DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 21, 27, 28, 34, 35, and 40 are amended; claims 29 and 36 are cancelled; claims 41 and 42 are new. Claims 21-28, 30-35, and 37-42 are pending.
Response to Arguments
Applicant’s claim amendments and arguments, see Remarks, filed 07/29/2026, with respect to the rejections of claims 21-23, 28-30, and 35-37 under 35 U.S.C. 103 as being unpatentable over Adams (U.S. Pat. App. Pub. 2013/0103944) and Parthasarathy et al. (U.S. Pat. App. Pub. 2015/0215302), claims 24, 31, and 38 under 35 U.S.C. 103 as being unpatentable over Adams, Parthasarathy, and Mesdaq (U.S. Pat. 10,601,865), claims 25 and 32 under 35 U.S.C. 103 as being unpatentable over Adams, Parthasarathy, and Himler (U.S. Pat. 9,781,149), claims 26, 33, and 39 under 35 U.S.C. 103 as being unpatentable over Adams, Parthasarathy, and Chang (U.S. Pat. 8,606,860), and claims 27, 34, and 40 under 35 U.S.C. 103 as being unpatentable over Adams, Parthasaraty, Chang, and Best (U.S. Pat. App. Pub. 2012/017161) have been fully considered and are persuasive. Therefore, the rejection has been withdrawn. However, upon further consideration, a new ground(s) of rejection is made in view of Yanovsky et al. (U.S. Pat. App. Pub. 2012/0311703) and Edwards et al. (U.S. Pat. App. Pub. 2019/0020682) as detailed below.
Claim Rejections - 35 USC § 103
The text of those sections of Title 35, U.S. Code not included in this action can be found in a prior Office action.
Claims 21-23, 28-30, and 35-37, and 42 are rejected under 35 U.S.C. 103 as being unpatentable over Adams et al. (U.S. Pat. App. Pub. 2013/0103944), hereinafter Adams, and further in view of Yanovsky et al. (U.S. Pat. App. Pub. 2012/0311703), hereinafter Yanovsky.
Regarding claim 21, Adams disclosed a computing apparatus, comprising:
a hardware platform including a processor and a memory, the memory including instructions (CPU, memory, instructions, ¶[0034]); and
a network interface (network interface, ¶[0034]), wherein the processor executes the instructions to
receive, via the network interface, an e-mail having a payload (receiving e-mail message including hypertext links, i.e., payload, ¶[0021]),
transmit a query to a cloud phishing reputation service, the query including information extracted from the e-mail payload (sending, i.e., transmitting query, extracted links from e-mail message, i.e., information based on e-mail payload, to mobile gateway, i.e., cloud phishing reputation service, ¶[0021]),
receive, from the cloud phishing reputation service, reputation data for the e-mail payload (returning status, i.e., reputation data, of links to mobile device, ¶[0021]),
assign the e-mail a reputation score, at least in part based on the scanning and the reputation data (appending, i.e., assigning, text, i.e., reputation score, indicating status of links, i.e., based on scanning/reputation data, ¶[0021]), and
provide a notice of a reputation for the e-mail payload, at least in part based on the reputation score, the notice indicating a flag or a warning (adding warning, i.e., providing notice, to links, i.e., payload, ¶[0021]).
Adams did not disclose:
perform a scanning of an attachment of the e-mail payload to detect malware or phishing features,
assign the e-mail a reputation score, at least in part based on the scanning and the reputation data, wherein the reputation score is a single combined score computed from both a result of the scanning of the attachment and the reputation data (emphasis added).
Yanovsky disclosed:
perform a scanning of an attachment of the e-mail payload to detect malware or phishing features (scanning e-mail components including attachments, ¶[0052]),
assign the e-mail a reputation score (determining whether an e-mail represents a threat, i.e., reputation score, ¶[0041]), at least in part based on the scanning and the reputation data, wherein the reputation score is a single combined score computed from both a result of the scanning of the attachment and the reputation data (processing e-mail components, e.g., embedded URLs and attachments, to create a signature/thumbprint for each component, i.e., reputation data, ¶[0041]; determining whether the e-mail represents a threat, i.e., reputation score, based on the combination thumbprint information/reputation score associated with each component, ¶[0041]).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the apparatus of Adams to perform a scanning of an attachment of the e-mail payload to detect malware or phishing features, and wherein the reputation score is a single combined score computed from both a result of the scanning of the attachment and the reputation data as claimed, because doing so would have prevented threats in a flexible, robust manner (Yanovsky, ¶[0053]).
