Office Action 2: Notice of Allowance (2024-11-22)

CLAIMS:
AMENDMENTS TO THE CLAIMSThe following listing of claims replaces all prior listings of claims:

1\. (Currently Amended) A method comprising:
inferring, in response to a trigger, a program identity of an unknown binary;
executing one or more authentication factors to authenticate the inferred program identity of the unknown binary as being one of a plurality of different programs;
determining that the unknown binary has been modified relative to a known binary;
determining whether the modifications of the unknown binary are congruent modifications or divergent modifications, the convergent modifications comprising a modification to a data representation of the known binary which preserve a program nature of the unknown binary, the divergent modifications comprising a modification to a data representation of the known binary which change the program nature of the unknown binary;
selectively providing the binary with access to system resources based on a program nature of the authenticated program identity and based on the determination of whether the modifications of the unknown binary are congruent modifications or divergent modifications.

2\. (Original) The method of claim 1 further comprising:
determining that the executed one or more authentication factors is unable to authenticate the inferred program identity;
initiating a manual authentication workflow in which contextual information about the unknown binary is displayed in a graphical user interface for human authentication of the unknown binary.

3\. (Currently Amended) The method of claim 1 further comprising:
preventing the unknown binary to the access system resources when it is not authenticated.

4\. (Original) The method of claim 1, wherein the trigger comprises the unknown binary requesting access to a system resource or performing a sensitive operation.

5\. (Original) The method of claim 1, wherein the trigger comprises the unknown binary commencing initialization.

6\. (Original) The method of claim 1, wherein the plurality of authentication factors comprises one or more executable integrity tests in which scripts forming part of the unknown binary are cryptographically verified as being from a known source.

7\. (Original) The method of claim 6, wherein the one or more executable integrity tests comprises one or more of: Authenticode, strong name signing, one or more Linux schemes, Android Package Kit (APK) Signing, Apple code signing, PowerShell signing, and JavaScript signing.

8\. (Currently Amended) The method of claim 1 further comprising:
allowing access by the binary to the system resources when it is determined that the modifications of the unknown binary are congruent; and \[\[or\]\] preventing access by the binary to the system resources when it is determined that the modifications of the unknown binary are divergent.

9\. (Currently Amended) A method comprising:
inferring, in response to a trigger, a program identity of an unknown binary;
executing one or more authentication factors to authenticate the inferred program identity of the unknown binary as being one of a plurality of different programs;
determining that the unknown binary has been modified relative to a known binary;
determining whether the modifications of the unknown binary are congruent modifications or divergent modifications, the convergent modifications comprising a modification to a data representation of the known binary which preserve a program nature of the unknown binary, the

divergent modifications comprising a modification to a data representation of the known binary which change the program nature of the unknown binary;andselectively prohibiting sensitive operations by the binary based on a program nature of the authenticated program identity and based on the determination of whether the modifications of the unknown binary are congruent modifications or divergent modifications.

10\. (Original) The method of claim 9 further comprising:
determining that the executed one or more authentication factors is unable to authenticate the inferred program identity;
initiating a manual authentication workflow in which contextual information about the unknown binary is displayed in a graphical user interface for human authentication of the unknown binary.

11\. (Original) The method of claim 9 further comprising:
prohibiting a set of sensitive operations when it is not authenticated.

12\. (Original) The method of claim 9, wherein the trigger comprises the unknown binary requesting access to a system resource or performing a sensitive operation.

13\. (Original) The method of claim 9, wherein the trigger comprises the unknown binary commencing initialization.

14\. (Original) The method of claim 9, wherein the plurality of authentication factors comprises one or more executable integrity tests in which scripts forming part of the unknown binary are cryptographically verified as being from a known source.

15\. (Original) The method of claim 14, wherein the one or more executable integrity tests comprises one or more of: Authenticode, strong name signing, one or more Linux schemes, Android Package Kit (APK) Signing, Apple code signing, PowerShell signing, and JavaScript signing.

16\. (Currently Amended) The method of claim 9 further comprising:
allowing access by the binary to system resources when it is determined that the modifications of the unknown binary are congruent; and \[\[or\]\] preventing access by the binary to system resources when it is determined that the modifications of the unknown binary are divergent.

17\. (Currently Amended) A method comprising:
individually inferring, for each of a plurality of unknown binaries, a program identity of the \[\[an\]\] unknown binary seeking to access a resource or in response to a request to run the unknown binary;
automatically authenticating the inferred program identity of each of the unknown binaries\[\[y\]\] as being one of a plurality of different programs when a plurality of authentication factors provide a confidence indicator above a threshold level;
initiating, when the confidence indicator of the corresponding unknown binary is at or below the threshold level, a manual authentication workflow in which contextual information about the unknown binary is displayed in a graphical user interface for human authentication of the unknown binary;
determining, for each unknown binary, that the unknown binary has been modified relative to a known binary;
determining, for each unknown binary, whether the modifications of the unknown binary are congruent modifications or divergent modifications, the convergent modifications comprising a modification to a data representation of the known binary which preserve a program nature of the unknown binary, the divergent modifications comprising a modification to a data representation of the known binary which change the program nature of the unknown binary;
assigning a same program identifier to each binary having a congruent modification relative to a same known binary;and

selectively providing each binary with access to system resources or prohibiting sensitive operations based on a program nature of the program after automatic or human authentication of the unknown binary and based on the program identifier.

