DETAILED ACTION
This office action is in response to the application filed on 8/2/2024. Claim(s) 1-18 is/are pending and are examined.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Priority/Benefit
Applicant’s priority claim is hereby acknowledged of 371 of PCT/JP2022/012543 03/18/2022, which papers have been placed of record in the file.
Information Disclosure Statement PTO-1449
The Information Disclosure Statement(s) submitted by applicant on 8/2/2024 has/have been considered. The submission is in compliance with the provisions of 37 CFR § 1.97. Form PTO-1449 signed and attached hereto.
Examiner’s Note – Allowable Subject Matter
Claims 3-5 overcome the prior art and would otherwise be allowable if incorporated into the base claim along with any intervening claims. Further, the claims must overcome the 35 USC 101 rejection below.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claim(s) 1-18 is/are rejected under 35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter. The claim(s) does/do not fall within at least one of the four categories of patent eligible subject matter because the claimed invention is directed to a judicial exception (i.e., a law of nature, a natural phenomenon, or an abstract idea) without significantly more.
The analysis is guided by the Supreme Court's two-step framework, described in Mayo and Alice (Alice Corp. Pty Ltd. v. CLS Bank Int’l, 134 S. Ct. 2347, 2354 (2014) and Mayo Collaborative Servs. V. Prometheus Labs., Inc., 132 S. Ct. 1289, 1296-97 (2012)).Step 1: Is/Are the claim(s) directed to a process, machine, manufacture, or composition of matter?Answer: Yes.Step 2A Prong 1: Is/Are the claim(s) directed to a law of nature, a natural phenomenon, or an abstract idea, i.e., judicially recognized exceptions (both individually and as an ordered combination)?
Answer: Yes, the claim(s) 1 is directed to the mental process of “plan a measure against an attack used in an attack route by using a measure candidate table containing a plurality of measures that can be introduced against attacks and a plurality of indices indicating effects of respective measures, and a measure compatibility table containing a combination of measures in which two or more of measures are combined with each other and an index indicating an effect of the combination; and calculate based on an index indicating an effect of a measure included in the planned measure and an index indicating an effect of a combination of measures included in the planned measure, a risk value of the attack route under an assumption that the planned measure is introduced into the system to be analyzed” beyond the scope of § 101. Dependent claims 2-10 expand on the identified abstract idea.
A similar analysis applies to independent claims 11, 15, 16, 17 and 18 as well as their rejected dependent claims. The identified abstract ideas are wholly directed to the measurement and calculating process for attack risk.
Step 2A Prong 2: Is/Are the claim(s) implemented into a practical application?
Answer: No, the limitations of the claim as drafted, is a process that, under its broadest reasonable interpretation, covers implementation of the mathematical concepts which can be performed by the mind using pencil and paper but for the recitation of generic computer components (i.e., “processor”, “memory”, “display” and a “non-transitory computer readable medium”). The claims recite extra solution activity including the ingestion of data and displaying of mental process results by a generic computer. This judicial exception is not integrated into a practical application. Extra solution activity of ingesting and outputting data on a generic computer amounts no more than mere instructions to apply the exception using a generic computer component. Accordingly, these additional elements do not integrate the abstract idea into a practical application because it does not impose any meaningful limits on practicing the abstract idea. Therefore, the claim is directed to an abstract idea.Step 2B: Does/Do the claim(s) recite additional elements that when analyzed individually and in ordered combinations amount to significantly more than the judicial exception(s)?
Answer: No, the claim(s) (both individually and as an ordered combinations) does/do not transform the nature of the claim(s) into a patent-eligible application of the abstract idea (i.e., significantly more than the abstract idea implemented using generic computer components). The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional elements to perform the processing steps amounts to no more than mere instructions to apply the exception using a generic computer component. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept. Therefore, claims are not patent eligible. If supported by the specification, the simplest way to overcome the rejection would be to add the implementation of a mitigation measure in any way supported by the specification and the knowledge of one of ordinary skill in the art.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112 (b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
Claim(s) 11-14 is/are rejected under 35 U.S.C. 112 (b), as being indefinite for failing to particularly point out and distinctly claim the subject matter which applicant regards as the invention.
