DETAILED ACTION
Examiner acknowledges receipt of Applicant’s amendment filed on 04/04/2026
Claims 1, 4, 6-7, 9-10, 12-13, 16-19, 21, and 23 are currently amended
Claims 2-3, and 14-15 have been cancelled
Claims 1, 4-13, and 16-23 are pending
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendment
Examiner has fully considered Applicant’s amendments to the Claims in the arguments filed on 04/04/2026. Claims 1, 4-13, and 16-23 remain pending in the application. Examiner has withdrawn the claim objections in view of the amendments. However, additional claim objections arise in view of the amendments.
Response to Arguments
Applicant’s arguments filed 05/05/2026, with respect to the rejections of independent claims 1 and 13 and their corresponding dependent claims under 35 USC 103 have been fully considered and are persuasive. Therefore, the rejections have been withdrawn. However, upon further consideration, new grounds of rejection are made in view of the previously applied combination of Littlejohn and Ziv, in addition to a newly applied reference from Nagatsuka (JP 2008234071 A), hereinafter Nagatsuka. Examiner respectfully submits that Nagatsuka, in combination with the previously applied references, is sufficient to teach the newly added limitations “and in response to the notification: determine whether a window of the user application that is in focus on a new document was opened at a display screen of the user computer”; “determine a current document associated with the window that is in focus”; “compare the current document associated with the window that is in focus to a previously stored document associated with the window that is in focus”; and “and determine that a new document has been opened for viewing by the user in the window based on the current document being different from the previously stored document”.
Claim Objections
Claims 1, 6, and 13 objected to because of the following informalities:
In Claim 1, the limitation “determine whether a window of the user application that is in focus on a display screen of the user computer” could be re-written as: “determine a window of the user application that is in focus on a display screen of the user computer” or the like, for clarity
Claim 13 recites a similar limitation, and is objected to for at least the same reason as Claim 1
In Claim 6, the limitation “the cache memory for the in focused window …” should read: “the cache memory for the focused window …” for clarity and consistency with the antecedent basis for the focused window
Appropriate correction is required.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1, 10, 13, and 17 is/are rejected under 35 U.S.C. 103 as being unpatentable over Littlejohn et al. (US 20140283042 A1), hereinafter Littlejohn, in view of Ziv et al. (WO 2020142654 A1), hereinafter Ziv, and Nagatsuka (JP 2008234071 A), hereinafter Nagatsuka.
Regarding Claim 1:
Littlejohn teaches a computer system for detecting whether a new document has been opened at a user computer on the computer system (Littlejohn – Paragraph [0056]: At the conclusion of the evaluation period, the real-time event evaluator 133 uses policy conditions (configured by the real-time event configuration manager 131) to make decisions on whether any reporting is necessary or whether the activity on the resource can be ignored; and Paragraph [0058]: These policy conditions can include whether a given resource was deleted, created, modified (written to), read, and/or had access/security permissions changed; and Paragraph [0014]: A "resource" includes a user, service, system, device, directory, data store, file system, files, non-volatile data, non-volatile files, groups of users, combinations and/or collections of these things, etc), the computer system comprising: the user computer comprising a processor and memory (Littlejohn – Paragraph [0022]: Also, the techniques presented herein are implemented in (and reside within) machines, such as processor(s) or processor-enabled devices (hardware processors). These machines are configured and programmed to specifically perform the processing of the methods and system presented herein. More particularly, the methods and system components are implemented as one or more software modules that reside or are programmed within: memory and/or a non-transitory computer-readable storage media; the software module(s) are processed on the processors of machines configured to perform the methods); a user application accessible by a human user at the user computer (Littlejohn – Paragraph [0037]: The kernel mode takes care of a variety of low level processes for the OS 120 and applications that execute in the user or application mode. In fact, a user application, which originates at the user mode of the OS 120, may use an API to have the OS 120 execute a number of kernel functions (in the kernel layer 140) to carry out the user application requests); and an agent application hosted by the user computer and configured to: [register to] receive notifications of user interface actions with an operating system (OS) of the user computer (Littlejohn – Paragraph [0038]: The real-time event configuration manager 131 registers as a handler for a class of IRPs; and Paragraph [0039]: The OS kernel layer 140 includes the real-time user event configurer 141. The real-time user event configurer 141 monitors resource actions (that it is configured to recognize) and collects a variety of information related to those actions, such as resource identifiers (this includes the acting resource that initiated activity on another resource (such as a particular user or user thread X reads resource Y (both X and Y are captured in a single event))), action identifiers, time stamps, and the like. When the real-time user event configurer 141 detects an action on a resource, the real-time user event configurer 141 generates event information including the collected information in an event that is raised up from the OS kernel layer 140 and detected by the real-time event queue manager 132; and Paragraph [0040]: The real-time event configuration manager 131 operates in the OS user layer 130 and is used to configure the real-time user event configurer 141 by passing configuration information to the real-time user event configurer 141. The configuration information informs or defines criteria for events that the event notification manager 141 is to trap and report in real time from the OS kernel layer 140 back up to the OS user layer 130); and determine whether a new document was opened at [a display screen of] the user computer by the user interface action (Littlejohn – Paragraphs [0058]-[0064]: This is but one example, the point is coarse grain and fine grain user defined policy conditions can be defined and configured into the real-time event evaluator 133 by the real-time event configuration manager 131. Some further examples of scenarios include the following: 1) is the file (type of resource) named in the consolidated event present in the file system of the processing environment; and 2) is the file named in the consolidated event present in the baseline resources 134? The answers to these initial policy conditions can lead to other policy conditions, such as:
1) if the file is in the file system and in the baseline resources 134, then a change occurred during the evaluation period and the file needs to be compared to its version in the baseline resources 134 to see what was in fact changed or the extend of the changes; 2) if the file is in the file system but not in the baseline resources 134, then a new file was created during the evaluation period, which may or may not necessitate reporting (based on still other policy conditions); Examiner’s Comment: determination that a file has been changed or that a new file was created is interpreted to represent the claimed determining “whether a new document was opened …”).
Littlejohn does not expressly teach register to receive notifications of user interface actions with an operating system; receive a notification from the OS of a user interface action; and in response to the notification: determine whether a window of the user application that is in focus on a display screen of the user computer.