18\. (Original)The method of claim 17, wherein the plurality of authentication factors comprises one or more executable integrity tests in which scripts forming part of the unknown binary are cryptographically verified as being from a known source.

19\. (Original) The method of claim 18, wherein the one or more executable integrity tests comprises one or more of: Authenticode, strong name signing, one or more Linux schemes, Android Package Kit (APK) Signing, Apple code signing, PowerShell signing, and JavaScript signing.

20\. (Currently Amended) The method of claim 19 further comprising:
allowing access by the binary to the system resources when it is determined that the modifications of the unknown binary are congruent; and \[\[or\]\] preventing access by the binary to the system resources when it is determined that the modifications of the unknown binary are divergent.

21\. (New) The method of claim 1, wherein the divergent modifications characterize representational disguise which comprises a contrived representation that is given to a program for to impersonate another program with a different program nature.

22\. (New) The method of claim 1, wherein the divergent modifications characterize representational obfuscation which comprises a contrived representation that is given to a program for frustrating an understanding of the program nature.

OFFICE ACTION:
DETAILED ACTION
Notice of Pre-AIA  or AIA  Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendments
This office action is in response to the amendments filed on 10/15/2024. After the examiner’s amendments shown below, claims 1, 9 and 17 are independent, claims 6, 14 and 18 are canceled, claims 23 and 24 are new, claims 1-3, 7-11, 15-17 and 19-20 are amended, and claims 1-5, 7-13, 15-17 and 19-24 are allowed.
Response to Arguments/Remarks
Applicant’s remarks, see pages 7-10, filed on 10/15/2024, have been fully considered and are persuasive in view of the remarks and examiner’s amendments, as disclosed below. Therefore, claim objections and claim rejections under 35 U.S.C. 103 as set forth in the previous office action has been waived.
Examiner’s Amendments
An examiner's amendment to the record appears below. Should the changes and/or additions be unacceptable to applicant, an amendment may be filed as provided by 37 CFR 1.312. To ensure consideration of such an amendment, it MUST be submitted no later than the payment of the issue fee.
Authorization for this examiner's amendment was given, via phone conversation, followed by an email by the applicant’s representative- Mr. Carl A. Kukkonen, III (Reg. No. 42,773) on 11/12/2024.
In the application, please replace all existing set of claims with the following:
1. 	(Currently Amended) A method for implementation by one or more computing devices comprising:
inferring, in response to a trigger, a program identity of an unknown binary;
executing one or more authentication factors to authenticate the inferred program identity of the unknown binary as being one of a plurality of different programs, the one or more authentication factors comprising one or more executable integrity tests in which scripts forming part of the unknown binary are cryptographically verified as being from a known source;
determining that the unknown binary has been modified relative to a known binary;
determining whether [[the]] modifications of the unknown binary are congruent modifications or divergent modifications, the congruent modifications comprising a modification to a data representation of the known binary which preserve a program nature of the unknown binary, the divergent modifications comprising a modification to a data representation of the known binary which change the program nature of the unknown binary;
selectively providing the unknown binary with access to system resources based on [[a]] the program nature of the authenticated program identity and based on the determination of whether the modifications of the unknown binary are said congruent modifications or said divergent modifications.
2. 	(Currently Amended) The method of claim 1, further comprising:
determining that the executed one or more authentication factors is unable to authenticate the inferred program identity;
initiating a manual authentication workflow in which contextual information about the unknown binary is displayed in a graphical user interface for human authentication of the unknown binary.
3.  	(Currently Amended) The method of claim 1, further comprising:
preventing the unknown binary from accessing the system resources when it is not authenticated.
4.	(Original) The method of claim 1, wherein the trigger comprises the unknown binary requesting access to a system resource or performing a sensitive operation.
5.	(Original) The method of claim 1, wherein the trigger comprises the unknown binary commencing initialization.
6.	(Canceled).
7.	(Currently Amended) The method of claim 1 [[6]], wherein the one or more executable integrity tests comprises one or more of: Authenticode, strong name signing, one or more Linux schemes, Android Package Kit (APK) Signing, Apple code signing, PowerShell signing, and JavaScript signing.
8.	(Currently Amended) The method of claim 1, further comprising:
allowing access by the unknown binary to the system resources when it is determined that the modifications of the unknown binary are congruent; and
preventing access by the unknown binary to the system resources when it is determined that the modifications of the unknown binary are divergent.
9. 	(Currently Amended) A method for implementation by one or more computing devices comprising:
inferring, in response to a trigger, a program identity of an unknown binary;
executing one or more authentication factors to authenticate the inferred program identity of the unknown binary as being one of a plurality of different programs, the one or more authentication factors comprising one or more executable integrity tests in which scripts forming part of the unknown binary are cryptographically verified as being from a known source;
determining that the unknown binary has been modified relative to a known binary;
determining whether [[the]] modifications of the unknown binary are congruent modifications or divergent modifications, the congruent modifications comprising a modification to a data representation of the known binary which preserve a program nature of the unknown binary, the divergent modifications comprising a modification to a data representation of the known binary which change the program nature of the unknown binary; and
selectively prohibiting sensitive operations by the unknown binary based on [[a]] the program nature of the authenticated program identity and based on the determination of whether the modifications of the unknown binary are said congruent modifications or said divergent modifications.
10. (Currently Amended) The method of claim 9, further comprising:
determining that the executed one or more authentication factors is unable to authenticate the inferred program identity;
initiating a manual authentication workflow in which contextual information about the unknown binary is displayed in a graphical user interface for human authentication of the unknown binary.
11. (Currently Amended) The method of claim 9, further comprising:
prohibiting a set of sensitive operations when it is not authenticated.
12. (Original) The method of claim 9, wherein the trigger comprises the unknown binary requesting access to a system resource or performing a sensitive operation.
13. (Original) The method of claim 9, wherein the trigger comprises the unknown binary commencing initialization.
14. (Canceled).