Regarding claim 22, Adams and Yanovsky disclosed the computing apparatus wherein the notice indicates a degree of confidence of the reputation (indicated status of links including, e.g., “clean”, “likely malicious”, “malicious”, or “unknown”, i.e., degree of confidence, Adams, ¶[0021]).
Regarding claim 23, Adams and Yanovsky disclosed the computing apparatus wherein the processor executes the instructions to extract a link from the e-mail payload, and the query indicates the link (extracting links from e-mail, Adams, ¶[0021]; sending, i.e., transmitting query, extracted links, Adams, ¶[0021]).
Regarding claim 28, Adams disclosed a method, comprising:
receiving an e-mail having a payload receiving e-mail message including hypertext links, i.e., payload, ¶[0021]);
transmitting a query to a cloud phishing reputation service, the query including information extracted from the e-mail payload (sending, i.e., transmitting query, extracted links from e-mail message, i.e., information based on e-mail payload, to mobile gateway, i.e., cloud phishing reputation service, ¶[0021]);
receiving, from the cloud phishing reputation service, reputation data for the e-mail payload (returning status, i.e., reputation data, of links to mobile device, ¶[0021]);
assigning the e-mail a reputation score, at least in part based on the scanning and the reputation data (appending, i.e., assigning, text, i.e., reputation score, indicating status of links, i.e., based on scanning/reputation data, ¶[0021]); and
providing a notice of a reputation for the e-mail payload, at least in part based on the reputation score, the notice indicating a flag or a warning (adding warning, i.e., providing notice, to links, i.e., payload, ¶[0021]).
Adams did not disclose:
performing a scanning of an attachment of the e-mail payload to detect malware or phishing features;
assigning the e-mail a reputation score, at least in part based on the scanning and the reputation data, wherein the reputation score is a single combined score computed from both a result of the scanning of the attachment and the reputation data (emphasis added).
Yanovsky disclosed:
performing a scanning of an attachment of the e-mail payload to detect malware or phishing features (scanning e-mail components including attachments, ¶[0052]);
assigning the e-mail a reputation score (determining whether an e-mail represents a threat, i.e., reputation score, ¶[0041]), at least in part based on the scanning and the reputation data, wherein the reputation score is a single combined score computed from both a result of the scanning of the attachment and the reputation data (processing e-mail components, e.g., embedded URLs and attachments, to create a signature/thumbprint for each component, i.e., reputation data, ¶[0041]; determining whether the e-mail represents a threat, i.e., reputation score, based on the combination thumbprint information/reputation score associated with each component, ¶[0041]).
The combination of references is made under the same rationale as claim 21 above.
Regarding claim 30, Adams and Yanovsky disclosed the method further comprising:
extracting a link from the e-mail payload, wherein the query indicates the link (extracting links from e-mail, Adams, ¶[0021]; sending, i.e., transmitting query, extracted links, Adams, ¶[0021]).
Regarding claim 35, Adams disclosed a non-transitory computer-readable medium having stored thereon instructions (computer readable medium storing software, ¶[0038]) that, when executed, instruct a processor to perform operations comprising:
receiving an e-mail having a payload (receiving e-mail message including hypertext links, i.e., payload, ¶[0021]);
transmitting a query to a cloud phishing reputation service, the query including information extracted from the e-mail payload (sending, i.e., transmitting query, extracted links from e-mail message, i.e., information based on e-mail payload, to mobile gateway, i.e., cloud phishing reputation service, ¶[0021]);
receiving, from the cloud phishing reputation service, reputation data for the e-mail payload (returning status, i.e., reputation data, of links to mobile device, ¶[0021]);
assigning the e-mail a reputation score, at least in part based on the scanning and the reputation data (appending, i.e., assigning, text, i.e., reputation score, indicating status of links, i.e., based on scanning/reputation data, ¶[0021]); and
providing a notice of a reputation for the e-mail payload, at least in part based on the reputation score, the notice indicating a flag or a warning (adding warning, i.e., providing notice, to links, i.e., payload, ¶[0021]).