However, Ziv teaches an agent application hosted by the user computer and configured to: register to receive notifications of user interface actions with an operating system (Ziv – P. 6: In a typical implementation, the agent 220 is configured to communicate and interact with the operating system 120 of the computer 110. For example, the agent 220 may register for notifications from the operating system 120 when a specific user related activity is detected by the operating system 120; and P. 18: the systems and techniques disclosed herein can be broadly applied to detecting any one of a variety of user actions at a computer, whether that action is performed through a keyboard-based interaction or through a mouse-based interaction. Moreover, regardless of the type of user action detected, a notification that may include any one of the types of information mentioned herein as possibly accompanying a paste activity notification may be included with a notification of whatever other activity is being noticed. These can include identifying what the non-paste activity was, who did it, on what machine, in what session, in what process(es), when, etc.); receive a notification from the OS of a user interface action (Ziv – P. 6: Upon receipt of a notification from the operating system 120 by the agent 220, the agent 220 may communicate notification data received from the operating system 120 to the monitor application server 210; and P. 13: The screenshot also shows a warning notification for a particular user action. The warning notification identifies, who performed the action (“nirs.mbp\nirbarak”), what was done (“performed paste” at a visited URL for a personal Gmail? account), on which computer (“nirs-mbp 1 10.1.100.133”), from which client (“console (ClientAddress-N/A),” which refers to the local console or laptop), and when (“Thursday 12/20/2018 8: 14AM”). In a typical implementation, all of the information presented about the indicated user action would have come from, or been derived from information provided by, the operating system for the computer where the action occurred; and P. 18: Moreover, regardless of the type of user action detected, a notification that may include any one of the types of information mentioned herein as possibly accompanying a paste activity notification may be included with a notification of whatever other activity is being noticed. These can include identifying what the non-paste activity was, who did it, on what machine, in what session, in what process(es), when, etc.); and in response to the notification: determine whether a window of the user application that is in focus on a display screen of the user computer (Ziv – P. 16: In some such implementations, the agent 220 may be configured to run in a user mode and be triggered when an interactive session is created on a monitored machine (connected via SSH, Telnet, Rlogin, and so on). It records user activity inside the sessions, including interactive user activity and system functions such as OPEN, EXEC, CHMOD and others; and P. 11: If the agent 220 (at 886) receives an indication from the operating system 120 that the user 201 has performed an action (such as right-clicking a mouse) that might open a context menu at the computer110 and that context menu might include a paste option, then the agent 220 (at 888) takes steps to inspect the contents of the context menu to determine if a Paste option is present. There are a variety of ways that the agent 220 might perform this function. According to one implementation, the agent first obtains information about open windows at the computer 110 from the user interface 123 for the computer 110. The user interface 123 for the computer 110 can provide a variety of information about open windows (e.g., 770a - 770d, and the context menu 772, which is its own window) at the computer 110 … The user interface 123 can also identify to the agent 220 which of the open windows (i.e., 770a, 770b,770c, or 770d or context menu 772) is “in focus” {i.e., which of the open windows is the user 201currently accessing or has most recently accessed)).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to modify Littlejohn, further incorporating Ziv to arrive at the conclusion of the claimed invention. One would be motivated to incorporate Ziv’s teaching for an agent to register to receive user activity notifications from an OS regarding a user’s on-screen activity into Littlejohn’s system for detecting new documents on a user computer. This combination would enhance Littlejohn’s system by providing an agent with a stream of specifically requested user activity information for more efficient and focused determination of potentially suspicious user file opens as they relate to an in-focus window on the user display.
The combination of Littlejohn and Ziv does not expressly teach determine a current document associated with the window that is in focus; compare the current document associated with the window that is in focus to a previously stored document associated with the window that is in focus; and determine that a new document has been opened for viewing by the user in the window based on the current document being different from the previously stored document.
However, Nagatsuka teaches determine a current document associated with the window that is in focus (Nagatsuka – P. 8-9: Here, a document information acquisition method will be described using a computer on which Microsoft Windows (registered trademark) is installed as an example. In the window system, a document is displayed in an area called a window, and a plurality of windows can be switched and operated. In the case of Microsoft Windows (registered trademark), there is a technology called automation that enables applications and services to expose internal objects and functions to external applications and services. An application that supports this automation can often obtain a document identifier. Therefore, in this embodiment, the document title and application name are acquired for all documents, and the document identifier is acquired for a document displayed by an application that supports automation … the application information displaying the document is acquired … it is determined whether the application displaying the document is compatible with automation … If it is compatible with automation, a document identifier is acquired according to each application … Next, the document information is updated (step 311). Here, the acquired document information is managed in a format as shown in FIG [8]. Here, not only the document currently being browsed but also the past history is retained. In the document update process, it is determined whether or not the browsed document has been switched. If it has been switched, the information is updated; compare the current document associated with the window that is in focus to a previously stored document associated with the window that is in focus; and determine that a new document has been opened for viewing by the user in the window based on the current document being different from the previously stored document (Nagatsuka – P. 9: In FIG. 8, in document information recording, since a document ID needs to be a unique ID on the network, a globally unique ID such as a UUID (GUID) is used as the ID. The document currently being browsed is a document in which the focus end time is not described (in the example of FIG. 8, a document with UUID 4). If any of the “window handle”, “document title”, or “document identifier” of the acquired document information is different from the information of the currently viewed document being recorded, it is determined that the viewed document has been switched, and the document information is being viewed. The current time is registered as the focus end time of the document information (UUID4), and the new document information (UUID5) is registered based on the acquired information. The current time is registered in the “focus start time” of the new document information. In this case, when there is document information having the same “window handle”, “document title”, and “document identifier” during document information recording, the “document open time” is registered as the “document open time” of the new document information).
