Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
DETAILED ACTION
Claims 1-20 are presented for examination.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 06/02/2025 has been considered. The submission is in compliance with the provisions of 37 CFR 1.97. Form PTO-1449 is signed and attached hereto.
Drawings
The drawings filed on 06/02/2025 are accepted by the examiner.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale or otherwise available to the public before the effective filing date of the claimed invention.
1. Claims 1-20 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Nickolov et al. (US Publication No. 2017/0034023, hereinafter “Nickolov”).
Regarding Claims 1, 12, and 20, Nickolov does disclose a method of managing information describing one or more vulnerabilities of a first software product (vulnerability processing 328 may be configured or designed to include functionality for processing new or changed vulnerability data, Para. [0160]), comprising: accepting, from a first software producer, first information describing the first software product (package information, such as, for example, package name, vendor, version, architecture, and release, as well as a list of CVEs [Common Vulnerabilities and Exposures] which have been fixed for the package, extracted on the subscriber from package changelogs, Para. [0330]; See also updated versions of packages and/or about new packages to be installed, such as, for example, the operating system "yum" and "apt" repositories, the Microsoft Update service, Para. [0331]), wherein: the first software product comprises a first set of software components (combinations of software packages, Para. [0422]; See also specific components of the complete specified package version information, Para. [0777]); the first information comprises: an identifier of each software component of the first set of software components (Package name and Package version information, Para. [0772] & [0773]; [the package is interpreted as a software component and the combination of software packages [Para. [0422]] is interpreted to correspond to the first set of software components]; [the name and version information of the package[s] are interpreted to correspond to identifiers]); accepting, from a database, second information describing one or more vulnerabilities of each of a second set of software components the second set of software components used by a plurality of software products (a list of CVEs [Common Vulnerabilities and Exposures] which have been fixed for the package, extracted on the subscriber from package changelogs, Para. [0330]; [Applicant's Specification, at Para. [0066], indicates that "the vulnerable software components of the software product can be determined as an intersection of the first set of software components [those software components in the software product] and the second set of software components [software components with known vulnerabilities]; [Thus, the first set of software components arc interpreted to correspond to the software components in the software product and the second set of software components are interpreted to correspond to those with known vulnerabilities]), the second information comprising: an identifier of each software component of the second set of software components, the identifier associated with each vulnerability of the respective software component of the second set of software components (vulnerability ID, Para. [0379]; See also CVE [Common Vulnerabilities and Exposures] identifier, Para. [0402]; See also a list of vulnerable software by name and version, Para. [0402]); for each vulnerability of the respective software component of the second set of software components, an identifier of a model of a device upon which each of the second set of software components is installed for execution (a configuration element is an attribute or characteristic of the server and includes chipset model and version and device or virtualization driver name and version, Paras. [0314], [0322] & [0323]; [the chipset model and version and device driver name and version are interpreted to correspond to an identifier of a model of a device upon which each of the second set of software components is installed for execution]; See also technology aspects described herein may be implemented as a SaaS service combining crowdsourced server and vulnerability data with big-data analytics to provide visibility into server reliability, vulnerability and change confidence, Para. [0020]);
storing the first information and the second information in a second database (DataGrid Application periodically checks public feeds of CVE [Common Vulnerabilities and Exposures] data and package changelogs, and processes this data, storing it in a database and using it to associate vulnerabilities to packages and to configurations, thereby impacting the DGRI Score for configurations and packages, Para. [0045]); processing the stored first information and the stored second information to identify vulnerable components of the first software product (DataGrid Application periodically checks public feeds of CVE [Common Vulnerabilities and Exposures] data and package changelogs, and processes this data, storing it in a database and using it to associate vulnerabilities to packages and to configurations, thereby impacting the DGRI Score for configurations and packages, Para. [0045]); and providing each of the identified vulnerable components of the first software product and the respective vulnerability of each of the identified vulnerable components of the first software product (DataGrid Application also includes an analytics engine which analyzes server, configuration, signal, and vulnerability data in order to determine the DGRI Scores for configurations or other entities such as packages, Para. [0045]; See also updating the association of vulnerabilities to packages or vulnerabilities to configurations which is stored in the DG Database Repository 334, Para. [0160])
Regarding Claim 2, Nickolov does disclose the method of claim 1, wherein the first set of software components are open source software components (information about package and configuration vulnerabilities may be obtained from databases provided by vendors and/or communities, including operating system vendors, packaged software vendors, open source communities, Para. [0405]).
