Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This Office Action is in response to the amendment filed on 03/24/2026. In the instant amendment, claims 4, 16, 18 and 20 were amended; claims 1 and 24 are independent claims. Claims 1-24 are pending in this application. THIS ACTION IS MADE FINAL.
Response to Arguments
The 35 U.S.C. 112(f) claims interpretation has been maintained.
The 35 U.S.C. 101 rejection to claim 20 has been withdrawn.
The 35 U.S.C. 112(b) rejection to claim 4 has been withdrawn.
Applicant’s arguments filed 03/24/2026 have been fully considered but they are not persuasive.
Applicant argues that on (pages 10-14):that Ansel and Korotaev address different problems and are incompatible and that the proposed combination would not result in the claimed checkpoint/orchestrator/substitution arrangement. Ansel is directed to distributed multithreaded checkpointing, while Korotaev is directed to hardening security systems using live patching.
The Examiner respectfully disagrees with the applicant. The fact that references address different stated problems does not, by itself, defeat obviousness. The relevant inquiry is whether the references are reasonably pertinent to the problem faced by the inventor and whether the proposed combination would have been a predictable use of prior-art elements.
Here, Ansel teaches the checkpointing infrastructure relied upon in the rejection. Ansel/DMTCP is expressed described as transparent checkpointing of distributed processes, including checkpointing “a network of programs connected by sockets,” while operating on unmodified binaries and without kernel modification.” Korotaev teaches runtime security hardening using generated live patches, including identifying software and data structures and modifying software during runtime without restarting the software. Thus both references are directed to managing running computer processes at runtime in a networked/security context. Ansel supplies a known checkpoint/restart mechanism for preserving process execution state, while Korotaev supplies a known security-driven reason to alter, harden, or intervene in a running process in response to unauthorized or malicious activity. Combining those teachings would have predictably yielded a system in which a running process is checkpointed and managed so that a security-related runtime intervention can occur without reduced disruption.
Applicant’s incompatibility argument (pages 13-14): appears to assume that Korotaev’s randomization live patch must be inserted directly into Ansel’s checkpoint image or that Ansel must restore a process whose code has been destructively altered.
The Examiner respectfully disagrees with the applicant. This is not the combination relied upon. The proposed combination uses Ansel for what Ansel teaches: checkpointing, suspending, storing, and restoring execution state of distributed processes, including processes connected through sockets. Korotaev is relied upon for its teaching that security systems can modify or intervene in running software during runtime for hardening purposes, without restarting the software. The combination does not require replacing Ansel’s checkpointing technique with Korotaev’s live-patching mechanism, nor does it require removing essential code from a process image before restoration. A person of ordinary skill in the art (PHOSITA) would have understood the combination as using Ansel’s checkpointing and restart framework to preserve or restore process state while applying Kortaev’s security-driven runtime intervention concept. Applicant’s assertion that a bodily incorporation might cause incorrect behavior does not address the actual proposed combination.
Applicant argues that on (pages 10-14): Korotaev does not teach the claimed “checkpoint generator,” “orchestrator,” or receiving a checkpoint and transition configuration to manage a substitution process.
The Examiner respectfully disagrees with the applicant. This rejection does not rely alone for those checkpointing features. Ansel supplies the checkpointing functionality: DMTCP is a checkpoint/restart system for distributed multithreaded processes and networked applications. It is specifically described as checkpointing distributed programs connected by sockets, and as operating transparently on unmodified binaries. Korotaev supplies the security-hardening context and the reason to perform a runtime intervention in response to unauthorized or malicious activity.
Accordingly, the combined teachings render obvious a system in which process state is checkpointed and later used to manage a runtime-security intervention. The claims do not require that a single reference use Applicant’s exact labels “checkpoint generator”, “orchestrator,” or “substitution process.”
Applicant argues (on pages 15-17) that one of ordinary skill in the art would not have had a reasonable expectation of success because Ansel allegedly restores memory and threads to their original state, while Korotaev allegedly removes or randomizes code in a way that would make the process unstable. This argument again assumes a bodily incorporation that is not required.
Ansel’s checkpointing system is expressly designed for transparent checkpoint/restart of distributed applications, including applications connected by sockets, and is described as working on unmodified binaries. Korotaev’s live-patching system is expressly directed to modifying software during runtime without restarting the software. These teachings would have given a person of ordinary skill in the art a reasonable expectation that process-state preservation and runtime security intervention could be used together to reduce disruption during security-related process modification or substitution. The proposed combination therefore does not require an inoperable system. Rather, it uses known checkpointing to preserve execution state and known runtime security modification to counter unauthorized activity.
Applicant further argues (pages 15-17) that Ansel teaches away because DMTCP is distributed without privileged access or special kernel modules, while Korotaev allegedly uses kernel modules or kernel patches. This is not a teaching away from the claimed invention.
A reference teaches away only when it criticizes, discredits or otherwise discourages the claimed combination. Ansel’s disclosure that DMTCP may operate transparently and without kernel modification does not criticize or discourage runtime security intervention. It merely describes an advantage of Ansel’s checkpointing implementation. Likewise, Korotaev’s disclosure of live patching does not discourage checkpointing. At most, Applicant identifies implementation differences, not a technical incompatibility that would have deterred a skilled artisan from using Ansel’s checkpointing implementation. Likewise, Korotaev’s disclosure of live patching does not discourage checkpointing. At most, applicant identifies implementation differences, not a technical incompatibility that would have deterred a skilled artisan from using Ansell’s checkpointing framework in a security-hardening environment.
For at least the reasons above, Applicant’s arguments are not persuasive. The rejection is maintained because Ansel teaches checkpointing, suspending, storing, and restoring execution information for distributed processes, including socket-connected purposes, and Korotaev teaches runtime security intervention/hardening of software without restarting the software. A person of ordinary skill in the art (PHOSITA) would have been motivated to combine these teachings to enable security-driven runtime intervention while preserving process execution state and reducing service disruption.
Claim Interpretation
The following is a quotation of 35 U.S.C. 112(f):
(f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph:
An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The claims in this application are given their broadest reasonable interpretation using the plain meaning of the claim language in light of the specification as it would be understood by one of ordinary skill in the art. The broadest reasonable interpretation of a claim element (also commonly referred to as a claim limitation) is limited by the description in the specification when 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is invoked.
