DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This final office action is responsive to the amendments filed on 12/22/2025.
Claims 1-20 are pending.
Response to Amendment
Applicant has amended independent claims 1, 19, 20 and dependent claims 2-5, 7-18 to include new/old limitations in a form not previously presented necessitating new search and considerations.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-6, 8-10, 14-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Ripberger (US 2016/0132512 A1) in view of Simons et al. (US 2016/0205081 A1, hereafter Simons).
Ripberger was cited in the last office action.
As per claim 1, Ripberger teaches the invention substantially as claimed including a method for data management, comprising ([0008] storage resource, resource group, management [0030] creation and manipulation of objects in a database [0044] fig.1 storage management software 420 storage 430):
receiving, at a computing system, a request to assign a first computing object of the computing system to a first tenant of the computing system ([0097] user account requesting access to a storage resource assigned a particular resource group; fig. 9 154, 158 [0098] fig. 10A 904 914 [0006] storage resources, partitioned, assigned to various workloads, set of workloads associated with a specific tenant, multiple tenants [0034] tenants, administrative user IDs assigned to the tenant [0008] storage resource, resource group, management [0030] creation and manipulation of objects in a database [0044] [0081]), wherein the computing system is operable to provide protection for data sources associated with a plurality of tenants of the computing system ([0032] specific users to have access to specific subsets of the object classes i.e. tenants, access, specific subsets of the object class; prevent users in the user set A from affecting logical volumes i.e. data source that are associated with user set B and vice versa [0034] tenants, administrative user IDs assigned to the tenant), and wherein the first computing object is within a first object hierarchy of a plurality of object hierarchies previously stored at the computing system ([0033] object class, object, manageable collection of resources, resource group; fig. 3 [0034] create new resource groups, sub-set storage resources, sub-divide the resources of that level into additional sub-levels [0038] set resources groups, related to one another in a tree structure, resource group, parent resource group, root resource group, number of child resource groups [0039] fig. 4 hierarchy, resource groups, root, child [0040] storage resource hierarchy with tree topology; fig. 6);
identifying ([0036] user resource scope attribute, resource group label attribute, users, managing the storage resources associated with the resource groups i.e. identifying [0035]storage resources, assigned to resource group, resource group label, uniquely identifiers [0054] to correlate, storage resources, user account [0059] test whether user has access to a given resource groups), by the computing system, from among the plurality of object hierarchies, the first object hierarchy that comprises the first computing object ([0035] resource group, collection of storage resources, resource group attributes, resource group attribute, included in the storage resource definition to associate storage resource with one of the plurality of resource group, resource group label attribute [0033] object class, associated with an object, manageable collection of resources, resource group [0034] create new resource groups, multi-level management hierarchy, sub-set storage resources, sub-divide the resources of that level into additional sub-levels [0039] fig. 4 hierarchy, resource groups, root, child [0040] storage resource hierarchy with tree topology; fig. 6 [0099] fig. 10B checks to see if the user URS (user resource scope) match resource X’s resource Group RGL - 926; check if the RG that the user is trying to reassign this resource to has a RGL that match the user URS 934);
checking, by the computing system, the first object hierarchy to identify one or more other computing objects having a hierarchical relationship with the first computing object ([0038] resources groups, particular hierarchy, related to one another, tree structure, parent/child resource groups, labels of the child groups, match all the characters in the parent resource group label e.g. IBM1 is subordinate to the resource group IBM [0101] determine if RGx is a child RG, determine whether RGx is a child RG and if RGX’s policies are subordinate to RG Y’s RGL; fig. 10D - yes [0102] if RGx has child RG, RGY’s RGL; fig. 10D 1014-N [0084] fig. 6; [0099] fig. 10B checks to see if the user URS match resource X’s resource Group RGL - 926; check if the RG that the user is trying to reassign this resource to has a RGL that match the user URS 934), wherein the hierarchical relationship comprises the one or more other computing objects being above or below the first computing object within the first object hierarchy ([0034] create new resource groups, sub-set storage resources, sub-divide the resources of that level into additional sub-levels [0038] set resources groups, related to one another in a tree structure, resource group, parent resource group, root resource group, number of child resource groups [0039] fig. 4 hierarchy, resource groups, root, child [0040] storage resource hierarchy with tree topology [0084] fig. 6 [0099] fig. 10B checks to see if the user URS match resource X’s resource Group RGL - 926; check if the RG that the user is trying to reassign this resource to has a RGL that match the user URS 934);
