Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This office action is in response to the application filed on 12/12/2024. Claim 1-20 are pending in this application. Claims 1, 12, 20 are independent claims.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1 - 20 are rejected under 35 U.S.C. 101 because the claimed invention recites a judicial exception, is directed to that judicial exception, an abstract idea, it has not been integrated into practical application and the claims further do not recite significantly more than the judicial exception. Examiner has evaluated the claims under the framework provided in the 2019 Patent Eligibility Guidance published in the Federal Register 01/07/2019 and has provided such analysis below.
Regarding claims 1, 12 and 20 the limitations “compare the binary source code to source code of a current Software Bill-of-Materials (SBOM) to identify differences between the binary source code and the source code of the current SBOM”, “ in response to determining that there are differences between the binary source code and the source code of the current SBOM”, and “generate, for display in a user interface, component information associated with the identified differences between the binary source code and the source code of the current SBOM.” as drafted, are functions that, under their broadest reasonable interpretation, recite the abstract idea of a mental process. These limitations encompass a human mind carrying out these functions through observation, evaluation judgment and /or opinion, or even with the aid of pen and paper. Thus, this limitation recites and falls within the “Mental Processes” grouping of abstract ideas under Prong 1.
Under Prong 2, the judicial exception is not integrated into a practical application. The additional elements “microprocessor”, “a computer readable medium”, “receive a binary file”, “ based on the received binary file, generate binary source code”, “store, in a memory, the identified differences between the binary source code and the source code of the current SBOM”, and “for display in a user interface” merely recite instructions to implement an abstract idea on a generic computer, or merely uses a generic computer or computer components as a tool to perform the abstract idea, thus is not a practical application under Prong 2. Accordingly, the additional elements do not integrate the recited judicial exception into a practical application and the claim is therefore directed to the judicial exception. See MPEP 2106.05(f) and (g), respectively.
Under Step 2B, the claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception. As stated above in prong 2, the additional elements “receive a binary file”, “ based on the received binary file, generate binary source code”, “store, in a memory, the identified differences between the binary source code and the source code of the current SBOM”, and “for display in a user interface” merely recite instructions to implement an abstract idea on a generic computer, or merely uses a generic computer or computer components as a tool to perform the abstract idea, and the additional element “receive a binary file; based on the received binary file, generate binary source code” is merely gathering data which the courts have identified as well-understood, routine conventional activity. Therefore, the additional elements do not amount to significantly more, thus, cannot provide an inventive concept. Accordingly, the claims are not patent eligible under 35 USC 101.
Claims 1 and 20 recite further additional elements “a microprocessor,” “a computer readable medium, coupled with the microprocessor and comprising microprocessor readable and executable instructions that, when executed by the microprocessor, cause the microprocessor to,” and a “A non-transient computer readable medium having stored thereon instructions that cause a processor to execute a method, the method comprising instructions to” These additional elements are recited at a high-level of generality such that it amounts no more than mere instructions to apply the exception using generic computer, and/or generic computer components. See MPEP 2106.05(f). Therefore, the additional elements recited in claims 6 and 11 do not integrate the judicial exception into a practical application under prong 2, nor amount to significantly more under step 2B.
Regarding claims 2-4, 10-11, 18-19 the limitations recited in these claims merely describe the data being classified in each of claim 1, 12 thus are likewise analyzed under Prong 1 as mental process.
Regarding claim 2 the limitations “identified differences …”; “search a component …”; “generate for display, in a user interface, component information for the identified …” and “add component information …” recite the functions that can be mentally done in human mind under Prong I step 2A. The other limitations “one or more missing software components and/or the identified one or more missing software licenses”; “for display, in a user interface”; and “ receive …” are the additional elements that recites at a high-level of generality such that it amounts no more than mere instructions to apply the exception using generic computer, and/or generic computer components. See MPEP 2106.05(f); and merely gathering data which the courts have identified as well-understood, routine conventional activity. Therefore, the additional elements as recited do not integrate the judicial exception into a practical application.
Regarding claim 3 the limitations “identified differences …”; “search a component database …”; “generate for display, in a user interface, component information for the identified …” and “replace component information …”, “remove the component information…” and “add the component information …” recite the functions that can be mentally done in human mind under Prong I step 2A. The other limitations “one or more incorrect software components…”; “for display, in a user interface”; and “ receive, via the user interface, an input to replace component …”; “remove the component information …”; and “add the component information …” are the additional elements that recites at a high-level of generality such that it amounts no more than mere instructions to apply the exception using generic computer, and/or generic computer components. See MPEP 2106.05(f); and merely gathering data which the courts have identified as well-understood, routine conventional activity. Therefore, the additional elements as recited do not integrate the judicial exception into a practical application.
