DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This office action is in response to the amendment filed on 04/08/2026.
Claims 1-7 and 16-22 are currently pending in this application. Claims 1 and 16 are amended.
No new IDS has been filed.
Examiner’s Note
Applicants are suggested to include information from figures 2, 3 with related text into the claims to provide a better condition for an allowance.
Response to Arguments
Regarding the previous 112(b) rejections, the applicant has amended the claims 1 and 16. However, the applicants’ amendments do not overcome all of the previous rejections or/and the current amendments cause the new rejections stated in the 112 rejections section below.
Regarding the 112(b) rejections, the applicants, in page 7 of the remarks, have argued that “… Examiner asserts that whether the protection policy of the configuration information is obtained by the signature verification module (not the Linux security module) … As recited in amended claim 1, the configuration information is obtained by the Linux … paragraph [0053] describes that after the verification succeeds, … the claim clearly defines the boundaries of the invention: the Linux security module obtains the configuration information (including the protection policy) from the signature verification server and enforces file protection based on it …”.
The applicants’ these arguments are not persuasive.
First of all, the applicants’ argued limitation, “… the Linux security obtain the configuration information (including the protection policy) …” is not in the claim. Please note that “the configuration information is used to record a protected file in the Linux file system and a protection policy for the protected file – see lines 7-8 of the claim 1, and the configuration information does NOT include the protection policy.
Secondly, it is noted that the features upon which applicant argues (e.g., … paragraph [0053] describes that after the verification succeeds, the signature verification server can return the initial configuration information to the current device. The initial configuration …”) is NOT recited in the claims. Although the claims are interpreted in light of the specification, limitations for the specification are not read into the claims. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993). As the applicants noted, the claim limitations are not clear without information from paragraph [0053] of the specification. Therefore, the rejection is maintained.
The applicants, in page 7 of the remarks, further argued that “… Examiner asserts that whether the file protection is performed to the protected file or not (e.g., double/multiple protections, etc.) … Applicant respectfully submits … file protection is clearly and precisely defined by the configuration information itself … precisely delineated by the scope of this configuration information. For example, paragraphs [0053]- [0055] describe that when a file access request is received, the Linux security module’s hook function first check … Thus … the protection applies exclusively to those files identified as protected in the configuration information …”.
The examiner respectfully disagrees with these arguments.
First of all, the applicants’ argued limitation, “… the protection applies exclusively to those files identified as protected in the configuration information …” is not in the claim. Please note that “performing file protection on the protected file based on the protection policy – see line 9 of the claim 1.
Secondly, it is noted that the features upon which applicant argues (e.g., … paragraphs [0053]- [0055] describe that … hook function first checks whether the file falls within …”) is NOT recited in the claims. Although the claims are interpreted in light of the specification, limitations for the specification are not read into the claims. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993). As the applicants noted, the claim limitations are not clear without information from paragraphs [0053]- [0055] of the specification. Therefore, the rejection is maintained.
The applicants, in page 8 of the remarks, further argued that “… Examiner asserts that whether the access control method is controlling an access to the configuration information by the Linux security module or the signature verification module … Applicant respectfully clarifies that the claimed access control method is directed to controlling access to protected files … it controls file access operation directed to the protected files, based on the protection policy recorded in the configuration information. Paragraphs [0032] and [0053] describe how the Linux security module, via its hook functions, checks whether … thus … access control is applied to the protected files listed …”.
The examiner respectfully disagrees with these arguments.
First of all, the applicants’ argued limitations, “… file access operation directed to the protected files, based on the protection policy recorded in the configuration information …” and “access control is applied to the protected files listed” are not in the claim. Please note that “the configuration information is used to record … a protection policy (see lines 7-8 of the claim 1) is NOT the same as “the protection policy is recorded in the configuration information).
Secondly, it is noted that the features upon which applicant argues (e.g., … paragraphs [0032] and [0053] describe how the Linux security module, via its hook functions, checks whether …”) is NOT recited in the claims. Although the claims are interpreted in light of the specification, limitations for the specification are not read into the claims. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993). As the applicants noted, the claim limitations are not clear without information from paragraphs [0032] and [0053] of the specification. Therefore, the rejection is maintained.
The applicants, in pages 8-9 of the remarks, also argued that “… Examiner’s concerns in … verifying a signature of a first user in response to receiving a modification request … The amended independent claim 1 recites that … The phrase ‘in response to receiving a modification request’ establishes a temporal and causal relationship between the receipt … the modification request includes or is accompanied by the user’s signature, as the verification operation necessarily requires the signature to be present for validation. Paragraph [0057] describes that the signature verification module can verify … it follows logically that the modification operation alters the content of … Paragraph [0055]- [0057] explains that an authorized user can temporarily modify the … Thus, the modification operation direly pertains to the protected files and protection policies recorded in the configuration information”.