15.	 (Currently Amended) The method of claim 9 [[14]], wherein the one or more executable integrity tests comprises one or more of: Authenticode, strong name signing, one or more Linux schemes, Android Package Kit (APK) Signing, Apple code signing, PowerShell signing, and JavaScript signing.
16.	 (Currently Amended) The method of claim 9, further comprising:
allowing access by the unknown binary to system resources when it is determined that the modifications of the unknown binary are congruent; and
preventing access by the unknown binary to system resources when it is determined that the modifications of the unknown binary are divergent.
17.	 (Currently Amended) A method for implementation by one or more computing devices comprising:
individually inferring, for each of a plurality of unknown binaries, a program identity of the unknown binary seeking to access a resource or in response to a request to run the unknown binary;
automatically authenticating the inferred program identity of each of the unknown binaries as being one of a plurality of different programs when a plurality of authentication factors provide a confidence indicator above a threshold level, the plurality of authentication factors comprising one or more executable integrity tests in which scripts forming part of the unknown binary are cryptographically verified as being from a known source;
initiating, when the confidence indicator of the corresponding unknown binary is at or below the threshold level, a manual authentication workflow in which contextual information about the unknown binary is displayed in a graphical user interface for human authentication of the unknown binary;
determining, for each unknown binary, that the unknown binary has been modified relative to a known binary;
determining, for each unknown binary, whether [[the]] modifications of the unknown binary are congruent modifications or divergent modifications, the congruent modifications comprising a modification to a data representation of the known binary which preserve a program nature of the unknown binary, the divergent modifications comprising a modification to a data representation of the known binary which change the program nature of the unknown binary;
assigning a same program identifier to each binary having a congruent modification relative to a same known binary; and
selectively providing each binary with access to system resources or prohibiting sensitive operations based on [[a]] the program nature of the program after automatic or human authentication of the unknown binary and based on the program identifier.
18.	 (Canceled).
19.	 (Currently Amended) The method of claim 17[[8]], wherein the one or more executable integrity tests comprises one or more of: Authenticode, strong name signing, one or more Linux schemes, Android Package Kit (APK) Signing, Apple code signing, PowerShell signing, and JavaScript signing.
20.	(Currently Amended) The method of claim 19, further comprising:
allowing access by the unknown binary to the system resources when it is determined that the modifications of the unknown binary are congruent; and
preventing access by the unknown binary to the system resources when it is determined that the modifications of the unknown binary are divergent.
21.	(Previously Presented) The method of claim 1, wherein the divergent modifications characterize representational disguise which comprises a contrived representation that is given to a program for to impersonate another program with a different program nature.
22.	(Previously Presented) The method of claim 1, wherein the divergent modifications characterize representational obfuscation which comprises a contrived representation that is given to a program for frustrating an understanding of the program nature.
23.	(New) The method of claim 9, wherein the divergent modifications characterize representational disguise which comprises a contrived representation that is given to a program for to impersonate another program with a different program nature.
24.	(New) The method of claim 9, wherein the divergent modifications characterize representational obfuscation which comprises a contrived representation that is given to a program for frustrating an understanding of the program nature.
Allowable Subject Matter
Claims 1-5, 7-13, 15-17 and 19-24 are allowed over prior art of record.
The following is an examiner’s statement of reasons for allowance:
Examiner’s updated search did not yield any specific references that reasonably, either alone or in combination, would result in a proper rejection of all the claimed features presented in each of the independent claims 1, 9 and 17 under 35 U.S.C 102 or 35 U.S.C.103 with proper motivation.
Thus, independent claims 1, 9 and 17 are allowed and the corresponding dependent claims depend upon one of the above-mentioned allowed claims are therefore allowed by virtue of their dependencies.
The closest relevant prior art made of record are:
JIANG, XIN (CN 114091027 A), discloses a trusted hardware that can verify the
validity of the identity of the application program, generating check information corresponding to the application program, and configuring the check information in the storage device needed to be accessed by the application program, based on the check information, determining the access authority of the application program, so as to ensure the data safety the storage device.
DESAI et al. (US 20170223024 A1), the present disclosure relates to client
application control systems and methods in cloud-based security systems for mobile devices. Systems and methods, implemented by one or more nodes in a cloud-based security system, for enforcing application-based control of network resources include receiving a request from a user device for the network resources; evaluating the request through the cloud-based security system and determining an application on the user device performing the request; and performing one of (1) denying the request if the application is unauthorized to access the network resources, (2) redirecting the request to an authorized application on the user device if the application is legitimate but unauthorized to access the network resources, and (3) allowing the request if the application is authorized to access the network resources.
LE ROY et al. (US 20190278914 A1), Techniques are disclosed herein for
preventing an unauthorized circumvention of data protections for sensitive data on a computing device. These techniques can mitigate attempts by firmware or software owners to circumvent these data protections by replacing firmware and/or software on the computing device. An unauthorized user who has physical access to the computing device may attempt to generate a signed firmware image that appears to be legitimate, and that when executed, can access the sensitive data stored on the computing device. The techniques disclosed herein can be used to detect an unauthorized update to software and/or firmware associated with the computing device, and sensitive data can be rendered unrecoverable to prevent the unauthorized software or firmware from obtaining the sensitive data.
Kursun; Eren (US 20200380114 A1), the present invention relates to a system