Regarding Claim 3, Nickolov does disclose the method of claim 1, wherein: accepting, from a first software producer, first information describing the first software product comprises: accepting source code of the first software product (execute code transformations [e.g., run migration tool to upgrade source code from python version 2 to python version 3 so that this code will run on python version 3], Para. [1258]; [Para. [1258] is interpreted to describe that the versions are source code]; See also updated versions of packages and/or about new packages to be installed, such as, for example, the operating system "yum" and "apt" repositories, the Microsoft Update service, Para. [0331]); scanning the source code of the first software product to identify the first information (3. Automatically and/or dynamically identify package versions [interpreted as source code as discussed above] that cause reliability problems, Para. [1261]; See also 4. Automatically and/or dynamically identify combination of software components that don't work well together [whether in general or specific versions, e.g., component A version 3 does not work well with component B version 5 but OK with version 4], Para. [1262]; See also combinations of two or more component may be evaluated and identified, Para. [1262]); and providing the first information (at least a portion of this data may be analyzed not only to provide insight into the confidence of configurations and proposed configuration changes, but also to propose changes, whether in server configuration or resource allocation or any other characteristic of server composition or functioning, Para. [0066]; Sec also updating the association of vulnerabilities to packages or vulnerabilities to configurations which is stored in the DG Database Repository 334, Para. [0160]).
Regarding Claims 4 and 13, Nickolov does disclose the method of claim 1, the apparatus of claim 12, and wherein the processor instructions for processing the stored first information and the stored second information to identify vulnerable software components of the first software product comprises: processor instructions for determining the vulnerable software components of the first software product as an intersection of the first set of software components and the second set of software components (4. Automatically and/or dynamically identify combination of software components that don't work well together [whether in general or specific versions, e.g., component A version 3 does not work well with component B version 5 but OK with version 4], Para. [1262]); and associating the vulnerable software components with the first software product (See also updating the association of vulnerabilities to packages or vulnerabilities to configurations which is stored in the DG Database Repository 334, Para. [0160]).
Regarding Claims 5 and 14, Nickolov does disclose the method of claim 4, the apparatus of claim 13, and wherein: the first information further comprises: an identifier of a version of the respective software component of the first set of software components (specific components of the complete specified package version information, Para. [0777]; See also identify packages and specific versions/ releases that are vulnerable VS. those that have patches for these vulnerabilities, Para. [0222]; See also identifiers for each installed package such as name, version, release, architecture, vendor, Para. [0030]); Reasoned statement under Rule 43bis.1(a)(i) with regard to novelty, inventive step and industrial applicability; citations and explanations supporting such statement an identifier of a publisher of the respective software component of the first set of software components (identifiers for each installed package such as name, version, release, architecture, vendor, Para. [0030]; See also vendor is referred to as 3rd party published, Para. [0141]; [a vendor is interpreted to correspond to a publisher based on Para. [0155]); the processor instructions for processing the stored first information and the second information to identify vulnerable components of the first software product comprises processor instructions for: accepting a query to identify the vulnerable components of the first software product (command line utility for enabling local and/or remote users to query the DataGrid Application
API to get information about servers, configurations and vulnerabilities pertaining to a particular account, Para. [0047]); wherein: the query is a manual query or an automatic query (the query of Para. [0047] is interpreted to be manual because of the command line utility and user input requirement); the query comprises at least one of: an identifier of the first software product; an identifier of at least one software component of the first set of software components; an identifier of the publisher of the respective component of the first set of components; and the identifier of the model of the device upon which the first software product is to be installed for execution (example use cases include [query] obtain detailed information about a particular system, incl. IP address, hostname, configuration details, etc., Para. [0184] & [0295]; See also configuration data [details] may include identifiers of each installed package such as name, version, release, architecture and vendor, Para. [0030]; [the query using configuration details is interpreted to include identifiers of each software package including name, version, vendor, which are interpreted to correspond to at least one of an identifier of the first software product, and an identifier of a publisher [vendor]]).