determining ([0102] fig. 10E resource group X, parent resource group Y, check if resource group X is child RG, user URS does not match the parent RG’s RGL i.e. determining user is associated with RG X and patent RG’s is associated with users other than the requesting user; checks if RG X is a child RG and whether RG X's policies are not subordinate to the parent RG's policies 1010 i.e. different tenant assignment [0104] RG X-child RG and user URS doesn’t match parent RG RGL-yes i.e. child and parent have different user URS indicate different tenant assignment [0084] fig. 6 ), by the computing system, that at least one other computing object from among the one or more other computing objects within the first object hierarchy is assigned to a second tenant of the computing system ([0039] hierarchy, root resource group RGL = Pepsi, child RGL Pepsi.1, Pepsi.2 ; user ID with URS Pepsi* access authority, all these resource groups, user ID with URS=Pepsi.*1, access to the Pepsi.1, Pepsi 1.1, and Pepsi 1.2 resource groups [0081] tenant, user resource scope, limited, range, determined administrator, e.g. Pepsi tenant, Pepsi* user resource scope, limiting to Pepsi subset of the resource group hierarchy [0092] partitioning hierarchical management authority of system of resources, computing storage environment, across multiple tenants and multiple tenant users at multiple level of a hierarchy [0093] fig. 8 814 private resource groups reassigns them to each tenant’s root resource groups 816); and
outputting, by the computing system and in response to the request, an indication that the first computing object is unavailable for assignment to the first tenant based at least in part on the at least one other computing object within the first object hierarchy being assigned to the second tenant ([0030] user interface, [0036] modifying, and managing the storage resource group, associated with at least one of the plurality of resource groups [0102] fig. 10E modify resource group X with existing parent resource group Y if RG x is Child RG and whether the User URS does not match the parent RG's RGL 1002 - yes, reject request 1004 [0084]-[0085] fig. 6).
Ripberger doesn’t specifically teach outputting, by the computing system and in response to the request, an indication.
Simons, however, teaches identify, by the computing system the first object hierarchy that comprises the first computing object ([0003] associate user, security object, security hierarchy, identify security objects in the security hierarchy relative to a security object to which the given user is associated [0044] security hierarchy model 200 defines data access privileges based on relationships between the users [0045] user, associated with security object, mapping information, access to data owned by or shared to user);
determining ([0045] based on mapping information, provide user 102 with access to data owned by or shared to user 104 [0047] [0048] mapping table, maps user IDs, hierarchical security mapping table 224, parent user id, associated with security object, child user id, second user associated with related child security object [0049] user associations to the security objects [0050] identify a number of other users associated with related child security objects that are mapped to the first user [0051] [0061] fig. 4 268 [0070] fig. 8 identifies users, security hierarchy model 458 identify set of users that are at a lower level in the security hierarchy 460), by the computing system, that at least one other computing object from among the one or more other computing objects within the first object hierarchy ([0042] fig. 3A security objects, arranged, plurality of hierarchical levels, parent/child relationships) is assigned to a second tenant of the computing system ([0043] security object. Associated, with a single user / group of users [0044] users, access, data owned by other users, lower in hierarchy i.e. different users is associated with different object in the same object hierarchy);
outputting, by the computing system and in response to the request, an indication ([0069] request, access, reject, notifies the user that access is not granted e.g. displaying an error or warning message on the computer monitor).
It would have been obvious to one of ordinary skills in the art before the effective filing date of the invention was made to combine the teachings of Simons of identify security object within security hierarchy; identify user that are at a lower level in the security hierarchy than the requesting user, and notify the user by displaying error/warning message in case request is rejected to improve efficiency and allow identify, by the computing system, the first object hierarchy that comprises the first computing object, determine, by the computing system, that at least one other computing object from among the one or more other computing objects within the first object hierarchy is assigned to a second tenant of the computing system and outputting an indication of rejection of assignment to the method of Ripberger as in the instant invention. The combination of analogous cited prior art would have been obvious because supplementing the teachings of Ripberger of rejecting the assignment with the GUI for displaying the result and identifying the object in the hierarchy, identifying the users associated with hierarchy at different levels as taught by Simons to yield predictable results of identify object in a hierarchy and outputting an indication of rejection of request with improved usability and efficiency.
