DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
The following is a Non-Final Office Action in response to communications received on July 14, 2025. Claims 1-20 are pending and addressed below.
Specification
For the record, Examiner acknowledges that the Specification submitted on July 14, 2025 has been accepted.
Drawings
For the record, Examiner acknowledges that the Drawings submitted on July 14, 2025 have been accepted.
Claim Interpretation
The following is a quotation of 35 U.S.C. 112(f):
(f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph:
An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
This application includes one or more claim limitations that do not use the word “means,” but are nonetheless being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because the claim limitation(s) uses a generic placeholder that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. Such claim limitation(s) is/are: “a request transformer configured to…” in claim 1.
Because this/these claim limitation(s) is/are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, it/they is/are being interpreted to cover the corresponding structure described in the specification as performing the claimed function, and equivalents thereof.
If applicant does not intend to have this/these limitation(s) interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, applicant may: (1) amend the claim limitation(s) to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph (e.g., by reciting sufficient structure to perform the claimed function); or (2) present a sufficient showing that the claim limitation(s) recite(s) sufficient structure to perform the claimed function so as to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph.
Claim Objections
Claim 5 is objected to because of the following informalities: Claim 5 recites the phrase “receive second instructions indicate of a change.” It is suggested the phrase be amended to “receive second instructions indicating a change” for grammatical correctness.
Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 3, 5, 9, 12 and 17-19 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 3 recites the limitation “the search parameter.” There are multiple previously recited search parameters and it is unclear as to which particular search parameter the limitation is referring. Claims 12 and 19 are rejected for similar reasons to claim 3.
Claim 5 recites the limitation “the search queries.” There are multiple previously recited search queries and it is unclear as to which particular search queries the limitation is referring. Claim 9 rejected for similar reasons to claim 5.
Claim 17 recites the limitation “Non-transitory instructions stored on a computer readable medium.” This term non-transitory instructions is not a known-term in the art and it is unclear what the term means. It is suggested the limitation be amended to recite that the medium is non-transitory as opposed to the instructions. Dependent claims 18-20 are rejected for containing the same indefinite language as parent claim 17 without further remedying the indefinite language.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 17-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter. The claim(s) does/do not fall within at least one of the four categories of patent eligible subject matter. Claim 17 is directed towards “Non-transitory instructions stored on a computer readable medium.” This does not fall within one of the four categories of patent eligible subject matter. Dependent claims 18-20 are rejected for failing to further define parent claim 17 as statutory.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-4 and 6-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Boyd et al. (“SQLrand: Preventing SQL Injection Attacks” and hereinafter referred to as Boyd) in view of Hsiung et al. (U.S. Pub. No. 2014/0068771 and hereinafter referred to as Hsiung).
As to claim 1, Boyd discloses a security proxy server located between an application server and a database (section 2 pg. 3, section 3 pg. 4 and Fig. 1, Boyd teaches a proxy located between a web (i.e. application) server and a database), the application server configured to convert database requests received from user devices into machine-to-machine messages that are used by the database to perform search queries, the security proxy server comprising:
a request receiver/transmitter configured to receive, from the application server, a machine-to-machine message including a search parameter (section 2 pg. 4, section 3 pgs. 5-6, section 4.1 pg. 6, and Fig. 1, Boyd teaches the proxy receives messages from the web server where the message may include a search query with parameter); and
a request transformer configured to transform the parameter into a re-written parameter based on stored instructions that correspond to how the database performs the search queries (section 3 pgs. 4-6 and Fig. 1, Boyd teaches the proxy de-randomizes a randomized query message and passes the message to the database),
wherein the request receiver/transmitter is further configured to transmit the re-written parameter in the machine-to-machine message to the database, causing the database to perform one or more search queries based on the re-written parameter (section 3 pgs. 4-6 and Fig. 1, Boyd teaches the proxy passes the de-randomized message to the database which performs the query.). Boyd is not specifically clear in disclosing transforming a search parameter as claimed. However, Hsiung does disclose
transforming a search parameter (paragraphs [0040]-[0046], Hsiung teaches transforming a search parameter for an SQL query.).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Boyd with the teachings of Hsiung for transforming a search parameter because this would improve security in a manner not requiring changes to existing database structure.
Claims 10 and 17 recite substantially similar subject matter to claim 1 and are therefore, rejected for similar reasons to claim 1 above.