Nagatsuka further teaches receive a notification from the OS of a user interface action (Nagatsuka – P. 7: The browsing document information acquisition unit 23 on the client PC 5 side acquires browsing document information by acquiring operation event information on a document performed by the user on the client PC 5. In the present embodiment, it is assumed that an OS having a window system based on a GUI represented by Microsoft Windows (registered trademark) is operating on the client. In this embodiment, “open / close” (open / close document window) and “focus” (front-most document window) are acquired as document operation events to be acquired. In the present embodiment, a user ID, a client identifier, an application name, a document title, a document identifier, an event name, an event start time, and an event end time are acquired as browsing document information.); and in response to the notification: determine whether a window of the user application that is in focus on a display screen of the user computer (Nagatsuka – P. 7-8: The event name is used to identify an event, and in this embodiment, two event names are “open /close” and “focus”. The event start time and event end time are the event start time and end time of “open / close” and “focus” … Then, in the document information acquisition process, information on the document currently being browsed (the window is focused on the foreground) is acquired (step 205). A detailed flowchart of this document information acquisition is shown in FIG. 7, and an example of document information acquisition is shown in FIG [8]).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to modify Littlejohn and Ziv, further incorporating Nagatsuka to arrive at the conclusion of the claimed invention. One would be motivated to incorporate Nagatsuka’s teaching to monitor user activity with respect to focused windows and documents displayed thereon to detect and notify switching of actively displayed documents Littlejohn and Ziv’s system for detecting new documents on a user computer. The additional consideration provides per-user real-time monitoring of document viewing and switching activity.
Regarding Claim 10:
The combination of Littlejohn, Ziv, and Nagatsuka teaches the computer system of claim 1.
Littlejohn further teaches wherein the agent reverts to listening for a subsequent notification from the OS of a subsequent user interface action if the agent determines that the document … on the … user computer when the user interface action notification was generated matches the document stored in the cache memory (Littlejohn – Paragraph [0050]: The evaluation period also allows OS kernel layer 140 activities for a given resource having detected events to stabilize before decisions are made by the real-time event evaluator 133. In an embodiment, each event that identifies a resource for a first time causes the evaluation period for that resource to be initiated. So, the evaluation period can, in one embodiment, be resource specific meaning that there can be multiple independent evaluation periods continually being reset and/or initialized as resources cease to have kernel activity and as resources start to have kernel activity. In an embodiment, the evaluation period is for all registered resource activities for all resources detected during the evaluation period, with the evaluation period being regularly reset each time it lapses to provide continuous monitoring of the processing environment 110; and Paragraph [0051]: Moreover, when a resource is first detected (by a monitored event) as having been accessed at the OS kernel layer 140, the real-time event evaluator 133 ensures that a copy of that resource is populated and securely maintained and persisted (unchanged) in the baseline resources 134 for the duration of the evaluation period; and Paragraph [0063]: 1) if the file is in the file system and in the baseline resources 134, then a change occurred during the evaluation period and the file needs to be compared to its version in the baseline resources 134 to see what was in fact changed or the extend of the changes).
Ziv further teaches the focused window on the display screen of the user computer (Ziv – P. 3: The computer-based method includes obtaining a handle for an in-focus window (e.g., an on-screen context menu) at the computer from a user interface of the computer, and using the handle to request information about the in-focus window from an accessibility application programming interface (API) on the computer).
The motivation to combine the arts is the same as that of Claim 1.
Regarding Claim 13:
Littlejohn teaches a method for an agent application hosted by a user computer of a computer system for detecting whether a new document has been opened via a user application accessible by a human user at the user computer at the user computer (Littlejohn – Paragraph [0056]: At the conclusion of the evaluation period, the real-time event evaluator 133 uses policy conditions (configured by the real-time event configuration manager 131) to make decisions on whether any reporting is necessary or whether the activity on the resource can be ignored; and Paragraph [0058]: These policy conditions can include whether a given resource was deleted, created, modified (written to), read, and/or had access/security permissions changed; and Paragraph [0014]: A "resource" includes a user, service, system, device, directory, data store, file system, files, non-volatile data, non-volatile files, groups of users, combinations and/or collections of these things, etc), comprising the steps of: [registering to] receive notifications of user interface actions with an operating system (OS) of the user computer (Littlejohn – Paragraph [0038]: The real-time event configuration manager 131 registers as a handler for a class of IRPs; and Paragraph [0039]: The OS kernel layer 140 includes the real-time user event configurer 141. The real-time user event configurer 141 monitors resource actions (that it is configured to recognize) and collects a variety of information related to those actions, such as resource identifiers (this includes the acting resource that initiated activity on another resource (such as a particular user or user thread X reads resource Y (both X and Y are captured in a single event))), action identifiers, time stamps, and the like. When the real-time user event configurer 141 detects an action on a resource, the real-time user event configurer 141 generates event information including the collected information in an event that is raised up from the OS kernel layer 140 and detected by the real-time event queue manager 132; and Paragraph [0040]: The real-time event configuration manager 131 operates in the OS user layer 130 and is used to configure the real-time user event configurer 141 by passing configuration information to the real-time user event configurer 141. The configuration information informs or defines criteria for events that the event notification manager 141 is to trap and report in real time from the OS kernel layer 140 back up to the OS user layer 130); and determining whether a new document was opened at [a display screen of] the user computer by the user interface action (Littlejohn – Paragraphs [0058]-[0064]: This is but one example, the point is coarse grain and fine grain user defined policy conditions can be defined and configured into the real-time event evaluator 133 by the real-time event configuration manager 131. Some further examples of scenarios include the following: 1) is the file (type of resource) named in the consolidated event present in the file system of the processing environment; and 2) is the file named in the consolidated event present in the baseline resources 134? The answers to these initial policy conditions can lead to other policy conditions, such as: 1) if the file is in the file system and in the baseline resources 134, then a change occurred during the evaluation period and the file needs to be compared to its version in the baseline resources 134 to see what was in fact changed or the extend of the changes; 2) if the file is in the file system but not in the baseline resources 134, then a new file was created during the evaluation period, which may or may not necessitate reporting (based on still other policy conditions); Examiner’s Comment: determination that a file has been changed or that a new file was created is interpreted to represent the claimed determining “whether a new document was opened …”).
Littlejohn does not expressly teach registering to receive notifications of user interface actions with an operating system; receiving a notification from the OS of a user interface action; and in response to the notification: determine whether a window of the user application that is in focus on a display screen of the user computer.
