DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This is a non-final office action in response to applicant’s preliminary amendment filed on 11/27/2024.
Claims 1-6 are amended, pending and being considered.
Priority
The instant application is a 371 of PCT/JP2022/022968 filed on 6/7/2022.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 11/27/2024, has been considered. The submission is in compliance with the provisions of 37 CFR 1.97. Accordingly, initialed and dated copy of Applicant’s IDS forms 1449 filed as stated above is/are attached to the instant Office Action.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-6 rejected under 35 U.S.C. §101 because the claimed invention is directed to an abstract idea without significantly more.
Eligibility Step 2A Prong One: Claim 1, similarly claims 5-6, recites “extract[ing] a first regular expression from a source code”, “determine[ing] whether the first regular expression satisfies …”, “synthesize[ing] a second regular expression …”. These would be interpreted as being analogous to concepts relating to organizing or analyzing information in a way that can be performed mentally or human mental work. Accordingly, the claim recites the abstract idea.
The limitation of extracting, determining and synthesizing, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of relating to regular expression in source code. Nothing in the claim element precludes the step from practically being performed in the mind. Accordingly, the claim recites an abstract idea.
Eligibility Step 2A Prong Two: Claims 1, 6 recite additional limitations of “processing circuitry”, “computer” to perform the steps of method claim discussed above. The limitations of extracting, determining and synthesizing, as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind but for the recitation of generic computer components. That is, other than reciting “processing circuitry” and “computer”, nothing in the claim element precludes the steps from practically being performed in the mind. Accordingly, the claims recite an abstract idea.
This judicial exception is not integrated into a practical application because the claim only recites the additional limitations of “source code”, “ReDoS”, which are merely used as generic and well-known terminologies, and they do not amount to significantly more than the abstract idea. In addition, the claims only recite additional elements – processing circuitry, computer, to perform the extracting/determining/synthesizing steps. The processing circuitry, computer are recited at a high level of generality (i.e., as a generic processor performing a generic computer function of extracting/determining/synthesizing) such that it amounts no more than mere instructions to apply the exception using generic computer components. Accordingly, these additional elements do not integrate the abstract idea into a practical application because they do not impose any meaningful limits on practicing the abstract idea. The claim is directed to an abstract idea.
Eligibility Step 2B: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional element of using computing system to perform the extracting/determining/synthesizing steps amounts to no more than mere instructions to apply the exception using generic computing system. Mere instructions to apply an exception using generic computing machines cannot provide an inventive concept. The claim is not patent eligible.
Dependent claims 2-4 depend on the rejected independent claims 1, therefore are not patent eligible.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966), that are applied for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-3 and 5-6 are rejected under 35 U.S.C. 103 as being unpatentable over Peng (CN110928793A, hereinafter, “Peng”), in view of Cook et al (US11200144B1-IDS, hereinafter, “Cook”).
Regarding claim 1, similarly claim 5, claim 6, Peng teaches:
A correction device comprising: processing circuitry/A correction method executed by a correction device/A non-transitory computer-readable recording medium storing therein a correction program for causing that causes a computer to execute a process (Peng, discloses a regular expression detecting method, device and a computer readable storage medium for detecting regular expression for improved test efficiency and accuracy against ReDoS attack) configured to/the correction method comprising/comprising:
extract a first regular expression from a source code (Refer to Fig. 1 at steps 101-102, and [0027] step 101, reading the file content to be detected based on the file path to be detected… [0030] Specifically, in this embodiment, based on the file attribute of the local embodiment whether the condition of triggering the positive regular expression detection judgment process, triggering the step 101 only under the condition of meeting the judging condition. And [0031] step 102, in the to-be-detected file content extracting target regular expression);
determine whether the first regular expression satisfies a condition indicating that the first regular expression is vulnerable to Regular Expression Denial of Service (ReDoS) ([0032] Specifically, in this embodiment, the regular expression (Regex, Regular Expression) for realizing the data in the text matching check, in the practical application, when the positive writing check of regular expression has defect or not precise, the attacker can be constructed of special character string to large consumption of system resource of the server, the service server is interrupted or stopped, wherein a typical attack mode is regular expression denial of service attack (ReDoS));
While Peng further teaches determining a recommended correction data (refer to Fig. 4 and [0060] In addition, it should also be noted that, after further capable of determining that the regular expression in this embodiment, writing rules based on criteria determining a recommended correction data), Peng does not specifically teach the following, in the same field of endeavor Cook teaches:
and synthesize a second regular expression that does not satisfy the condition on a basis of the first regular expression (Cook, discloses systems and methods for refinement of static analysis of program code for refinement against flaws, security vulnerabilities, see [Abstract]. And [Col. 8 lines 31-33] additional analysis 150 using regular-expression pattern matching (e.g., using the grep tool) may be performed. And [Col. 11 lines 33-41] the static analysis refinement system 100 may automatically generate one or more code patches that corrects one or more problems and may then replace the problematic segment(s) of code with the code patch(es) (i.e., second regular expression), e.g., without user input accepting or rejecting the code patch(es)… the system 100 may thus generate modified program source code 560 that includes one or more code patches to the original code 160).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have employed the teachings of Cook in the regular expression detection of Peng by refinement of program code with static analysis. This would have been obvious because the person having ordinary skill in the art would have been motivated to refine program code against flaws and security vulnerabilities (Cook, [Abstract], Background).
