DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-23 is/are rejected under 35 U.S.C. 103 as being unpatentable over Prasad Tanniru et al., US 20250037141 A1 in view of Spoonamore, US 20080047016 A1.
19. A method comprising:
obtaining, by a processing system including a processor, first information that characterizes development of a software program, (see Prasad, ¶ 1 “The most prevalent challenges that organizations face are delayed validations of regulations, compliance, and security checks towards the end of a software development life cycle (SDLC).”);
obtaining, by the processing system, second information that identifies one or more Sarbanes-Oxley (SOX) controls that have been applied to the software program, (see Prasad, ¶ 71 “compliance type may refer to different legislative acts that measure the existing security and compliance practices followed against the requirements that may need to be met. For example, compliance type may include, but not limited to, health insurance portability and accountability act (HIPAA), Sarbanes-Oxley Act (SOX), etc.”);
obtaining, by the processing system, third information that characterizes development of a software program under test; inputting the first, second, and third information to a first generative artificial intelligence (AI) process, wherein the first generative AI process outputs one or more suggested SOX controls to be applied to the software program under test, (see Prasad, ¶ 51, 57);
Although Prasad does disclose the use of Artificial Intelligence, Prasad fails to disclose other features taught by reference to Spoonamore:
inputting the one or more suggested SOX controls, (see Spoonamore, ¶ 108) to a second generative process separate from the first process, wherein the second process outputs a recommended test plan for the software program under test, and wherein the recommended test plan indicates how each of the one or more suggested SOX controls is to be tested for the software program under test, and wherein the recommended test plan includes a security vulnerability detection operation for source code of the software program under test, (see Spoonamore, ¶ 16 “ 10. Vulnerability testing: Vulnerability testing entails obtaining knowledge of vulnerabilities that exist on a computer system or network and using that knowledge to gain access to resources on the computer or network while bypassing normal authentication barriers”;
applying the recommended test plan to the software program under test, wherein applying the recommended test plan includes applying the security vulnerability detection operation to the source code of the software program under test, (see Spoonamore, Table 1 “16. Is someone on the Board of Directors responsible for overseeing technology risk? Asset Management 17. Have you taken an inventory of each access point to your network (e.g., every connected device, wireless, remote, etc.), both inside and outside of the firewall, in order to identify potential points of vulnerability? 18. Have you conducted a business impact analysis? Consequently, do you have an asset based threat profile which would include a definition of potential impact to the enterprise should there be a breach in security (i.e. a loss of confidentiality, integrity or availability)?”); and
outputting one or more results of the applying of the applying the recommended test plan, the one or more results identifying whether a security vulnerability is present, (see Spoonamore, ¶ 107 “(5) evaluate and adjust the program in light of relevant circumstances, including changes in the firms business arrangements or operations, or the results of testing and monitoring of safeguards.”).
It would have been obvious to one of ordinary skill in the art at the time of the invention to combine the features of Prasad and Spoonamore because of the following findings of fact:
F. Known Work in One Field of Endeavor May Prompt Variations of It for Use in Either the Same Field or a Different One Based on Design Incentives or Other Market Forces if the Variations Are Predictable to One of Ordinary Skill in the Art
(1) the scope and content of the prior art in the same field of endeavor as that of the applicant’s invention include a similar or analogous device (method, or product), i.e. Sarbanes-Oxley Act compliance;
(2) there were design incentives or market forces which would have prompted adaptation of the known device (method, or product), (see Spoonamore, abstract, ¶ 117)(to ensure compliance with statutes, regulations, Executive Orders and Presidential Directives, administrative consent decrees, contractual agreements, and public expectations);
(3) the differences between the claimed invention and the prior art were encompassed in known variations or in a principle known in the prior art;
(4) one of ordinary skill in the art, in view of the identified design incentives or other market forces, could have implemented the claimed variation of the prior art, and the claimed variation would have been predictable to one of ordinary skill in the art.
This motivation to combine is applied to all claims below herein by reference.