However, Ziv teaches an agent application hosted by the user computer and configured to: register to receive notifications of user interface actions with an operating system (Ziv – P. 6: In a typical implementation, the agent 220 is configured to communicate and interact with the operating system 120 of the computer 110. For example, the agent 220 may register for notifications from the operating system 120 when a specific user related activity is detected by the operating system 120); receiving a notification from the OS of a user interface action (Ziv – P. 6: Upon receipt of a notification from the operating system 120 by the agent 220, the agent 220 may communicate notification data received from the operating system 120 to the monitor application server 210; and P. 13: The screenshot also shows a warning notification for a particular user action. The warning notification identifies, who performed the action (“nirs.mbp\nirbarak”), what was done (“performed paste” at a visited URL for a personal Gmail? account), on which computer (“nirs-mbp 1 10.1.100.133”), from which client (“console (ClientAddress-N/A),” which refers to the local console or laptop), and when (“Thursday 12/20/2018 8: 14AM”). In a typical implementation, all of the information presented about the indicated user action would have come from, or been derived from information provided by, the operating system for the computer where the action occurred; and P. 18: Moreover, regardless of the type of user action detected, a notification that may include any one of the types of information mentioned herein as possibly accompanying a paste activity notification may be included with a notification of whatever other activity is being noticed. These can include identifying what the non-paste activity was, who did it, on what machine, in what session, in what process(es), when, etc.); and in response to the notification: determine whether a window of the user application that is in focus on a display screen of the user computer (Ziv – P. 16: In some such implementations, the agent 220 may be configured to run in a user mode and be triggered when an interactive session is created on a monitored machine (connected via SSH, Telnet, Rlogin, and so on). It records user activity inside the sessions, including interactive user activity and system functions such as OPEN, EXEC, CHMOD and others; and P. 11: If the agent 220 (at 886) receives an indication from the operating system 120 that the user 201 has performed an action (such as right-clicking a mouse) that might open a context menu at the computer110 and that context menu might include a paste option, then the agent 220 (at 888) takes steps to inspect the contents of the context menu to determine if a Paste option is present. There are a variety of ways that the agent 220 might perform this function. According to one implementation, the agent first obtains information about open windows at the computer 110 from the user interface 123 for the computer 110. The user interface 123 for the computer 110 can provide a variety of information about open windows (e.g., 770a - 770d, and the context menu 772, which is its own window) at the computer 110 … The user interface 123 can also identify to the agent 220 which of the open windows (i.e., 770a, 770b,770c, or 770d or context menu 772) is “in focus” {i.e., which of the open windows is the user 201currently accessing or has most recently accessed)).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to modify Littlejohn, further incorporating Ziv to arrive at the conclusion of the claimed invention. One would be motivated to incorporate Ziv’s teaching for an agent to register to receive user activity notifications from an OS regarding a user’s on-screen activity into Littlejohn’s system for detecting new documents on a user computer. This combination would enhance Littlejohn’s system by providing an agent with a stream of specifically requested user activity information for more efficient and focused determination of potentially suspicious user file opens.
The combination of Littlejohn and Ziv does not expressly teach determine a current document associated with the window that is in focus; compare the current document associated with the window that is in focus to a previously stored document associated with the window that is in focus; and determine that a new document has been opened for viewing by the user in the window based on the current document being different from the previously stored document.
However, Nagatsuka teaches determine a current document associated with the window that is in focus (Nagatsuka – P. 8-9: Here, a document information acquisition method will be described using a computer on which Microsoft Windows (registered trademark) is installed as an example. In the window system, a document is displayed in an area called a window, and a plurality of windows can be switched and operated. In the case of Microsoft Windows (registered trademark), there is a technology called automation that enables applications and services to expose internal objects and functions to external applications and services. An application that supports this automation can often obtain a document identifier. Therefore, in this embodiment, the document title and application name are acquired for all documents, and the document identifier is acquired for a document displayed by an application that supports automation … the application information displaying the document is acquired … it is determined whether the application displaying the document is compatible with automation … If it is compatible with automation, a document identifier is acquired according to each application … Next, the document information is updated (step 311). Here, the acquired document information is managed in a format as shown in FIG [8]. Here, not only the document currently being browsed but also the past history is retained. In the document update process, it is determined whether or not the browsed document has been switched. If it has been switched, the information is updated; compare the current document associated with the window that is in focus to a previously stored document associated with the window that is in focus; and determine that a new document has been opened for viewing by the user in the window based on the current document being different from the previously stored document (Nagatsuka – P. 9: In FIG. 8, in document information recording, since a document ID needs to be a unique ID on the network, a globally unique ID such as a UUID (GUID) is used as the ID. The document currently being browsed is a document in which the focus end time is not described (in the example of FIG. 8, a document with UUID 4). If any of the “window handle”, “document title”, or “document identifier” of the acquired document information is different from the information of the currently viewed document being recorded, it is determined that the viewed document has been switched, and the document information is being viewed. The current time is registered as the focus end time of the document information (UUID4), and the new document information (UUID5) is registered based on the acquired information. The current time is registered in the “focus start time” of the new document information. In this case, when there is document information having the same “window handle”, “document title”, and “document identifier” during document information recording, the “document open time” is registered as the “document open time” of the new document information).
Nagatsuka further teaches receiving a notification from the OS of a user interface action (Nagatsuka – P. 7: The browsing document information acquisition unit 23 on the client PC 5 side acquires browsing document information by acquiring operation event information on a document performed by the user on the client PC 5. In the present embodiment, it is assumed that an OS having a window system based on a GUI represented by Microsoft Windows (registered trademark) is operating on the client. In this embodiment, “open / close” (open / close document window) and “focus” (front-most document window) are acquired as document operation events to be acquired. In the present embodiment, a user ID, a client identifier, an application name, a document title, a document identifier, an event name, an event start time, and an event end time are acquired as browsing document information.); and in response to the notification: determining whether a window of the user application that is in focus on a display screen of the user computer (Nagatsuka – P. 7-8: The event name is used to identify an event, and in this embodiment, two event names are “open /close” and “focus”. The event start time and event end time are the event start time and end time of “open / close” and “focus” … Then, in the document information acquisition process, information on the document currently being browsed (the window is focused on the foreground) is acquired (step 205). A detailed flowchart of this document information acquisition is shown in FIG. 7, and an example of document information acquisition is shown in FIG [8]).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to modify Littlejohn and Ziv, further incorporating Nagatsuka to arrive at the conclusion of the claimed invention. One would be motivated to incorporate Nagatsuka’s teaching to monitor user activity with respect to focused windows and documents displayed thereon to detect and notify switching of actively displayed documents Littlejohn and Ziv’s system for detecting new documents on a user computer. The additional consideration provides per-user real-time monitoring of document viewing and switching activity.