Regarding claim(s) 11, the phrase “the at least one processor” makes the claims indefinite and unclear in that it lacks antecedent basis.
Dependent claim(s) 12-14 is/are rejected for the reasons presented above with respect to rejected claim(s) 11 in view of their dependence thereon.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-2, 6, 8-9, 11-13, and 15-18 is/are rejected under 35 U.S.C. 103 as being unpatentable over Scheideler (US 2022/0131889 A1), in view of King-Wilson (US 2024/0348641 A1).
Regarding claims 1, 15 and 17, Scheideler teaches:
“An information processing apparatus comprising: at least one memory storing instructions (Scheideler, ¶ 116 teaches memory); and at least one processor (Scheideler, ¶ 116 teaches processor. Scheideler, ¶ 122-123 teaches medium storing method steps) configured to execute the instructions to : acquire a result of a risk analysis on a system to be analyzed, including an attack route (Scheideler, ¶ 22, 75, 79-81 and 88-89 teaches evaluating the cyber risk of a system from activity information and intelligence feeds to determine a risk to the system based on attack chains); plan a measure against an attack used in an attack route by using a measure candidate table containing a plurality of measures that can be introduced against attacks and a plurality of indices indicating effects of respective measures (Scheideler, Table 2, ¶ 75-76, 89-97 and 101-102 teaches determining the multiple mitigations and the value of effectiveness), and a measure compatibility table containing a combination of measures in which two or more of measures are combined with each other and an index indicating an effect of the combination (Scheideler, Table 3, ¶ 75-76, 89-97 and 103-105 teaches determining the combination of multiple mitigations and the value of effectiveness to stop various attack chains in combination); and calculate based on an index indicating an effect of a measure included in the planned measure and an index indicating an effect of a combination of measures included in the planned measure, a value of the attack route under an assumption that the planned measure is introduced into the system to be analyzed (Scheideler, Table 3 ¶ 75-76, 89-97 and 101-105 teaches determining the combination of multiple mitigations in their value of effectiveness to stop various attack chains)”.
Scheideler does not, but in related art, King-Wilson Fig. 10 ¶ 212-215 teaches the risk value reduction based on using the mitigation. King-Wilson, ¶ 23, 83, and 204 teaches displaying the results of the risk analysis.
Before applicant’s earliest effective filing it would have been obvious to one of ordinary skill in the art, having the teachings of Scheideler and King-Wilson, to modify the risk analysis of Scheideler to include the risk measurement value and display system of King-Wilson. The motivation to do so constitutes applying a known technique to known devices and/or methods ready for improvement to yield predictable results.
Regarding claim 2, Scheideler in view of King-Wilson teaches:
“The information processing apparatus according to claim 1 (Scheideler in view of King-Wilson teaches the limitations of the parent claims as discussed above), wherein the at least one processor is configured to execute the instructions to select a first measure based on an index indicating an effect of a measure contained in the measure candidate table (Scheideler, Table 3 ¶ 75-76, 89-97 and 101-105 teaches selecting mitigations based on the cost/value comparison and its combinatorial effect of multiple attack chains), and select second and subsequent measures based on at least one of an effect of a measure contained in the measure candidate table and an effect of a combination of measures contained in the measure compatibility table (Scheideler, Table 3 ¶ 75-76, 89-97 and 101-105 teaches selecting mitigations based on the cost/value comparison and its combinatorial effect of multiple attack chains)”.
Regarding claim 6, Scheideler in view of King-Wilson teaches:
“The information processing apparatus according to claim 1 (Scheideler in view of King-Wilson teaches the limitations of the parent claims as discussed above) wherein the index indicating the effect of the combination is set according to an effect of the combination of measures and a cost of implementation thereof (Scheideler, Table 3, ¶ 75-76, 89-97 and 103-105 teaches determining the combination of multiple mitigations, the value of effectiveness to stop various attack chains in combination and their respective costs)”.
