DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
The instant application having application No. 18/953,708 filed on November 20, 2024, presents claims 1-13 for examination, claims foreign priority to JP2023-216502, filed on 12/22/2023.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 11/20/2024 was filed before the mailing date of the Non-Final Office Action. The submission is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Examiner Notes
Examiner cites particular columns, paragraphs, figures and line numbers in the references as applied to the claims below for the convenience of the applicant. Although the specified citations are representative of the teachings in the art and are applied to the specific limitations within the individual claim, other passages and figures may apply as well. It is respectfully requested that, in preparing responses, the applicant fully consider the references in their entirety as potentially teaching all or part of the claimed invention, as well as the context of the passage as taught by the prior art or disclosed by the examiner.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claim Interpretation
Claim 5, lines 1-2, “the controller generates”; claim 6, lines 1-2, “the controller generates”; and claim 7, lines 1-2, “the controller is configures to”, have been interpreted not to invoke 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because Para [0049, 0051] and fig. 4 disclose that the controller is hardware with explicitly defined structure such as CPU, RAM, and ROM.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-13 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
With respect to claim 1, This claim is within at least one of the four categories of patent eligible subject matter as it is directed to a device claim under Step 1.
Under Prong 1, Step 2A:
However, the limitations of claim 1,
“generate software information including information about the one or more of the software modules constituting the first software, based on one or more pieces of the module information stored in the storage device and the distributed record book;”
as drafted, are functions that, under its broadest reasonable interpretation, recite the abstract idea of a mental process. The limitations encompass a human mind carrying out the functions through observation, evaluation, judgment and /or opinion, or even with the aid of pen and paper. E.g. the user can manually generate software information as defined in the claim. Thus, these limitations recite and fall within the “Mental Processes” grouping of abstract ideas under Prong 1 Step 2A.
Under Prong 2, Step 2A:
The judicial exception is not integrated into a practical application, the claim recites the following additional elements,
“An information processing device”, “a controller”,
“receive module information about a software module from a terminal corresponding to a first entity, the software module being produced by the first entity, one or more of the software modules constituting first software, and one or more of the first entities being included in a supply chain of the first software;
store different parts of the module information in a storage device and a distributed record book, the distributed record book using a block chain platform;
transmit the software information to a terminal corresponding to a second entity.”
Wherein “receive …” and “transmit …” are insignificant extra-solution activities such as data gathering and transmitting; “store …” is insignificant extra-solution activity such as retrieving and storing data. “An information processing device”, and “a controller” are recited as generic computer/software components used as tools to implement the identified abstract idea. Thus, these additional elements do not integrate the judicial exception into a practical application.
Under Step 2B:
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to
integration of the abstract idea into a practical application, “receive …” and “transmit …” are insignificant extra-solution activities such as data gathering and transmitting which are recognized as well-understood, routine, and conventional activities, see MPEP 2106.05(d), II, Symantec for receiving and transmitting data. “store …” is insignificant extra-solution activity such as retrieving and storing data which are recognized as well-understood, routine, and conventional activities, see MPEP 2106.05(d), II, Versata Dev. Group, Inc. v. SAP Am., Inc. for retrieving and storing data. “An information processing device”, and “a controller” are recited as generic computer/software components used as tools to implement the identified abstract idea. Accordingly, even viewed as whole, the claim does not appear to be patent eligible under 35 USC 101.
With respect to claim 2, This claim recites similar features as claim 1, and is rejected for the same reason. Please see claim 1 above for analysis.
With respect to claim 8, This claim is within at least one of the four categories of patent eligible subject matter as it is directed to a method claim under Step 1.
Under Prong 1, Step 2A:
However, the limitations of claim 8,
“…, and generating the software information corresponding to the first software based on the acquired module information.”
as drafted, are functions that, under its broadest reasonable interpretation, recite the abstract idea of a mental process. The limitations encompass a human mind carrying out the functions through observation, evaluation, judgment and /or opinion, or even with the aid of pen and paper. E.g. the user can manually generate software information as defined in the claim. Thus, these limitations recite and fall within the “Mental Processes” grouping of abstract ideas under Prong 1 Step 2A.
Under Prong 2, Step 2A:
The judicial exception is not integrated into a practical application, the claim recites the following additional elements,
“first device”, “second device”, and “storage device”,
“the first devices executing a process including
transmitting module information about one or more software modules constituting the first software to the second device, and
requesting software information corresponding to the first software from the second device; and
the second device executing a process including
storing different parts of the received module information in a storage device and a distributed ledger, the distributed ledger using a block chain platform, and
acquiring the module information about the one or more software modules constituting the first software from the storage device and the distributed ledger in response to the requesting”.