Regarding Claim 17:
Claim 17 is a method claim with limitations corresponding to those of system Claim 10. Therefore, Claim 17 is rejected with the same combination and rationale as that of the rejection of Claim 10.
Claim(s) 4, 5, 11, 12, 16, 22, and 23 is/are rejected under 35 U.S.C. 103 as being unpatentable over Littlejohn, in view of Ziv, Nagatsuka, and Biswas et al. (US 20220174097 A1), hereinafter Biswas.
Regarding Claim 4:
The combination of Littlejohn, Ziv, and Nagatsuka teaches the computer system of claim 1.
Littlejohn further teaches to report on user activities that cause or result in new documents being opened at the user computer (Littlejohn – Paragraph [0047]: In an embodiment, the policies conditions include patterns of activity performed on a given resource that indicate reporting needs to occur; and Paragraph [0056]: At the conclusion of the evaluation period, the real-time event evaluator 133 uses policy conditions (configured by the real-time event configuration manager 131) to make decisions on whether any reporting is necessary or whether the activity on the resource can be ignored; and Paragraph [0058]: the policy conditions can state fine-grain rules, such as if an acting resource belonging to a particular role or group reads a file (type of resource) belong to a particular user-defined classification of files, then report to an administrator (another type of resource) using via email (type of communication for the reporting; and Paragraph [0064]: if the file is in the file system but not in the baseline resources 134, then a new file was created during the evaluation period, which may or may not necessitate reporting).
The combination of Littlejohn, Ziv, and Nagatsuka does not expressly teach further comprising: an admin computer configured to present a user interface at a display screen of the admin computer.
However, Biswas teaches further comprising: an admin computer configured to present a user interface at a display screen of the admin computer (Biswas – Paragraph [0081]: In some examples, the control manager 172 can also maintain security policies for the organization 130. A security policy can define an action or set of actions that, when detected, constitute a security violation or an event that otherwise requires attention … In some examples, a security policy can also define one or more remediation actions to perform when a violation of the policy is detected. A remediation action can include, for example, sending a notification to the user who caused the violation, to network administrators of the organization 130, to administrators of the security management and control system 102, and/or to another entity; and Paragraph [0087]: In various implementations, the security management and control system 102 provides an interface 120 through which customers of the security management and control system 102 can use the services of the security management and control system 102. The interface 120 can provide, for example, a graphical user interface (GUI) that can display a control panel or dashboard that enables the organization's administrative users to configure the services of the security management and control system 102. The graphical user interface can further enable the administrative users to view reports of user activity with respect to the services 112a-112b of the service provider 110. The graphical user interface can further provide reports of security events and suggest remediation actions, and/or report on the outcome of remediation actions that the security management and control system 102 automatically performs).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to modify Littlejohn, Ziv, and Nagatsuka, further incorporating Biswas to arrive at the conclusion of the claimed invention. One would be motivated to incorporate Biswas’s teachings to provide reports on at least user document open activities to an administrator into Littlejohn, Ziv, and Nagatsuka’s system for detecting new documents on a user computer. This additional functionality would enhance the system with actionable alerts regarding suspicious or potentially malicious user activity.
Regarding Claim 5:
The combination of Littlejohn, Ziv, Nagatsuka and Biswas teaches the computer system of claim 4.
Littlejohn further teaches wherein the agent is further configured to cause the system to generate a report … in response to the agent determining that the document … on the … user computer when the user interface action notification was generated does not match the document stored in the cache memory (Littlejohn – Paragraph [0052]: The baseline resources 134 can be used to detect the extent of changes made to resources at the conclusion of the evaluation period. The copy of the resources in the baseline resources 134 are copies of the resources before any volatile operations occurred on those resources, such that at the conclusion of the evaluation period for a given resource, the final version of the given resource can be compared against its baseline version in the baseline resources 134 to provide more meaningful details on the extent of the actual changes beyond just a binary reporting that a change occurred; and Paragraph [0053]: In an embodiment, the baseline resources 134 are housed in cache; and Paragraph [0063]: 1) if the file is in the file system and in the baseline resources 134, then a change occurred during the evaluation period and the file needs to be compared to its version in the baseline resources 134 to see what was in fact changed or the extend of the changes; and Paragraph [0064]: 2) if the file is in the file system but not in the baseline resources 134, then a new file was created during the evaluation period, which may or may not necessitate reporting).
Ziv further teaches document contained in the focused window on the display screen of the user computer (Ziv – P. 3: The computer-based method includes obtaining a handle for an in-focus window (e.g., an on-screen context menu) at the computer from a user interface of the computer, and using the handle to request information about the in-focus window from an accessibility application programming interface (API) on the computer).
Biswas further teaches generate a report at the user interface of the admin computer (Biswas – Paragraph [0081]: In some examples, the control manager 172 can also maintain security policies for the organization 130. A security policy can define an action or set of actions that, when detected, constitute a security violation or an event that otherwise requires attention … In some examples, a security policy can also define one or more remediation actions to perform when a violation of the policy is detected. A remediation action can include, for example, sending a notification to the user who caused the violation, to network administrators of the organization 130, to administrators of the security management and control system 102, and/or to another entity; and Paragraph [0087]: In various implementations, the security management and control system 102 provides an interface 120 through which customers of the security management and control system 102 can use the services of the security management and control system 102. The interface 120 can provide, for example, a graphical user interface (GUI) that can display a control panel or dashboard that enables the organization's administrative users to configure the services of the security management and control system 102. The graphical user interface can further enable the administrative users to view reports of user activity with respect to the services 112a-112b of the service provider 110. The graphical user interface can further provide reports of security events and suggest remediation actions, and/or report on the outcome of remediation actions that the security management and control system 102 automatically performs).
The motivation to combine the arts is the same as that of Claim 4.
Regarding Claim 11:
The combination of Littlejohn, Ziv, Nagatsuka, and Biswas teaches the computer system of claim 5.
