DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claims 1, 2, 5-8, 10-14, 16, 18, and 20 are rejected under 35 U.S.C. 102(a)(1)/(a)(2) as being anticipated by Aloisio et al. (hereafter referred to as “Aloisio”), U.S. Patent No. 10,873,604 B1.
As to claim 1, Aloisio discloses a computer-implemented method for preventing security vulnerabilities (Col. 3, ln. 54 – Col. 4, ln. 16, in particular, “Thus, the software system approach to automated dynamic reconfiguration of the network devices prevents cyber-attack reconnaissance, and provides fast remediation with low overhead costs.”), comprising:
monitoring communications between a computing system and an external server (Col. 8, ln. 58 – Col. 9, ln. 21);
identifying, a request from a third party to the external server, wherein the request seeks information regarding the computing system (Col. 1, ln. 18-26; Col. 3, ln. 54 – Col. 4, ln. 16, in particular, “The software system may help complex computing network environments sidestep cyber-attack reconnaissance by enabling context aware reconfiguration procedures that change the cyber-attack landscape of the network devices.” and “Thus, the software system approach to automated dynamic reconfiguration of the network devices prevents cyber-attack reconnaissance, and provides fast remediation with low overhead costs.”; Col. 9, ln. 5-21); and
in response to identifying the request, modifying a data transfer protocol between the computing system and the external server (Col. 2, ln. 19-41, in particular, “changing protocols between the network devices in a multi-tier reconfiguration solution”).
As to claim 2, Aloisio discloses wherein the external server is associated with a web domain (Col. 8, ln. 58 – Col. 9, ln. 21, in particular, “websites or web-based applications hosted on external servers” and “The proxy server may have a function of relaying a user's access to a resource device or the data of a website, for example”).
As to claim 5, Aloisio discloses wherein the request is associated with at least one of: a data exfiltration technique, a skimmer, malware, malicious code, unauthorized access and data transfer, and a security breach (Col. 1, ln. 18-26; Col. 3, ln. 54 – Col. 4, ln. 16, in particular, “The software system may help complex computing network environments sidestep cyber-attack reconnaissance by enabling context aware reconfiguration procedures that change the cyber-attack landscape of the network devices.” and “Thus, the software system approach to automated dynamic reconfiguration of the network devices prevents cyber-attack reconnaissance, and provides fast remediation with low overhead costs.”; Col. 9, ln. 5-21).
As to claim 6, Aloisio discloses wherein the communications between the computing system and the external server are monitored for at least one specific risk, wherein the at least one specific risk is associated with a user selection (Col. 1, ln. 18-26; Col. 3, ln. 54 – Col. 4, ln. 16, in particular, “The software system may help complex computing network environments sidestep cyber-attack reconnaissance by enabling context aware reconfiguration procedures that change the cyber-attack landscape of the network devices.” and “Thus, the software system approach to automated dynamic reconfiguration of the network devices prevents cyber-attack reconnaissance, and provides fast remediation with low overhead costs.”; Col. 9, ln. 5-21).
As to claim 7, Aloisio discloses wherein the at least one specific risk comprises at least one of: malware, personal identifying information (PII), a session replay, fingerprinting, a tracker, a young domain, a cookie request, a phishing attempt, a URL redirection, bad SSL, and a geographical risk (Col. 1, ln. 18-26; Col. 3, ln. 54 – Col. 4, ln. 16, in particular, “The software system may help complex computing network environments sidestep cyber-attack reconnaissance by enabling context aware reconfiguration procedures that change the cyber-attack landscape of the network devices.” and “Thus, the software system approach to automated dynamic reconfiguration of the network devices prevents cyber-attack reconnaissance, and provides fast remediation with low overhead costs.”; Col. 9, ln. 5-21).
As to claim 8, Aloisio discloses wherein modifying the data transfer protocol comprises blocking or filtering a data transfer between the computing system and the external server (Col. 9, ln. 5-21, in particular, “During operation, the proxy server may capture header information regarding the source network device 102 to determine whether to permit or block incoming data traffic”).
As to claim 10, Aloisio discloses a system for preventing security vulnerabilities (Col. 3, ln. 54 – Col. 4, ln. 16, in particular, “Thus, the software system approach to automated dynamic reconfiguration of the network devices prevents cyber-attack reconnaissance, and provides fast remediation with low overhead costs.”), comprising:
a processor and a memory comprising instructions, which when executed on the processor, cause the processor (Col. 6, ln. 37 – Col. 7, ln. 3; Col. 12, ln. 3-30) to at least:
monitoring communications between a computing system and an external server (Col. 8, ln. 58 – Col. 9, ln. 21);
identifying, a request from a third party to the external server, wherein the request seeks information regarding the computing system (Col. 1, ln. 18-26; Col. 3, ln. 54 – Col. 4, ln. 16, in particular, “The software system may help complex computing network environments sidestep cyber-attack reconnaissance by enabling context aware reconfiguration procedures that change the cyber-attack landscape of the network devices.” and “Thus, the software system approach to automated dynamic reconfiguration of the network devices prevents cyber-attack reconnaissance, and provides fast remediation with low overhead costs.”; Col. 9, ln. 5-21); and
in response to identifying the request, modifying a data transfer protocol between the computing system and the external server (Col. 2, ln. 19-41, in particular, “changing protocols between the network devices in a multi-tier reconfiguration solution”).
