Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This action is in response to the claims filed 7/09/2025. Claims 1, 2, 4-8, 10-13, 15-20 are pending. Claims 1, 8, and 13 are independent.
Response to Arguments
Applicant's arguments filed 7/09/2025 have been fully considered but they are not persuasive.
On page 8 of the remarks, Applicant references ¶¶ 29, 30, 40-42 and states “the numerous references to use of a platform-agnostic scanner in the Specification would inform such a person that the inventors had possession of the concept of performing platform agnostic scans as part of the claimed method.”
This argument is not persuasive. Repeatedly reciting the word “platform agnostic” does not remedy the lack of written description thereof. The specification does not describe how to perform a platform agnostic scan.
On page 9 of the remarks, Applicant states: “A person having ordinary skill in the art would understand that a platform-agnostic scan is a scan that is agnostic to the platform of the thing being scanned.” This argument is not persuasive.
The thing being scanned, the cloud storage object, has no platform. Nor is it required to be an executable that requires a particular operating system. It is unclear what acts or structure are required of a platform agnostic scan.
Applicant’s remarks with regard to “locking the storage object” are persuasive and the reference thereto has been removed from the 112(a) rejection.
Applicant’s arguments with respect to claim(s) 1, 2, 4-8, 10-13, 15-20 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Claim Rejections - 35 USC § 112
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Claims 7, 13, 16, and 17 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
Each of claims 7, 13, 16, and 17 require “a platform-agnostic scan capable of detecting threats irrespective of a target operating system of the cloud storage object”. Similar terminology is found in Applicant’s specification paragraph 29. Applicant’s specification provides no detail on how to perform a “platform agnostic scan”.
Per MPEP 2163.I.A: “An invention described solely in terms of a method of making and/or its function may lack written descriptive support where there is no described or art-recognized correlation between the disclosed function and the structure(s) responsible for the function…. Written description issues may also arise if the knowledge and level of skill in the art would not have permitted the ordinary artisan to immediately envisage the claimed product arising from the disclosed process.”
Here, Applicant requires that the scanner is “platform agnostic” but provides no structure responsible for the function.
Malware often relies on particular operating systems to function (such as Microsoft Windows libraries or Android permission structures. Clearly, Applicant’s specification has provided no mechanism for accommodating malware targeted to particular operating systems. The claim scope encompasses all classes of malware but the specification provides no written description of detecting all classes of malware with a ”platform agnostic” scanner.
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 7, 13, 16, and 17 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Each of claims 7, 13, 16, and 17 require “a platform-agnostic scan capable of detecting threats irrespective of a target operating system of the cloud storage object”. Similar terminology is found in Applicant’s specification paragraph 29.
(A) It is unclear what “a target operating system of the cloud storage object” requires.
(B) It is unclear what manner of functionality constitutes “platform-agnostic … irrespective of a target operating system”
Regarding (A), the cloud storage object is not stated to be an executable and its not clear why the storage object would have an intended operating system, nor which entities ‘intent’ is implicated in the context of the claim.
Regarding (B), it is not clear if “platform agnostic scan” limits the claim to particular types of malware that are not related to an operating system (such as JavaScript, See Burdette ¶ 59); if the scan is performed outside of an operating system (such as at boot time, See Rothman et al., US 2005/0216759 ¶ 42); or if some entirely different functionality is intended.
Per MPEP 2173.I: “if the language of a claim, given its broadest reasonable interpretation, is such that a person of ordinary skill in the relevant art would read it with more than one reasonable interpretation, then a rejection under 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph is appropriate.”
The several contradictory interpretations render each of claims 7, 13, 16, and 17 ambiguous. For the purposes of Examination, this platform agnostic scan will be interpreted to be that of Burdette, that accommodates JavaScript and other OS independent scripting languages.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claim(s) 1, 2, 4-8, 10-13, 15-20 is/are rejected under 35 U.S.C. 102(A)(2) as being anticipated by Burdette et al., US 2017/0372070 (filed 2017).