Littlejohn further teaches wherein the system connects the report on the new document open activity to file tracking data based upon whether file tracking exists (Littlejohn – Paragraph [0046]: The real-time event configuration manager 131 can also configure the real-time event evaluator 133 with policies (may also be received by the real-time event configuration manager 131 via an API or GUI). The policies are conditions that inform the real-time event evaluator 133 on when the real-time event evaluator 133 should raise an event based on activity occurring in the queues for events received for the monitored resources (defined by the configuration information) during the monitored period of time (short during, such as between 30-90 seconds, which gives activity for resources a chance to stabilize and reduces noise associated with OS activity that may be irrelevant to whether the resource was changed or not); and Paragraph [0047]: In an embodiment, the policies conditions include patterns of activity performed on a given resource that indicate reporting needs to occur; and Paragraph [0014]: A "resource" includes a user, service, system, device, directory, data store, file system, files, non-volatile data, non-volatile files, groups of users, combinations and/or collections of these things, etc.).
The motivation to combine the arts is the same as that of Claim 4.
Regarding Claim 12:
The combination of Littlejohn, Ziv, Nagatsuka, and Biswas teaches the computer system of claim 5.
Littlejohn further teaches wherein the report is correlated with another event [on a user session] (Littlejohn – Paragraph [0046]: The real-time event configuration manager 131 can also configure the real-time event evaluator 133 with policies (may also be received by the real-time event configuration manager 131 via an API or GUI). The policies are conditions that inform the real-time event evaluator 133 on when the real-time event evaluator 133 should raise an event based on activity occurring in the queues for events received for the monitored resources (defined by the configuration information) during the monitored period of time (short during, such as between 30-90 seconds, which gives activity for resources a chance to stabilize and reduces noise associated with OS activity that may be irrelevant to whether the resource was changed or not); and Paragraph [0047]: In an embodiment, the policies conditions include patterns of activity performed on a given resource that indicate reporting needs to occur; and Paragraph [0014]: A "resource" includes a user, service, system, device, directory, data store, file system, files, non-volatile data, non-volatile files, groups of users, combinations and/or collections of these things, etc.).
Ziv further teaches the report is correlated with another event on a user session (Ziv – P. 15: The agent 220 may be a software component that can be installed, for example, on any Windows-based operating system (server or desktop) that you want to record. In those implementations, the agent 220 may be a user-mode executable that binds to every user session. As soon as a user logs into a monitored endpoint, the agent 220 begins recording based on a configured recording policy. From the moment a user logs on, the agent 220 starts capturing user activity data logs and, if configured, screen video. In certain implementations, all captured user activity data can be searched for, reported on, configured for alerts, and integrated with security information and event management (SIEM) systems).
The motivation to combine the arts is the same as that of Claim 4.
Regarding Claim 16:
The combination of Littlejohn, Ziv, and Nagatsuka teaches the method of claim 13.
Littlejohn further teaches further comprising the step of: causing the system to generate a report … in response to the agent determining that the document … on the … user computer when the user interface action notification was generated does not match the document stored in the cache memory (Littlejohn – Paragraph [0052]: The baseline resources 134 can be used to detect the extent of changes made to resources at the conclusion of the evaluation period. The copy of the resources in the baseline resources 134 are copies of the resources before any volatile operations occurred on those resources, such that at the conclusion of the evaluation period for a given resource, the final version of the given resource can be compared against its baseline version in the baseline resources 134 to provide more meaningful details on the extent of the actual changes beyond just a binary reporting that a change occurred; and Paragraph [0053]: In an embodiment, the baseline resources 134 are housed in cache; and Paragraph [0063]: 1) if the file is in the file system and in the baseline resources 134, then a change occurred during the evaluation period and the file needs to be compared to its version in the baseline resources 134 to see what was in fact changed or the extend of the changes; and Paragraph [0064]: 2) if the file is in the file system but not in the baseline resources 134, then a new file was created during the evaluation period, which may or may not necessitate reporting); and to report on user activities that cause or result in new documents being opened at the user computer (Littlejohn – Paragraph [0047]: In an embodiment, the policies conditions include patterns of activity performed on a given resource that indicate reporting needs to occur; and Paragraph [0056]: At the conclusion of the evaluation period, the real-time event evaluator 133 uses policy conditions (configured by the real-time event configuration manager 131) to make decisions on whether any reporting is necessary or whether the activity on the resource can be ignored; and Paragraph [0058]: the policy conditions can state fine-grain rules, such as if an acting resource belonging to a particular role or group reads a file (type of resource) belong to a particular user-defined classification of files, then report to an administrator (another type of resource) using via email (type of communication for the reporting; and Paragraph [0064]: if the file is in the file system but not in the baseline resources 134, then a new file was created during the evaluation period, which may or may not necessitate reporting).
Ziv further teaches document contained in the focused window on the display screen of the user computer (Ziv – P. 3: The computer-based method includes obtaining a handle for an in-focus window (e.g., an on-screen context menu) at the computer from a user interface of the computer, and using the handle to request information about the in-focus window from an accessibility application programming interface (API) on the computer)
The combination of Littlejohn and Ziv does not expressly teach generate a report at a user interface of an admin computer of the computer system; and wherein the admin computer is configured to present the user interface at a display screen of the admin computer.