As explained in MPEP § 2181, subsection I, claim limitations that meet the following three-prong test will be interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph:
(A) the claim limitation uses the term “means” or “step” or a term used as a substitute for “means” that is a generic placeholder (also called a nonce term or a non-structural term having no specific structural meaning) for performing the claimed function;
(B) the term “means” or “step” or the generic placeholder is modified by functional language, typically, but not always linked by the transition word “for” (e.g., “means for”) or another linking word or phrase, such as “configured to” or “so that”; and
(C) the term “means” or “step” or the generic placeholder is not modified by sufficient structure, material, or acts for performing the claimed function.
Use of the word “means” (or “step”) in a claim with functional language creates a rebuttable presumption that the claim limitation is to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites sufficient structure, material, or acts to entirely perform the recited function.
Absence of the word “means” (or “step”) in a claim creates a rebuttable presumption that the claim limitation is not to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is not interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites function without reciting sufficient structure, material or acts to entirely perform the recited function.
Claim limitations in this application that use the word “means” (or “step”) are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action. Conversely, claim limitations in this application that do not use the word “means” (or “step”) are not being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action.
This application includes one or more claim limitations that do not use the word “means,” but are nonetheless being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because the claim limitation(s) uses a generic placeholder that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. Such claim limitation(s) is/are: a profiler component that collects (claim 1); a checkpoint generator component that instantiates/suspends/stores/creates (claim 1), an orchestrator component that receives (claim 1); a transition configuration to manage/enact (claim 1); the profiler component extracts/analyzes (claim 2); the profiler component generates (claim 3); a process instantiator that executes (claim 5); a process interactor that establishes (claim 3), an artifact extractor that stores (claim 5); the processor interactor logs (claim 6); the checkpoint generator component creates (claim 8); a unique identifier element that matches (claim 9); a port element that the checkpoint utilizes (claim 9); a method element that identifies (claim 9); a connection element that specifies (claim 10); a store element that identifies (claim 10); a template element that identifies (claim 10); a converter element that identifies (claim 10); a weaver element that identifies (claim 10); a script element that identifies (claim 10); a command element that isolates and extracts (claim 10); a delay element that identifies (claim 10); a template element that identifies (claim 11); a first trigger element that identifies (claim 11); a compile element that determines (claim 11); a checkpoint element that specifies (claim 11); a checkpoint element that specifies (claim 11); a library element that identifies (claim 11); an environment constructor that reads (claim 12); a code generator that creates (claim 12); an interaction process that connects (claim 12); an interaction process that connects (claim 12); a checkpoint creator that runs (claim 12); the code generator uses a template engine to create (claim 13); the code generator creates an auto-interrupter program that overrides (claim 14); the orchestrator component handles (claim 17); the orchestrator component handles (claim 18); the orchestrator component interweaves (claim 18); a code generator that creates (claim 19); a honeypot instantiator that executes (claim 19); a trigger that analyzes (claim 19); a process weaver that retrieves (claim 19).
Because this/these claim limitation(s) is/are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, it/they is/are being interpreted to cover the corresponding structure described in the specification as performing the claimed function, and equivalents thereof.
If applicant does not intend to have this/these limitation(s) interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, applicant may: (1) amend the claim limitation(s) to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph (e.g., by reciting sufficient structure to perform the claimed function); or (2) present a sufficient showing that the claim limitation(s) recite(s) sufficient structure to perform the claimed function so as to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-2, 12, 20 and 24 are rejected under 35 U.S.C. 103 as being unpatentable over Ansel et al (“Ansel,” DMTCP: Transparent Checkpointing for Cluster Computations and the Deskop, IEEE, Pages 1-12, 2009) in view of Korotaev et al (“Korotaev,” US 20220147619).
Regarding claim 1, Ansel discloses a networked computer system for automated substitution process with reserved connection capabilities, (Ansel discloses on Pages 1-2 Under Abstract and Introduction, Section 1.1. Use Cases, a networked computer system for automated substitution process with reserved connection capabilities)
the networked computer system comprising: a profiler component that collects information about a candidate process and generates a configuration file; (Ansel discloses on Page 3, Under Section 4 Usage and Features and Page 1, Abstract, a profiler component that collects information about a candidate process and generates a configuration file)
Ansel fails to explicitly disclose a checkpoint generator component that instantiates, suspends, and stores information for execution of the candidate process and creates a checkpoint based on the configuration file; and an orchestrator component that receives the checkpoint and a transition configuration to manage and enact a substitution process for the candidate process for counteracting unauthorized use of predetermined data in the network while maintaining all network connections during execution of the substitution process.
However, in an analogous art, Korotaev discloses a checkpoint generator component that instantiates, suspends, and stores information for execution of the candidate process and creates a checkpoint based on the configuration file; (Korotaev discloses a checkpoint generator component [0044] that instantiates [0007], suspends [0029], and stores information [0044] for execution of the candidate process [0032] and creates a checkpoint [0044] based on the configuration file [0032];
and an orchestrator component that receives the checkpoint and a transition configuration to manage and enact a substitution process for the candidate process for counteracting unauthorized use of predetermined data in the network while maintaining all network connections during execution of the substitution process (Korotaev discloses
and an orchestrator component that receives the checkpoint [0044] and a transition configuration to manage and enact a substitution process [0009] for the candidate process [0032] for counteracting unauthorized use of predetermined data [0044], [0026] in the network [0038] while maintaining all network connections [0075] during execution of the substitution process [0009])
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Korotaev with Ansel to include a checkpoint generator component that instantiates, suspends, and stores information for execution of the candidate process and creates a checkpoint based on the configuration file; and an orchestrator component that receives the checkpoint and a transition configuration to manage and enact a substitution process for the candidate process for counteracting unauthorized use of predetermined data in the network while maintaining all network connections during execution of the substitution process. One would have been motivated to harden security systems using live patching (Korotaev, [0002]).
Regarding claim 2, Ansel and Korotaev disclose the networked computer system of claim 1.
Ansel further discloses wherein the profiler component extracts key information about the candidate process by executing the candidate process and analyzing system calls associated with file and network actions during execution, (Ansel on Page 3 Under Usage and Features and Pages 3-6, Section 4. Software Architecture discloses wherein the profiler component extracts key information about the candidate process by executing the candidate process and analyzing system calls associated with file and network actions during execution)
Regarding claim 12, Ansel and Korotaev disclose the networked computer system of claim 1.