The applicants’ these arguments are not persuasive.
First of all, the applicants’ argued limitations, “… the modification request includes or is accompanied by the user’s signature, as the verification operation necessarily requires the signature to be present for validation …”, and “… the modification operation direly pertains to the protected files and protection policies recorded in the configuration information” are not in the claim. Please note that “the configuration information is used to record (NOT including) a protected file in the Linux file system and a protection policy for the protected file – see lines 7-8 of the claim 1, and the protection policy is NOT recorded in (or a part of) the configuration information.
Secondly, it is noted that the features upon which applicant argues (e.g., … paragraph [0057] describes that the signature verification module can verify … it follows logically that the modification operation alters the content of … Paragraph [0055]- [0057] explains that an authorized user can temporarily modify …”) are NOT recited in the claims. Although the claims are interpreted in light of the specification, limitations for the specification are not read into the claims. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993). As the applicants noted, the claim limitations are not clear without information from paragraphs [0055]- [0057] of the specification. Therefore, the rejection is maintained.
The applicants, in pages 9-10 of the remarks, further argued that “… Examiner’s concern … whether ‘the Linux security module’ and ‘the signature verification module’ are components of the … for intended use, Applicant respectfully submits that these modules are functional components of the computing device, implemented as software modules within the Linux operating system kernel, and are clearly defined in the specification. Paragraph [0036] describes that ‘the Linux security module can be implemented by using an LSM module … the Linux security module can include a file whose suffix is .ko’ This defines the Linux security module as a loadable kernel module – a standard software component of the Linux kernel that resides on the computing device and is registered during system startup”.
The examiner respectfully disagrees with these arguments.
First of all, the applicants’ argued limitations, “… these modules are functional components of the computing device, implemented as software modules within the Linux operating system kernel …” and “… the Linux security module as a loadable kernel module – a standard software component of the Linux kernel that resides on the computing device and is registered during system startup” are not in the claim.
Secondly, it is noted that the features upon which applicant argues (e.g., … paragraph [0036] describes ‘the Linux security module can be implemented by using an LSM module … the Linux security module can include a file whose suffix is .ko”) is NOT recited in the claims. Although the claims are interpreted in light of the specification, limitations for the specification are not read into the claims. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993). As the applicants noted, the claim limitations are not clear without information from paragraph [0036] of the specification. Please note that the applicants’ indication of “a standard” regarding claimed limitation is defined as the Applicant Admitted Prior Art (AAPA). Therefore, the rejection is maintained.
The applicants, in pages 10-12 of the remarks for the 112(b) rejections, further argued that “… Examiner asserts that claims 2, 3, 17 and 18 recite … supported by the Specification at [0065] … Specification confirms this at [0042] … and [0063]- [0065] … The Specification further details this mechanism at [0066]- [0069] …”; “… Examiner asserts that claims 4 and 19 recite … illustrated in paragraphs [0029] and paragraphs [0031] …”; “… Examiner asserts that claims 6 and 21 recite … The Specification at [0072] describes that … The Specification at [0070]- [0071] explains that … as noted at [0073] …”; “… Examiner asserts that claims 7 and 22 recite … explanations at paragraphs [0043]- [0048] and [0037], respectively …”.
The examiner respectfully disagrees with these arguments.
it is noted that the features upon which applicant argues (e.g., information described in paragraphs [0065], [0042], [0063]- [0065], [0066]- [0069], [0029], [0031], [0072], [0070]- [0071], [0073], [0043]- [0048], [0037]) are NOT recited in the claims. Although the claims are interpreted in light of the specification, limitations for the specification are not read into the claims. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993). As the applicants noted, the claim limitations are not clear without information from these paragraphs of the specification. Therefore, the rejections are maintained.
The applicants, in pages 12-13 of the remarks, have argued that “Claims 1-7 and 16-22 are rejected under 35 U.S.C. 112(f) being indefinite. The module as used in the art, particularly in the context of Linux kernel programing is well-understood to encompass specific structures as a kernel object ... is a well-known … Accordingly, the Examiner’s 35 U.S.C. 112(f) rejection directed to that term is now moot with respect to all pending claims.