Wherein “transmitting …” and “requesting …” are insignificant extra-solution activities such as data gathering and transmitting; “storing …” and “acquiring …” are insignificant extra-solution activity such as retrieving and storing data. “first device”, “second device”, and “storage device” are recited as generic computer/software components used as tools to implement the identified abstract idea. Thus, these additional elements do not integrate the judicial exception into a practical application.
Under Step 2B:
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception. As discussed above with respect to
integration of the abstract idea into a practical application, “transmitting …” and “requesting …” are insignificant extra-solution activities such as data gathering and transmitting which are recognized as well-understood, routine, and conventional activities, see MPEP 2106.05(d), II, Symantec for receiving and transmitting data. “storing …” and “acquiring …” are insignificant extra-solution activity such as retrieving and storing data which are recognized as well-understood, routine, and conventional activities, see MPEP 2106.05(d), II, Versata Dev. Group, Inc. v. SAP Am., Inc. for retrieving and storing data. “first device”, “second device”, and “storage device” are recited as generic computer/software components used as tools to implement the identified abstract idea. Accordingly, even viewed as whole, the claim does not appear to be patent eligible under 35 USC 101.
With respect to claims 3 and 9, “wherein:
the module information includes first information that represents a dependence relationship between software modules and second information that represents a unique value corresponding to a target software module; and
the controller stores the first information in the storage device, and stores the second information in the distributed ledger.” The claim further defines the module information which is merely indicating a field of use or technological environment in which to apply a judicial exception, and does not amount to significantly more than the exception itself, and cannot integrate a judicial exception into a practical application. See MPEP § 2106.05(h). The claim also further defines the “store …” process which is the same extra-solution activity as in claim 1.
With respect to claims 4 and 10, “wherein the unique value corresponding to the target software module is a unique value of a body of the target software module or a unique value of a software bill of materials corresponding to the target software module.” The claim further defines the unique value which is merely indicating a field of use or technological environment in which to apply a judicial exception, and does not amount to significantly more than the exception itself, and cannot integrate a judicial exception into a practical application. See MPEP § 2106.05(h).
With respect to claims 5 and 11, “wherein the controller generates, as the software information, tree information that indicates a dependence relationship between a plurality of the software modules constituting the first software.” The claim as drafted, is mental process, because human can manually generate tree information as defined in the claim. The controller is recited as a generic computer/software component used as a tool to implement the identified abstract idea.
With respect to claims 6 and 12, “wherein the controller generates, as the software information, tree information that represents a dependence relationship between a plurality of the software modules constituting the first software and unique value information that represents the unique value corresponding to each of the software modules.” The claim as drafted, is mental process, because human can manually generate tree information as defined in the claim. The controller is recited as a generic computer/software component used as a tool to implement the identified abstract idea.
With respect to claims 7 and 13, “wherein the controller is configured to:
set, for the second company, a reference authority for the one or more of the software modules constituting the first software; and
perform a predetermined process of concealing a software module for which no reference authority is given to the second company, among the one or more of the software modules constituting the first software, when generating the software information.” The claim as drafted, is mental process, because human can manually set a reference authority as defined in the claim, and can manually perform a predetermined process of concealing a software module as defined in the claim. The controller is recited as a generic computer/software component used as a tool to implement the identified abstract idea.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1-4, and 8-10 are rejected under 35 U.S.C. 102 (a) (1) as being anticipated by VARGHESE (US 20240320624 A1, hereinafter “VARGHESE”).