for security analysis and authentication across downstream applications. For sample, illustrative purposes, system environments will be summarized. The system may involve receiving one time password data associated with the user for an authentication request of a first application. Next, the system may cause a one-time password signature generation engine, comprising a neural network machine learning system, to identify characteristics within the received one time password data and generate a password signature for the user based on the received one time password data associated with the user wherein the password signature comprises a collection of digital or character code associated with the identified characteristics within the received one time password data. The system can then identify a first set of authentication verification matching requirements based on the first application. The system may then determine a first user authentication value based on a comparison of the generated password signature for the user and the identified first set of authentication verification matching requirements based on the first application, and determine whether the user authentication value meets a predetermined threshold value associated with the first application. In response to determining that the user authentication value meets the predetermined threshold value associated with the first application, the system will authenticate the user. Alternatively, in response to determining that the user authentication value does not meet the predetermined threshold value associated with the first application, the system would not authenticate the user or prompt the user for additional authentication credentials.
Jain et al. (US 11522703 B1), discloses that when an application 130 is being
configured and first needs access to a data area, the application 130 can initiate a function call or procedure that involves the access authorization tool 180. For the web application 130b, this may involve redirecting the user from the browser to a user interface of the access authorization tool 180, where the user 102a can select from the data areas for which keys 181 are stored. From this interface, the user can authorize an application 130 to gain access to a specific data area or multiple data areas. Such as, Fig. 3D shows a user interface 330 for the authorization tool 180, or alternatively the web-based authorization tool 183. The interface 330 gives the user options to approve or deny access, including to approve partial or limited access. In the example of Fig. 3D, the user selects to grant/approve a partial access for a Health Data Visualizer Application which is requesting access to read from and write to data area PID1 (e.g., contextual information) as displayed in the authorization tool 330 interface, which then leads to an interface for setting the level of access the user is willing to give to the application as depicted in Fig. 3E. Fig. 3F then shows a user interface 350 that shows the application after receiving the access token and populating information from the data area that the user authorized.
KELLEY; Brian H. (US 20100275014 A1), discloses the process for verifying and
executing an application that involves the mobile device receiving a script for execution from the server, the mobile device verifying that the server from which the script was obtained is named in a digital certificate, the mobile device determining which permissions have been granted to the server according to the contents of the certificate, and the mobile device enabling the script to access a protected resource only when an associated permission has been granted to the server from which the script was obtained.
Chao Zhang, Tao Wei, Zhaofeng Chen, Lei Duan, Laszlo Szekeres, Stephen
McCamant, Dawn song, and Wei Zou (Practical Control Flow Integrity & Randomization for Binary Executables); Pages 15; Published in 2013 IEEE.
However, none of the closest cited prior art(s) mentioned above teaches or suggests, either taken alone or in combination, neither anticipates nor renders obvious, all of the claimed features presented in each of the independent claims 1, 9 and 17. Such as,
with regards to independent claim 1, the claim recites subject matter “executing the one or more authentication factors comprising one or more executable integrity tests in which scripts forming part of the unknown binary are cryptographically verified as being from a known source; selectively providing the unknown binary with access to system resources based on the program nature of the authenticated program identity and based on the determination of whether the modifications of the unknown binary are said congruent modifications or said divergent modifications, wherein the congruent modifications comprising a modification to a data representation of the known binary which preserve a program nature of the unknown binary, and the divergent modifications comprising a modification to a data representation of the known binary which change the program nature of the unknown binary;” which is not disclosed in the closest cited prior art of record. For this reason, the claim limitations as recited in the independent claim 1 along with other features taken as a whole are allowable over the cited prior arts.
with regards to independent claim 9, the claim recites subject matter “executing the one or more authentication factors comprising one or more executable integrity tests in which scripts forming part of the unknown binary are cryptographically verified as being from a known source; selectively prohibiting sensitive operations by the unknown binary based on the program nature of the authenticated program identity and based on the determination of whether the modifications of the unknown binary are said congruent modifications or said divergent modifications, wherein the congruent modifications comprising a modification to a data representation of the known binary which preserve a program nature of the unknown binary, and the divergent modifications comprising a modification to a data representation of the known binary which change the program nature of the unknown binary;” which is not disclosed in the closest cited prior art of record. For this reason, the claim limitations as recited in the independent claim 9 along with other features taken as a whole are allowable over the cited prior arts.
with regards to independent claim 17, the claim recites subject matter “the plurality of authentication factors comprising one or more executable integrity tests in which scripts forming part of the unknown binary are cryptographically verified as being from a known source; assigning a same program identifier to each binary having a congruent modification relative to a same known binary, wherein the congruent modifications comprising a modification to a data representation of the known binary which preserve a program nature of the unknown binary, and the divergent modifications comprising a modification to a data representation of the known binary which change the program nature of the unknown binary; and selectively providing each binary with access to system resources or prohibiting sensitive operations based on the program nature of the program after automatic or human authentication of the unknown binary and based on the program identifier.” which is not disclosed in the closest cited prior art of record. For this reason, the claim limitations as recited in the independent claim 17 along with other features taken as a whole are allowable over the cited prior arts.
Thus, independent claims 1, 9 and 17 along with their dependent claims are in condition of allowance.
Any comments considered necessary by applicant must be submitted no later than the payment of the issue fee and, to avoid processing delays, should preferably accompany the issue fee. Such submissions should be clearly labeled Comments on Statement of Reasons for Allowance. In event of any post-allowance papers (e.g., IDS, 312 amendments, petition, etc.), Applicant is exhorted to mail papers to the Production Control branch in Publications or faxed to post-allowance papers correspondence branch at (703) 308-5864 to expedite issuing process or call PUB's Customer Service if any questions at (703) 305-8497.
Conclusion