Adams did not disclose:
performing a scanning of an attachment of the e-mail payload to detect malware or phishing features;
assigning the e-mail a reputation score, at least in part based on the scanning and the reputation data, wherein the reputation score is a single combined score computed from both a result of the scanning of the attachment and the reputation data (emphasis added).
Yanovsky disclosed:
performing a scanning of an attachment of the e-mail payload to detect malware or phishing features (scanning e-mail components including attachments, ¶[0052]);
assigning the e-mail a reputation score (determining whether an e-mail represents a threat, i.e., reputation score, ¶[0041]), at least in part based on the scanning and the reputation data, wherein the reputation score is a single combined score computed from both a result of the scanning of the attachment and the reputation data (processing e-mail components, e.g., embedded URLs and attachments, to create a signature/thumbprint for each component, i.e., reputation data, ¶[0041]; determining whether the e-mail represents a threat, i.e., reputation score, based on the combination thumbprint information/reputation score associated with each component, ¶[0041]).
The combination of references is made under the same rationale as claim 21 above.
Regarding claim 37, Adams and Yanovsky disclosed the medium the operations further comprising:
extracting a link from the e-mail payload, wherein the query indicates the link (extracting links from e-mail, Adams, ¶[0021]; sending, i.e., transmitting query, extracted links, Adams, ¶[0021]).
Regarding claim 42, Adams and Yanovsky disclosed the computing apparatus wherein the information extracted from the e-mail payload includes content other than a link (processing, i.e., extracting, components including text, images, attachments, i.e., content, Yanovsky, ¶[0041]).
The combination of references is made under the same rationale as claim 21 above.
Claims 24, 31, and 38 are rejected under 35 U.S.C. 103 as being unpatentable over Adams (U.S. Pat. App. Pub. 2013/0103944) and Yanovsky (U.S. Pat. App. Pub. 2012/0311703) as applied to claims 21, 28, and 35 above, respectively, and further in view of Mesdaq (U.S. Pat. 10,601,865).
Regarding claim 24, Adams and Yanovsky disclosed the computing apparatus as detailed above. Adams and Yanovsky did not disclose the computing apparatus wherein the processor executes the instructions to provide a screenshot image of the e-mail payload, and the reputation data is at least in part based on a visual analysis of the screenshot image.
Mesdaq disclosed:
wherein the processor executes the instructions to provide a screenshot image of the e-mail payload, and the reputation data is at least in part based on a visual analysis of the screenshot image (extracting visual content, i.e., a screenshot image, attributed with an e-mail to perform screen shot analysis, i.e., visual analysis, to determine a phishing attack, i.e., reputation data, col. 12, lines 45-65).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the apparatus of Adams and Yanovsky wherein the processor executes the instructions to provide a screenshot image of the e-mail payload, and the reputation data is at least in part based on a visual analysis of the screenshot image as claimed, because doing so would have been applying a known technique (i.e., screenshot/visual analysis) to a known device/method/product ready for improvement (i.e., the e-mail verification/scanning system of Adams and Yanovsky) to yield predictable results (i.e., using screenshot/visual analysis in e-mail verification/scanning).
Claims 31 and 38 are rejected under the same rationale as claim 24 above.
Claims 25 and 32 are rejected under 35 U.S.C. 103 as being unpatentable over Adams (U.S. Pat. App. Pub. 2013/0103944) and Yanovsky (U.S. Pat. App. Pub. 2012/0311703) as applied to claims 21 and 28 above, respectively, and further in view of Himler et al. (U.S. Pat. 9,781,149), hereinafter Himler.
Regarding claim 25, Adams and Yanovsky disclosed the computing apparatus as detailed above. Adams and Yanovsky did not disclose the computing apparatus wherein the notice is provided via a push notification.
Himler disclosed: wherein the notice is provided via a push notification (outputting feedback, e.g., a message/prompt/notification, i.e., push notification/reputation notice, col. 6, lines 55-58, col. 7, lines 54-59, col. 9, line 63, col. 11, lines 14-15, col. 15, lines 1-2).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the apparatus of Adams and Yanovsky wherein the notice is provided via a push notification as claimed, because doing so would help a user understand the results of e-mail analysis (Himler, col. 15, lines 1-7).
Claim 32 is rejected under the same rationale as claim 25 above.
