DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 10/8/25 has been entered.
Remarks
This action is in response to the request for continued examination received on 10/29/25. Claims 1, 3-23, 25-45, and 47-67 are pending in the application. Claim 2, 24, and 46 have been cancelled. Applicants' arguments have been carefully and respectfully considered.
Claim(s) 1, 16-23, 38-45, and 60-66 are rejected under 35 U.S.C. 103 as being unpatentable over Benameur et al. (US 2020/0125731), and further in view of Price et al. (US 9,230,131).
Allowable Subject Matter
Claims 3-15, 24-37, and 47-59 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1, 16-23, 38-45, and 60-66 are rejected under 35 U.S.C. 103 as being unpatentable over Benameur et al. (US 2020/0125731), and further in view of Price et al. (US 9,230,131).
With respect to claim 1, Benameur discloses a computer-implemented method for identifying accessed files in a computing environment by instrumenting one or more applications, the method comprising:
setting, by an initialization operation of an instrumentation engine at a beginning of an instrumentation session for an instrumented application comprising a set of executables, an access time for a set of files to an initial value (Benameur, pa 0019, As shown in FIG. 1, the container reducer 110 receives a first container image 160. The first container image 160 may be configured to instantiate a container in which a particular application can be executed. To enable execution of the particular application, the first container image 160 may include one or more libraries. For example, the first container image may include Library A and Library B. A library may be a collection of files that provide functions that may be called upon by an application executed in a container. For example, Library A includes File A1 and File A2, that together are used to provide Function A1, and File A3, that provides Function A2, and Library B includes File B1 and File B2 that together provide Function B. & pa 0032, each time a file is accessed, the container monitor 120 may receive a notification from the kernel of the operating system with the name of the file and the file identifier 130 may determine those files accessed are necessary to execute the application. & pa 0034, determining that a predetermined time period has elapsed without the second particular file being accessed. For example, the file identifier 130 may determine that three days, five days, seven days, or some other number of days has passed while the application has been run in a container instantiated from the first container image. Examiner note: the initial access sets an initial value), wherein the initial value corresponds to a predetermined time prior to a start time of executing the set of executables and is identical for the files in the set (pa 0019, A library may be a collection of files that provide functions that may be called upon by an application executed in a container. For example, Library A includes File A1 and File A2, that together are used to provide Function A1, and File A3, that provides Function A2, and Library B includes File B1 and File B2 that together provide Function B. & pa 0022, The container monitor 120 may monitor events that occur during execution of the application in a container instantiated from the first container image 160. For example, the container monitor 120 may determine that during a one week period of execution, Files A1, A2, and A3 were accessed and Function A1 was called. The container monitor 120 may monitor events by obtaining file system access events. For example, each time a file is accessed, the container monitor 120 may receive a file system access event from a kernel of an operating system that hosts the container, where the file system access event indicates the file that was accessed. Examiner note: this results in “a start time” by being before a future start time);
executing at least a part of the set of executables in the instrumented application, wherein upon accessing a file by the set of executables, a kernel of the computing environment sets the access time of the file to a new value (Benameur, pa 0032, each time a file is accessed, the container monitor 120 may receive a notification from the kernel of the operating system with the name of the file and the file identifier 130 may determine those files accessed are necessary to execute the application. & pa 0034, determining that a predetermined time period has elapsed without the second particular file being accessed. For example, the file identifier 130 may determine that three days, five days, seven days, or some other number of days has passed while the application has been run in a container instantiated from the first container image. Examiner note: subsequent accesses reset the value)
identifying, from the set of files by a data collection operation of the instrumentation engine at an end of the instrumentation session, a subset of files accessed by the set of executables based on the access time of the files in the subset being different from the initial value (Benameur, pa 0035, determining that a predetermined time period has elapsed without a function that uses the second particular file being called. For example, the file identifier 130 may determine that three days, five days, seven days, or some other number of days has passed while the application has been run in a container instantiated from the first container image and because no function that is provided by the second particular file was accessed during those days, the second particular file is not necessary.); and
providing an output representing the subset of files, wherein the output enables at least one of detecting unusual behavior of the one or more applications or restricting access to one or more files not included in the subset of files (Benameur, pa 0037, The process 300 includes, in response to determining that the first particular file of the set of files is necessary for an application and the second particular file of the set of files is not necessary for the application based on execution of the application in the first container instantiated with the first container image, generating a second container image from the first particular file and not from the second particular file (330). & pa 0042, the process 300 includes identifying a first set of vulnerabilities in the first container image, identifying a second set of vulnerabilities in the second container image, and providing an indication of a difference between the first set of vulnerabilities and the second set of vulnerabilities. For example, the system 100 may identify vulnerabilities in the first container image based on a hash of the files or layers of the first container image, identify vulnerabilities in the second container image, based on a hash of the files or layers of the second container image, and then provide for display to a user a side by side report of vulnerabilities before reduction by the container reducer 110 and vulnerabilities after reduction.).
Benameur doesn't expressly discuss an access time, an initial value, and a new value, and wherein the access time is a field in metadata of the file, wherein the initial value is zero, and wherein the new value represents a time when the file is accessed.