However, Biswas teaches generate a report at a user interface of an admin computer of the computer system (Biswas – Paragraph [0081]: In some examples, the control manager 172 can also maintain security policies for the organization 130. A security policy can define an action or set of actions that, when detected, constitute a security violation or an event that otherwise requires attention … In some examples, a security policy can also define one or more remediation actions to perform when a violation of the policy is detected. A remediation action can include, for example, sending a notification to the user who caused the violation, to network administrators of the organization 130, to administrators of the security management and control system 102, and/or to another entity; and Paragraph [0087]: In various implementations, the security management and control system 102 provides an interface 120 through which customers of the security management and control system 102 can use the services of the security management and control system 102. The interface 120 can provide, for example, a graphical user interface (GUI) that can display a control panel or dashboard that enables the organization's administrative users to configure the services of the security management and control system 102. The graphical user interface can further enable the administrative users to view reports of user activity with respect to the services 112a-112b of the service provider 110. The graphical user interface can further provide reports of security events and suggest remediation actions, and/or report on the outcome of remediation actions that the security management and control system 102 automatically performs); and wherein the admin computer is configured to present the user interface at a display screen of the admin computer (Biswas – Paragraph [0081]: In some examples, the control manager 172 can also maintain security policies for the organization 130. A security policy can define an action or set of actions that, when detected, constitute a security violation or an event that otherwise requires attention … In some examples, a security policy can also define one or more remediation actions to perform when a violation of the policy is detected. A remediation action can include, for example, sending a notification to the user who caused the violation, to network administrators of the organization 130, to administrators of the security management and control system 102, and/or to another entity; and Paragraph [0087]: In various implementations, the security management and control system 102 provides an interface 120 through which customers of the security management and control system 102 can use the services of the security management and control system 102. The interface 120 can provide, for example, a graphical user interface (GUI) that can display a control panel or dashboard that enables the organization's administrative users to configure the services of the security management and control system 102. The graphical user interface can further enable the administrative users to view reports of user activity with respect to the services 112a-112b of the service provider 110. The graphical user interface can further provide reports of security events and suggest remediation actions, and/or report on the outcome of remediation actions that the security management and control system 102 automatically performs).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to modify Littlejohn and Ziv, further incorporating Biswas to arrive at the conclusion of the claimed invention. One would be motivated to incorporate Biswas’s teachings to provide reports on at least user document open activities to an administrator into Littlejohn and Ziv’s system for detecting new documents on a user computer. This additional functionality would enhance the system with actionable alerts regarding suspicious or potentially malicious user activity.
Regarding Claim 22:
Claim 22 is a method claim with limitations corresponding to those of system Claim 11. Therefore, Claim 22 is rejected with the same combination and rationale as that of the rejection of Claim 11.
Regarding Claim 23:
Claim 23 is a method claim with limitations corresponding to those of system Claim 12. Therefore, Claim 22 is rejected with the same combination and rationale as that of the rejection of Claim 12.
Claim(s) 6, 7, 18, and 19 is/are rejected under 35 U.S.C. 103 as being unpatentable over Littlejohn, in view of Ziv, Nagatsuka, Biswas, and Nakatani et al. (US 20070192375 A1), hereinafter Nakatani.
Regarding Claim 6:
The combination of Littlejohn, Ziv, Nagatsuka, and Biswas teaches the computer system of Claim 4.
Littlejohn further teaches the agent determines that the document … on … the user computer when the user interface action notification was generated does not match the document stored in cache memory (Littlejohn – Paragraph [0052]: The baseline resources 134 can be used to detect the extent of changes made to resources at the conclusion of the evaluation period. The copy of the resources in the baseline resources 134 are copies of the resources before any volatile operations occurred on those resources, such that at the conclusion of the evaluation period for a given resource, the final version of the given resource can be compared against its baseline version in the baseline resources 134 to provide more meaningful details on the extent of the actual changes beyond just a binary reporting that a change occurred; and Paragraph [0053]: In an embodiment, the baseline resources 134 are housed in cache; and Paragraph [0063]: 1) if the file is in the file system and in the baseline resources 134, then a change occurred during the evaluation period and the file needs to be compared to its version in the baseline resources 134 to see what was in fact changed or the extend of the changes; and Paragraph [0064]: 2) if the file is in the file system but not in the baseline resources 134, then a new file was created during the evaluation period, which may or may not necessitate reporting).
Ziv further teaches the in focused window; and document contained in the focused window on the display screen of the user computer (Ziv – P. 3: The computer-based method includes obtaining a handle for an in-focus window (e.g., an on-screen context menu) at the computer from a user interface of the computer, and using the handle to request information about the in-focus window from an accessibility application programming interface (API) on the computer).
The combination of Littlejohn, Ziv, and Biswas does not expressly teach wherein the system clears the cache memory.
However, Nakatani teaches wherein the system clears the cache memory (Nakatani – Paragraph [0129]: In the case where the mirror synchronization processing is executed by the copy function of the disk controller 125 and the server 110 keeps as a cache data that is once read onto its own local memory 113, the server 110 needs to clear the cache so that the server 110 refers to an update reflected on the LDEV 124 (logical device(s)).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to modify Littlejohn, Ziv, and Biswas, further incorporating Nakatani to arrive at the conclusion of the claimed invention. One would be motivated to incorporate Nakatani’s teaching to clear a cache memory for storing an expected version of a document upon determining a mismatch into Littlejohn, Ziv, and Biswas’s system for detecting new documents on a user computer. This additional functionality would ensure that the system’s reference point for detecting new documents was updated, enhancing security and detection capability.
Regarding Claim 7:
The combination of Littlejohn, Ziv, Nagatsuka, Biswas, and Nakatani teaches the computer system of Claim 6.
Littlejohn further teaches wherein the system stores the document … and/or related data in the cache memory (Littlejohn – Paragraph [0051]: when a resource is first detected (by a monitored event) as having been accessed at the OS kernel layer 140, the real-time event evaluator 133 ensures that a copy of that resource is populated and securely maintained and persisted (unchanged) in the baseline resources 134 for the duration of the evaluation period; and Paragraph [0052]: The baseline resources 134 can be used to detect the extent of changes made to resources at the conclusion of the evaluation period. The copy of the resources in the baseline resources 134 are copies of the resources before any volatile operations occurred on those resources, such that at the conclusion of the evaluation period for a given resource, the final version of the given resource can be compared against its baseline version in the baseline resources 134 to provide more meaningful details on the extent of the actual changes beyond just a binary reporting that a change occurred; and Paragraph [0053]: In an embodiment, the baseline resources 134 are housed in cache).
Ziv further teaches document from the focused window; and a previous in-focus window (Ziv – P. 3: The computer-based method includes obtaining a handle for an in-focus window (e.g., an on-screen context menu) at the computer from a user interface of the computer, and using the handle to request information about the in-focus window from an accessibility application programming interface (API) on the computer).
Nakatani further teaches clearing the … cache memory (Nakatani – Paragraph [0129]: In the case where the mirror synchronization processing is executed by the copy function of the disk controller 125 and the server 110 keeps as a cache data that is once read onto its own local memory 113, the server 110 needs to clear the cache so that the server 110 refers to an update reflected on the LDEV 124 (logical device(s)).