Claims 26, 33, and 39 are rejected under 35 U.S.C. 103 as being unpatentable over Adams (U.S. Pat. App. Pub. 2013/0103944) and Yanovsky (U.S. Pat. App. Pub. 2012/0311703) as applied to claims 21, 28, and 35 above, respectively, and further in view of Chang et al. (U.S. Pat. 8,606,860), hereinafter Chang.
Regarding claim 26, Adams and Yanovsky disclosed the computing apparatus as detailed above. Adams and Yanovsky did not disclose the computing apparatus wherein the processor executes the instructions to receive an e-mail address for an online e-mail service, and access a mailbox, at least in part based on the e-mail address, to receive the e-mail. Chang disclosed:
wherein the processor executes the instructions to receive an e-mail address for an online e-mail service, and access a mailbox, at least in part based on the e-mail address, to receive the e-mail (obtaining an email address and accessing a corresponding mailbox of email messages, claim 1).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the apparatus of Adams and Yanovsky wherein the processor executes the instructions to receive an e-mail address for an online e-mail service, and access a mailbox, at least in part based on the e-mail address, to receive the e-mail as claimed, because doing so would have been an efficient way of accessing email for filtering purposes (Chang, col. 1, lines 24-31).
Claims 33 and 39 are rejected under the same rationale as claim 26 above.
Claims 27, 34, and 40 are rejected under 35 U.S.C. 103 as being unpatentable over Adams (U.S. Pat. App. Pub. 2013/0103944), Yanovsky (U.S. Pat. App. Pub. 2012/0311703), and Chang (U.S. Pat. 8,606,860) as applied to claims 21, 28, and 35 above, respectively, and further in view of Best et al. (U.S. Pat. App. Pub. 2012/0117161), hereinafter Best.
Regarding claim 27, Adams and Parthasarathy disclosed the computing apparatus as detailed above. Adams and Parthasarathy did not disclose the computing apparatus wherein the processor executes the instructions to download a copy of the e-mail without marking the e-mail as read or opened.
Best disclosed:
wherein the processor executes the instructions to download a copy of the e-mail without marking the e-mail as read or opened (forwarding unread email messages to, i.e., downloading by, a delegate without changing the original messages’ read status and maintaining it at unread, ¶[0014], [0057], claim 8).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the apparatus of Adams and Parthasarathy wherein the processor executes the instructions to download a copy of the e-mail without marking the e-mail as read or opened as claimed, because doing so would have preserved the read status of analyzed emails and therefore not detracted from the account holder’s attention towards the email (Best, ¶[0003]).
Claims 34 and 40 are rejected under the same rationale as claim 27 above.
Claim 41 is rejected under 35 U.S.C. 103 as being unpatentable over Adams (U.S. Pat. App. Pub. 2013/0103944) and Yanovsky (U.S. Pat. App. Pub. 2012/0311703) as applied to claim 21 above, and further in view of Edwards et al. (U.S. Pat. App. Pub. 2019/0020682), hereinafter Edwards.
Regarding claim 41, Adams and Yanovsky disclosed the computing apparatus as detailed above. Adams and Yanovsky did not disclose the computing apparatus wherein, upon determining that the reputation score indicates the e-mail is unsafe or malicious, the processor executes the instructions to provide, with the notice, a textual instruction not to open one or more links in the e-mail.
Edwards disclosed:
wherein, upon determining that the reputation score indicates the e-mail is unsafe or malicious, the processor executes the instructions to provide, with the notice, a textual instruction not to open one or more links in the e-mail (modifying an email with notifications and notifying, i.e., providing textual instruction, a user that an identified hazardous link should not be opened, ¶[0008], [0124]).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the apparatus of Adams and Yanovsky wherein, upon determining that the reputation score indicates the e-mail is unsafe or malicious, the processor executes the instructions to provide, with the notice, a textual instruction not to open one or more links in the e-mail as claimed, because doing so would have warned a user about potential threats and made it less likely a user would interact with a suspicious email and cause harm (Edwards, ¶[0005], [0007]).
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JOSEPH R MANIWANG whose telephone number is (571)270-7257. The examiner can normally be reached 8:30AM - 4:30PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Wing F Chan can be reached at (571) 272-7493. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/JOSEPH R MANIWANG/Primary Examiner, Art Unit 2453