Regarding claim 4, the limitation “identified differences…” recite the functions that can be mentally done in human mind under Prong I step 2A. There is no additional elements that would integrate into a practical application.
Regarding claim 5, the limitation “the binary file…the corresponding binaries” are considered as additional elements and analyzed under Prong II as merely recited instructions to implement an abstract idea on a generic computer or merely uses a generic computer or computer components as a tool to perform the abstract idea, thus does not integrate into a practical application.
Regarding claims 5-9, 13-17 the limitation “binary processing AI algorithm” merely recite instructions to implement an abstract idea on a generic computer or merely uses a generic computer or computer components as a tool to perform the abstract idea, thus is not a practical application under Prong 2.
Regarding claim 10, 18 the limitation “AI algorithm” merely recite instructions to implement an abstract idea on a generic computer or merely uses a generic computer or computer components as a tool to perform the abstract idea, thus is not a practical application under Prong 2.
Regarding claim 11, 19 the limitations “comparing the…”; “identified any differences…” recite the functions that can be mentally done in human mind under Prong I step 2A. There is no additional elements that would integrate into a practical application.
Additionally, claim 20 is further rejected under 35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter. The claim does not fall within at least one of the four categories of patent eligible subject matter because they cover both statutory and non-statutory embodiments (under the broadest reasonable interpretation of the claim when read in light of the specification and in view of one skilled in the art) and embraces subject matter that is not eligible for patent protection, and therefore is directed to non-statutory subject matter.
“[a] transitory, propagating signal … is not a “process, machine, manufacture, or composition of matter.” Those four categories define the explicit scope and reach of subject matter patentable under 35 U.S.C. § 101; thus, such a signal cannot be patentable subject matter.” (In re Petrus A.C.M. Nuijten; Fed Cir, 2006-1371, 9/20/2007). Claim 20 recites “A non-transient computer readable medium” The claim does not fall within at least one of the four categories of patent eligible subject matter because the claim is directed to a signal per se. Specifically, Applicant’s specification loosely defines the term “computer readable medium” in paragraphs [0008-0010] that would cover both transitory and non-transitory medium but not really mention anything about the term “non-transient computer readable medium”. Thus, the term “non-transient computer readable medium” can be interpreted under BRI as both transitory and non-transitory computer readable medium wherein transitory computer readable medium is not eligible for patentability. It is recommended to amend the claim by changing “A non-transient” to “non-transitory” in the preamble of the claim.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim 1-11,12-19, 20 are rejected under 35 U.S.C. 103 as being anticipated by Golan et al. (US 20220405397 A1) in view of Kairali et al. (US 20240126530 A1).
Regarding claim 1, Golan teaches A system comprising: a microprocessor (Fig. 614 – Processor); and a computer readable medium (Fig. 4 612 - Memory), coupled with the microprocessor and comprising microprocessor readable and executable instructions that, when executed by the microprocessor, cause the microprocessor to:
receive a binary file (Fig. 4B, 446 – Receive updated executable for updated version of application; Pg. 11, [0072] lines 1-5: “Turning our attention to FIG. 4B, workflow 440 begins, after a start block, at block 446. At block 406, the application security service 320 may receive a copy of an updated executable 306 for an updated version of the application.” Examiner notes 406 above should be 446);
based on the received binary file, generate binary source code (Fig. 4B, 452 – Generate updated source code via decompilation process of updated executable; Pg. 12, [0076] lines 7-12:” For embodiments where the updated executable 306 is a binary executable, workflow 440 may proceed to block 452. At block 452, the decompiler 344 may perform a decompilation process of the updated executable 306 to generate updated source code for the updated version of the application.”);
compare the binary source code to source code of a current Software Bill-of-Materials (SBOM) that that is associated with the binary file to identify differences between the binary source code and the source code of the current SBOM (Fig .4B 456 – Determine differences between updated source code and previous source code; Pg. 12 [0077] lines 9-12: “At block 456, the code difference generator 346 may determine or generate one or more differences between the updated source code 306 and the previous source code”. Examiner notes previous source code may be the current source code (Pg. 12 [0077] lines 8-9: “The previous source code may be the current source code stored in block 422 of workflow 400”);
Golan does not teach in response to determining that there are differences between the binary source code and the source code of the current SBOM, store, in a memory, the identified differences between the binary source code and the source code of the current SBOM.