As to claim 1 Burdette discloses a non-transitory CRM comprising:
(see Burdette ¶ 8, discussing computer readable media and hardware)
receiving data for storage in a cloud storage object; (“an application stores a file in the cloud data store 306 with default permissions that permit access by applications running in the VPC 314. The scanning service 304 receives notification of the storage event from the cloud data store 306, and the scanning service 304 scans the file.” Burdette ¶ 100. Also Burdette ¶ 126)
locking the cloud storage object by making the cloud storage object inaccessible to users, devices, and networks; (“In some implementations in which permissions are used, an application stores a file in the cloud data store 306 with default permissions that do not permit access by applications running in the VPC 314.” Burdette ¶ 101. See Burdette ¶¶ 36, 88. VPC, a virtual private cloud, comprises a network, administrator, and applications on the VPC. See also Burdette ¶¶ 98 and 99)
sending an event to a cloud storage security system, (“an application stores a file in the cloud data store 306 with default permissions that permit access by applications running in the VPC 314. The scanning service 304 receives notification of the storage event from the cloud data store 306, and the scanning service 304 scans the file.” Burdette ¶ 100) the event including information describing the data, wherein the event includes one or more of an identifier of the cloud storage object, a type of the cloud storage object, an owner of the cloud storage object, a total size of the cloud storage object, a size of a change to the cloud storage object, or a source of the change to the cloud storage object; (“the scanning service takes file event notifications from the data store as an input. For example, in some implementations, an ‘event’ may be a JSON file, which is passed into the queue. The scanning service may pull this JSON structure from the queue. The JSON structure may include relevant details about the file activity, and (assuming permissions have been delegated appropriately by the owner of the data store) includes information to access the file. An example JSON structure in the context of AWS is below….” Burdette ¶ 120)
receiving an event response from the cloud storage security system; and (Burdette ¶ 128, file scanned then: “block 518, a notification may be sent regarding the file. The notification may include or trigger instructions to take an action. The notification may include information about the file. The notification may include a link to the file. The notification may include a link to delete the file.” Burdette ¶ 134. Also the other actions detailed in Figure 5B.)
performing a security action based on the event response. (“If access to the file needs to be restricted based on the scan, the scanning service 304 does not change the permission of the file so that applications in the VPC 314 still cannot access the file. If access to the file does not need to be restricted based on the scan, the scanning service 304 changes the permission of the file so that applications in the VPC 314 may access the file.” Burdette ¶ 101)
As to claim 8 Burdette discloses a method comprising:
receiving data for storage in a cloud storage object; (“an application stores a file in the cloud data store 306 with default permissions that permit access by applications running in the VPC 314. The scanning service 304 receives notification of the storage event from the cloud data store 306, and the scanning service 304 scans the file.” Burdette ¶ 100. Also Burdette ¶ 126)
locking the cloud storage object by making the cloud storage object inaccessible to users, devices, and networks; (“In some implementations in which permissions are used, an application stores a file in the cloud data store 306 with default permissions that do not permit access by applications running in the VPC 314.” Burdette ¶ 101. See Burdette ¶¶ 36, 88. VPC, a virtual private cloud, comprises a network, administrator, and applications on the VPC. See also Burdette ¶¶ 98 and 99)
sending an event to a cloud storage security system, (“an application stores a file in the cloud data store 306 with default permissions that permit access by applications running in the VPC 314. The scanning service 304 receives notification of the storage event from the cloud data store 306, and the scanning service 304 scans the file.” Burdette ¶ 100) the event including information describing the data, wherein the event includes one or more of an identifier of the cloud storage object, a type of the cloud storage object, an owner of the cloud storage object, a total size of the cloud storage object, a size of a change to the cloud storage object, or a source of the change to the cloud storage object; (“the scanning service takes file event notifications from the data store as an input. For example, in some implementations, an ‘event’ may be a JSON file, which is passed into the queue. The scanning service may pull this JSON structure from the queue. The JSON structure may include relevant details about the file activity, and (assuming permissions have been delegated appropriately by the owner of the data store) includes information to access the file. An example JSON structure in the context of AWS is below….” Burdette ¶ 120)
receiving an event response from the cloud storage security system; and (Burdette ¶ 128, file scanned then: “block 518, a notification may be sent regarding the file. The notification may include or trigger instructions to take an action. The notification may include information about the file. The notification may include a link to the file. The notification may include a link to delete the file.” Burdette ¶ 134. Also the other actions detailed in Figure 5B.)