As to claim 11, Aloisio discloses wherein modifying the data transfer protocol comprises disabling at least one of: a personal identifying information (PII) transfer, a fingerprinting operation, a tracker, a session, a replay, and a malware operation associated with the computing system (Col. 1, ln. 18-26; Col. 3, ln. 54 – Col. 4, ln. 16, in particular, “The software system may help complex computing network environments sidestep cyber-attack reconnaissance by enabling context aware reconfiguration procedures that change the cyber-attack landscape of the network devices.” and “Thus, the software system approach to automated dynamic reconfiguration of the network devices prevents cyber-attack reconnaissance, and provides fast remediation with low overhead costs.”; Col. 9, ln. 5-21, in particular, “During operation, the proxy server may capture header information regarding the source network device 102 to determine whether to permit or block incoming data traffic”).
As to claim 12, the claim is rejected for the same reasons as those given for claim 2 above.
As to claim 13, Aloisio discloses wherein the communications between the computing system and the external server are monitored for at least one specific risk, and wherein the at least one specific risk comprises at least one of: malware, personal identifying information (PII), a session replay, fingerprinting, a tracker, a young domain, a cookie request, a phishing attempt, a URL redirection, bad SSL, and a geographical risk (Col. 1, ln. 18-26; Col. 3, ln. 54 – Col. 4, ln. 16, in particular, “The software system may help complex computing network environments sidestep cyber-attack reconnaissance by enabling context aware reconfiguration procedures that change the cyber-attack landscape of the network devices.” and “Thus, the software system approach to automated dynamic reconfiguration of the network devices prevents cyber-attack reconnaissance, and provides fast remediation with low overhead costs.”; Col. 9, ln. 5-21).
As to claim 14, the claim is rejected for the same reasons as those given for claim 8 above.
As to claim 16, the claim is rejected for the same reasons as those given for claim 10 above.
As to claim 18, the claim is rejected for the same reasons at those given for claim 7 above.
As to claim 20, Aloisio discloses wherein modifying the data transfer protocol comprises at least one of:
preventing a communication of personally identifiable information (PII);
generating a false fingerprint;
preventing an execution of a set of trackers;
disabling session replay execution;
disabling malware execution;
reporting a secure sockets layer (SSL) vulnerability;
sending spoofed PII;
disabling connections to a set of third-party web domains;
blocking at least one of inbound and outbound communications (Col. 9, ln. 5-21, in particular, “During operation, the proxy server may capture header information regarding the source network device 102 to determine whether to permit or block incoming data traffic”); and
blocking geospatial queries.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 3, 4, and 17 are rejected under 35 U.S.C. 103 as being unpatentable over Aloisio as applied above, in view of Wang et al. (hereafter referred to as “Wang”), U.S. Patent App. Pub. No. 2018/0375896 A1.
As to claim 3, Aloisio is silent on wherein the communications comprise information indicative of a script associated with a web domain.
However, Wang discloses wherein the communications comprise information indicative of a script associated with a web domain (¶ [0047]).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains to modify the teachings of Aloisio in the aforementioned manner as taught by Wang in order to prevent malicious scripts from compromising a web domain.
As to claim 4, Aloisio is silent on analyzing the script to determine a security vulnerability that enables the request from the third party.
However, Wang discloses analyzing the script to determine a security vulnerability that enables the request from the third party (¶ [0047]).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains to modify the teachings of Aloisio in the aforementioned manner as taught by Wang in order to prevent malicious scripts from compromising a web domain.
As to claim 17, the claim is rejected for the same reasons as those given for claim 3 above.
Claims 9, 15, and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Aloisio as applied above, in view of Stute et al. (hereafter referred to as “Stute”), U.S. Patent App. Pub. No. 2009/1078139 A1.
As to claim 9, Aloisio is silent on generating an alert via a dashboard associated with the computing system.
However, Stute discloses generating an alert via a dashboard associated with the computing system (Abstract).
It would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains to modify the teachings of Aloisio in the aforementioned manner as taught by Stute in order to display security alerts in a user-friendly manner (Stute: Abstract).
As to claims 15 and 19, the claims are rejected for the same reasons as those given for claim 9 above.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. See the Notice of References Cited (PTO-892).
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Brian Whipple whose telephone number is 571-270-1244. The examiner can normally be reached M/W/F: 6:45 to 8:45 and 10:30 to 3:30; T: 6:45 to 8:45 and 11:00 to 3:30; R: 6:45 to 8:45 and 10:15 to 2:15; S: 9:00 to 3:30. All time are ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Joon Hwang can be reached at 571-272-4036. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Brian Whipple/
Primary Examiner
Art Unit 2447
10/7/26