Regarding Claims 6 and 15, Nickolov does disclose the method of claim 5, the apparatus of claim 14, and wherein: cach respective vulnerability is associatively presented with the associated identified vulnerable software component and the identifier of the device model (associate vulnerabilities to packages and to configurations, thereby impacting the DGRI Score for configurations and packages, Para. [0045]; See also configuration data [details] may include identifiers of each installed package such as name, version, release, architecture and vendor, Para. [0030]; a configuration clement is an attribute or characteristic of the server and includes chipset model and version and device or virtualization driver name and version, Paras. [0314], [0322] & [0323]; [the chipset model and version and device driver name and version are interpreted to correspond to an identifier of a device model]).
Regarding Claims 7, Nickolov does disclose the method of claim 6, wherein: the information is managed in a software distribution system (updated versions of packages and/or about new packages to be installed, such as, for example, the operating system "yum" and "apt" repositories, the Microsoft Update service, Para. [0331]); each of the identified vulnerabilities are further associatively presented with a link to an external source presenting software vulnerability information (show additional vulnerability details for a package in the change set [c.g., by clicking on the See Details 3414 link of the Vulnerabilities section], Para. [0919]); and the method further comprises: modifying the first software product according to the presented software vulnerability information (updates at least one configuration in the database which includes this package to modify the list of vulnerabilities which affect that configuration [adding or removing as required], and recalculates the DGRI Score for the configuration, Para. [0391]); and providing the modified first software product to a consumer of the software product using the software distribution system (FIG. 34 illustrates an example screenshot of a graphical user interface [GUI] 3401 which may include functionality for causing the DataGrid System to initiate and/or perform various operation[s] and/or action[s] relating to the DataGrid technology such as, for example, one or more of the following [or combinations thereof]: Show additional vulnerability details for a package in the change set [e.g., by clicking on the See Details 3414 link of the Vulnerabilities section], Paras. [0917]-[0919]).
Regarding Claims 8 and 17, Nickolov does disclose the method of claim 1, the apparatus of claim 12, and wherein: the method further comprises [and the processor instructions further comprise instructions for]: accepting third information describing: an identifier of at least one of the first set of software components, the identifier associated with a further vulnerability of the respective software component (the Vulnerability Processing 328 may additionally trigger the Analysis Algorithms 331 to process the newly arrived vulnerability data in addition to the data already in the DG Database Repository 334, Para. [0160]); and for the at least one of the first set of software components, an identifier of a model of the device upon which the first set of software components are installed for execution (associate vulnerabilities to packages and to configurations, thereby impacting the DGRI Score for configurations citations and explanations supporting such statement and packages, Para. [0045]; See also configuration data [details] may include identifiers of each installed package such as name, version, release, architecture and vendor, Para. [0030]; a configuration element is an attribute or characteristic of the server and includes chipset model and version and device or virtualization driver name and version, Paras. [0314], [0322] & [0323]; [the chipset model and version and device driver name and version are interpreted to correspond to an identifier of a device model]); storing the third information in the second database (DataGrid Application periodically checks public feeds of CVE [Common Vulnerabilities and Exposures] data and package changelogs, and processes this data, storing it in a database and using it to associate vulnerabilities to packages and to configurations, thereby impacting the DGRI Score for configurations and packages, Para. [0045]); and wherein: [the processor instructions for] processing the stored first information and the stored second information to identify vulnerable components of the first software product comprises [instructions for]: processing the stored first information, the stored second information and the stored third information to identify vulnerable components of the first software product (DataGrid Application periodically checks public feeds of CVE [Common Vulnerabilities and Exposures] data and package changelogs, and processes this data, storing it in a database and using it to associate vulnerabilities to packages and to configurations, thereby impacting the DGRI Score for configurations and packages, Para. [0045]; See also the Vulnerability Processing 328 may additionally trigger the Analysis Algorithms 331 to process the newly arrived vulnerability data in addition to the data already in the DG Database Repository 334, Para. [0160]; [newly arrived vulnerability data is interpreted to correspond to the stored third information]).