Kairali teaches in response to determining that there are differences between the binary source code and the source code of the current SBOM, store, in a memory, the identified differences between the binary source code and the source code of the current SBOM (Kairali, Pg. 11, lines 9-17: “In some embodiments, when a lack of compliance is detected (e.g., an SBOM indicates the software is missing a required control, etc.) by the host process 420 may also compare the list 430 of SBOMs for the software programs to a list of similar SBOMs to see how problems were addressed stored in another database 424. This can provide the host process with suggestions for fixing problems for which solutions are not readily identifiable.”).
Golan does not teach generate, for display in a user interface, component information associated with the identified differences between the binary source code and the source code of the current SBOM.
Kairali teaches generate, for display in a user interface, component information associated with the identified differences between the binary source code and the source code of the current SBOM (Fig. 4C - User Interface 460; Pg. 11, [0106] lines 1-9: “Referring now to FIG. 4C, upon detecting the recommended controls 442 to be installed in the software program, the host process 420 may display a notification to a user interface 460. As an example, the host process 420 may display the notification to a developer, owner, or the like, of the software program with a request to install the missing controls 462 which in this example is a missing software library.”);
Golan and Kairali are considered analogous to the claimed invention because they are both directed to system and method to identify threats to software applications. Therefore, it would have been obvious to a person having ordinary skill in the art before the effective filing date of the claimed invention to utilize Kairali’s teaching of “in response to determining that there are differences between the binary source code and the source code of the current SBOM, store, in a memory, the identified differences between the binary source code and the source code of the current SBOM” and “generate, for display in a user interface, component information associated with the identified differences between the binary source code and the source code of the current SBOM“ to Golan’s invention in order to efficiently visualizing and rectifying the identified differences.
Regarding claim 2, Golan in view of Kairali teach The system of claim 1, wherein the identified differences between the binary source code and the source code of the current SBOM comprise one or more missing software components and/or one or more missing software licenses and wherein the microprocessor readable and executable instructions further cause the microprocessor to:
search a component database to identify the one or more missing software components and/or the one or more missing software licenses (Kairali, Pg. 10, [0105] line 4 - Pg. 11 lines 1-6: “If a control of a software program is detected as missing or is incorrect based on an SBOM of the software program in comparison to its required controls, the host process 420 may determine which controls need to be installed in the software program within the hybrid environment from the required controls stored in the database 422”);
and generate for display, in a user interface, the identified one or more missing software components and/or the identified one or more missing software licenses (Kairali, Pg. 11, [0106], lines 1-4:” Referring now to FIG. 4C, upon detecting the recommended controls 442 to be installed in the software program, the host process 420 may display a notification to a user interface 460.”);
receive, via the user interface, an input to add component information for the identified one or more missing software components to the current SBOM and/or the identified one or more missing software licenses to a license file (Kairali, Pg. 11, [0106], lines 4-11 “As an example, the host process 420 may display the notification to a developer, owner, or the like, of the software program with a request to install the missing controls 462 which in this example is a missing software library. The user may select to install the missing controls via the user interface 460. For example, the user may select a button, menu, icon, radio button, etc. and make a selection.”);
and add the component information for the one or more identified missing software components to the current SBOM and/or the identified one or more missing software licenses to the license file (Kairali, Pg. 11, [0106] lines 11-19: “In response, the host process 420 may trigger the agent 422 to operate in remedy mode. Here, the host process 420 may generate a software update 464 with the missing component (e.g., an open source library in this example, etc.) and deliver the software update to the agent 422 installed within the hybrid environment 410. In response, the agent 422 may install the software update 464 the hybrid environment such as within one or more of the private cloud and the public cloud of the hybrid environment.”).