Ansel further discloses wherein the checkpoint generator component comprises: an environment constructor that reads file descriptors associated with an established network connection or connections to a client device complied by the profiler component and generates at least one directory that will be used to store time-based and automatic checkpoints for the candidate process; (Ansel discloses in Pages 3-4, Section 3. Usage & Feature; Section 4: Software Archtecture, Section 4.1 Design of DMTCP wherein the checkpoint generator component comprises: an environment constructor that reads file descriptors associated with an established network connection or connections to a client device complied by the profiler component and generates at least one directory that will be used to store time-based and automatic checkpoints for the candidate process)
a code generator that creates an execution script for the candidate process; (Ansel discloses Page 3, Section 3 Usage and Features a code generator that creates an execution script for the candidate process)
an interaction process that connects to the candidate process to checkpoint in a connected state; (Ansel discloses on Pages 4-5, Section 4.2. Initialization of an Application Process Under DMTCP; Section 4.3 Under Section Checkpointing under DMTCP an interaction process that connects to the candidate process to checkpoint in a connected state)
and a checkpoint creator that runs the execution script for the candidate process, (Ansel discloses on Page 3, Section 3. Usage and Features and a checkpoint creator that runs the execution script for the candidate process)
Regarding claim 20, claim 20 is directed to a non-transitory computer readable medium. Claim 20 is similar in scope to claim 24 and is therefore rejected under the same rationale.
Regarding claim 24, claim 24 is directed to a method. Claim 24 is similar in scope to claim 1 and is therefore rejected under the same rationale.
Claim 3 is rejected under 35 U.S.C. 103 as being unpatentable over Ansel et al (“Ansel,” DMTCP: Transparent Checkpointing for Cluster Computations and the Deskop, IEEE, Pages 1-12, 2009) in view of Korotaev et al (“Korotaev,” US 20220147619) and further in view of Thomas et al (“Thomas,” US 20220131836).
Regarding claim 3, Ansel and Korotaev disclose the networked computer system of claim 1.
Ansel and Korotaev fail to explicitly disclose wherein the profiler component generates a configuration file that includes network and file descriptor information.
However, in an analogous art, Thomas discloses wherein the profiler component generates a configuration file that includes network and file descriptor information, (Thomas discloses wherein the profiler component [0279] generates a configuration file [0279] that includes network [0069] and file descriptor information [0007])
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Thomas with Ansel and Korotaev to include wherein the profiler component generates a configuration file that includes network and file descriptor information. One would have been motivated to update labels for computing objects in a context-sensitive manner (Thomas, [0005]).
Claim 4 is rejected under 35 U.S.C. 103 as being unpatentable over Ansel et al (“Ansel,” DMTCP: Transparent Checkpointing for Cluster Computations and the Deskop, IEEE, Pages 1-12, 2009), Korotaev et al (“Korotaev,” US 20220147619) in view of Thomas et al (“Thomas,” US 20220131836) and further in view of Peteva et al (“Peteva,” US 20170199770).
Regarding claim 4, Ansel, Korotaev and Thomas disclose the networked computer system of claim 3.
Ansel, Korotaev and Thomas fail to explicitly disclose wherein the configuration file is defined by: a unique identifier element to keep track of processes, configurations, and associated data; a commands element to be executed before the processes; a binary or script element to instantiate the processes; a first path element to identify a location of a checkpoint/restore in userspace binary; and a second path element to identify where the userspace binary is to be executed.
However, in an analogous art, Peteva discloses wherein the configuration file is defined by: a unique identifier element to keep track of processes, configurations, and associated data; a commands element to be executed before the processes; a binary or script element to instantiate the processes; a first path element to identify a location of a checkpoint/restore in userspace binary; and a second path element to identify where the userspace binary is to be executed, (Peteva discloses wherein the configuration file [0025] is defined by:
a unique identifier element [0161] to keep track of processes [0119], configurations [0094], and associated data [0178];
a commands element [0196] to be executed before the processes [0076];
a binary or script element [0150] to instantiate the processes [0076];
a first path element [0117] to identify a location [0159] of a checkpoint/restore [0111] in userspace binary [0111];
and a second path element [0117] to identify where the userspace binary is to be executed [0111])
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Peteva with Ansel, Korotaev and Thomas to include wherein the configuration file is defined by: a unique identifier element to keep track of processes, configurations, and associated data; a commands element to be executed before the processes; a binary or script element to instantiate the processes; a first path element to identify a location of a checkpoint/restore in userspace binary; and a second path element to identify where the userspace binary is to be executed. One would have been motivated to provide systems and methods for managing distributed computing resources (Peteva, [0002]).
Claim 5 is rejected under 35 U.S.C. 103 as being unpatentable over Ansel et al (“Ansel,” DMTCP: Transparent Checkpointing for Cluster Computations and the Deskop, IEEE, Pages 1-12, 2009) in view of Korotaev et al (“Korotaev,” US 20220147619) and further in view of Craft et al (“Craft,” US 20080270422).
Regarding claim 5, Ansel and Korotaev disclose the networked computer system of claim 1.
Ansel and Korotaev fail to explicitly disclose wherein the profiler component comprises: a process instantiator that executes the candidate process; a process interactor that establishes a simple network connection with the candidate process to reveal specific file descriptors associated with the established network connection or connections; and an artifact extractor that stores the specific file descriptors associated with the established network connection or connections to client devices so that subsequent phases are able to pinpoint particular information required for a transition to the substitution process.
However, in an analogous art, Craft discloses wherein the profiler component comprises: a process instantiator that executes the candidate process; (Craft describes wherein the profiler component comprises: a process instantiator [0007] that executes the candidate process [0025])
a process interactor that establishes a simple network connection with the candidate process to reveal specific file descriptors associated with the established network connection or connections; (Craft describes a process interactor that establishes a simple network connection [0018] with the candidate process to reveal specific file descriptors [0007] associated with the established network connection [0018] or connections)
and an artifact extractor that stores the specific file descriptors associated with the established network connection or connections to client devices so that subsequent phases are able to pinpoint particular information required for a transition to the substitution process, (Craft describes and an artifact extractor that stores the specific file descriptors [0007] associated with the established network connection [0018] or connections to client devices so that subsequent phases are able to pinpoint particular information required for a transition to the substitution process [0037])
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Craft with Ansel and Korotaev to include wherein the profiler component comprises: a process instantiator that executes the candidate process; a process interactor that establishes a simple network connection with the candidate process to reveal specific file descriptors associated with the established network connection or connections; and an artifact extractor that stores the specific file descriptors associated with the established network connection or connections to client devices so that subsequent phases are able to pinpoint particular information required for a transition to the substitution process. One would have been motivated to enabling the restoration of in-flight file descriptors during a checkpoint operation (Craft, [0002]).