performing a security action based on the event response. (“If access to the file needs to be restricted based on the scan, the scanning service 304 does not change the permission of the file so that applications in the VPC 314 still cannot access the file. If access to the file does not need to be restricted based on the scan, the scanning service 304 changes the permission of the file so that applications in the VPC 314 may access the file.” Burdette ¶ 101)
As to claim 13 Burdette discloses a non-transitory CRM comprising:
(see Burdette ¶ 8, discussing computer readable media and hardware)
receiving, from a cloud storage platform, an event identifying a cloud storage object, (“an application stores a file in the cloud data store 306 with default permissions that permit access by applications running in the VPC 314. The scanning service 304 receives notification of the storage event from the cloud data store 306, and the scanning service 304 scans the file.” Burdette ¶ 100. Also Burdette ¶ 126) wherein the event includes one or more of an identifier of the cloud storage object, a type of the cloud storage object, an owner of the cloud storage object, a total size of the cloud storage object, a size of a change to the cloud storage object, or a source of the change to the cloud storage object; (“the scanning service takes file event notifications from the data store as an input. For example, in some implementations, an ‘event’ may be a JSON file, which is passed into the queue. The scanning service may pull this JSON structure from the queue. The JSON structure may include relevant details about the file activity, and (assuming permissions have been delegated appropriately by the owner of the data store) includes information to access the file. An example JSON structure in the context of AWS is below….” Burdette ¶ 120)
determining, using the event, to scan the cloud storage object; (“the scanning service receives from the cloud storage service, a notification regarding storage activity related to a file.” Burdette ¶ 126)
responsive to determining to scan the cloud storage object, downloading a copy of the cloud storage object from the cloud storage platform; (“block 506, after the completion of the storage activity, the scanning service receives the file from the cloud storage service. The scanning service may copy the file from the cloud data store to another data store. The another data store may be a cloud data store. The another data store may be a local data store.” Burdette ¶ 127. Also, Burdette ¶ 121)
scanning the copy of the cloud storage object using a platform-agnostic scanner, (“block 508, the file is scanned by the scanning service.” Burdette ¶ 128) wherein the platform-agnostic scanner comprises a malware detection agent that is capable of detecting threats irrespective of a target operating system of the cloud storage object, (“the scanning services uses one or more scanners (e.g., anti-malware, anti-virus, data loss prevention, content matching, etc.) to scan the file and return a result.” Burdette ¶ 124. No specific OS is required of the scanner. Note also the discussion of OS agnostic script executables in Burdette ¶ 59: “Programming environments for thin clients 144 may include JavaScript/AJAX, ASP, JSP, Ruby on Rails, Python's Django, PHP, and the like.”) and wherein the malware detection agent operates in a runtime environment that is separate from the target operating system; and (See Burdette Figure 3, VPC containing VM instances 314 being the target OS and the scanning service 304 being separate therefrom. See discussion of the existence of Oss in Burdette ¶ 60)
providing instructions to the cloud storage platform to perform a security action, the security action determined using results of the scan of the copy of the cloud storage object. (“If access to the file needs to be restricted based on the scan, the scanning service 304 does not change the permission of the file so that applications in the VPC 314 still cannot access the file. If access to the file does not need to be restricted based on the scan, the scanning service 304 changes the permission of the file so that applications in the VPC 314 may access the file.” Burdette ¶ 101. Also, Burdette ¶ 134)
As to claim 2, Burdette discloses the CRM/method of claim 1 and further discloses:
wherein the cloud storage object is a preexisting cloud storage object and the data is a change to the preexisting cloud storage object. (“The activity may be, as a few examples, a related to an upload of a file to a cloud data store, or related to download of a file from a cloud data store, or related to a change to a file in a cloud data store.” Burdette ¶ 126)
As to claims 4 and 10, Burdette discloses the CRM/method of claims 1 and 8 and further discloses:
the operations further comprising sending a copy of the cloud storage object to a scanner, wherein the event response includes results of a scan performed by the scanner on the copy of the cloud storage object. (“block 506, after the completion of the storage activity, the scanning service receives the file from the cloud storage service. The scanning service may copy the file from the cloud data store to another data store. The another data store may be a cloud data store. The another data store may be a local data store.” Burdette ¶ 127. Also, Burdette ¶ 121).
As to claims 5, 11, and 19, Burdette discloses the CRM/method of claims 4, 10, and 13 and further discloses:
wherein the results of the scan indicate that the cloud storage object is safe, and the security action comprises unlocking the cloud storage object responsive to the results of the scan indicating that the cloud storage object is safe. (“If access to the file does not need to be restricted based on the scan, the scanning service 304 changes the permission of the file so that applications in the VPC 314 may access the file.” Burdette ¶ 101)
As to claims 6, 12, and 20, Burdette discloses the CRM/method of claim 4, 10, and 13 and further discloses:
wherein the results of the scan indicate that a threat was detected in the cloud storage object, and the security action comprises one or more of: (“block 516, an action may be taken with respect to the cloud storage service based on the determination that at least a portion of the file should not be distributed.” Burdette ¶ 133)
sending a notification of the threat to a client device of a user associated with the cloud storage object, quarantining the cloud storage object, deleting the cloud storage object, changing access permissions for the cloud storage object, or locking access to a cloud storage platform in which the cloud storage object is stored.
(Burdette ¶ 128, file scanned then: “block 518, a notification may be sent regarding the file. The notification may include or trigger instructions to take an action. The notification may include information about the file. The notification may include a link to the file. The notification may include a link to delete the file.” Burdette ¶ 134. Also the other actions detailed in Figure 5B.)