With respect to claim 1, VARGHESE anticipates An information processing device comprising a controller configured to:
receive module information about a software module from a terminal corresponding to a first entity, the software module being produced by the first entity, one or more of the software modules constituting first software, and one or more of the first entities being included in a supply chain of the first software (e.g. Fig. 6, step 602, “Receive a web request to store a software bill of material …” wherein a software bill of material reads on the module information. Fig. 1A, the computing device 100 may read on the first entity);
store different parts of the module information in a storage device and a distributed record book, the distributed record book using a block chain platform (e.g. Fig. 6, step 604, “Store the SBOM in a distributed file system”. Fig. 6, step 608, para [0064], “Next at operation 608, a smart contract function store function 114 that is part of smart contract 112 is invoked. Store function 114 stores SBOM hash 230 in a block 250A on blockchain 120.”);
generate software information including information about the one or more of the software modules constituting the first software, based on one or more pieces of the module information stored in the storage device and the distributed record book (e.g. Figs. 4A-4C, para [0055], “FIG. 4C illustrates Web API 110 obtaining SBOM 310 from distributed database 140. Web API 110 provides distributed database 140 with SBOM hash 310 as part of a query. Distributed database uses SBOM hash 330 to retrieve SBOM 310, and returns SBOM 310 to Web API 110.” Also see para [0052-0054]); and
transmit the software information to a terminal corresponding to a second entity (e.g. Fig. 4D, para [0056], “FIG. 4D illustrates Web API 110 providing retrieve web response
460 to computing device 400. Retrieve web response includes SBOM 310 which was retrieved from distributed database 140. Computing device 400 may use SBOM 310 to programmatically determine if the dependencies of component 302 meet minimum security standards, among other operations.” Also see para [0052-0055]).
With respect to claim 2, it recites similar features as claim 1, (e.g. the entity in claim 1 may read on the company in claim 2, and the distributed record book in claim 1 may read on the distributed ledger in claim 2.) and is rejected for the same reason.
With respect to claim 3, VARGHESE anticipates The information processing device according to claim 2, wherein:
the module information includes first information that represents a dependence relationship between software modules and second information that represents a unique value corresponding to a target software module (e.g. Fig. 6, steps 604, 608 as cited above regarding claim 1. Para [0033], “SBOM 210 describes the dependencies of component 202. …”); and
the controller stores the first information in the storage device, and stores the second information in the distributed ledger. (e.g. Fig. 6, steps 604, 608 as cited above regarding claim 1. Wherein file system reads on the storage device, and the public blockchain reads on the distributed ledger Para [0033], “SBOM 210 describes the dependencies of component 202. …” para [0020], “Blockchain 120 and distributed database 140 are two examples of distributed systems that may be leveraged by Web API 110 to securely store and distribute SBOMs. …”).
With respect to claim 4, VARGHESE anticipates The information processing device according to claim 3, wherein the unique value corresponding to the target software module is a unique value of a body of the target software module or a unique value of a software bill of materials corresponding to the target software module (e.g. Fig. 6, steps 606, 608. Para [0063], “Next at operation 606, a hash 230 of SBOM 210 is determined. …”).
With respect to claim 8, VARGHESE anticipates An information processing method executed by one or more first devices respectively corresponding to one or more companies included in a supply chain of first software and a second device that manages information about the first software (e.g. Figs 1A, 4A), comprising:
the first devices executing a process including
transmitting module information about one or more software modules constituting the first software to the second device (e.g. Fig. 6, step 602, “Receive a web request to store a software bill of materials…” which indicating the first device transmitting module information), and
requesting software information corresponding to the first software from the second device (e.g. para [0052], “FIG. 4A illustrates computing device 400 submitting retrieve web request 420 to Web API 110. Retrieve web request 420 includes publisher identifier 412, SBOM format type 414, and SBOM identifier 242. …”); and
the second device executing a process including
storing different parts of the received module information in a storage device and a distributed ledger, the distributed ledger using a block chain platform (e.g. Fig. 6, step 604, “Store the SBOM in a distributed file system”. Fig. 6, step 608, para [0064], “Next at operation 608, a smart contract function store function 114 that is part of smart contract 112 is invoked. Store function 114 stores SBOM hash 230 in a block 250A on blockchain 120.”), and
acquiring the module information about the one or more software modules constituting the first software from the storage device and the distributed ledger in response to the requesting, and generating the software information corresponding to the first software based on the acquired module information (e.g. Figs. 4A-4C, para [0055], “FIG. 4C illustrates Web API 110 obtaining SBOM 310 from distributed database 140. Web API 110 provides distributed database 140 with SBOM hash 310 as part of a query. Distributed database uses SBOM hash 330 to retrieve SBOM 310, and returns SBOM 310 to Web API 110.” Para [0056], “FIG. 4D illustrates Web API 110 providing retrieve web response 460 to computing device 400. Retrieve web response includes SBOM 310 which was retrieved from distributed database 140. …” wherein the retrieve web response which includes SBOM 310 reads on generating the software information corresponding to the first software).
With respect to claim 9, it recites same features as claim 3, and is rejected for the same reason.