Regarding Claims 9 and 18, Nickolov does disclose the method of claim 1, the apparatus of claim 12, and wherein: the method further comprises [the apparatus further comprises processor instructions for]: accepting, from a second software producer (vendor info 440 [or community info] [e.g., third party] existing database of known/reported vulnerabilities provided by vendors and/or community for OS or other software package and configuration artifact, Para. [0254]-[0255]; [vendors is interpreted as including two or more software producers]), third information describing a further software product (package information, such as, for example, package name, vendor, version, architecture, and release, as well as a list of CVEs [Common Vulnerabilities and Exposures] which have been fixed for the package, extracted on the subscriber from package changelogs, Para. [0330]; See also updated versions of packages and/or about new packages to be installed, such as, for example, the operating system "yum" and "apt" repositories, the Microsoft Update service, Para. [0331]), wherein: the further software product comprises a further set of software components (combinations of software packages, Para. [0422]; See also specific components of the complete specified package version information, Para. [0777]; See also vendor Info 440 [or Community Info] [e.g., third party] existing database of known/ reported vulncrabilitics provided by vendors and/or community for OS or other software package and configuration artifact, Paras. [0254]-[0255]; [vendors is interpreted as including two or more software producers]); and the third information comprises: an identifier for each software component of the further set of software components (Package name and Package version information, Para. [0772] & [0773]; [the package is interpreted as a software component and the combination of software packages [Para. [0422]] is interpreted to correspond to the first set of software components]; [the name and version information of the package[s] are interpreted to correspond to identifiers]); accepting, from the second software producer, fourth information describing one or more vulnerabilities of at least one of the further set of software components (a list of CVEs [Common Vulnerabilities and Exposures] which have been fixed for the package, extracted on the subscriber from package changelogs, Para. [0330]; [Applicant's Specification, at Para. [0066], indicates that "the vulnerable software components of the software product can be determined as an intersection of the first set of software components [those software components in the software product] and the second set of software components [software components with known vulnerabilities]; [Thus, the first set of software components are interpreted to correspond to the software components in the software product and the second set of software components are interpreted to correspond to those with known vulnerabilities]), the fourth information comprising: an identifier for each software component of the further set of software components, the identifier associated with cach vulnerability of a respective software component of the further set of software components (vulnerability ID, Para. [0379]; See also CVE [Common Vulnerabilities and Exposures] identifier, Para. [0402]; See also a list of vulnerable software by name and version, Para. [0402]); and for each vulnerability and each respective software component of the further set of software components, an identifier of a model of the device upon which cach of the further set of software components is installed for execution (a configuration element is an attribute or characteristic of the server and includes chipset model and version and device or virtualization driver name and version, Paras. [0314], [0322] & [0323]; [the chipset model and version and device driver name and version are interpreted to correspond to an identifier of a model of a device upon which each of the second set of software components is installed for execution]; See also technology aspects described herein may bc implemented as a SaaS service combining crowdsourced server and vulnerability data with big-data analytics to provide visibility into
server reliability, vulnerability and change confidence, Para. [0020]); storing the third information and the fourth information in the second database (DataGrid Application periodically checks public feeds of CVE [Common Vulnerabilities and Exposures] data and package changelogs, and processes this data, storing it in a database and using it to associate vulnerabilities to packages and to configurations, thereby impacting the DGRI Score for configurations and packages, Para. [0045]); and wherein: [the processor instructions for] processing the stored first information and the second information to identify the vulnerabilities of the first software product comprises: processing the stored first information, the second information, the third information, and the fourth information to identify the vulnerabilities of the first software product (DataGrid Application periodically checks public feeds of CVE [Common Vulnerabilities and Exposures] data and package changelogs, and processes this data, storing it in a database and using it to associate vulnerabilities to packages and to configurations, thereby impacting the DGRI Score for configurations and packages, Para. [0045]; See also 4. Automatically and/or dynamically identify combination of software components that don't work well together [whether in general or specific versions, e.g., component A version 3 does not work well with component B version 5 but OK with version 4], Para. [1262]; See also combinations of two or more component may be evaluated and identified, Para. [1262]; [the identifying of combination of software components that don't work well together is interpreted to correspond to processing the stored first information [a first software package/ component], the stored second information [a vulnerability of the first software package/component, such as incompatibility with a second software package/component], the stored third information [the second software package/component], and the stored third information [the vulnerability of the second software package/components, such as the incompatibility with the second software package/component]).