As to claim 7, Burdette discloses the CRM/method of claim 1 and further discloses:
wherein the scan performed by the scanner is a platform-agnostic scan capable of detecting threats irrespective of a target operating system of the cloud storage object. (“the scanning services uses one or more scanners (e.g., anti-malware, anti-virus, data loss prevention, content matching, etc.) to scan the file and return a result.” Burdette ¶ 124. No specific OS is required of the scanner. Note also the discussion of OS agnostic script executables in Burdette ¶ 59: “Programming environments for thin clients 144 may include JavaScript/AJAX, ASP, JSP, Ruby on Rails, Python's Django, PHP, and the like.”)
As to claim 15, Burdette discloses the CRM/method of claim 13 and further discloses:
wherein determining to scan the cloud storage object comprises: identifying a policy that applies to the cloud storage object; and (“the file may include content that should be protected from distribution under a policy.” Burdette ¶ 104))
applying the policy to one or more attributes of the cloud storage object to determine whether to scan the cloud storage object, (“The scanning service 304 may receive policies from a security manager 316 and also may provide status information, events, and alerts to the security manager 316.” Burdette ¶ 94. Note also Burdette ¶ 110 discussing policies assigned to the scanning service.)
wherein the one or more attributes includes at least one of size, frequency of access, total number of accesses, time since last use, frequency of edits, source, or storage location. (“the scanning service takes file event notifications from the data store as an input. For example, in some implementations, an ‘event’ may be a JSON file, which is passed into the queue. The scanning service may pull this JSON structure from the queue. The JSON structure may include relevant details about the file activity, and (assuming permissions have been delegated appropriately by the owner of the data store) includes information to access the file. An example JSON structure in the context of AWS is below….” Burdette ¶ 120).
As to claim 16, Burdette discloses the CRM/method of claim 13 and further discloses:
recording activities of a plurality of platform-agnostic scanners that includes the platform-agnostic scanner; (“a usage-based billing model as compared to a per-seat license for each image created, which may be desirable with cloud billing models, and particularly in an auto-scaling environment. As instances are created and shut down, instantiations of the scanning service 304 may be based on the load on the scanning service 304 load, and may be managed, for example, by the security manager 316” Burdette ¶ 90. Also: “The security data lookup service 320 may be used, for example, to check patterns identified by the scanning service 304, determine reputations of resources identified or provided by the scanning service 304, and so forth.” Burdette ¶ 97)
determining, based on the activities of the plurality of platform-agnostic scanners, that the platform-agnostic scanner is available to scan the copy of the cloud storage object; and (“The scanning service 304 may provide files or data to the data lookup facility 320 for further analysis.” Burdette ¶ 97)
instructing the platform-agnostic scanner to scan the copy of the cloud storage object. (“the scanning service 304 may initiate sending data to the data lookup 320 under a variety of circumstances, for example, if the scanning service 304 is unable to determine whether a file or a portion of a file is malicious, or the relevance of code or other content, or if the reputation of a file is unknown. The data lookup service 320 may request a file or data to be provided to the data lookup service 320 for further investigation.” Burdette ¶ 97).
As to claim 17, Burdette discloses the CRM/method of claim 16 and further discloses:
predicting demand for scanning jobs based on historical data of scanning jobs performed by the plurality of platform-agnostic scanners; and adding or removing an additional platform-agnostic scanner to the plurality of platform- agnostic scanners based on the predicted demand. (“a usage-based billing model as compared to a per-seat license for each image created, which may be desirable with cloud billing models, and particularly in an auto-scaling environment. As instances are created and shut down, instantiations of the scanning service 304 may be based on the load on the scanning service 304 load, and may be managed, for example, by the security manager 316” Burdette ¶ 90.)
As to claim 18, Burdette discloses the CRM/method of claim 16 and further discloses:
wherein the operations further comprise sending, to the cloud storage platform and responsive to determining to scan the cloud storage object, an instruction to lock the cloud storage object by making the cloud storage object inaccessible to users, devices, and networks. (“In some implementations, the scanning service may move files or change the name of files in order to control access. For example, to prevent access to a file, the scanning service may change the name or the location (e.g., path in a file system) of a file in order to prevent access. In some implementations, the scanning service 304 may replace a file with another file that is “clean.”” Burdette ¶ 98. See Burdette ¶¶ 36, 88. VPC, a virtual private cloud, comprises a network, administrator, and applications on the VPC. See also Burdette ¶¶ 99 and 101)
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. See PTO-892, particularly:
Silk et al., US 2019/0251273, disclosing a policy decision offload accelerator.
DiGiambattista, US 2017/0017795, discloses enterprise level security orchestration.
Rothman et al., US 2005/0216759, discloses that a virus scanner is ‘considered’ platform agnostic if it is independent of an OS.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Rupal Dharia can be reached at 571-272-3880. The examiner can normally be reached Monday - Friday 6:30 A.M.- 3:00 P.M. E.D.T..
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/RUPAL DHARIA/Supervisory Patent Examiner, Art Unit 2492
Prosecution Insights