Claim 6 is rejected under 35 U.S.C. 103 as being unpatentable over Ansel et al (“Ansel,” DMTCP: Transparent Checkpointing for Cluster Computations and the Deskop, IEEE, Pages 1-12, 2009), Korotaev et al (“Korotaev,” US 20220147619) in view of Craft et al (“Craft,” US 20080270422) and further in view of Vertes et al (“Vertes,” US 20080250400).
Regarding claim 6, Ansel, Korotaev and Craft disclose the networked computer system of claim 5.
Ansel, Korotaev and Craft fail to explicitly disclose wherein the process interactor logs system calls executed by the candidate process.
However, in an analogous art, Vertes discloses wherein the process interactor logs system calls executed by the candidate process, (Vertes discloses [0050]-[0052], [0061] describes wherein the process interactor logs system calls executed by the candidate process)
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Vertes with Ansel, Korotaev and Craft to include wherein the process interactor logs system calls executed by the candidate process.. One would have been motivated to provide method for intercepting system calls and allows interception of system calls from user space (Vertes, [0001]).
Claim 7 is rejected under 35 U.S.C. 103 as being unpatentable over Ansel et al (“Ansel,” DMTCP: Transparent Checkpointing for Cluster Computations and the Deskop, IEEE, Pages 1-12, 2009), Korotaev et al (“Korotaev,” US 20220147619), Craft et al (“Craft,” US 20080270422) in view of Vertes et al (“Vertes,” US 20080250400) and further in view of Johnson et al (“Johnson,” US 20180262388).
Regarding claim 7, Ansel, Korotaev, Craft and Vertes disclose the networked computer system of claim 6.
Ansel, Korotaev, Craft and Vertes disclose wherein the system calls include network socket system calls which are parsed to obtain information about listening ports and listening interface addresses.
However, in an analogous art, Johnson discloses wherein the system calls include network socket system calls which are parsed to obtain information about listening ports and listening interface addresses, (Johnson discloses wherein the system calls [0060] include network socket system calls [0098] which are parsed [0111] to obtain information about listening ports [0511] and listening interface addresses [0512])
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Johnson with Ansel, Korotaev, Craft and Vertes to include wherein the system calls include network socket system calls which are parsed to obtain information about listening ports and listening interface addresses. One would have been motivated to provide a method and system for auto-configuration of remote devices upon deployment (Johnson, [0013]).
Claim 8 is rejected under 35 U.S.C. 103 as being unpatentable over Ansel et al (“Ansel,” DMTCP: Transparent Checkpointing for Cluster Computations and the Deskop, IEEE, Pages 1-12, 2009) in view of Korotaev et al (“Korotaev,” US 20220147619) and further in view of Emelyanov et al (“Emelyanov,” US 10,681,008).
Regarding claim 8, Ansel and Korotaev disclose the networked computer system of claim 1.
Ansel and Korotaev disclose wherein the checkpoint generator component creates the checkpoint by suspending the candidate process and storing all data that is required to resume the candidate process at a later time.
However, in an analogous art, Emelyanov discloses wherein the checkpoint generator component creates the checkpoint by suspending the candidate process and storing all data that is required to resume the candidate process at a later time, (Emelyanov discloses wherein the checkpoint generator component (Col. 3, Lines 32-41) creates the checkpoint (Col. 3, Lines 32-41) by suspending the candidate process (Col. 6, Lines 36-40) and storing all data that is required to resume the candidate process at a later time (Col. 5, Lines 44-46)
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Emelyanov with Ansel and Korotaev to include wherein the checkpoint generator component creates the checkpoint by suspending the candidate process and storing all data that is required to resume the candidate process at a later time. One would have been motivated to provide management of network sockets for servers that maintain a large number of live connections (Emelyanov, Col. 1, Lines 9-10).
Claim 9 is under 35 U.S.C. 103 as being unpatentable over Ansel et al (“Ansel,” DMTCP: Transparent Checkpointing for Cluster Computations and the Deskop, IEEE, Pages 1-12, 2009), Korotaev et al (“Korotaev,” US 20220147619), Emelyanov et al (“Emelyanov,” US 10,681,008) in view of Goyal et al (“Goyal,” US 20040243673) and further in view of Neary et al (“WO 2006026403).
Regarding claim 9, Ansel, Korotaev and Emelyanov disclose the networked computer system of claim 8.
Ansel, Korotaev and Emelyanov fail to explicitly disclose wherein the checkpoint is defined by: a unique identifier element that matches a unique identifier specified in the candidate process; and a method element that identifies whether a time-based or automatic checkpoint type occurs.
However, in an analogous art, Goyal discloses wherein the checkpoint is defined by: a unique identifier element that matches a unique identifier specified in the candidate process; (Goyal discloses in FIG 3, [0021]-[0023] a configuration table containing multiple configuration data entries each associated with a specific node such as configdata for node 162, configdata for 164, where each entry is keyed to a unique node identifier [wherein the checkpoint is defined by: a unique identifier element that matches a unique identifier specified in the candidate process])
and a method element that identifies whether a time-based or automatic checkpoint type occurs, (Goyal discloses [0017], FIG 3, [0028], [0043]-[0044] automatic reconfiguration behavior where nodes inspect the configuration table header and determine whether a change occurred; if so, nodes inspect configuration data and reconfigure. In Figures 5-7, do not inspect, no reconfiguration, required when there is no counter/sequence change implying event driven automatic logic [and a method element that identifies whether a time-based or automatic checkpoint type occurs])
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Goyal with Ansel, Korotaev and Emelyanov to include wherein the checkpoint is defined by: a unique identifier element that matches a unique identifier specified in the candidate process; and a method element that identifies whether a time-based or automatic checkpoint type occurs. One would have been motivated to configuring nodes in cluster file systems (Goyal, [0001]).
Ansel, Korotaev, Emelyanov and Goyal fail to explicitly disclose a port element that the checkpoint utilizes for network communication; a directive element that indicates whether checkpoint data should be overwritten if a target directory is not empty.
