm information through operation of the algorithm evaluation unit, S3: inputting the first security algorithm information, at least one implementation security algorithm, at least one implementation security algorithm information and at least one corresponding risk datum into a risk evaluation unit, and generating at least one second security algorithm information through operation of the risk evaluation unit and S4: transmitting the second security algorithm information to the electronic device. In an analogous art, Chiarelli discloses a vulnerability score determination system (paragraph 0029-0031) which comprises a risk score generating engine, a mitigation factor determination engine, a score processing engine, and a machine learning engine (paragraph 0030). The vulnerability score determination system communicates with external databases such as the CFSS, NVD, open source vulnerability database, and cybersecurity frameworks provided by NIST (paragraph 0074). This is analogous to the security algorithm database of the claims. These databases comprise vulnerabilities (e.g., corresponding risks) and allow the system to request information about vulnerabilities and risks in order to generate risk information (second security algorithm information) which is then sent to the requesting device. Furthermore, Chiarelli discloses using the machine learning model to update temporal scores (e.g., predicted post-revision version scores) from the pre-revision version scores (paragraph 0044). This is analogous to a joint continuous density function as it calculates probabilities. It would have been obvious to use the machine learning model and scoring system of Chiarelli in the system of Lu in order to provide access to a collection of vulnerabilities to allow an aggregated risk score for an organization (runtime environment) (Chiarelli: see Abstract).
The combination of Lu and Chiarelli does not explicitly disclose the selection of a security algorithm from a security algorithm instance database and transmitting the second security algorithm information to the electronic device. In an analogous art, Jalisatgi discloses a method of selecting a cipher from a suite (database) of ciphers (paragraphs 0022-0023, 0044) based on a set of predetermined data/thresholds (analogous to runtime information of Lu) (paragraphs 0044, 0048-0051). Jalisatgi further discloses that the selection module may select the cipher based on measured risk factor (paragraphs 0051-0053). It would have been obvious to one of ordinary skill in the art to use the selection module of Jalisatgi in the system of Lu and Chiarelli to allow a more efficient selection method of selecting ciphers which takes into consideration processing load and risk factors (Jalisatgi: paragraph 0010).
The combination of Lu, Chiarelli and Jalisatgi discloses using a machine learning model to update temporal scores by using probabilities (Chiarelli: paragraph 0044) which is analogous to a joint continuous density function (probability model) but there is no explicit mention of a joint continuous density function. In an analogous art, Hampapur discloses using a joint probability density function which calculates and predicts the risk of failure (paragraph 0039). It would have been obvious to one of ordinary skill in the art to use the joint probability density function of Hampapur in order to recalculate the risk of failure based on updated parameters (paragraph 0039).
6. Claim(s) 2 and 10 is/are rejected under 35 U.S.C. 103 as being unpatentable over Lu et al. (U.S. Patent 12,306,738) in view of Chiarelli et al. (U.S. Patent Pub. No. Us 2021/0312058) further in view of Jalisatgi et al. (U.S. Patent Pub. No. US 2015/0271145) in further in view of Hampapur et al. (U.S. Patent Pub. No. US 2016/0210183) in further in view of Bracken (U.S. Patent Pub. No. 2024/0031408).
Claim 2 is rejected as applied above in rejecting claim 1. Furthermore, the combination of Lu, Chiarelli, Jalisatgi and Hampapur does not explicitly disclose an algorithm regrouping unit for obtaining the second security algorithm information from the risk evaluation unit, screening the second security algorithm information, and then regrouping the screened second security algorithm information to generate at least one instruction set, and transmitting the instruction set to the electronic device. In an analogous art, Bracken discloses editing the client cipher site list (paragraph 0150) in the hello message before sending it to the electronic device (paragraphs 0151-0153). It would have been obvious to allow the editing and reordering of the algorithms so that the keep the cipher suite updated with algorithms with the algorithms which are required (Bracken: paragraph 0151).
Claim 10 is rejected as applied above in rejecting claim 9. Furthermore, Chiarelli discloses:
The security algorithm selection method as claimed in claim 9, wherein after step S3 of generating at least one second security algorithm information through operation of the risk evaluation unit, further comprising:
S7: using one of the runtime environment information, the security algorithm, the security algorithm information, the first security algorithm information, the implementation security algorithm, the implementation security algorithm information, the corresponding risk datum, the second security algorithm information, the instruction set or a combination thereof to generate a runtime log information and storing the runtime log information in a storage unit (paragraphs 0074-0082: the system stores data, such as scoring systems, algorithms, metrics, and formulas, mitigation factor analysis, vulnerability systems, application data, etc.); and
S8: a comparison unit obtaining the runtime environment information, comparing the runtime log information with the runtime environment information, and then outputting the second security algorithm information or the instruction set to the electronic device (paragraphs 0070-0073: migration factor analysis system determines for each vulnerability one or more mitigations against the vulnerabilities, and a risk factor can vary based on the mitigation factor applied).
Furthermore, the combination of Lu, Chiarelli, Jalisatgi and Hampapur does not explicitly disclose an algorithm regrouping unit regrouping the second security algorithm information to generate at least one instruction set and the algorithm regrouping unit transmitting the instruction set to the electronic device. In an analogous art, Bracken discloses editing the client cipher site list (paragraph 0150) in the hello message before sending it to the electronic device (paragraphs 0151-0153). It would have been obvious to allow the editing and reordering of the algorithms so that the keep the cipher suite updated with algorithms with the algorithms which are required (Bracken: paragraph 0151).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to KAVEH ABRISHAMKAR whose telephone number is (571)272-3786. The examiner can normally be reached M-F 9-5:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jung Kim can be reached at 571-272-3804. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/KAVEH ABRISHAMKAR/
01/14/2026Primary Examiner, Art Unit 2494