The applicants’ these arguments are not persuasive as there is NOT the 35 U.S.C. 112(f) rejections (see pages 5-7 of the previous office action). However, the term, “module” included in the claims 16-22 are invoked for the 112(f) interpretations and rejected the claims under 35 U.S.C. 112(b). See the 112(b)-rejection section below for detail.
Regarding the 102 rejections, the currently amended limitations are in a condition of lack of clarity and/or capability for a prior-art examination. See the 112(b) rejections section below for detail.
Thus, the applicants’ arguments are not persuasive. Please see amended rejections below for the amended claims. This action is final.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(a):
(a) IN GENERAL. —The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
Claims 1-7 and 16-22 are rejected under 35 U.S.C. 112(a), as failing to comply with the written description requirements (e.g., the new matter issue).
Applicants have amended the claims 1 and 16 to include subject matter “… the Linux security module is configured to perform the following operations: obtaining configuration information … and performing file protection … verifying a signature of a first user … and modifying the configuration information …”, however, these amended limitations/terms were not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, at the time the application was filed, had possession of the claimed invention.
Examiner noted that the specification describes that “The signature verification module is configured to perform the following operations: verifying a signature of a first user in response to receiving a modification request of the first user for the configuration information; and modifying the configuration information if the verification on a signature of the first user succeeds.” – see paragraphs [0005], [0012], [0101]. However, this information does not provide to support or describe the amended limitations, “… the Linux security module is configured to perform the following operations: … verifying a signature of a first user … and modifying the configuration information …”.
Claims 2-7 and 17-22 depend from the claim 1 or 16, and are analyzed and rejected accordingly.
The following is a quotation of 35 U.S.C. 112(b):
(B) CONCLUSION. —The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
Claims 1-7 and 16-22 are rejected under 35 U.S.C. 112(b) as being indefinite for failing to particularly point out and distinctly claim the subject matter which applicant regards as the invention.
Claim 1 (claim 16 includes similar limitations) recites:
“An access control method … registering a Linux security module in a procedure of starting a Linux operating system, the Linux file system includes a signature verification server, the Linux security module includes a file whose suffix is a kernel object, wherein the Linux security module is configured to perform … obtaining configuration information from the signature verification server … used to record a protected file … and a protection policy for … performing file protection on the protected file …”, however, it is not clear (1) whether “the Linux security module” is a storage/database or a folder (e.g., a group of files) because it includes a file – omitting necessary component/step which causes the limitations unclear; (2) whether the protection policy of the configuration information is obtained by the signature verification module (not the Linux security module) or not (note: the Linux security module performs the file protection using the protection policy); (3) whether the file protection is performed to the protected file or not (e.g., double/multiple protections, etc.) – it is not clear to define a boundary of the limitations; (4) whether “the access control method” is controlling an access to “the configuration information” by the Linux security module or the signature verification module (note: the configuration information is obtained by the signature verification module);
“… performing file protection … verifying a signature of a first user in response to receiving a modification request of the first user for the configuration information; and modifying the configuration information …”, however, it is not clear (1) whether “the signature of the first user” is including in “the modification request” or not – omitting necessary component/step which causes the limitations unclear; (2) whether “modifying the configuration information” performs modification to record the protected file and the protection policy or not.
Claims 1 and 16 recites “a/the Linux security module”, “a/the signature verification module”; however, it is not clear whether these modules are components of the Linux file system (for the claim 1) or of the computing device (for the claim 16) or they are separate components included in the claims for intended use.
Claims 2-7 and 17-22 depend from the claim 1 or 16, and are analyzed and rejected accordingly.
Claims 2, 3, 17 and 18 recite “… receiving a file access request sent by a first process; and when a user corresponding to the first process is a root user … the first process is a process escaping from a container …”, however, it is not clear (1) whether the first process is the process of sending the file access request or not; (2) whether “the user corresponding to the first process” is “the first user” of the claim 1 or 17 or else; (3) how to define the user as a root user (e.g., the root user of the Linux file system, the root user of a user device, etc.) – it is not clear to define a boundary of the limitations; (4) how to define a process escaping from a container – omitting necessary component/step which causes the limitations unclear.
Claims 4 and 19 recite “… the container identifier of the parent process is obtained by using an mnt_mns field of …”, however, it is not clear what is the “mnt_mns” field.
Claims 6 and 21 recite “… determining that a user corresponding to the second process is a login user and user permission is a root user permission …”, however, it is not clear (1) whether the second process is a login process or not; (2) whether the user permission is the permission for the login permission or not – or omitting necessary step/component which causes the limitations unclear.