As per claim 2, Ripberger teaches further comprising:
receiving, at the computing system, an assignment of available computing objects to the first tenant ([0102] fig. 10E user request modify RG x with parent RG y 994, is RG x is a child RG and user URS doesn’t match RG Y’s RGL-y 1002 reject requests 1004), wherein the available computing objects assigned to the first tenant do not overlap with computing objects assigned to the second tenant ([0084] fig. 6 resource group, user accounts Steve and Mary, Steve - access to create, modify, or delete logical volumes with Resource Group 1, not authorized to create, modify, or delete logical volumes associated with Resource Group 2 [0085] Mary - access to create, modify, or delete logical volumes with Resource Group 2, not, authorized to create, modify, or delete volumes associated with Resource Group 1).
As per claim 3, Ripberger teaches further comprising:
outputting, by the computing system, an indication of one or more computing objects that be available for assignment to the first tenant (fig. 10E user request to modify RGx with parent RG Y 994 allow request 1016 ), an indication of one or more computing objects that are unavailable for assignment to the first tenant (fig. 10E user request to modify RGx with parent RG Y 994 reject request 1004), or both.
Simons teaches remaining claim elements of outputting by computing system an indication ([0069] notifies the user that access is not granted e.g. displaying an error or warning message on the computer monitor).
As per claim 4, Ripberger teaches filtering, by the DMS, a set of computing objects for display via a user interface view, wherein filtering the set of computing objects comprises excluding one or more computing objects from the user interface view based at least in part on the one or more computing objects being unavailable for assignment to the first tenant (fig. 10E user request to modify RGx with parent RG y 994 allow request 1016 reject request 998 [0084]-[0085] fig. 6 [0030] user interface).
Simons teaches remaining claim elements of display via a user interface, from the user interface ([0069] notifies the user that access is not granted e.g. displaying an error or warning message on the computer monitor).
As per claim 5, Ripberger teaches scanning, by the computing system, the plurality of object hierarchies in the computing system to determine whether any computing objects are assigned to more than one tenant of the computing system ([0086] fig. 7 [0087] Bob, RG1-3, Mary, access to subset of Bob’s logical volume, Steve has access to another subset of Bob’s logical volume [0036] schema, comparing, plurality of value of user resource scope attribute with resource group label attribute i.e. scanning); and
updating, by the computing system, respective assignments for any computing objects that are assigned to more than one tenant of the computing system in accordance with a mutually exclusive resource assignment scheme ([0086] fig. 7 [0087] Bob, RG1-3, Mary, access to subset of Bob’s logical volume, Steve has access to another subset of Bob’s logical volume; changing the resource group attributes [0036] schema, user resource scope, resource group).
As per claim 6, Ripberger teaches wherein the first computing object is associated with a cloud platform or a cluster of storage nodes (fig. 1 storage 430 volume 432 [0033] object class, logical volumes, resource group).
As per claim 8, Ripberger teaches wherein determining that the first computing object is unavailable for assignment to the first tenant is based at least in part on a multi-tenant role-based access control (RBAC) scheme of the computing system ([0032] specific users, access, subset of the object classes [0030] different users, different role [0034] multi-tenancy environment, highest level, individual tenants and administrative user, assigned to tenant, [0080] fig. 5 user roles 502 access authorities 504 user resource scope 506).
As per claim 9, Ripberger teaches wherein each computing object of the computing system is assigned to at most one tenant of the plurality of tenants ([0084] fig. 6 Steve-access to resource group 1 not resource group 2 [0085] Mary-access to resource group 2 not resource group 1).
As per claim 10, Ripberger teaches wherein the first computing object is unavailable for assignment to the first tenant if a computing object above or below the first computing object within the first object hierarchy is assigned to another tenant of the computing system ([0099] fig. 10E user requests to modify RG X with parent RG Y 994 is RGx is a child RG and user URS doesn’t match RG Y’s RGL-y 1002 reject request 1004).
As per claim 14, Ripberger teaches the first computing object comprises a first cluster of storage nodes of a plurality of clusters within the computing system ([0043] storage arrays ), and the at least one other computing object comprises a storage node of the first cluster or a portion of the storage node ([047] fig. 1 storage 430 volume 432 ).