APPLICANT REBUTTAL: REMARKS
Reconsideration and allowance are respectfully requested. No new matter has been added. The examiner is encouraged to contact the undersigned at +1.858.314.1178 or ckukkonen@jonesday.com to discuss how best to advance prosecution in light of this filing.
Recognizing that Internet communications are not secure, the undersigned hereby authorizes the USPTO to communicate with the undersigned and practitioners of record in accordance with 37 CFR § 1.33 and 37 CFR § 1.34 concerning any subject matter of this application by video conferencing, instant messaging, or electronic mail. The undersigned acknowledges that a copy of any such communications may be made of record in the application file.
Claim Ob
j
ections
The claims have been amended to address the antecedent basis issues raised in the office action.
Rej
ections under 35 USC
Claims 1, 3-4, 9 and 12 stand rejected under 35 U.S.C. 103 as allegedly being
unpatentable over JIANG, XIN (CN 114091027 A, hereinafter "Jiang"), in view of DESAI et al. (US 20170223024 Al, hereinafter "Desai"). Claims 2, 5, 10 and 13 are rejected under 35 U.S.C. 103 as being unpatentable over JIANG, in view of DESAI and further in view of Jain et al. (US 11522703 B1, hereinafter "Jain"). Claims 6-7 and 14-15 stand rejected under 35 U.S.C. 103 as allegedly being unpatentable over JIANG in view of DESAI and further in view of KELLEY; Brian H. (US 20100275014 Al, hereinafter "Kelley"). Claims 8 and 16 stand rejected under 35 U.S.C. 103 as being unpatentable over JIANG, in view of DESAI and further in view of LE
ROY et al. (US 20190278914 Al; hereinafter "LeRoy"). Claim 11 stands rejected under 35 U.S.C. 103 as allegedly being unpatentable over JIANG in view of DESAI, and further in view of Kraemer et al. (US 20060174319 Al, hereinafter "Kraemer"). Claim 17 stands rejected under 35 U.S.C. 103 as alleged being unpatentable over JIANG in view of Kursun; Eren (US 20200380114 Al; hereinafter "Kursun"), and further in view of Jain and DESAI et al. (US 20170223024 Al, hereinafter "Desai"). Claims 18-19 stand rejected under 35 U.S.C. 103 as allegedly being unpatentable over Jiang as modified by Kursun in view Jain and Desai, as applied above, and further in view of KELLEY; Brian H. (US 20100275014 Al, hereinafter "Kelley"). Claim 20 stands rejected under 35 U.S.C. 103 as allegedly being unpatentable over Jiang as modified by Kursun in view Jain, Desai and Kelley, as applied above, and further in view of LE ROY. These rejections are respectfully traversed.
For a proper rejection under 35 U.S.C. § 103(a), the Office "bears the initial burden of factually supporting any prima facie conclusion of obviousness" and must therefore present "a clear articulation of the reason(s) why the claimed invention would have been obvious." MPEP §2142. An obviousness rejection "cannot be sustained by mere conclusory statements; instead, there must be some articulated reasoning with some rational underpinning to support the legal conclusion of obviousness." MPEP §2141 quoting KSR International Co. v. Teleflex Inc., 82 USPQ2d 1386, 1385 (2007). This rationale must include a showing that all of the claimed elements were known in the prior art and that one skilled in the art could have combined the elements as claimed by known methods with no change in their respective functions, to produce a combination yielding nothing more than predictable results to one of ordinary skill in the art. KSR, 82 USPQ2d at 1395. MPEP §2141.02 further notes that "a prior art reference must be considered in its entirety, i.e., as a
whole,
including portions that would lead away from the
claimed invention. W.L. Gore & Associates, Inc. v. Garlock, Inc., 721 F.2d 1540, 220 USPQ 303 (Fed. Cir. 1983), cert. denied, 469 U.S. 851 (1984). The rejections over the cited references fail to satisfy this burden with regard to the currently pending claims.
Certain amendments were made to the claims in an effort to expedite allowance. Claim 1 was amended to incorporate subject matter from claim 8. The other independent claims were amended in a similar fashion.
It is submitted that the art of record, including the LeRoy reference, fail to teach the
determination of whether or not modifications to an unknown binary relative to a known binary are congruent or divergent as recited. The LeRoy reference is directed to an arrangement in changes to installed software on an integrated circuit are authenticated using a message authentication code (MAC) for the software by applying a cipher-based message authentication code (CMAC) algorithm to the software using a key derived from a Hardware Unique Key (HUK) associated with the integrated circuit along with an authentication of the user. The protection of non-volatile memory in an integrated circuit is sufficiently different than the current subject matter (characterizing unknown binaries and then selectively giving them access based on their program nature) that the skilled artisan would not have been motivated to access the LeRoy reference as alleged. Even if such reference was accessed, LeRoy fails to teach that a determination of both convergent modifications which are a modification to a data representation of the known binary which preserve a program nature of the unknown binary and divergent modifications which are a modification to a data representation of the known binary which change the program nature of the unknown binary. Moreover, with regard to claim 17, the art of record fails to teach the assignment of a single program identifier to all congruent modifications
of a particular known binary file and the uniform treatment of such congruent modifications with regard to access control (as recited).
Therefore, each independent claim should be allowable.
As the independent claims are nonobvious under 35 U.S.C. § 103, then the claims
depending therefrom are also nonobvious. In re Fine, 837 F.2d 1071, 5 USPQ2d 1596 (Fed. Cir. 1988). Accordingly, all claims should be allowable.
Conc
l
udin
g
Comments
On the basis of the foregoing amendments, the pending claims are in condition for allowance. It is believed that all of the pending claims have been addressed in this paper. However, failure to address a specific rejection, issue or comment, does not signify agreement with or concession of that rejection, issue or comment. In addition, because the arguments made above are not intended to be exhaustive, there may be reasons for patentability of any or all pending claims (or other claims) that have not been expressed. Finally, nothing in this paper should be construed as an intent to concede any issue with regard to any claim, except as specifically stated in this paper.
Please treat this reply and any concurrent or future reply, requiring a petition for an
extension of time under 37 CFR 1.136 for its timely submission, as incorporating a petition for extension of time for the appropriate length of time. No fee is believed to be due for this submission. However, should any fee be required, please charge such fee to Jones Day Deposit Account No. 50-3013, referencing our number 103250-999008 and please credit any excess fees to such deposit account.
Respectfully submitted,