Regarding claim 8, Scheideler in view of King-Wilson teaches:
“The information processing apparatus according to claim 1 (Scheideler in view of King-Wilson teaches the limitations of the parent claims as discussed above) wherein the at least one processor is configured to execute the instructions to calculate, for each attack route, an effect of the planned measure under an assumption that the planned measure is introduced into the system to be analyzed (Scheideler, Table 3, ¶ 75-76, 89-97 and 103-105 teaches determining the combination of multiple mitigations and the value of effectiveness to stop various attack chains in combination) and display the calculated effect of the measure in association with a risk value of the attack route (King-Wilson, ¶ 23, 83, and 204 teaches displaying the results of the risk analysis)”.
Regarding claim 9, Scheideler in view of King-Wilson teaches:
“The information processing apparatus according to claim 8 (Scheideler in view of King-Wilson teaches the limitations of the parent claims as discussed above), wherein the at least one processor is configured to execute the instructions to calculate, as the effect of the measures, a sum total of an index indicating the effect of the measure included in the planned measures and an index indicating the effect of the combination included in the planned measures (Scheideler, Table 3, ¶ 75-76, 89-97 and 103-105 teaches determining the combination of multiple mitigations and the value of effectiveness to stop various attack chains in combination), or a sum total of the measures included in the planned measures (Scheideler, Table 3, ¶ 75-76, 89-97 and 103-105 teaches determining the combination of multiple mitigations and the value of effectiveness to stop various attack chains in combination)”.
Regarding claims 11, 16, and 18, Scheideler teaches:
“An information processing apparatus comprising: at least one memory storing instructions (Scheideler, ¶ 116 teaches memory); and the at least one processor configured to execute the instructions to calculate, for each of attack routes included in a result of a risk analysis on a system to be analyzed, an effect of a planned measure under an assumption that the planned measure is introduced into the system to be analyzed (Scheideler, Table 2, ¶ 75-76, 89-97 and 101-102 teaches determining the multiple mitigations and the value of effectiveness. Scheideler, Table 3, ¶ 75-76, 89-97 and 103-105 teaches determining the combination of multiple mitigations and the value of effectiveness to stop various attack chains in combination); and
calculated effect of the measure in association with a risk value of the attack route (Scheideler, Table 3 ¶ 75-76, 89-97 and 101-105 teaches determining the combination of multiple mitigations in their value of effectiveness to stop various attack chains)”.
Scheideler does not, but in related art, King-Wilson teaches:
“display the calculated effect of the measure in association with a risk value (Fig. 10 ¶ 212-215 teaches the risk value reduction based on using the mitigation. King-Wilson, ¶ 23, 83, and 204 teaches displaying the results of the risk analysis)”.
Before applicant’s earliest effective filing it would have been obvious to one of ordinary skill in the art, having the teachings of Scheideler and King-Wilson, to modify the risk analysis of Scheideler to include displaying the risk measurement value of King-Wilson. The motivation to do so constitutes applying a known technique to known devices and/or methods ready for improvement to yield predictable results.
Regarding claim 12, Scheideler in view of King-Wilson teaches:
“The information processing apparatus according to claim 11 (Scheideler in view of King-Wilson teaches the limitations of the parent claims as discussed above), wherein the at least one processor is configured to execute the instructions to calculate, as the effect of the measures, a sum total of an index indicating an effect of the measure included in the planned measures contained in a measure candidate table containing a plurality of measures that can be introduced against an attack and indices indicating effects of respective measures (Scheideler, Table 3 ¶ 75-76, 89-97 and 101-105 teaches determining the combination of multiple mitigations in their value of effectiveness to stop various attack chains), and an index indicating an effect of a combination of two or more measures of the plurality of measures included in the planned measures contained in a measure compatible table containing combinations of two or more of measures of the plurality of measures and indices indicating effects of respective combinations of measures (Scheideler, Table 3, ¶ 75-76, 89-97 and 103-105 teaches determining the combination of multiple mitigations and the value of effectiveness to stop various attack chains in combination)”.
Regarding claim 13, Scheideler in view of King-Wilson teaches:
“The information processing apparatus according to claim 11 (Scheideler in view of King-Wilson teaches the limitations of the parent claims as discussed above), wherein the at least one processor is configured to execute the instructions to calculate a sum total of the measures included in the planned measures as the effect of the measures (Scheideler, Table 3, ¶ 75-76, 89-97 and 103-105 teaches determining the combination of multiple mitigations and the value of effectiveness to stop various attack chains in combination)”.
