Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
Claims 21-40 have been examined.
Priority
Acknowledgment is made of applicant's claim for foreign priority based on U.S. Patent Application No. 16/698,925, 17/348,680, (matured to U.S. Patent No. 12,189,780) filed on June 15, 2021, which is continuation of U.S. Patent Application No. 16/698,925, (matured to U.S. Patent No. 11,106,800) filed November 27, 2019, which claims priority to U.S. Provisional Patent Application No. 62/825,737 filed March 28, 2019 and to U.S. Provisional Patent Application No. 62/773,892 filed November 30, 2018.
Information Disclosure Statement
The examiner reviewed IDS document(s) on 5/1/25 and 1/5/26, carefully considering the art cited within the document(s).
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/process/file/efs/guidance/eTD-info-I.jsp.
Claim(s) 21-22, 27-31 and 36-40 is/are rejected on the ground of nonstatutory double patenting as being unpatentable over claim(s) 1-27 of U.S. Patent No. 11,106,800 and claims 1-20 of U.S. Patent No. 12,189,780. Although the claims at issue are not identical, they are not patentably distinct from each other because they either recite a concomitance of the claim features, or they are their obvious modifications. Specifically, the instant claims are essentially a broader.
For example, compare claim 30 and 38 with claims 1 and 10/13 in the corresponding patents.
NOTE: Once metes and bounds of claims 23-26 and 32-35 are ascertained (see 35 USC § 112 rejection bellow, the double patenting rejection may be extended these claims as well.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), first paragraph:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 23-26 and 32-35 rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for pre-AIA the inventor(s), at the time the application was filed, had possession of the claimed invention.
As described below, the disclosure does not provide adequate structure of the claimed means plus function elements (i.e. telemetry mechanism configured to throttle or drop data to prevent … , configured to operate below a resource …, especially in light of the dependent claims, e.g. the resource threshold including a CPU/RAM threshold) The specification does not demonstrate that applicant has made an invention that achieves the claimed function because the invention is not described with sufficient details that one of ordinary skill in the art can reasonable conclude that the inventor had possession of the claimed invention.
The following is a quotation of 35 U.S.C. 112(b):
(B) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 23-26 and 32-35 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor, or for pre-AIA the applicant regards as the invention.
Claim limitation telemetry mechanism configured to throttle or drop data to prevent …, and configured to operate below a resource …, especially in light of the dependent claims, e.g. the resource threshold including a CPU/RAM threshold, invokes 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. However, the written description fails to disclose the corresponding structure, material, or acts for performing the entire claimed function and to clearly link the structure, material, or acts to the function. Therefore, the examiner is unable to ascertain the metes and bounds of the claims, and the claims are indefinite and are rejected under 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph.
Applicant may:
(a) Amend the claim so that the claim limitation will no longer be interpreted as a limitation under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph;
(b) Amend the written description of the specification such that it expressly recites what structure, material, or acts perform the entire claimed function, without introducing any new matter (35 U.S.C. 132(a)); or
(c) Amend the written description of the specification such that it clearly links the structure, material, or acts disclosed therein to the function recited in the claim, without introducing any new matter (35 U.S.C. 132(a)).
If applicant is of the opinion that the written description of the specification already implicitly or inherently discloses the corresponding structure, material, or acts and clearly links them to the function so that one of ordinary skill in the art would recognize what structure, material, or acts perform the claimed function, applicant should clarify the record by either:
(a) Amending the written description of the specification such that it expressly recites the corresponding structure, material, or acts for performing the claimed function and clearly links or associates the structure, material, or acts to the claimed function, without introducing any new matter (35 U.S.C. 132(a)); or
(b) Stating on the record what the corresponding structure, material, or acts, which are implicitly or inherently set forth in the written description of the specification, perform the claimed function. For more information, see 37 CFR 1.75(d) and MPEP §§ 608.01(o) and 2181.
Appropriate correction/clarification is required.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966), that are applied for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 30-31 and 38-39 are rejected under 35 U.S.C. 103 as being unpatentable over Li (USPUB 20160021134) in view of Reves (Reeves, et al., Lightweight Intrusion Detection for Resource-Constrained Embedded Control Systems. 5th International Conference Critical Infrastructure Protection (ICCIP), 3/11, pp.31-46, 10.1007/978-3-642-24864-1_3; the references cited within the received IDS documents).
As per claim 30, Li teaches a method, comprising: monitoring a kernel of a computing node with a sensor for an activation of one or more collection mechanisms associated with the sensor, that provide telemetry data from the kernel for the sensor; determining that a strategy pattern match has occurred with a detection strategy for a stack pivot by detecting, with the activation of at least one of the one or more collection mechanisms, that a stack pointer has referenced an address outside normal stack bounds; and in response to the strategy pattern match occurring, taking a remedial action to an exploit chain on the computing node associated with the stack pivot (during a malware attack, a stack pivoting exploits need to call APIs to deliver some functions. After the calls have been logged by stack pivoting logging module, stack pivoting detection module can detect stack pivoting by comparing the valid stan range with instructions ESP register value for API calls which can identify attack. After malware is detected, the log may be analyzed to rebuild the exploit path and analyze the malware, col. 31-35, for example. Note that stack pivoting logging module 28 uses Hooked DLL 48a that can be a hooked kernel32.DLL or a file including NT kernel function, see para 31 and Fig. 2).
