DETAILED ACTION
Claims 1- 20 are pending.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory obviousness-type double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); and In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on a nonstatutory double patenting ground provided the reference application or patent either is shown to be commonly owned with this application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The USPTO internet Web site contains terminal disclaimer forms which may be used. Please visit http://www.uspto.gov/forms/. The filing date of the application will determine what form should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to http://www.uspto.gov/patents/process/file/efs/guidance/eTD-info-I.jsp.
Effective January 1, 1994, a registered attorney or agent of record may sign a terminal disclaimer. A terminal disclaimer signed by the assignee must fully comply with 37 CFR 3.73(b).
Claims 1-20 are rejected on the ground of nonstatutory obviousness-type double patenting as being unpatentable over claims 1-20 of co-pending application 19/027,092. Although the conflicting claims are not identical, they are not patentably distinct from each other because the claims are directed to substantially the same subject matter involving the steps of (1) obtaining a list of hardware components of the data processing system that are compliant with a security protocol and data model (SPDM) security standard and (2) managing operation of the data processing system based on the security posture to reduce a likelihood of the data processing system being compromised.
Instant Application 19/027,016
Co-pending Application 19/027,092
1. A method for managing operation of a data processing system, the method comprising: during a startup of a data processing system:
obtaining a list of hardware components of the data processing system that are compliant with a security protocol and data model (SPDM) security standard using an existing list of hardware components that are compliant with the SPDM security standard and any new hardware components of the data processing system that are not identified in the existing list;
performing a measurement process based on the security protocol and data model security standard for hardware components listed in the list of hardware components to obtain a plurality of measurements;
evaluating, using a trusted platform module, a security posture of the data processing system based on the plurality of measurements; and
managing operation of the data processing system based on the security posture to reduce a likelihood of the data processing system being compromised.
1. A method for managing operation of a data processing system, the method comprising: during a startup of the data processing system:
making, by a management controller of the data processing system, an identification that at least one hardware component of the data processing system that is operably connected to the management controller is compliant with a security protocol and data model (SPDM) security standard; based on the identification:
performing, by the management controller, a measurement process based on the SPDM security standard for the at least one hardware component to obtain at least one measurement;
providing, by the management controller, the at least one measurement to an entity of the data processing system;
collaboratively evaluating, by the entity and a trusted platform module (TPM) of the data processing system, a security posture of the data processing system based on at least the at least one measurement; and
managing operation of the data processing system based on the security posture to reduce a likelihood of the data processing system being compromised.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claims 1,3-9,11-15,17-20 are rejected under AIA 35 U.S.C. 102(a)(2) as being anticipated by Ponnuru (US 20240313983 A1).
Regarding claim 1, Ponnuru discloses a method for managing operation of a data processing system, the method comprising:
during a startup of a data processing system: obtaining a list of hardware components of the data processing system that are compliant with a security protocol and data model (SPDM) security standard using an existing list of hardware components that are compliant with the SPDM security standard and any new hardware components of the data processing system that are not identified in the existing list [0045: an IHS comprises a first hardware device conforming to an SPDM specification, a second hardware device conforming to the SPDM specification][0046-0047][Claims 14-19];
performing a measurement process based on the security protocol and data model security standard for hardware components listed in the list of hardware components to obtain a plurality of measurements [0045: configured to receive a request to provision an SPDM certificate from the first hardware device, and a BMC configured to evaluate the SPDM certificate against an SPDM certificate profile policy and to notify the second hardware device whether the SPDM certificate is valid or not. The first hardware device is configured to send an SPDM SET_CERTIFICATE request message to the second hardware device in order to request provisioning of the SPDM certificate. The second hardware device is further configured to send an event notification message to the BMC, wherein the event notification message indicates receipt of the request to provision SPDM certificate in a slot on the second hardware device. The BMC is further configured to request the certificate profile policy obtained from a manufacturer of the second hardware device] [0046-0047] [Claims 14-19];
evaluating, using a trusted platform module, a security posture of the data processing system based on the plurality of measurements; and managing operation of the data processing system based on the security posture to reduce a likelihood of the data processing system being compromised [0046: The BMC is further configured to determine that the SPDM certificate is valid based on the certificate profile policy and to send a validation successful message to the second hardware device. The second hardware device is further configured to, in receipt of the validation successful message, send a certificate provision response to the first hardware device][0047: The BMC is further configured to determine that the SPDM certificate is not valid based on the certificate profile policy and to send a validation failure message to the second hardware device, and the second hardware device is configured to, upon receipt of the validation failure message, enter a quarantine state until a certificate chain is successfully validated][0046-0047][Claims 14-19].
Regarding claim 3, Ponnuru discloses the method of claim 1, wherein the SPDM security standard is a data model for hardware components of data processing systems, the SPDM security standard specifying, at least, methods of security communication between the hardware components, minimum standards of data to be made available to other hardware components, and security information to be made available to the other hardware components [0045-0047] [Claims 14-19].
Regarding claim 4, Ponnuru discloses the method of claim 1, wherein the plurality of measurements comprises security data usable to validate authenticity and/or integrity of software hosted by the hardware components listed in the list of hardware components [0045-0047] [Claims 14-19].
Regarding claim 5, Ponnuru discloses the method of claim 1, wherein managing operation of the data processing system comprises: limiting, by the trusted platform module, use of secrets by the data processing system based on the security posture of the data processing system [0045-0047] [Claims 14-19].
Regarding claim 6, Ponnuru discloses the method of claim 5, wherein evaluating the security posture of the data processing system comprises: checking integrity and/or authenticity of software hosted by the hardware components listed in the list of hardware components using the plurality of measurements and data structures trusted by the trusted platform module [0045-0047] [Claims 14-19].
Regarding claim 7, Ponnuru discloses the method of claim 1, wherein the existing list of hardware components is established by the data processing system prior to the startup of the data processing system [0027-0033] [0044].
Regarding claim 8, Ponnuru discloses the method of claim 1, wherein the startup of the data processing system is managed by a startup manager hosted by a hardware processor of the data processing system, and the trusted platform module is a hardware component that is distinguishable from the hardware processor [0013] [0015] [0022] [0024].
Regarding claims 9,11– 14, these claims are rejected for the same reasons as set forth in claims 1, 3-6 above.
Regarding claims 15,17-20, these claims are rejected for the same reasons as set forth in claims 1, 3-6 above.
Allowable Subject Matter
Claims 2,10,16 are objected to as being dependent upon a rejected base claim, but would be allowable if (1) rewritten in independent form including all of the limitations of the base claim and any intervening claims (2) overcome the double patenting rejection above.
The following is a statement of reasons for the indication of allowable subject matter:
The prior arts of record do not disclose nor suggest the limitation recited in claims 2,10,16.
Conclusion
Examiner's note: Examiner has cited particular paragraphs and columns and line numbers in the references as applied to the claims above for the convenience of the applicant. Although the specified citations are representative of the teachings of the art and are applied to the specific limitations within the individual claim, other passages and figures may apply as well. It is respectfully requested from the applicant in preparing responses, to fully consider the references in entirety as potentially teaching all or part of the claimed invention, as well as the context of the passage as taught by the prior art or disclosed by the examiner (see MPEP § 2123).
Any inquiry concerning this communication or earlier communications from the examiner should be directed to PHIL K NGUYEN whose telephone number is (571)270-3356. The examiner can normally be reached 9:30 a.m - 5 p.m.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jaweed Abbaszadeh can be reached at (571)270-1640. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/PHIL K NGUYEN/Primary Examiner, Art Unit 2176
Prosecution Insights