However, in an analogous art, Neary discloses a port element that the checkpoint utilizes for network communication, (Neary discloses [0009] that checkpointing captures open files, sockets, pipes and other state information that is for instance retained in the kernel on behalf of the process [a port element that the checkpoint utilizes for network communication])
a directive element that indicates whether checkpoint data should be overwritten if a target directory is not empty, (Neary discloses [0028] describes removing the first storage checkpoint when a subsequent storage checkpoint is saved and maintaining the hardlink to the first saved storage checkpoint; wherein a physical copy of said first storage checkpoint is not made when said subsequent storage checkpoint is saved [a directive element that indicates whether checkpoint data should be overwritten if a target directory is not empty[)
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Neary with Ansel, Korotaev, Emelyanov and Goyal to include a port element that the checkpoint utilizes for network communication; a directive element that indicates whether checkpoint data should be overwritten if a target directory is not empty.. One would have been motivated to provide a method and system to transparently checkpoint and restore a computer application program (Neary, [0014]).
Claim 10 is rejected under 35 U.S.C. 103 as being unpatentable over Ansel et al (“Ansel,” DMTCP: Transparent Checkpointing for Cluster Computations and the Deskop, IEEE, Pages 1-12, 2009), Korotaev et al (“Korotaev,” US 20220147619) in view of Emelyanov et al (“Emelyanov,” US 10,681,008) and further in view of Craft et al (“Craft,” US 20090007147).
Regarding claim 10, Ansel, Korotaev and Emelyanov disclose the networked computer system of claim 8.
Emelyanov further discloses wherein the checkpoint is defined by: a connection element that specifies whether a network connection should gracefully close after the checkpoint; (Emelyanov discloses in Col. 2, Lines 1-16, Col. 3, Lines 32-47 wherein the checkpoint is defined by: a connection element that specifies whether a network connection should gracefully close after the checkpoint)
a store element that identifies a location where checkpoint data will be stored; (Emelyanov discloses in Col. 2, Lines 17-30; Col. 8, Lines 1-8 a store element that identifies a location where checkpoint data will be stored)
a converter element that identifies a location of a software program to convert specific checkpoint files from one data interchange format to another; (Emelyanov describes in Col. 2, Lines 1-44 describes a converter element that identifies a location of a software program to convert specific checkpoint files from one data interchange format to another)
a weaver element that identifies a location of the software program that transfers network socket information across checkpoints; (Emelyanov describes in Col. 5, Lines 24-61 socket info is transferred across checkpoints [a weaver element that identifies a location of the software program that transfers network socket information across checkpoints]; also see Col. 2, Lines 1-44)
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Emelyanov with Ansel and Korotaev to include wherein the checkpoint is defined by: a connection element that specifies whether a network connection should gracefully close after the checkpoint; a store element that identifies a location where checkpoint data will be stored; a converter element that identifies a location of a software program to convert specific checkpoint files from one data interchange format to another; a weaver element that identifies a location of the software program that transfers network socket information across checkpoints. One would have been motivated to provide management of network sockets for servers that maintain a large number of live connections (Emelyanov, Col. 1, Lines 8-11).
Ansel, Korotaey and Emelyanov fail to explicitly disclose a template element that identifies a location of a template that will be used to generate a script for creating the checkpoint; a script element that identifies a location where an auto-generated checkpoint execution script will reside; a command element that isolates and extracts an identification of a running process; and a delay element that identifies a duration before the checkpoint is selected.
However, in an analogous art, Craft discloses a template element that identifies a location of a template that will be used to generate a script for creating the checkpoint; (Craft discloses [0010]-[0011] a template element that identifies a location of a template that will be used to generate a script for creating the checkpoint)
a script element that identifies a location where an auto-generated checkpoint execution script will reside; (Craft discloses [0008]-[0011] a script element that identifies a location where an auto-generated checkpoint execution script will reside)
a command element that isolates and extracts an identification of a running process; (Craft discloses [0008]-[0011] a command element that isolates and extracts an identification of a running process)
and a delay element that identifies a duration before the checkpoint is selected, (Craft discloses [0008]-[0011], and a delay element that identifies a duration before the checkpoint is selected)
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Craft with Ansel, Korotaev and Emelyanov to include a template element that identifies a location of a template that will be used to generate a script for creating the checkpoint; a script element that identifies a location where an auto-generated checkpoint execution script will reside; a command element that isolates and extracts an identification of a running process; and a delay element that identifies a duration before the checkpoint is selected. One would have been motivated to manage virtualized instances of hardware resources and migration enabled applications partitioned into one of multiple partitions (Craft, [0009).
Claim 11 is rejected under 35 U.S.C. 103 as being unpatentable over Ansel et al (“Ansel,” DMTCP: Transparent Checkpointing for Cluster Computations and the Deskop, IEEE, Pages 1-12, 2009), Korotaev et al (“Korotaev,” US 20220147619), Emelyanov et al (“Emelyanov,” US 10,681,008). in view of Meth et al (“Meth,” US 20020087916) and further in view of Gallagher et al (“Gallagher,” US 20060107222).
Regarding claim 11, Ansel, Korotaev and Emelyanov disclose the networked computer system of claim 8.
Ansel, Korotaev and Emelyanov fail to explicitly disclose wherein the checkpoint is defined by: a first trigger element that identifies system calls that will be overridden and that will potentially checkpoint the process, depending on whether a file descriptor matches; a second trigger element that identifies file descriptors that will be compared within system call functions to determine whether the process should be checkpointed; a checkpoint element that specifies, in the case of multiple system call and file descriptor matches, which iterations the checkpoints should be taken; and a library element that identifies a location where the pre-load library source file will be stored.