Claim(s) 7 is/are rejected under 35 U.S.C. 103 as being unpatentable over Scheideler in view of King-Wilson in view of Hanna (US 2014/0270404 A1).
Regarding claim 7, Scheideler in view of King-Wilson teaches:
“The information processing apparatus according to claim 1 (Scheideler in view of King-Wilson teaches the limitations of the parent claims as discussed above) wherein the at least one processor is configured to execute the instructions to add a measure (King-Wilson, Fig. 10 ¶ 213 teaches adding measures decreasing the risk)”.
Scheideler in view of King-Wilson does not, but in related art, Hanna teaches:
“until the calculated risk value decreases beyond a predetermined criterion (Hanna, ¶ 111 teaches adding mitigation factors until the risk drops below a given threshold)”.
Before applicant’s earliest effective filing it would have been obvious to one of ordinary skill in the art, having the teachings of Scheideler, Hanna and King-Wilson, to modify the risk analysis of Scheideler and King-Wilson to include reducing the risk with mitigation factors until a threshold is achevied. The motivation to do so constitutes applying a known technique to known devices and/or methods ready for improvement to yield predictable results.
Claim(s) 10 and 14 is/are rejected under 35 U.S.C. 103 as being unpatentable over Scheideler in view of King-Wilson in view of Haruki (US 2023/0274005 A1).
Regarding claim 10, Scheideler in view of King-Wilson teaches:
“The information processing apparatus according to claim 8 (Scheideler in view of King-Wilson teaches the limitations of the parent claims as discussed above)”.
Scheideler in view of King-Wilson does not, but in related art, Haruki teaches:
“wherein the at least one processor is configured to execute the instructions to divide the effect of the measures into a plurality of sections and display, for each of the sections of the effect of the measures, the number of attack routes corresponding to that section and the risk value (Haruki, Figs. 7, 12, 13B ¶ 169, 187, 223, and 245 teaches a display system which depicts the risk value and the attack paths for a given countermeasure)”.
Before applicant’s earliest effective filing it would have been obvious to one of ordinary skill in the art, having the teachings of Scheideler, Haruki and King-Wilson, to modify the risk analysis of Scheideler and King-Wilson to include displaying the risk measurement and attack path information as shown in Haruki. The motivation to do so constitutes applying a known technique to known devices and/or methods ready for improvement to yield predictable results.
Regarding claim 14, Scheideler in view of King-Wilson teaches:
“The information processing apparatus according to claim 11 (Scheideler in view of King-Wilson teaches the limitations of the parent claims as discussed above)”.
Scheideler in view of King-Wilson does not, but in related art, Haruki teaches:
“wherein the at least one processor is configured to execute the instructions to divide the effect of the measures into a plurality of sections and display, for each of the sections of the effect of the measures, the number of attack routes corresponding to that section and the risk value (Haruki, Figs. 7, 12, 13B ¶ 169, 187, 223, and 245 teaches a display system which depicts the risk value and the attack paths for a given countermeasure)”.
Before applicant’s earliest effective filing it would have been obvious to one of ordinary skill in the art, having the teachings of Scheideler, Haruki and King-Wilson, to modify the risk analysis of Scheideler and King-Wilson to include displaying the risk measurement and attack path information as shown in Haruki. The motivation to do so constitutes applying a known technique to known devices and/or methods ready for improvement to yield predictable results.
Conclusion
In the case of amending the claimed invention, Applicant is respectfully requested to indicate the portion(s) of the specification which dictate(s) the structure relied on for proper interpretation and also to verify and ascertain the metes and bounds of the claimed invention.
The prior art made of record and not relied upon is considered pertinent to applicant’s disclosure: See PTO-892.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Stephen T Gundry whose telephone number is (571) 270-0507. The examiner can normally be reached Monday-Friday 9AM-5PM (EST).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Joseph Hirl can be reached on (571) 272-3685. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/STEPHEN T GUNDRY/Primary Examiner, Art Unit 2435