CITED REFERENCE SUMMARIES: Ref US20170223024A1: Claims:
A method, implemented by one or more nodes in a cloud-based security system, for enforcing application-based control of network resources, the method comprising: receiving a request from a user device for the network resources; evaluating the request through the cloud-based security system and determining an application on the user device performing the request; and performing one of denying the request if the application is unauthorized to access the network resources, redirecting the request to an authorized application on the user device if the application is legitimate but unauthorized to access the network resources, and allowing the request if the application is authorized to access the network resources.
receiving a request from a user device for the network resources;
evaluating the request through the cloud-based security system and determining an application on the user device performing the request; and
performing one of denying the request if the application is unauthorized to access the network resources, redirecting the request to an authorized application on the user device if the application is legitimate but unauthorized to access the network resources, and allowing the request if the application is authorized to access the network resources.
denying the request if the application is unauthorized to access the network resources,
redirecting the request to an authorized application on the user device if the application is legitimate but unauthorized to access the network resources, and
allowing the request if the application is authorized to access the network resources.
The method of claim 1 , wherein the network resources are in an enterprise network, the user device is a mobile device, the mobile device is configured to communicate with the enterprise network through the cloud-based security system, wherein the enterprise network and the mobile device are both located external to the cloud-based security system, and the enterprise network and the mobile device are both located external to one another.
wherein the enterprise network and the mobile device are both located external to the cloud-based security system, and the enterprise network and the mobile device are both located external to one another.
The method of claim 1 , wherein the user device is connected to the cloud-based security system through a tunnel, and wherein the evaluating is based on a tunnel protocol used.
The method of claim 1 , wherein the network resources are connected to the cloud-based security system through a tunnel, and wherein the evaluating is based on a tunnel protocol used.
The method of claim 1 , wherein the redirecting comprises causing the authorized application to intercept a redirect request, causing a tunnel between the user device and a network associated with the network resources, and enabling exchange of the network resources to the authorized application via the tunnel.
causing the authorized application to intercept a redirect request,
causing a tunnel between the user device and a network associated with the network resources, and
enabling exchange of the network resources to the authorized application via the tunnel.
The method of claim 1 , further comprising: receiving a list of whitelist and blacklist applications for determining the application, wherein the list is associated with the network resources.
receiving a list of whitelist and blacklist applications for determining the application, wherein the list is associated with the network resources.
The method of claim 1 , further comprising: responsive to the denying, providing a notification to the end user through a mobile Operating System notification cloud.
responsive to the denying, providing a notification to the end user through a mobile Operating System notification cloud.
The method of claim 1 , wherein the application comprises an email client and the network resources comprise email on a corporate network.
The method of claim 1 , wherein the application comprises a Web browser and the network resources comprise data files or content on a corporate network.
A node in a cloud-based security system configured to enforce application-based control of network resources, the node comprising: a network interface, a data store, and a processor communicatively coupled to one another; and memory storing computer executable instructions, and in response to execution by the processor, the computer-executable instructions cause the processor to receive a request from a user device for the network resources, evaluate the request through the cloud-based security system and determine an application on the user device performing the request, and perform one of deny the request if the application is unauthorized to access the network resources, redirect the request to an authorized application on the user device if the application is legitimate but unauthorized to access the network resources, and allow the request if the application is authorized to access the network resources.
a network interface, a data store, and a processor communicatively coupled to one another; and
memory storing computer executable instructions, and in response to execution by the processor, the computer-executable instructions cause the processor to receive a request from a user device for the network resources, evaluate the request through the cloud-based security system and determine an application on the user device performing the request, and perform one of deny the request if the application is unauthorized to access the network resources, redirect the request to an authorized application on the user device if the application is legitimate but unauthorized to access the network resources, and allow the request if the application is authorized to access the network resources.
receive a request from a user device for the network resources,
evaluate the request through the cloud-based security system and determine an application on the user device performing the request, and
perform one of deny the request if the application is unauthorized to access the network resources, redirect the request to an authorized application on the user device if the application is legitimate but unauthorized to access the network resources, and allow the request if the application is authorized to access the network resources.
deny the request if the application is unauthorized to access the network resources,
redirect the request to an authorized application on the user device if the application is legitimate but unauthorized to access the network resources, and