Regarding claim 3, Golan in view of Kairali teach The system of claim 1, wherein the identified differences between the binary source code and the source code of the current SBOM comprise one or more incorrect software components and/or one or more incorrect software licenses and wherein the microprocessor readable and executable instructions further cause the microprocessor to:
search a component database to identify one or more correct software components and/or one or more correct software licenses (Kairali, Pg. 10, [0105] line 4 - Pg. 11 lines 1-6: “If a control of a software program is detected as missing or is incorrect based on an SBOM of the software program in comparison to its required controls, the host process 420 may determine which controls need to be installed in the software program within the hybrid environment from the required controls stored in the database 422”);
and generate for display, in a user interface, component information for the identified one or more correct software components and/or the identified one or more correct software licenses (Kairali, Pg. 11, [0106], lines 1-4:” Referring now to FIG. 4C, upon detecting the recommended controls 442 to be installed in the software program, the host process 420 may display a notification to a user interface 460.”);
receive, via the user interface, an input to add component information for the identified one or more missing software components to the current SBOM and/or the identified one or more missing software licenses to a license file (Kairali, Pg. 11, [0106] lines 4-11 “As an example, the host process 420 may display the notification to a developer, owner, or the like, of the software program with a request to install the missing controls 462 which in this example is a missing software library. The user may select to install the missing controls via the user interface 460. For example, the user may select a button, menu, icon, radio button, etc. and make a selection.”);
receive, via the user interface, an input to replace component information for the identified one or more incorrect software components in the current SBOM and/or the identified one or more incorrect software licenses from a license file (Kairali, Pg. 11, [0106] lines 4-11 “As an example, the host process 420 may display the notification to a developer, owner, or the like, of the software program with a request to install the missing controls 462 which in this example is a missing software library. The user may select to install the missing controls via the user interface 460. For example, the user may select a button, menu, icon, radio button, etc. and make a selection.”);
remove the component information for the identified one or more incorrect software components from the current SBOM and/or remove the identified one or more incorrect software licenses from the license file; and add the component information for the identified one or more correct software components to the current SBOM and/or add the identified one or more correct software licenses to the license file. (Kairali , Pg. 2, [0030] lines 1 to end: “The host service may include a database with a list of controls (referred to herein as components) for each of the software programs currently running in the hybrid environment. These controls may include libraries, software packages, version information, third-party data, third-party software, and the like, which the software needs to run properly. The host service may compare the controls to the version of the software running within the hybrid environment to determine whether any of the software is missing the necessary controls. Should the controls be missing, the host service can automatically identify and install any missing controls through the form of software updates, patches, installation of applications or other programs, upgrading (or downgrading) versions of the software, and the like.” It’s obvious to one of ordinary skill in the art that upgrading or downgrading includes removing and installing (adding) different version i.e. correct version.).
Regarding claim 4, Golan in vew of Kairali teach wherein the wherein the identified differences between the binary source code the source code of the current SBOM comprise one or more extra software components in the binary source code (Golan, Pg. 12, [0079], lines 4-12: “As described throughout, the one or more ML risk models may be trained to detect patterns in the one or more differences that indicate a likelihood for a potential security threat associated with the differences in the source code. For example, differences in components of the application's source code that are related to network functionality and/or operations may be more indicative of security threats than differences in components related to data logging operations.)
Regarding claim 5, Golan in view of Kairali teach The system of claim 1, wherein the binary file and the source code of the current SBOM are input prompts to a binary processing AI algorithm and wherein the binary processing AI algorithm is trained on source code used to generate corresponding binaries and the corresponding binaries (Golan, Pg. 4, [0025} lines 1-4: “As described throughout, the ML risk model may be trained to detect patterns in the one or more differences that indicate a likelihood for a potential security threat associated with the differences in the source code.”; Pg. 14, [0091], lines 1-6: “At block 520, one or more difference risk scores may be determined for the updated version of the application. The one or more difference risk scores may be based on a machine learning (ML) risk model that analyzes the one or more differences between the updated source code and the previous source code. “).
Regarding claim 6, Golan in view of Kairali teach The system of claim 5, wherein the input prompts also comprise an input prompt that identifies one or more of: a compiler type, a compiler version, a compiler name, a compiler option and text to direct the binary processing AI algorithm to identify source code of missing, extra, and/or incorrect version software components in the current SBOM (Golan, Pg. 4, [0025], lines 9-13: “In some embodiments, the ML risk model may be trained via one or more supervised methods, e.g., with labeled training data indicating examples of known security threats and examples of more secure differences in the source code.”).
Regarding claim 7, Golan in view of Kairali do not teach wherein the binary processing AI algorithm further comprises a vector AI algorithm that vectorizes the source code of the current SBOM and binary source code to identify the differences between the binary source code and the source code of the current SBOM (Golan, Pg. 4, [0025], lines 9-16: “In some embodiments, the ML risk model may be trained via one or more supervised methods, e.g., with labeled training data indicating examples of known security threats and examples of more secure differences in the source code. In other embodiments, the ML risk model may be trained via unsupervised methods (e.g., unsupervised clustering of vector representations of components of source code.”).