Regarding Claims 10 and 19, Nickolov does disclose the method of claim 9, the apparatus of claim 18, and wherein: [the processor instructions for] processing the stored first information and the stored second information, the stored third information and the stored fourth information to identify vulnerable components of the first software product comprises [processor instructions for]: determining vulnerable software components of the first software product as a union of: an intersection of the first set of software components and the second set of software components, and an intersection of the first set of software components and the vulnerable further set of software components (a list of CVEs [Common Vulnerabilities and Exposures] which have been fixed for the package, extracted on the subscriber from package changelogs, Para. [0330]; [Applicant's Specification, at Para. [0066], indicates that "the vulnerable software components of the software product can be determined as an intersection of the first set of software components [those software components in the software product] and the second set of software components [software components with known vulnerabilities]; [Thus, the first set of software components are interpreted to correspond to the software components in the software product and the second set of software components are interpreted to correspond to those with known vulnerabilities]).
Regarding Claim 11, Nickolov does disclose the method of claim 1, wherein: the one or
more of the vulnerabilities of the second set of software components is associated with a risk value (Monte Carlo simulation furnishes the decision-maker with a range of possible outcomes and the probabilities they will occur for any choice of action, and performs risk analysis by building models of possible results by substituting a range of values [e.g., probability distribution] for any factor that has inherent uncertainty, Para. [0681]); and the processing of the stored first information and the stored second information to identify vulnerable components of the first software product is configured to be automatically performed according to a schedule (Microsoft Update service, Para. [0331]; [Microsoft Update service is interpreted to correspond to a scheduled update corresponding to processing of stored first information [the software package/component] and the stored second information [the vulnerability information] to identify vulnerable components]); and the method further comprises: determining if any of the identified vulnerable components is associated with a risk value exceeding a configurable maximum risk value (examine vulnerability summaries in the block 4431, including total number of vulnerabilities affecting the system, maximum severity level, and maximum severity level that the system will have if all vulnerabilities that have fixes available are fixed [e.g., maximum severity level of the vulnerabilities for which a fix is currently not available], Para. [1058]; See also severity level [e.g., 1 meaning minor impact, 10 meaning critical], Para. [1064]; [critical severity level is interpreted to correspond to exceeding a configurable maximum risk value]); and notifying the first software producer if any of the identified vulnerable components is associated with a risk value exceeding the configurable maximum risk value (display the results of analysis of the system's information using the DataGrid Technology, such as, for example, results relating to one or more of the following [or combinations thereof]: Packages 4420, Vulnerabilities 4430, Para. [1050]; [displaying the results of the analysis is interpreted to include displaying the vulnerability data including critical severity level [i.e., the identified vulnerable component is associated with a risk value exceeding the configurable maximum risk value]).
Regarding Claim 16, Nickolov does disclose the apparatus of claim 15, wherein: each of the identified vulnerabilities are further associatively presented with a link to an external source presenting software vulnerability information (show additional vulnerability details for a package in the change set [e.g., by clicking on the See Details 3414 link of the Vulnerabilities section], Para. [0919]); and the processor instructions further comprise processor instructions for: modifying the first software product according to the presented software vulnerability information (updates at least one configuration in the database which includes this package to modify the list of vulnerabilities which affect that configuration [adding or removing as required], and recalculates the DGRI Score for the configuration, Para. [0391]).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
US Publication No. 2017/0147338, “A concept is to allow the system to establish and utilize arbitrary criteria to pass or not pass the software component which may have risks. Such risks can be security vulnerabilities, e.g., whether a software component has security vulnerabilities, even if it passes security tests or vetting; and/or licenses which are required by the software component. If the software component has pre-defined risks, the system can take actions which correspond to the failure and/or which correspond to the type of risk, such as blocking the software component or other pre-defined programmatic steps”.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MORSHED MEHEDI whose telephone number is (571) 270-7640. The examiner can normally be reached on M - F, 8:00 am to 4:00 pm EST. If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, Linglan Edwards can be reach on (571) 270-5440. The fax number for the organization where this application or proceeding is assigned is (571) 273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from their Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (In USA or Canada) or 571-272-1000.
/MORSHED MEHEDI/Primary Examiner, Art Unit 2408
Prosecution Insights