allow the request if the application is authorized to access the network resources.
The node of claim 10 , wherein the network resources are in an enterprise network, the user device is a mobile device, the mobile device is configured to communicate with the enterprise network through the cloud-based security system, wherein the enterprise network and the mobile device are both located external to the cloud-based security system, and the enterprise network and the mobile device are both located external to one another.
The node of claim 10 , wherein the user device is connected to the cloud-based security system through a tunnel, and wherein the evaluating is based on a tunnel protocol used.
The node of claim 10 , wherein the network resources are connected to the cloud-based security system through a tunnel, and wherein the evaluating is based on a tunnel protocol used.
The node of claim 10 , wherein, to redirect, the computer-executable instructions cause the processor to cause the authorized application to intercept a redirect request, cause a tunnel between the user device and a network associated with the network resources, and enable exchange of the network resources to the authorized application via the tunnel.
cause the authorized application to intercept a redirect request,
cause a tunnel between the user device and a network associated with the network resources, and
enable exchange of the network resources to the authorized application via the tunnel.
The node of claim 10 , wherein the computer-executable instructions further cause the processor to receive a list of whitelist and blacklist applications for determining the application, wherein the list is associated with the network resources.
receive a list of whitelist and blacklist applications for determining the application, wherein the list is associated with the network resources.
The node of claim 10 , wherein the computer-executable instructions further cause the processor to responsive to the denying, provide a notification to the end user through a mobile Operating System notification cloud.
responsive to the denying, provide a notification to the end user through a mobile Operating System notification cloud.
The node of claim 10 , wherein the application comprises an email client and the network resources comprise email on a corporate network.
The node of claim 10 , wherein the application comprises a Web browser and the network resources comprise data files or content on a corporate network.
A user device configured to access a cloud-based security system which performs application-based control of network resources, the node comprising: a network interface, a data store, and a processor communicatively coupled to one another; and memory storing computer executable instructions, and in response to execution by the processor, the computer-executable instructions cause the processor to provide a request the network resources through an application, responsive to evaluation of the request through the cloud-based security system, perform one of receive a denial of the request if the application is unauthorized to access the network resources, cause redirection of the request to an authorized application by the cloud-based security system if the application is legitimate but unauthorized to access the network resources, and receive a response to the request if the application is authorized to access the network resources.
memory storing computer executable instructions, and in response to execution by the processor, the computer-executable instructions cause the processor to provide a request the network resources through an application, responsive to evaluation of the request through the cloud-based security system, perform one of receive a denial of the request if the application is unauthorized to access the network resources, cause redirection of the request to an authorized application by the cloud-based security system if the application is legitimate but unauthorized to access the network resources, and receive a response to the request if the application is authorized to access the network resources.
provide a request the network resources through an application,
responsive to evaluation of the request through the cloud-based security system, perform one of receive a denial of the request if the application is unauthorized to access the network resources, cause redirection of the request to an authorized application by the cloud-based security system if the application is legitimate but unauthorized to access the network resources, and receive a response to the request if the application is authorized to access the network resources.
receive a denial of the request if the application is unauthorized to access the network resources,
cause redirection of the request to an authorized application by the cloud-based security system if the application is legitimate but unauthorized to access the network resources, and
receive a response to the request if the application is authorized to access the network resources.
The user device of claim 19 , wherein the network resources are in an enterprise network, the user device is a mobile device, the mobile device is configured to communicate with the enterprise network through the cloud-based security system, wherein the enterprise network and the mobile device are both located external to the cloud-based security system, and the enterprise network and the mobile device are both located external to one another.
Ref US20040268313A1: Claims:
A method for controlling the execution of a program implementing successive operations comprising: during program execution, comparing each operation with a pre-established list, and for each operation contained in the list, incrementing and memorizing a number of occurrences of this operation; and at the end of the program execution, comparing the number of occurrences of the current program execution for each operation with previously-stored ranges of numbers of occurrences assigned to each operation, wherein said ranges of values are determined by analysis of the possible statistical deviations of the numbers of occurrences with respect to one or several program executions.
during program execution, comparing each operation with a pre-established list, and for each operation contained in the list, incrementing and memorizing a number of occurrences of this operation; and
at the end of the program execution, comparing the number of occurrences of the current program execution for each operation with previously-stored ranges of numbers of occurrences assigned to each operation,