As to claim 2, the combination of teachings between Boyd and Hsiung disclose the security proxy server of Claim 1, wherein transmitting the re-written search parameter in the machine-to-machine message to the database further causes the database to transmit, to the application server, a response to the one or more search queries that were performed (section 2 pg. 3 and Fig. 1, Boyd teaches returning results from the database to the web server.).
Claims 11 and 18 recite substantially similar subject matter to claim 2 and are therefore, rejected for similar reasons to claim 2 above.
As to claim 3, the combination of teachings between Boyd and Hsiung disclose the security proxy server of Claim 1, wherein the stored instructions specify at least one of: reversing a search parameter; reversing an order of terms within a search parameter; adding one or more characters and/or symbols to a search parameter; replacing one or more characters and/or symbols within a search parameter; converting a search string into binary or hexadecimal form within a search parameter; converting alphabetic characters of a search string to SOUNDEX form within a search parameter; changing labels/types of one or more terms within a search parameter; and partitioning searches of multiple search terms, specified within the search parameter, into separate searches and cross-comparing search results (paragraphs [0040]-[0046], Hsiung teaches adding and/or replacing characters for search parameters.).
Examiner supplies the same rationale for the combination of the references as in claim 1 above.
Claims 12 and 19 recite substantially similar subject matter to claim 3 and are therefore, rejected for similar reasons to claim 3 above.
As to claim 4, the combination of teachings between Boyd and Hsiung disclose the security proxy server of Claim 1, wherein the request transformer is configured to transform the search parameter into the re-written search parameter as a defensive re-write of the machine-to-machine message for preventing malicious applications from successfully performing database injection attacks (section 1 pgs. 1-2 and Fig. 1, Boyd teaches preventing SQL injection attacks. Paragraphs [0001] and [0040]-[0046], Hsiung teaches transforming parameters for preventing SQL injection attacks.).
Examiner supplies the same rationale for the combination of the references as in claim 1 above.
Claims 13 and 20 recite substantially similar subject matter to claim 4 and are therefore, rejected for similar reasons to claim 4 above.
As to claim 6, the combination of teachings between Boyd and Hsiung disclose the security proxy server of Claim 1, wherein the database is configured to store at least one of data, services, and media content, and wherein the search parameter specifies at least one search query for the at least one of the data, the services, and the media content (section 3 pg. 5, section 4.1 pg. 6, and Fig. 1, Boyd teaches the database stores data and a search is for data. Paragraphs [0004] and [0040]-[0046], Hsiung teaches transforming a search parameter for data.).
Examiner supplies the same rationale for the combination of the references as in claim 1 above.
Claim 16 recites substantially similar subject matter to claim 6 and is therefore, rejected for similar reasons to claim 6 above.
As to claim 7, the combination of teachings between Boyd and Hsiung disclose the security proxy server of Claim 1, wherein the security proxy server is configured as an interface to the database (section 3 pg. 5 and Fig. 1, Boyd teaches the proxy interfaces with the database and other devices access the database through the proxy.).
Claim 15 recites substantially similar subject matter to claim 7 and is therefore, rejected for similar reasons to claim 7 above.
As to claim 8, the combination of teachings between Boyd and Hsiung disclose the security proxy server of Claim 1, wherein the database is a Structured Query Language ("SQL") database (section 3 pg. 5 and Fig. 1, Boyd teaches an SQL database.).
As to claim 9, the combination of teachings between Boyd and Hsiung disclose the security proxy server of Claim 1, wherein the database performs the search queries consistent with at least one of HyperText Transfer Protocol ("HTTP"), GETS, and POSTS (section 4.1 pg. 7 and Fig. 1, Boyd teaches sending queries based on HTTP requests.).
As to claim 14, the combination of teachings between Boyd and Hsiung disclose the method of Claim 10, wherein the security proxy server is included with the application server or the database (section 2 pg. 3 and Fig. 1, Boyd teaches the proxy can be with the database on a server or with the web server.).
Allowable Subject Matter
Claim 5 would be allowable if rewritten to overcome the rejection(s) under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), 2nd paragraph, set forth in this Office action and to include all of the limitations of the base claim and any intervening claims.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to THADDEUS J PLECHA whose telephone number is (571)270-7506. The examiner can normally be reached M-F 8-4:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Taghi Arani can be reached at 571-272-3787. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/THADDEUS J PLECHA/Examiner, Art Unit 2438
Prosecution Insights