As per claim 15, Ripberger teaches the first computing object comprises a storage node or a portion of the storage node included in a cluster of storage nodes within the computing system ([0043] storage arrays), and the at least one other computing object comprises another storage node of the cluster, another portion of the storage node, or the cluster ([0043] storage arrays; [047] fig. 1 storage 430 volume 432 ).
As per claim 16, Ripberger teaches wherein the plurality of object hierarchies associated with the computing system correspond to the data sources subject to protection by the computing system, computing objects within the computing system, users or groups of users associated with the computing system, the plurality of tenants of the computing system, or any combination thereof ([0032] specific users i.e. tenants, access, specific subsets of the object class; prevent users in the user set A from affecting logical volumes i.e. data source that are associated with user set B and vice versa [0034] tenants, administrative user IDs assigned to the tenant [0030] different users, different role [0034] multi-tenancy environment, highest level, individual tenants and administrative user, assigned to tenant, [0080] fig. 5 user roles 502 access authorities 504 user resource scope 506).
As per claim 17, Ripberger teaches wherein all child computing objects that descend from a parent computing object within an object hierarchy of the plurality of object hierarchies are automatically assigned to the first tenant if the parent computing object is assigned to the first tenant ([0038] resource groups, hierarchy, tree structure, root/ parent/ child resource group, each resource group in hierarchy may have any number of child resource groups, policies defined in a child resource group are constrained to be a least as restrictive as the policies of the parent resource group [0039] the user resource scopes of user IDs are assigned such that the user resource scopes have authority over a given node in the tree of a resource group hierarchy and generally also authority over any descendants of the node the user resource scopes are allowed to manage).
As per claim 18, Ripberger teaches assigning a sibling computing object of the first computing object to the first tenant ([0039] user resource scopes of user IDs are assigned such that the user resource scopes have authority over a given node in the tree of a resource group hierarchy and generally also authority over any descendants of the node the user resource scopes are allowed to manage e.g. user ID with URS=Pepsi* would have access authority to all these resource groups; A user ID with a URS=Pepsi.1* would have access to the Pepsi.1, Pepsi.1.1 and Pepsi.1.2 resource groups) based at least in part on determining that a parent computing object from which the sibling computing object and the first computing object both descend is not assigned to another tenant of the computing system ([0039] A user ID with URS=Pepsi* would have access authority to all these resource groups. A user ID with a URS=Pepsi.1* would have access to the Pepsi.1, Pepsi.1.1 and Pepsi.1.2 resource groups [0102] fig. 10E if RG x is Child RG and whether the User URS does not match the parent RG's RGL 1002->N…allow request 1016; [0084] fig. 6).
Claim 19 recites an apparatus comprising: a processor; memory coupled with the processor; and instructions stored in the memory and executable by the processor to cause the apparatus to perform elements similar to claim 1. Therefore, it is rejected for the same rationale.
Claim 20 recites non-transitory computer-readable medium storing code comprising instructions executable by a processor to perform elements similar to claim 1. Therefore, it is rejected for the same rationale.
Claim 7 is/are rejected under 35 U.S.C. 103 as being unpatentable over Ripberger in view of Simons, as applied to above claims, and further in view of Lincoln et al. (US 10,282,718 B1, hereafter Lincoln).
Lincon was cited in the last office action.
As per claim 7, Ripberger teaches wherein transmitting the indication that the first computing object is unavailable comprises: causing, by the DMS, display of a user interface in which an option to assign the first computing object to the first tenant is rendered non-selectable ([0034] tenants, user id, assigned fig. 9 deny access 160 [0030] user interface [0033] logical volume, resource group, attribute, indicate, resource group, not allowed, used as, target, copy operation ).
Ripberger and Simons, in combination, do not specifically teach display of a user interface in which an option is rendered non-selectable.
Lincoln, however, teaches display of a user interface in which an option is rendered non-selectable (col 15 lines 57-65 graphical user interface, inactivated payment option, disabled for user selection).
It would have been obvious to one of ordinary skills in the art before the effective filing date of the invention was made to combine the teachings of Ripberger and Simons with the teachings of Lincoln of graphical user interface with inactivated options that are disabled for user selection to improve efficiency and allow display of a user interface in which an option is rendered non-selectable to the method of Ripberger and Simons as in the instant invention. The combination of cited prior art would have been obvious because supplementing the teachings of Ripberger and Simons of GUI associated with resource assignment with the teachings of Lincoln for inactivating selection option on a GUI to yield predictable results with improved usability and security.