The motivation to combine the arts is the same as that of Claim 6.
Regarding Claim 18:
Claim 18 is a method claim with limitations corresponding to those of system Claim 6. Therefore, Claim 18 is rejected with the same combination and rationale as that of the rejection of Claim 6.
Regarding Claim 19:
Claim 19 is a method claim with limitations corresponding to those of system Claim 7. Therefore, Claim 19 is rejected with the same combination and rationale as that of the rejection of Claim 7.
Claim(s) 8, 9, 20, and 21 is/are rejected under 35 U.S.C. 103 as being unpatentable over Littlejohn, in view of Ziv, Nagatsuka, Biswas, Nakatani, and Pathak et al. (US 20160224764 A1), hereinafter Pathak.
Regarding Claim 8:
The combination of Littlejohn, Ziv, Biswas, and Nakatani teaches the computer system of claim 7.
The combination of Littlejohn, Ziv, Nagatsuka, Biswas, and Nakatani does not expressly teach wherein the system determines whether the user performing the user activity resulting in the new document being opened at the user computer has permission to view the document.
However, Pathak teaches wherein the system determines whether the user performing the user activity resulting in the new document being opened at the user computer has permission to view the document (Pathak – Figure 2: illustration of a method for enforcing access control for a digital document, including determining user permission; and Paragraph [0010]: managing access to digital documents, the method including: (a) upon receiving a user command to open a document, transmitting an authorization request to the server, the authorization request includes a user ID of the user and a document ID of the document; (b) receiving a reply from the server which includes an original list of permissions; (c) based on the original list of permissions, opening the document in a viewer application and enabling or disabling one or more functions of the viewer application; (d) while the document is open in the viewer application, transmitting an update request to the server, the update request including the user ID of the user and the document ID of the document; (e) receiving an updated reply from the server which includes an updated list of permissions; and (f) based on the updated list of permissions, automatically and without user interaction, performing at least one action selected from a group of actions consisting of: closing the document in the viewer application, disabling at least one function of the viewer application that was previous enabled, enabling at least one function of the viewer application that was previous disabled, and adjusting settings of at least one function of the viewer application).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to modify Littlejohn, Ziv, Nagatsuka, Biswas, and Nakatani further incorporating Pathak to arrive at the conclusion of the claimed invention. One would be motivated to incorporate Pathak’s teaching to dynamically track user document access privileges and automatically close a document when it is determined that the user is not permitted to view the document into Littlejohn, Ziv, Nagatsuka, Biswas, and Nakatani’s system for detecting new documents on a user computer. This combination would further enhance the system’s capability to monitor user behavior and protect documents from unauthorized access/viewing.
Regarding Claim 9:
The combination of Littlejohn, Ziv, Nagatsuka, Biswas, Nakatani, and Pathak teaches the computer system of claim 8.
Biswas further teaches wherein the system automatically … notifies an administrator and optionally the user (Biswas – Paragraph [0081]: In some examples, the control manager 172 can also maintain security policies for the organization 130. A security policy can define an action or set of actions that, when detected, constitute a security violation or an event that otherwise requires attention … In some examples, a security policy can also define one or more remediation actions to perform when a violation of the policy is detected. A remediation action can include, for example, sending a notification to the user who caused the violation, to network administrators of the organization 130, to administrators of the security management and control system 102, and/or to another entity; and Paragraph [0087]: In various implementations, the security management and control system 102 provides an interface 120 through which customers of the security management and control system 102 can use the services of the security management and control system 102. The interface 120 can provide, for example, a graphical user interface (GUI) that can display a control panel or dashboard that enables the organization's administrative users to configure the services of the security management and control system 102. The graphical user interface can further enable the administrative users to view reports of user activity with respect to the services 112a-112b of the service provider 110. The graphical user interface can further provide reports of security events and suggest remediation actions, and/or report on the outcome of remediation actions that the security management and control system 102 automatically performs; and Paragraph [0182]: In some embodiments, the monitoring system may maintain an audit trail log that includes events that are detected in the cloud system … The event may also include an action performed by the event, such as … opening a document).
Pathak further teaches wherein the system automatically closes the new document at the user computer … in response to determining that the user lacks permission to view the document (Pathak – Figure 2: illustration of a method for enforcing access control for a digital document, including determining user permission; and Paragraph [0010]: managing access to digital documents, the method including: (a) upon receiving a user command to open a document, transmitting an authorization request to the server, the authorization request includes a user ID of the user and a document ID of the document; (b) receiving a reply from the server which includes an original list of permissions; (c) based on the original list of permissions, opening the document in a viewer application and enabling or disabling one or more functions of the viewer application; (d) while the document is open in the viewer application, transmitting an update request to the server, the update request including the user ID of the user and the document ID of the document; (e) receiving an updated reply from the server which includes an updated list of permissions; and (f) based on the updated list of permissions, automatically and without user interaction, performing at least one action selected from a group of actions consisting of: closing the document in the viewer application, disabling at least one function of the viewer application that was previous enabled, enabling at least one function of the viewer application that was previous disabled, and adjusting settings of at least one function of the viewer application).
The motivation to combine the arts is the same as that of Claim 8.
Regarding Claim 20:
Claim 20 is a method claim with limitations corresponding to those of system Claim 8. Therefore, Claim 20 is rejected with the same combination and rationale as that of the rejection of Claim 8.
Regarding Claim 21:
Claim 21 is a method claim with limitations corresponding to those of system Claim 9. Therefore, Claim 21 is rejected with the same combination and rationale as that of the rejection of Claim 9.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Krauss et al. (US 20140173569 A1) teaches methods that utilize the abilities of an operating system to manage the window focus, including monitoring user interactions with the interface and detecting the in-focus window
Haines et al. (US 20140344273 A1) teaches techniques for monitoring user interface actions and associating content identifiers with actively displayed windows
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to NICHOLAS JOSEPH DILUZIO whose telephone number is (703)756-1229. The examiner can normally be reached Mon - Fri -- 7:30 AM - 5 PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Yin-Chen Shaw can be reached at 571-272-8878. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/NICHOLAS JOSEPH DILUZIO/Examiner, Art Unit 2498
/YIN CHEN SHAW/Supervisory Patent Examiner, Art Unit 2498