Regarding claim 2, Peng-Cook combination teaches the correction device according to claim 1,
Peng further teaches: wherein the processing circuitry is further configured to convert the source code into a syntax analysis tree, and extract a regular expression restored on a basis of a variable extracted from the syntax analysis tree as the first regular expression ([0039] In this embodiment one embodiment optionally, regular expression test rule is a standard grammar rule, based on the preset regular expression test rule, the positive target expression to compile accuracy detection comprises: based on the preset standard grammar rules, the target regular expression syntax analysis, regular expressions based on the syntax analysis result detection target writing accuracy).
Regarding claim 3, Peng-Cook combination teaches the correction device according to claim 1,
Cook further teaches: wherein the processing circuitry is further configured to: generate a first set that is a set of character strings accepted by the first regular expression and a second set that is a set of character strings rejected by the first regular expression, and synthesize a second regular expression that is a regular expression obtained by replacing range characters in the first regular expression with a predetermined syntax, that is, a regular expression that accepts a character string of the first set and rejects the character string of the second set ([Col. 11 lines 28-37] As shown in FIG. 5, the static analysis refinement system 100 may include a component 140 for automated code patching. In one embodiment, the correction(s) to the source code may be presented to a user as a suggestion, e.g., via a user interface, and user input may be solicited to accept or reject the recommendation. In one embodiment, the static analysis refinement system 100 may automatically generate one or more code patches that corrects one or more problems and may then replace the problematic segment(s) of code with the code patch(es)). Same motivation as presented in claim 1 would apply.
Allowable Subject Matter
Claim 4 is objected to as being dependent upon a rejected base claim(s), but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims as well as resolving of any outstanding informalities and 35 USC 101 presented in this office action.
The following is a statement of reasons for the indication of allowable subject matter:
Claim 4 depends on claim 3 which depends on claim 1, further specifies “wherein the processing circuitry is further configured to convert the first regular expression into a nondeterministic finite automaton, generate a set of character strings obtained by a path reaching an acceptance state among paths on the nondeterministic finite automaton as the first set, and generate a set of character strings obtained by a path not reaching the acceptance state among the paths on the nondeterministic finite automaton as the second set”.
The prior arts identified, Peng, Cook, Namjoshi, Li, Sullivan, either singularly or in combination fails to anticipate or render obvious the claimed limitations of claims shown above.
Citation of References
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. The following references are cited but not been replied upon for this office action:
Namjoshi et al (US20100146623A1) discloses method pattern matching by a regular expression with back-references (backref-regex) in a single pass of a non-deterministic finite automaton.
Huang (CN113139183A) discloses method for detecting abnormal flow of code injection.
Li et al (“ReDoS Hunter: A combined Static and Dynamic Approach for Regular Expression DoS Detection”, Pages 3847-3864. The Proceedings of the 30th USENIX Security Symposium, August 11-13, 2021) discloses methods for detection of ReDoS in regular expression.
Sullivan (“Security Briefs – Regular Expression Denial of Service Attacks and Defenses”. Technical Report. https://msdn.microsoft. com/en-us/magazine/ff646973.aspx, 2010).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MICHAEL M LEE whose telephone number is (571)272-1975.
The examiner can normally be reached on M-F: 8:30AM - 5:30PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Shewaye Gelagay can be reached on (571) 272-4219. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MICHAEL M LEE/Primary Examiner, Art Unit 2436
Prosecution Insights