Regarding claim 8, Golan in view of Kairali teach The system of claim 1, wherein the binary file is an input prompt to a binary processing AI algorithm, wherein the binary processing AI algorithm is trained on source code used to generate corresponding binaries and the generated corresponding binaries (Golan, Pg. 4, [0025} lines 1-4: “As described throughout, the ML risk model may be trained to detect patterns in the one or more differences that indicate a likelihood for a potential security threat associated with the differences in the source code.”), wherein an output from the binary processing AI algorithm is the binary source code (Golan, Pg. 9, lines 6-9: “That is, a decompilation process may receive the updated binary executable 306 as input, and generate updated source code for the updated versions of the application, as output”), and wherein comparing the binary source code to the source code of the current SBOM is accomplished by at least one of: a diff tool or a diff AI algorithm (Golan, Fig. 3, 346- CODE DIFFERENCE GENERATOR and Pg. 8, [0054], lines 23-26: “The code difference generator 346 may determine one or more differences between the updated source code and the previous source code.”; Fig. 4B, 456- DETERMINE DIFFERENCES BETWEEN UPDATED SOURCE AND PREVIOUS SOURCE CODE, Pg. 12, [0077], lines 9-12: “At block 456, the code difference generator 346 may determine or generate one or more differences between the updated source code 306 and the previous source code.”).
Regarding claim 9, Golan in view of Kairali teach The system of claim 8, wherein in the comparing of the binary source code to the source code of the current SBOM is accomplished by the diff AI algorithm (Golan, Fig. 3, 346- CODE DIFFERENCE GENERATOR and Pg. 8, [0054], lines 23-26: “The code difference generator 346 may determine one or more differences between the updated source code and the previous source code.”; Fig. 4B, 456- DETERMINE DIFFERENCES BETWEEN UPDATED SOURCE AND PREVIOUS SOURCE CODE, Pg. 12, [0077], lines 9-12: “At block 456, the code difference generator 346 may determine or generate one or more differences between the updated source code 306 and the previous source code.”);
wherein the diff AI algorithm is a vector AI algorithm that vectorizes the binary source code and the source code of the current SBOM (Golan, Pg. 4, [0025], lines 9-16: “In some embodiments, the ML risk model may be trained via one or more supervised methods, e.g., with labeled training data indicating examples of known security threats and examples of more secure differences in the source code. In other embodiments, the ML risk model may be trained via unsupervised methods (e.g., unsupervised clustering of vector representations of components of source code.”).
Regarding claim 10, Golan in view of Kairali teach wherein comparing the binary source code to the source code of the current SBOM is accomplished by at least one of: a diff tool or a diff AI algorithm (Golan, Fig. 3, 346- CODE DIFFERENCE GENERATOR and Pg. 8, [0054], lines 23-26: “The code difference generator 346 may determine one or more differences between the updated source code and the previous source code.”; Fig. 4B, 456- DETERMINE DIFFERENCES BETWEEN UPDATED SOURCE AND PREVIOUS SOURCE CODE, Pg. 12, [0077], lines 9-12: “At block 456, the code difference generator 346 may determine or generate one or more differences between the updated source code 306 and the previous source code.”).
Regarding claim 11, Golan in view of Kairali teach The system of claim 1, wherein comparing the binary source code to the source code of the current SBOM that that is associated with the binary file to identify any differences between the binary source code and the source code of the current SBOM is accomplished when the binary file is being installed and/or being executed (Kairali, Pg. 2, [0030] lines 1-4: “The host service may include a database with a list of controls (referred to herein as components) for each of the software programs currently running in the hybrid environment.”).
Claim 12, 13-19 correspond to method claims of system claims 1, 5-11; therefore, they are rejected under the same rationale in the system claims 1, 5-11 respectively as shown above.
Claim 20 corresponds to non-transient computer readable medium claim of system claim 1; therefore, it is rejected under the same rationale in the system claims 1 as shown above.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
US 20220318127 A1 discloses system for software compiler integrity verification by utilizing decompiler and comparing generated source codes to identifying differences.
US 20250238509 A1 discloses Model-based process to validate build integrity of software product by comparing build artifact model with source code model.
US 20210149788 A1 discloses software diagnosis using transparent decompilation.
US 12518024 B1 discloses detection of weakness in binary code and utilizing AI model to detect weakness in decompiled codes.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to THUAN H NGUYEN whose telephone number is (571)270-0332. The examiner can normally be reached 8am-5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Chat Do can be reached at 5712723721. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/THUAN HUU NGUYEN/Examiner, Art Unit 2648
/Chat C Do/Supervisory Patent Examiner, Art Unit 2193