20. The method of claim 19, wherein:
the first information comprises one or more user stories, one or more test plans, one or more test plan results, source code of the software program, runtime code of the software program, or any combination thereof, (see Prasad, ¶ 71 “Dynamic Application Security Testing (DAST), Static Application Security Testing (SAST)”), ¶ 91 “generative AI may be leveraged…generating the test cases in real-time”;
each of the one or more SOX controls of the second information provides for monitoring, detection, remediation, prevention, or any combination thereof, (see Prasad, ¶ 89 “the ML-based compliance advisor 406 may be trained using industry/domain specific compliance requirements like… SOX for finance”);
the third information comprises one or more user stories, one or more test plans, one or more test plan results, source code of the software program under test, runtime code of the software program under test, or any combination thereof, (see Prasad, ¶ 71); and
each of the one or more suggested SOX controls provides for monitoring, detection, remediation, prevention, or any combination thereof, (see Prasad, ¶ 89, 91 “the real-time recommendations may be suggested which may help projects to stay fully compliant and give ready to use controls, which may also be customized”).
5. The device of claim 4, wherein the outputting comprises: outputting one or more real-time alerts, (see Prasad, ¶ 112 “an alert mechanism may be incorporated for immediate action by a developer or user”).
10. The device of claim 1, wherein: each of the corporate governance controls relates to access control, change, control, release control, distribution control, deployment, or any combination thereof; and each of the one or more proposed corporate governance controls relates to access control, change, control, release control, distribution control, deployment, or any combination thereof, (see Prasad, ¶ 137, “the disclosed solution may make compliance types and controls available for every project within an enterprise, thereby bridging compliance gaps and staying updated with new global or enterprise-level regulatory, compliance, and policy amendments”).
12. The device of claim 1, wherein each of the plurality of software applications and the software application under test comprises a respective communications network software application, (see Prasad, FIG. 1 “illustrates an example operating environment or a network architecture in which a system such as a compliance system may be implemented to democratize compliance with customizable and extendable controls”).
13. The device of claim 12, wherein each communications network software application comprises a respective wireless communications network software application, (see Prasad, ¶ 53 “The network may also include, by way of example, but not limited to, one or more of a wireless network”).
14. The device of claim 13, wherein the operating features facilitate operation of a wireless communications network, (see Prasad, ¶ 53).
15. The device of claim 1, wherein: the first generative AI process comprises a machine leaning (ML) process, (see Prasad, ¶ 5 “dynamically generate, via a machine learning engine, a set of remedies for fixing each of the non-complaint controls”).
21. (New) The device of claim 1, wherein the operations further comprise: monitoring pipeline executions from centralized logs; determining whether the pipeline executions adhere to pipeline definitions; and generating an alert in response to a pipeline execution that does not adhere to a pipeline definition, (see Prasad, fig. 3 “alert engine”, ¶ 152, “The example representation 1600E of FIG. 16E displays an interface to configure controls such as, define orchestrator tools, add custom tools, pipelines, schedule frequencies, etc.”).
22. (New) The device of claim 1, wherein the operations further comprise generating an action or remediation in response to the result identifying that the security vulnerability is present, (see Prasad, ¶ 5 “the results including a list of non-compliant controls and a list of compliant controls, dynamically generate, via a machine learning engine, a set of remedies for fixing each of the non-complaint controls, and cause the generated set of remedies to be displayed on the user interface of the user device, wherein the set of remedies is caused to be executed or modified by the user to fix each of the non-compliant controls”).
23. (New) The device of claim 1, wherein the operations further comprise transmitting, to a provisioning system associated with the software application under test, prevention-check information associated with the result identifying whether the security vulnerability is present, (see Prasad, ¶ 5 “the results including a list of non-compliant controls and a list of compliant controls, dynamically generate, via a machine learning engine, a set of remedies for fixing each of the non-complaint controls, and cause the generated set of remedies to be displayed on the user interface of the user device, wherein the set of remedies is caused to be executed or modified by the user to fix each of the non-compliant controls”).
Claims 1-4, 6-9, 11, 16-18 are substantially similar to the claims rejected above, and therefore these claims are rejected on the same basis and rationale as those above herein by reference.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to RUSSELL S GLASS whose telephone number is (571)272-7285. The examiner can normally be reached M-F, 9-5.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, FLORIAN ZEENDER can be reached at 571-272-6790. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/RUSSELL S GLASS/Primary Examiner, Art Unit 3627