Claims 11-13 is/are rejected under 35 U.S.C. 103 as being unpatentable over Ripberger in view of Simons, as applied to above claims, and further in view of Zhang et al. (US 2021/0191798 A1, hereafter Zhang).
Zhang was cited in the last office action.
As per claim 11, Ripberger teaches wherein the first tenant is a managed service provider (MSP) that manages data for a plurality of sub-tenants that are below the first tenant within a tenant hierarchy of the DMS ([0038] resource groups, hierarchy, tree structure, root/parent/ child resource group, policies defined in a child resource group, constrained to be a least as restrictive as the policies of the parent resource group).
Ripberger and Simons, in combination, do not specifically teach tenant is a managed service providers that manages data for a plurality of sub-tenants.
Zhang, however, teaches first tenant is a managed service provider (MSP) that manages data for a plurality of sub-tenants ([0077] multi-tenant distributed computing system, multi-tenant data center, server, host VMs or containers, provide services to clients, tenant’s system, layers, different sub-teams [0079] VDC, multiple tenants, cloud services provider vdc partitioned into four different tenant-associated vdc, cloud-director services).
It would have been obvious to one of ordinary skills in the art before the effective filing date of the invention was made to combine the teachings of Ripberger and Simons with the teachings of Zhang of multi-tenant virtual data center partitioned into secure virtual data centers to multiple tenants to improve efficiency and allow tenant is a managed service providers that manages data for a plurality of sub-tenants. The combination of cited prior art would have been obvious because supplementing the teachings of Ripberger and Simons of GUI associated with resource assignment with the teachings of Zhang of distributed multi-tenant cloud service provider virtual data center partitioned into and provided to multiple tenants to yield predictable results with improved efficiency.
As per claim 12, Ripberger teaches the first computing object comprises a first virtual data center of a plurality of virtual data centers within the computing system, the first virtual data center comprising a plurality of virtual machines partitioned into a plurality of logical folders, and the at least one other computing object comprises a virtual machine of the plurality of virtual machines ([0006] host logical partitions, capable of running operating system, application) or a logical folder of the plurality of logical folders ([0031] logical volumes).
Zhang teaches remaining claim elements of the first computing object comprises a first virtual data center of a plurality of virtual data centers within the DMS (fig. 9 multi-tenant virtual data centers 910-912 916-919), the first virtual data center comprising a plurality of virtual machines partitioned into a plurality of logical folders ([0054] fig. 7 virtual data centers, servers, runs multiple VMs, virtual data stores, logical abstraction layer).
As per claim 13 Ripberger teaches the first computing object comprises a virtual machine of a plurality of virtual machines in a virtual data center within the DMS ([0006] host logical partitions, capable of running operating system, application), and the at least one other computing object comprises another virtual machine of the plurality of virtual machines ([0006] host logical partitions, capable of running operating system, application), the virtual data center, or a logical folder that includes one or more virtual machines of the plurality of virtual machines ([0031] logical volumes ).
Zhang teaches remaining claim elements of plurality of virtual machine within the virtual data center ([0054] fig. 7 virtual data centers, servers, runs multiple VMs, virtual data stores, logical abstraction layer).
Examiners Note
Applicant is further reminded of that the cited paragraphs and in the references as applied to the claims above for the convenience of the applicant(s) and although the specified citations are representative of the teachings of the art and are applied to the specific limitations within the individual claim, other passages and figures may apply as well. It is respectfully requested from the applicant in preparing responses, to fully consider all of the references in entirety as potentially teaching all or part of the claimed invention, as well as the context of the passage as taught by the prior art or disclosed by the examiner.
Response to Arguments
The previous objections under 35 USC 112 have been withdrawn.
Applicant's arguments filed on 12/22/2025 have been fully considered but they moot in view of new grounds of rejections without acquiescing to any characterization of the previously cited art by the Applicant and only to advance prosecution.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ABU ZAR GHAFFARI whose telephone number is (571)270-3799. The examiner can normally be reached on Monday-Thursday 9:00 - 17:00 Hrs.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Aimee Lee can be reached on 571-272-4169. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ABU ZAR GHAFFARI/Primary Examiner, Art Unit 2195