wherein said ranges of values are determined by analysis of the possible statistical deviations of the numbers of occurrences with respect to one or several program executions.
The method of claim 1 , wherein the numbers of current occurrences are stored in a table.
The method of claim 1 , wherein the increment value is weighted according to the nature and/or the position of the operation in the program.
A processor for executing a program, comprising an area for storing a table of numbers of operation occurrences upon execution of a program, said table being used for the implementation of the method of claim 1.
Ref US20050289270A1: Claims:
A method of automatic control of the execution of a program by a microprocessor, comprising: assigning a digital decrement or increment to at least one function of the program; assigning a digital increment, respectively decrement, to at least one section considered as critical as to the program execution and called by the function; setting a counter to a first value; decreasing, respectively increasing, the counter once per program function before a call to a critical section, by a value which is a function of the decrement, respectively increment, assigned to the concerned program function; increasing, respectively decreasing, the counter on each correct execution of a section, by a value which is a function of the increment, respectively decrement, assigned to the concerned section; and comparing the current value of the counter with a predetermined critical threshold.
assigning a digital decrement or increment to at least one function of the program;
assigning a digital increment, respectively decrement, to at least one section considered as critical as to the program execution and called by the function;
setting a counter to a first value;
decreasing, respectively increasing, the counter once per program function before a call to a critical section, by a value which is a function of the decrement, respectively increment, assigned to the concerned program function;
increasing, respectively decreasing, the counter on each correct execution of a section, by a value which is a function of the increment, respectively decrement, assigned to the concerned section; and
comparing the current value of the counter with a predetermined critical threshold.
The method of claim 1 , wherein the comparison with the critical threshold is performed at each end of a function.
The method of claim 1 , wherein an error processing is implemented when the current value becomes smaller, respectively greater, than the critical threshold, said processing resulting, preferably, in a blocking of the microprocessor.
The method of claim 1 , wherein the increase, respectively decrease, of the counter on each correct execution of a section is limited by a second value.
The method of claim 4 , wherein the first set value of the counter is randomly selected between two terminals.
The method of claim 5 , wherein the second value is randomly selected between two limits relatively high with respect to the two limits of the first value.
The method of claim 1 , wherein the increase, respectively the decrease, of the counter occurs at each beginning of a function.
The method of claim 1 , wherein the increase, respectively the decrease, of the counter occurs at each end of a section.
The method of claim 1 , wherein the increase, respectively the decrease, of the counter before a critical section call, is zero.
The method of claim 1 , wherein the respective increment and decrement values are selected according to their critical character as to the program execution.
The method of claim 1 , wherein the steps of increasing and decreasing the counter comprise incrementing, respectively decrementing, the counter.
A microcontroller comprising at least one microprocessor, a rewritable non-volatile memory, a non-volatile memory, rewritable or not, for storing at least one program to be executed, and a RAM, comprising: means for assigning a digital decrement or increment to at least one function of the program; means for assigning a digital increment, respectively decrement, to at least one section considered as critical as to the program execution and called by the function; means for setting a counter to a first value; means for decreasing, respectively increasing, the counter once per program function before a call to a critical section, by a value which is a function of the decrement, respectively increment, assigned to the concerned program function; means for increasing, respectively decreasing, the counter on each correct execution of a section, by a value which is a function of the increment, respectively decrement, assigned to the concerned section; and means for comparing the current value of the counter with a predetermined critical threshold.
means for assigning a digital decrement or increment to at least one function of the program;
means for assigning a digital increment, respectively decrement, to at least one section considered as critical as to the program execution and called by the function;
means for setting a counter to a first value;
means for decreasing, respectively increasing, the counter once per program function before a call to a critical section, by a value which is a function of the decrement, respectively increment, assigned to the concerned program function;
means for increasing, respectively decreasing, the counter on each correct execution of a section, by a value which is a function of the increment, respectively decrement, assigned to the concerned section; and
means for comparing the current value of the counter with a predetermined critical threshold.
A smart card comprising the microcontroller of claim 12.
Ref US20060265578A1: Claims:
A method of automatic control of the execution of a program by a microprocessor, comprising: storing an initial state of a counter before execution of at least one instruction comprising the execution a given number of times of at least one same operation; on each execution of the operation, incrementing or decrementing the counter by a weight assigned to the operation; and at the end of the instruction, comparing the final state of the counter with an estimated value by increasing, respectively decreasing, its initial state by a multiple of the weight assigned to the operation corresponding to the normal number of executions of this operation in the instruction.
storing an initial state of a counter before execution of at least one instruction comprising the execution a given number of times of at least one same operation;
on each execution of the operation, incrementing or decrementing the counter by a weight assigned 
[Truncated to input limit]