Although Li’s invention pertains to kernel probes using one or more collection mechanism (that stack pivoting logging module 28 uses Hooked DLL 48a that can be a hooked kernel32.DLL or a file including NT kernel function, see para 31 and Fig. 2) the prior art fails to teach the mechanism including at least one of a Kprobe and a Kretprobe. However, Ramaswamy teaches collection mechanism comprising including at least one of a Kprobe and a Kretprobe (probing Kernel through kprobes to get instructions before is executed in order to identify malware, see Kprobes in 3.4 section and Abstract). It would have been obvious to one of ordinary skill in the art at the time the application was filed to include known mechanism as discussed by Ramaswamy given the predictable benefit of monitoring kernel while saving development costs and time.
As per claim(s) 38 and [21, addressed below and], a skilled in the art would readily appreciate that the computing functionalities are provided by memory executing computing code, including the code embodied in a computer media.
As per the limitation of claims 31 and 39 [as well as 22 dependent on claim 21 addressed, below], clearly a skilled artisan would appreciate that elements of the devices are configured to use a highest performing functionalities available on the devices. Thus, even if such solution would have not been entertained, the examiner asserts that such solution would have been obvious old and well known in the art at the time the application was filed and the claim would have been obvious because a person of ordinary skill would have good reason to pursue the known options within his or her technical grasp. If this leads to the anticipated success, it is likely the product not of innovation but of ordinary skill and common sense.
Lastly, as per claims 32-35 [as well as 23-26, dependent on claim 21 addressed below, given no particular definition or functional language defining “resource threshold”, the examiner asserts that these limitations, if not inherent, it would have been at least implicit. Clearly, a skilled in the art would strive to configured any mechanisms (including telemetry collection mechanisms) placed on computing nodes to be below resource thresholds (e.g., resource capabilities) in order to not only make the computing node be more efficient but also prevent errors and possible malfunction of the machine and its resources. Similarly, throttle or dropping data, if not inherent, would have been obvious (e.g., DDOS attack prevention) given the predictable benefit of efficiency and availability. Thus, theses claim would have been obvious because a person of ordinary skill has good reason to pursue the known options within his or her technical grasp. If this leads to the anticipated success, it is likely the product not of innovation but of ordinary skill and common sense.
Claims 21-26 are rejected under 35 U.S.C. 103 as being unpatentable over Li Reves and further in view of Anand (Pratyush Anand, “Dynamic tracing in Linux user and kernel space”, found at https://opensource.com/article/17/7/dynamic-tracing-linux-user-and-kernel-space, 7/17).
Li in view of Reves teach telemetry mechanism including Kprobe as discussed above.
Although Li in view of Reves clearly would necessitate facilitating collection hooks/probes for exported kernel symbols and collecting data on function entry to the kernel or function return from the kernel in order to be able detect the stack pivoting exploits and malware detection as taught by the prior art, Li/Reves fail to suggest the mechanism including at least one Kprobe and at least one Kretprobe to provide such these functionalities. However, including any particular probes to facilitate on-demand collection hook for exported kernel symbols or collecting data on function entry to the kernel or function return from the kernel, including well-known probes such as Kprobe/Kretprobe would have been obvious an obvious variant to one of ordinary skill in the art at the time the application as illustrated by Anand (see Probe point, Static vs dynamic probing and Tracing kernel space using kprobe sections) given the benefit of usability and the predictable benefit of probing kernel code.
Claims 28-29, 37 and 40 are rejected under 35 U.S.C. 103 as being unpatentable over Li in view of Reves and of Anand, and further in view of Garza (USPUB 20050278706, found in the applicant submitted IDS) or, in alternative Roundy (USPN 9659182, found in the applicant submitted IDS) and Pratt (USPN 10430591, found in the applicant submitted IDS).
Reves as modified teaches taking a remedial action as discussed above.
Reves does not but teach one of the remedial actions including one of generating an alert and terminating a network connection.
However, Garza or, in alternative Roundy and Pratt suggest such solution (see para Garza’s 26: an alert sent to the developer when debugging component invoked or Roundy’s col. 12 lines 8-25: security module may display a waning message to the user and notify an administrator of the unauthorized attempt … the security action taken may vary depending on the severity of the perceived threat and Pratt’s terminating a network connection, see step 350 of Fig. 3 with the associated text). ). It would have been obvious to one of ordinary skill in the art before the effective filling date of the invention to include Garza’s or Roundy’s teaching into Li’s as modified system given the benefit of making appropriate parties aware of the incident and enabling issue resolution. Also, it would have been obvious to one of ordinary skill in the art before the effective filling date of the invention to include Pratt’s teaching into Li’s as modified invention given the benefit of security. Similarly, it would have been obvious to one of ordinary skill in the art before the effective filling date of the invention to include the known solution such as taught by Li’s as modified into Pratt’s invention given the predictable benefit of monitoring/tracing/detecting events.
Claims 27 and 36 is rejected under 35 U.S.C. 103 as being unpatentable over Li in view of Reves and of Anand, and further in view, and further in view of Gassoway (USPUB 20070078915).
Li as modified teaches the strategy patterns as discussed above.
Li as modified does not but in the related art Gassoway teaches scanning kernel memory to determine whether a security mechanism associated with the strategy pattern match has been disabled (kernel level rootkit capable of finding the malicious process from the detection detected by scanning a kernel memory with a rootkit detector, para 2-4, 38 and 51, for example). It would have been obvious to one of ordinary skill in the art before the effective filling date of the invention to include Gassway teaching into Li’ as modified invention given the predictable benefit of security.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Peter Poltorak whose telephone number is (571) 272-3840. The examiner can normally be reached Monday through Thursday from 9:00 a.m. to 5:00 p.m.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Pwu can be reached on (571) 272-6798. The fax phone number for the organization where this application or proceeding is assigned is (571) 273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
/PIOTR POLTORAK/Primary Examiner, Art Unit 2433
Prosecution Insights