However, in an analogous art, Meth discloses wherein the checkpoint is defined by: a first trigger element that identifies system calls that will be overridden and that will potentially checkpoint the process, depending on whether a file descriptor matches; (Meth discloses [0015], [0039], [0046] wherein the checkpoint is defined by: a first trigger element that identifies system calls that will be overridden and that will potentially checkpoint the process, depending on whether a file descriptor matches)
a second trigger element that identifies file descriptors that will be compared within system call functions to determine whether the process should be checkpointed; (Meth discloses [0013], [0025], FIG 6 a second trigger element that identifies file descriptors that will be compared within system call functions to determine whether the process should be checkpointed)
a checkpoint element that specifies, in the case of multiple system call and file descriptor matches, which iterations the checkpoints should be taken; (Meth discloses FIG 6, [0057]-[0059], a checkpoint element that specifies, in the case of multiple system call and file descriptor matches, which iterations the checkpoints should be taken)
and a library element that identifies a location where the pre-load library source file will be stored, (Meth discloses [0053], [0066], and a library element that identifies a location where the pre-load library source file will be stored)
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Meth with Ansel, Korotaev and Emelyanov to include wherein the checkpoint is defined by: a first trigger element that identifies system calls that will be overridden and that will potentially checkpoint the process, depending on whether a file descriptor matches; a second trigger element that identifies file descriptors that will be compared within system call functions to determine whether the process should be checkpointed; a checkpoint element that specifies, in the case of multiple system call and file descriptor matches, which iterations the checkpoints should be taken; and a library element that identifies a location where the pre-load library source file will be stored. One would have been motivated to provide user-level checkpointing and restarting a program having multiple processes (Meth, [0002]).
Ansel, Korotaey, Emelyanov and Meth fail to explicitly disclose wherein the checkpoint is defined by: a template element that identifies a location of a template engine that will be used to generate the code for a pre-load library source file; a compile element that determines whether to compile a generated library if a binary already exists.
However, in an analogous art, Gallagher discloses wherein the checkpoint is defined by: a template element that identifies a location of a template engine that will be used to generate the code for a pre-load library source file; (Gallagher discloses [0011], [0018] wherein the checkpoint is defined by: a template element that identifies a location of a template engine that will be used to generate the code for a pre-load library source file)
a compile element that determines whether to compile a generated library if a binary already exists; (Gallagher discloses [0011], [0018]-[0019] a compile element that determines whether to compile a generated library if a binary already exists)
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Gallagher with Ansel, Korotaev, Emelyanov and Meth to include wherein the checkpoint is defined by: a template element that identifies a location of a template engine that will be used to generate the code for a pre-load library source file; a compile element that determines whether to compile a generated library if a binary already exists. One would have been motivated to automatically generate program code and to automatically generate wrapper classes dynamically to enforce call-by-value semantics between objects collocated within an application server (Gallagher, [0005]).
Claim 13 is rejected under 35 U.S.C. 103 as being unpatentable over Ansel et al (“Ansel,” DMTCP: Transparent Checkpointing for Cluster Computations and the Deskop, IEEE, Pages 1-12, 2009), Korotaev et al (“Korotaev,” US 20220147619), Emelyanov et al (“Emelyanov,” US 10,681,008) in view of Craft et al (“Craft,” US 20090007147) and further in view of Tsantilis et al (“Tsantilis,” US 20080046868).
Regarding claim 13, Ansel, Korotaev, Emelyanov and Craft disclose the networked computer system of claim 10.
Ansel, Korotaev, Emelyanov and Craft fail to explicitly disclose wherein the code generator uses a template engine to create the execution script.
However, in an analogous art, Tsantillis discloses wherein the code generator uses a template engine to create the execution script, (Tsantillis discloses [0010]-[0014] wherein the code generator uses a template engine to create the execution script)
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Tsantillis with Ansel, Korotaev, Emelyanov and Craft to include wherein the code generator uses a template engine to create the execution script. One would have been motivated to provide a method and a system for template-based code generation (Tsantillis, [0010]).
Claim 14 is rejected under 35 U.S.C. 103 as being unpatentable over Ansel et al (“Ansel,” DMTCP: Transparent Checkpointing for Cluster Computations and the Deskop, IEEE, Pages 1-12, 2009), Korotaev et al (“Korotaev,” US 20220147619), Emelyanov et al (“Emelyanov,” US 10,681,008) in view of Craft et al (“Craft,” US 20090007147) and further in view of Meth et al (“Meth,” US 6,282,703).
Regarding claim 14, Ansel, Korotaev, Emelyanov and Craft disclose the networked computer system of claim 10.
Ansel, Korotaev, Emelyanov and Craft fail to explicitly disclose wherein the code generator creates an auto-interrupter program that overrides system call functions, which is compiled into a library that is pre-loaded into a target candidate process.
However, in an analogous art, Meth discloses wherein the code generator creates an auto-interrupter program that overrides system call functions, which is compiled into a library that is pre-loaded into a target candidate process, (Meth discloses (Col. 2, Lines 5-67; Col. 3, Lines 1-36) wherein the code generator creates an auto-interrupter program that overrides system call functions (Col. 6, Lines 44-60), which is compiled into a library (Col. 6, Lines 61-67; Col. 7, Lines 1-5) that is pre-loaded into a target candidate process (Col. 7, Lines 37-65; Col. 2, Lines 50-61))
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Meth with Ansel, Korotaev, Emelyanov and Craft to include wherein the code generator creates an auto-interrupter program that overrides system call functions, which is compiled into a library that is pre-loaded into a target candidate process. One would have been motivated to provide a technique for intercepting calls between an application process and a program
library in a statically linked environment (Meth, Col. 1, Lines 27-30).
Claim 15 is rejected under 35 U.S.C. 103 as being unpatentable over Ansel et al (“Ansel,” DMTCP: Transparent Checkpointing for Cluster Computations and the Deskop, IEEE, Pages 1-12, 2009) in view of Korotaev et al (“Korotaev,” US 20220147619) and further in view of Hooda et al (“Hooda,” US 20200177629).
Regarding claim 15, Ansel and Korotaev disclose the networked computer system of claim 1.
Ansel and Korotaev fail to explicitly disclose wherein the candidate process and the substitution process for the candidate process comprise honeypots.
However, in an analogous art, Hooda discloses wherein the candidate process and the substitution process for the candidate process comprise honeypots, (Hooda discloses wherein the candidate process [0019], [0022], [0073] and the substitution process [0022] for the candidate process comprise honeypots [0022], [0018])
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Hooda with Ansel and Korotaev to include wherein the candidate process and the substitution process for the candidate process comprise honeypots. One would have been motivated to provide systems and methods for improving end-to-end network security by dynamic generation of honeypots (Hooda, [0002]).
Claim 16 is rejected under 35 U.S.C. 103 as being unpatentable over Ansel et al (“Ansel,” DMTCP: Transparent Checkpointing for Cluster Computations and the Deskop, IEEE, Pages 1-12, 2009), Korotaev et al (“Korotaev,” US 20220147619) in view of Hooda et al (“Hooda,” US 20200177629) and further in view of Rafalovich et al (“Rafalovich,” US 20090328216).