Claims 7 and 22 recite “… exporting the protected file and/or the protection policy to a Linux file system interface based on the configuration information”, however, it is not clear (1) whether the protected file of the Linux file system (see the claim 1 or 16) is exported to itself or not – or it is not clear to define a boundary of the limitations; (2) whether the exporting process is based on the recording information (e.g., the configuration information) or not – see also the limitations of the claim 1.
Claim Interpretation
The following is a quotation of 35 U.S.C. 112(f):
(f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The claims in this application are given their broadest reasonable interpretation using the plain meaning of the claim language in light of the specification as it would be understood by one of ordinary skill in the art. The broadest reasonable interpretation of a claim element (also commonly referred to as a claim limitation) is limited by the description in the specification when 35 U.S.C. 112(f) is invoked.
As explained in MPEP § 2181, subsection I, claim limitations that meet the following three-prong test will be interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph:
(A) the claim limitation uses the term “means” or “step” or a term used as a substitute for “means” that is a generic placeholder (also called a nonce term or a non-structural term having no specific structural meaning) for performing the claimed function;
(B) the term “means” or “step” or the generic placeholder is modified by functional language, typically, but not always linked by the transition word “for” (e.g., “means for”) or another linking word or phrase, such as “configured to” or “so that”; and
(C) the term “means” or “step” or the generic placeholder is not modified by sufficient structure, material, or acts for performing the claimed function.
Use of the word “means” (or “step”) in a claim with functional language creates a rebuttable presumption that the claim limitation is to be treated in accordance with 35 U.S.C. 112(f). The presumption that the claim limitation is interpreted under 35 U.S.C. 112(f) is rebutted when the claim limitation recites sufficient structure, material, or acts to entirely perform the recited function.
Absence of the word “means” (or “step”) in a claim creates a rebuttable presumption that the claim limitation is not to be treated in accordance with 35 U.S.C. 112(f). The presumption that the claim limitation is not interpreted under 35 U.S.C. 112(f) is rebutted when the claim limitation recites function without reciting sufficient structure, material or acts to entirely perform the recited function.
Claim limitations in this application that use the word “means” (or “step”) are being interpreted under 35 U.S.C. 112(f) except as otherwise indicated in an Office action. Conversely, claim limitations in this application that do not use the word “means” (or “step”) are not being interpreted under 35 U.S.C. 112(f) except as otherwise indicated in an Office action.
This application includes one or more claim limitations that a generic placeholder (e.g., “module”) that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. Such claim limitation(s) is/are: “… Linux security module is configured to perform … calling … performing …”, “… signature verification module is configured to perform … verifying … modifying …” in claim 16 (and dependent claims). Therefore, the claim limitations invoke 35 U.S.C. 112(f).
However, the written description fails to disclose the corresponding structure, material, or acts for performing the entire claimed function and to clearly link the structure, material, or acts to the function – see figures 1, 4 and paragraph 0022, 0031-0034, 0036-0040 of the disclosure.
Therefore, the claims 16-22 are indefinite and are rejected under 35 U.S.C. 112(b).
Applicant may:
(a) Amend the claim so that the claim limitation will no longer be interpreted as a limitation under 35 U.S.C. 112(f);
(b) Amend the written description of the specification such that it expressly recites what structure, material, or acts perform the entire claimed function, without introducing any new matter (35 U.S.C. 132(a)); or
(c) Amend the written description of the specification such that it clearly links the structure, material, or acts disclosed therein to the function recited in the claim, without introducing any new matter (35 U.S.C. 132(a)).
Examiner’s Note Regarding Prior-art Rejections
As explained in the 112(b) rejections stated above, the current limitations are in a condition of lack of clarity and/or capability for a prior-art examination. However, a potential concept of the application can be found in:
Callaghan et al. (US 10,397,230 B2) teaches a service processor for executing an operating system kernel having an integrity management system, secure boot firmware, and a tamper-resistant secure trusted dedicated microprocessor and performing the boot operation, in one or more registers for recording first measurements of code executed and recording the second measurements by the integrity management subsystem with execution of the operating system kernel, etc.
Lui et al. (US 2006/0015723 A1) teaches a method and apparatus for authorizing a file to use stored information for executing a process in a Linux operating system, wherein the file includes an executable linking format, an application authorization data, and other attributes for the application., etc.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MAUNG T LWIN whose telephone number is (571)270-7845. The examiner can normally be reached Monday - Friday 10:00 am - 6:00 pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Farid Homayounmehr can be reached at 571-272-3739. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MAUNG T LWIN/Primary Examiner, Art Unit 2495
Prosecution Insights