Price teaches setting … an access time for a set of files to an initial value; … upon accessing a file by the set of executables, … sets the access time of the file to a new value (Price, Col. 8 Li. 20-23, On a first access or positive evaluation of the ACL entry, an initial access time/date metadata entry atime (which is initialized as unset or zero) is updated to reflect the time/date of this first access);
identifying… of files accessed by the set of executables based on the access time … being different from the initial value (Price, Col. 8 Li. 35-44, Thus, at 402 the process determines a total number of accesses of the object by this user reflected in a use count metadata (nuse), including a present access request at 102 (which may result in an increment of a nuse data count); or in response to a management query at 102, such as periodic housekeeping inquiry. At 404 the nuse data is compared to threshold applicable to this user provided by the ACL rules 105, and access granted at 108 if the nuse meets (for example, does not exceed or equal) the threshold; else, access is denied and/or user ACL invalidated at 106.);
wherein the access time is a field in metadata of the file, wherein the initial value is zero, and wherein the new value represents a time when the file is accessed (Price, Col. 8 Li. 20-23, On a first access or positive evaluation of the ACL entry, an initial access time/date metadata entry atime (which is initialized as unset or zero) is updated to reflect the time/date of this first access).
It would have been obvious at the effective filing date of the invention to a person having ordinary skill in the art to which said subject matter pertains to have modified Benameur with the teachings of Price because enables an administrator or object owner to have a better understanding of who is using the object, when they used it, how they used it, along with allowing the owner to better control the ACL entries by knowing which ones are not being used, and if used by whom (Price, Col. 5 Li. 60-64).
With respect to claim 16, Benameur in view of Price teaches the method of claim 1, wherein the set of executables comprises a single executable (Benameur, Fig. 1 Function A2).
With respect to claim 17, Benameur in view of Price teaches the method of claim 1, wherein an application image comprises the set of executables (Benameur, Fig. 1).
With respect to claim 18, Benameur in view of Price teaches the method of claim 1, wherein the initial value represents a time before the start time of executing the at least the part of the set of executables, the start time occurring after setting the access time for the set of files to the initial value (Price, Col. 8 Li. 20-23, On a first access or positive evaluation of the ACL entry, an initial access time/date metadata entry atime (which is initialized as unset or zero) is updated to reflect the time/date of this first access).
With respect to claim 19, Benameur in view of Price teaches the method of claim 18, wherein the new value represents a time after the start time (Price, Col. 8 Li. 20-23, On a first access or positive evaluation of the ACL entry, an initial access time/date metadata entry atime (which is initialized as unset or zero) is updated to reflect the time/date of this first access).
With respect to claim 20, Benameur in view of Price teaches the method of claim 1, wherein setting the access time to the new value is in response to determining that at least one of: an initial access of the file is occurring (Price, Col. 8 Li. 20-23, On a first access or positive evaluation of the ACL entry, an initial access time/date metadata entry atime (which is initialized as unset or zero) is updated to reflect the time/date of this first access), a current modification time is younger than the access time before setting the access time to the new value, a current change time is younger than the access time before setting the access time to the new value, or the access time before setting the access time to the new value is at least a threshold time period before a current time.
With respect to claim 21, Benameur in view of Price teaches the method of claim 1, further comprising: executing a side process to wake up in response to a trigger, wherein the subset of files accessed by the set of executables is identified, during execution of an application image, upon waking up of the side process (Benameur, pa 0032, each time a file is accessed, the container monitor 120 may receive a notification from the kernel of the operating system with the name of the file).
With respect to claim 22, Benameur in view of Price teaches the method of claim 21, wherein the trigger comprises at least one of: reaching one or more predetermined times, a user request, a signal, an inter-process communication message or a network message (Benameur, pa 0032, each time a file is accessed, the container monitor 120 may receive a notification from the kernel of the operating system with the name of the file).
With respect to claims 23 and 38-44, the limitations are essentially the same as claims 1 and 16-22, in the form of a machine readable medium, and are rejected for the same reasons
With respect to claims 45 and 60-66, the limitations are essentially the same as claims 1 and 16-22, in the form of an apparatus comprising processing circuitry and memory, and are rejected for the same reasons.
With respect to claim 67, Benameur in view of Price teaches the method of claim 1, wherein metadata of each file of the set of files comprises an access time field, and wherein setting the access time of the set of files to the initial value comprises setting the access time field of each file of the set of files to the initial value (Price, Col. 8 Li. 20-23, On a first access or positive evaluation of the ACL entry, an initial access time/date metadata entry atime (which is initialized as unset or zero) is updated to reflect the time/date of this first access).
Response to Arguments
35 U.S.C. 103
Applicant seems to argue a newly amended limitation. Applicant’s amendment has rendered the previous rejection moot. Upon further consideration of the amendment, a new grounds of rejection is made in view of Price et al. (US 9,230,131).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to BRITTANY N ALLEN whose telephone number is (571)270-3566. The examiner can normally be reached M-F 9 am - 5:00 pm EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Sherief Badawi can be reached on 571-272-9782. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/BRITTANY N ALLEN/ Primary Examiner, Art Unit 2169