With respect to claim 10, it recites same features as claim 4, and is rejected for the same reason.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 5-6, and 11-12 are rejected under 35 U.S.C. 103 as being unpatentable over VARGHESE (US 20240320624 A1, hereinafter “VARGHESE”) in view of Gokhman et al. (US 20210117548 A1, hereinafter “Gokhman”).
With respect to claim 5, VARGHESE discloses The information processing device according to claim 4, but does not appear to explicitly disclose wherein the controller generates, as the software information, tree information that indicates a dependence relationship between a plurality of the software modules constituting the first software. However, this is taught in analogous art, Gokhman (e.g. Fig. 1, para [0060], “On Step 120, apply translator to create the package tree. …” wherein the package tree reads on tree information. Para [0010], “… and wherein the data structure forming a directed acyclic graph representing a package dependency tree.” )
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the invention of VARGHESE with the invention of Gokhman because it provides techniques for providing an efficient data structure that can efficiently represent the package dependencies in an accurate manner. A person having ordinary skill in the art would have been motivated to make this combination, with a reasonable expectation of success, for the purpose of providing techniques for providing an efficient data structure that can efficiently represent the package dependencies in an accurate manner as suggested by Gokhman (see para [0039]).
With respect to claim 6, VARGHESE discloses The information processing device according to claim 4, but does not appear to explicitly disclose wherein the controller generates, as the software information, tree information that represents a dependence relationship between a plurality of the software modules constituting the first software and unique value information that represents the unique value corresponding to each of the software modules. However, this is taught in analogous art, Gokhman (e.g. Fig. 1, para [0060], “On Step 120, apply translator to create the package tree. …” wherein the package tree reads on tree information. Para [0010], “… and wherein the data structure forming a directed acyclic graph representing a package dependency tree.” Para [0065], “On Step 154, a hash value on the list of package instance identifiers may be computed. …”. For motivation to combine, please refer to office action regarding claim 5.)
With respect to claim 11, it recites same features as claim 5, and is rejected for the same reason.
With respect to claim 12, it recites same features as claim 6, and is rejected for the same reason.
Claims 7 and 13 are rejected under 35 U.S.C. 103 as being unpatentable over VARGHESE (US 20240320624 A1, hereinafter “VARGHESE”) in view of Michaelis et al. (US 20240113902 A1, hereinafter “Michaelis”).
With respect to claim 7, VARGHESE discloses The information processing device according to claim 2, but does not appear to explicitly disclose wherein the controller is configured to:
set, for the second company, a reference authority for the one or more of the software modules constituting the first software; and
perform a predetermined process of concealing a software module for which no reference authority is given to the second company, among the one or more of the software modules constituting the first software, when generating the software information.
However, in analogous art, Michaelis discloses
wherein the controller is configured to:
set, for the second company, a reference authority for the one or more of the software modules constituting the first software (e.g. para [0087], “At block 306, the issuing entity causes an authorization event template to be created in association with the resource. The authorization event template comprises an identification of the resource and an address where the resource may be accessed (i.e., a URL), an identification of one or more users/entities that are authorized to access the resource (in one embodiment, a “realm” is listed, the realm associated with a “tails file” on a distributed identifier (DID) blockchain network in an embodiment where users are grouped into organizations/domains/realms. …”); and
perform a predetermined process of concealing a software module for which no reference authority is given to the second company, among the one or more of the software modules constituting the first software, when generating the software information (e.g. para [0113], “At block 342, processor 200 may continue to determine whether all of the conditions specified in the authorization record are continuously being satisfied. Generally, if at any time at least one of the conditions are not presently being satisfied, processor may deny further access to the resource, i.e., by blanking the display screen, interrupting a remote networking session, interrupting a data stream, deleting a local copy of a document, etc.”).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the invention of VARGHESE with the invention of Michaelis because it provides techniques for protecting resources from unauthorized accesses. A person having ordinary skill in the art would have been motivated to make this combination, with a reasonable expectation of success, for the purpose of providing techniques for protecting resources from unauthorized accesses as suggested by Michaelis (see para [0005, 0037]).
With respect to claim 13, it recites same features as claim 7, and is rejected for the same reason.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. For example, Singh et al., US 20250217113 A1 teaches system and method for enterprise software supply chain security.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Zengpu Wei whose telephone number is 571-270-1302. The examiner can normally be reached on Monday to Friday from 8:00AM to 5:00 PM.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Bradley Teets, can be reached on 571-272-3338. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://portal.uspto.gov/external/portal. Should you have questions about access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
/ZENGPU WEI/
Examiner, Art Unit 2197