Regarding claim 16, Ansel, Korotaev and Hooda disclose the networked computer system of claim 15.
Ansel, Korotaev and Hooda fail to explicitly disclose wherein the honeypots comprise decoy devices or services or a combination thereof operating on the network that are used to lure attackers away from the predetermined data.
However, in an analogous art, Rafalovich discloses wherein the honeypots comprise decoy devices or services or a combination thereof operating on the network that are used to lure attackers away from the predetermined data, (Rafalovich discloses wherein the honeypots [0035] comprise decoy devices [0004], [0038] or services or a combination thereof operating on the network [0040] that are used to lure attackers away from the predetermined data [0008], [0033])
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Rafalovich with Ansel, Korotaev and Hooda to include wherein the honeypots comprise decoy devices or services or a combination thereof operating on the network that are used to lure attackers away from the predetermined data. One would have been motivated to provide a personalized honeypot for detecting information leaks and security breaches (Rafalovich, [0008]).
Claim 17 is rejected under 35 U.S.C. 103 as being unpatentable over Ansel et al (“Ansel,” DMTCP: Transparent Checkpointing for Cluster Computations and the Deskop, IEEE, Pages 1-12, 2009) in view of Korotaev et al (“Korotaev,” US 20220147619) and further in view of Ahmadzadeh et al (“Ahmadzadeh,” US 20170134405).
Regarding claim 17, Ansel and Korotaev disclose the networked computer system of claim 1.
Ansel and Korotaev disclose wherein the orchestrator component handles an instantiation and transition of a substitution process for the candidate process when specified conditions are met based on time or system calls.
However, in an analogous art, Ahmadzadeh discloses wherein the orchestrator component handles an instantiation and transition of a substitution process for the candidate process when specified conditions are met based on time or system calls, (Ahmadzadeh discloses wherein the orchestrator component [0046] handles an instantiation [0049], [0076], and transition of a substitution process for the candidate process [0005], [0025], [0015] when specified conditions are met based on time [0033] or system calls)
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Ahmadzadeh with Ansel and Korotaev to include wherein the orchestrator component handles an instantiation and transition of a substitution process for the candidate process when specified conditions are met based on time or system calls. One would have been motivated to provide a honeypot system to trigger malicious activities by applications (Ahmadzadeh, [0002]).
Claim 18 is rejected under 35 U.S.C. 103 as being unpatentable over Ansel et al (“Ansel,” DMTCP: Transparent Checkpointing for Cluster Computations and the Deskop, IEEE, Pages 1-12, 2009), Korotaev et al (“Korotaev,” US 20220147619) and further in view of Bean et al (“Bean,” US 8,090,836).
Regarding claim 18, Ansel and Korotaev disclose the networked computer system of claim 1.
Ansel and Korotaev fail to explicitly disclose wherein the orchestrator component interweaves data across processes that are needed to preserve network connections.
However, in an analogous art, Bean discloses wherein the orchestrator component interweaves data across processes that are needed to preserve network connections, (Bean, Col. 1, Lines 52-54 describes wherein the orchestrator component (Col. 2, Lines 45-52) interweaves data across processes (Col. 7, Lines 15-19; Col. 2, Lines 6-8; Col. 11, Lines 52-54) that are needed to preserve network connections (Col. 5, Lines 15-17).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Bean with Ansel and Korotaev to include wherein the orchestrator component interweaves data across processes that are needed to preserve network connections. One would have been motivated to migrate a connection between two computing nodes of a computing center (Bean, Col. 1, Lines 52-54).
Claim 19 is rejected under 35 U.S.C. 103 as being unpatentable over Ansel et al (“Ansel,” DMTCP: Transparent Checkpointing for Cluster Computations and the Deskop, IEEE, Pages 1-12, 2009), Korotaev et al (“Korotaev,” US 20220147619) in view of Buehne et al (“Buehne,” US 20180060313) and further in view of Bean et al (“Bean,” US 8,090,836).
Regarding claim 19, Ansel and Korotaev disclose the networked computer system of claim 1.
Ansel and Korotaev fail to explicitly disclose wherein the orchestrator component comprises: a code generator that creates a switchover script for executing the substitution process for the candidate process; a honeypot instantiator that executes the switchover script; a trigger that analyzes the executed switchover script and determines and stores information about a current network state of the network; and a process weaver that retrieves information regarding at least one previous target and updates a socket to match that of a current process.
However, in an analogous art, Buehne discloses wherein the orchestrator component comprises: a code generator that creates a switchover script for executing the substitution process for the candidate process; (Buehne discloses [0004] wherein the scheduler computer system that manages migration scripts executed during migration between system [orchestrator component] comprises: [0004]-[0007] discloses receiving/handling migration scripts executed during migration, including control of what scripts run and when [a code generator that creates a switchover script for executing the substitution process for the candidate process])
a honeypot instantiator that executes the switchover script;. (Buehne discloses in [0004]-[0007] execution of migration scripts during the migration scripts during the migration process controlled by the schedular computer system [a honeypot instantiator that executes the switchover script])
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Buehne with Ansel and Korotaev to include wherein the orchestrator component comprises: a code generator that creates a switchover script for executing the substitution process for the candidate process; a honeypot instantiator that executes the switchover script; a trigger that analyzes the executed switchover script and determines and stores information about a current network state of the network; and a process weaver that retrieves information regarding at least one previous target and updates a socket to match that of a current process. One would have been motivated to provide arrangements for managing migrations between server system (Buehne, [0003]).
Ansel, Korotaey and Buehne fail to explicitly disclose a trigger that analyzes the executed switchover script and determines and stores information about a current network state of the network; and a process weaver that retrieves information regarding at least one previous target and updates a socket to match that of a current process
However, in an analogous art, Bean discloses a trigger that analyzes the executed switchover script and determines and stores information about a current network state of the network; (Bean discloses Col. 1, Lines 52-67; Col. 2, Lines 1-30 storing and uses network/connection state which is a IP address, snapshot ID and connection structure as part of pausing/restoring and the connection filter uses this state to preserve the TCP connection [a trigger that analyzes the executed switchover script and determines and stores information about a current network state of the network]);
and a process weaver that retrieves information regarding at least one previous target and updates a socket to match that of a current process, (Bean discloses Col. 5, Lines 21-44; Col. 1, Lines 52-67; Col. 2, Lines 1-30 migration preserves the TCP connection without interrupting by capturing/transferring connection state during restore and updating transport/socket state including handling the sequence number so that the restored process continues with the same network session [and a process weaver that retrieves information regarding at least one previous target and updates a socket to match that of a current process])
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Bean with Ansel, Korotaey and Buehne to include a trigger that analyzes the executed switchover script and determines and stores information about a current network state of the network; and a process weaver that retrieves information regarding at least one previous target and updates a socket to match that of a current process. One would have been motivated to provide a method for migrating a connection between two computing nodes of a computing center (Bean, Col. 1, Lines 52-54).
Claims 21-22 are rejected under 35 U.S.C. 103 as being unpatentable over Ansel et al (“Ansel,” DMTCP: Transparent Checkpointing for Cluster Computations and the Deskop, IEEE, Pages 1-12, 2009) in view of Korotaev et al (“Korotaev,” US 20220147619) and further in view of Fan et al (“Fan,” “A Novel SDN based Stealthy TCP Connection Handover Mechanism for Hybrid Honeypot Systems,” IEEE, 2017, Pages 1-9)
Regarding claim 21, Ansel and Korotaev disclose the networked computer system of claim 1.
Ansel and Korotaev fail to explicitly disclose comprising at least one local device in communication and at least one remote device, and both the candidate process and the substitution process operate on the same local device in communication with the same remote device, and the orchestrator executes a switchover occurs between those processes without communication connections between the local device to the remote system being severed.
However, in an analogous art, Fan discloses comprising at least one local device in communication and at least one remote device, (Fan discloses in Section III.A. TCP Connection Handover Mechanism, Phase 1 description on Page 3, Left Column; FIG 2 under Transparent TCP connection handover mechanism that the attacker sends the TCP connection request to the target honeypot)
and both the candidate process and the substitution process operate on the same local device in communication with the same remote device, (Fan, Section IV, Implementation, Page 5, Right Column to Page 6, Left Column, FIG labeled An implementation of proof-of-concept by one physical machine; Section III, the Design of the Controller Application, Page 2, Right Column describes and both the candidate process and the substitution process operate on the same local device Section III.A. Fig. 2, caption, Phases 1-3, Page 3-4 describes in communication with the same remote device)
and the orchestrator executes a switchover occurs between those processes without communication connections between the local device to the remote system being severed (Fan discloses Section III, describing controller architecture, Page 2, Right Column, FIG 1, The Architecture of the Controller Application; Title & Abstract on Page 1-stealthy/transparent TCP connection handover; second III.A. Phases 2 and 3, Pages 3-4, FIG 3 the approach for synchronizing Seq and Ack Number on Page 4 describes and the orchestrator executes a switchover occurs between those processes without communication connections between the local device to the remote system being severed)
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Fan with Ansel, and Korotaev to include comprising at least one local device in communication and at least one remote device, and both the candidate process and the substitution process operate on the same local device in communication with the same remote device, and the orchestrator executes a switchover occurs between those processes without communication connections between the local device to the remote system being severed. One would have been motivated to provide a hybrid honeypot system to deploy different types of independent honeypots and control the access of the interesting traffic to the corresponding honeypots according to certain security requirements (Fan, Page 8, Conclusion, Last Paragraph)
Regarding claim 22, Ansel and Korotaev disclose the networked computer system of claim 1.
Ansel and Korotaev fail to explicitly disclose wherein switching occurs after a TCP 3-Way handshake is established between the remote device and the local device.
However, in an analogous art, Fan discloses wherein switching occurs after a TCP 3-Way handshake is established between the remote device and the local device, (Fan discloses in Page 3-6 specifically Section III.A. TCP Connection Handover Mechanism, Phase 1 Description and FIG 2, Phase 1 caption, Page 3, Left to Right Column and Section III.B. Workflow on Page 4, Right Column, FIG 3 describe wherein switching occurs after a TCP 3-Way handshake is established between the remote device and the local device)
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Fan with Ansel, and Korotaev to include wherein switching occurs after a TCP 3-Way handshake is established between the remote device and the local device. One would have been motivated to provide a hybrid honeypot system to deploy different types of independent honeypots and control the access of the interesting traffic to the corresponding honeypots according to certain security requirements (Fan, Page 8, Conclusion, Last Paragraph)
Claim 15 is rejected under 35 U.S.C. 103 as being unpatentable over Ansel et al (“Ansel,” DMTCP: Transparent Checkpointing for Cluster Computations and the Deskop, IEEE, Pages 1-12, 2009), Korotaev et al (“Korotaev,” US 20220147619) in view of Hooda et al (“Hooda,” US 20200177629) and further in view of Fan et al (“Fan,” “A Novel SDN based Stealthy TCP Connection Handover Mechanism for Hybrid Honeypot Systems,” IEEE, 2017, Pages 1-9)
Regarding claim 23, Ansel, Korotaev and Hooda disclose the networked computer system of claim 15.
Ansel, Korotaev and Hooda fail to explicitly disclose wherein the candidate process is a low-interaction honeypot and the substitution process is a high-interaction honeypot.
However, in an analogous art, Fan discloses wherein the candidate process is a low-interaction honeypot and the substitution process is a high-interaction honeypot, (Fan describes in Abstract on Page 1, and Section I. Introduction on Page 1, Left & Right Column, Section III.B. The Filtering Approach, Page 4, Right Column describes wherein the candidate process is a low-interaction honeypot and the substitution process is a high-interaction honeypot)
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claim invention to combine the teachings of Fan with Ansel, Korotaev and Hooda to include wherein the candidate process is a low-interaction honeypot and the substitution process is a high-interaction honeypot. One would have been motivated to provide a hybrid honeypot system to deploy different types of independent honeypots and control the access of the interesting traffic to the corresponding honeypots according to certain security requirements (Fan, Page 8, Conclusion, Last Paragraph)
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JAMES J WILCOX whose telephone number is (571)270-3774. The examiner can normally be reached M-F: 8 A.M. to 5 P.M..
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Luu T. Pham can be reached at (571)270-5002. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/JAMES J WILCOX/ Examiner, Art Unit 2439
/LUU T PHAM/ Supervisory Patent Examiner, Art Unit 2439
Prosecution Insights