DETAILED ACTION
1. Claims 1- 20 are pending in this examination.
Notice of Pre-AIA or AIA Status
2. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
3. In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claim Rejections - 35 USC § 103
4.1. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
4.2. Claims 1-3, 5, 7-11, 13-17 and 19-20 are rejected under 35 U.S.C. 103 as being unpatentable over US Patent Application No. 20200125700 to Chang et al (“Chang”) in view of US Patent Application No. 20200364078 to Potter et al (“Potter”).
As per claim 1, Chang discloses a method comprising: receiving, from an internal service, by an assistant service, a service request to perform a cloud computing action over tenant data of a tenant of a cloud computing environment ([0024] to receive requests from the user-facing services to perform functions of the backend
services. The proxy service stores user authorization data that authorizes a user of a user-facing service to use a particular function of a backend service. Responsive to a request, via the API, to perform the function for an account associated with the user, the proxy service uses the user authorization data to access the backend service, to perform the function.);
identifying, by the assistant service, an existing principal of the assistant service within the tenant and permission associated with performing the cloud computing action within the tenant of the cloud computing environment ([0025], the proxy service obtains an authorization code indicating that a user is authorized to use a function of the backend service. The proxy service generates an authorization session identifier, which it transmits to the user-facing service. The proxy service receives, from the user-facing service, a request to perform the function of the backend service for an account associated with the user. The request includes the authorization session identifier. Responsive to the request, the proxy service determines that the request is authorized. The proxy service transmits, to the backend service, another request to perform the function of the backend service. Responsive to the proxy service's request, the proxy service receives, from the backend service, confirmation that the second request was authorized to perform the function); and
performing the cloud computing action on behalf of the internal service based on permission [0069] In an embodiment, the proxy service receives a request to perform a function of a backend service (Operation 232). Responsive to the request, the proxy service may determine whether the request is authorized (Operation 234). For example, the request may include an authorization identifier and/or access token that the proxy service previously provided to the user-facing service. If the request includes an authorization identifier and does not include an access token, the proxy service may use the authorization identifier to perform a lookup and retrieve the access token. Based on the authorization identifier and/or access token, the proxy service may determine whether the user account associated with the request is authorized to access the requested function of the backend service).
Chang does not explicitly disclose however in the same field of endeavor, Potter discloses possession of the existing permission associated with performing the cloud computing action; performing the cloud computing action on behalf of the internal service based on identifying the existing principal and possession of the existing permission ([0048]-[0050], If no change to the cloud management program 104 is detected, the process 300 exits. However, if the test engine 102 detects a change in the cloud management program 104, the test engine 102 performs (at 304) a test of the changed cloud management program 104 by invoking API calls included in a code portion of the changed cloud management program 104. The API calls are received (at 306) by the proxy 116. The proxy 116 determines (at 308) permissions for the invoked API calls included in the code portion of the changed cloud management program 104. [0049] The proxy 116 compares (at 310) the permissions for the invoked calls of the API included in the code portion of the changed cloud management program 104 with the collection 118 of permissions that was previously created (e.g., in task 204 of FIG. 2). Based on the comparing, the proxy 116 identifies (at 312) a first permission (or multiple first permissions) not included in the collection 118 of permissions and that is to be used for the changed cloud management program 104. In other words, the first permission(s) include(s) those permission(s) not included in the collection 118 of permissions but that are to be provided for the changed cloud management program 104 to allow the changed cloud management program 104 to properly access the cloud environment 106 using the API 108 ...also see [0083]).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teaching of Chang with the teaching of Potter by including the feature of possession, in order for Chang’s system to prevent unauthorized acts with respect to the resources of the cloud environment. For example, the permissions may prevent the creation of a VM or another resource by an entity that is not authorized to create VMs. [0014] A cloud management program (including machine-readable instructions) may be used to manage resources of the cloud environment. In some cases, a human administrator may manually set a collection of permissions for the cloud management program. This collection of permissions can be included in an access policy of the cloud environment, and the collection of permissions included in the access policy governs whether API calls made by the cloud management program for managing resources (e.g., creating a resource, modifying a resource, removing a resource, etc.) are permitted (Potter, [0014]).
As per claim 2, the combination of Chang and Potter discloses the method of claim 1, further comprising: receiving, from the internal service, by the assistant service, a registration request to access the tenant data of the tenant; generating, based on the registration request, by the assistant service, the existing principal for the assistant service within the tenant (Chang, [0060] In an embodiment, a user-facing service is registered with the proxy service (Operation 206). Registering a user-facing service with the proxy service authorizes the user-facing service, as a client of the proxy service, to access authorization proxying functions of the proxy
service. To authorize as a client of the proxy service, the user-facing service may submit a registration request to the proxy service. Responsive to the registration
request, the proxy service may supply credentials that are uniquely associated with the user-facing service. The credentials may include a unique client identifier, a client secret, and/or any other kind of credentials or combination thereof. The user-facing service may supply the credentials when submitting requests to the proxy service. In an embodiment, registering as a client of the proxy service allows the user-facing service to access content and/or other functionality of the backend service, without the user-facing service being required to register as a client of the backend service. Alternatively, or additionally, registering as a client of the proxy service may allow the user-facing service to access multiple backend services supported by the proxy service. In an embodiment, as a client of the proxy service, the user-facing service is not required to implement instructions for communicating directly with the backend service during an authentication session., also see [0076]-[0077], also see [0069]).
Chang does not explicitly disclose however in the same field of endeavor, Potter discloses assigning the existing permission to the assistant service, the existing permission permitting performance of the cloud computing action (Potter, [0048]-[0050], [0083]). The motivation regarding the obviousness of claim 1 is also applied to claim 2.
As per claim 3, the combination of Chang and Potter discloses the method of claim 2, wherein the registration request includes a scope of the access to the tenant data of the tenant, an intent of the access to the tenant data, and a duration of the access to the tenant data, and generating the existing principal comprises (Potter, [0048]-[0050], [0083])
verifying at least one of the scope of the access to the tenant data of the tenant, the intent of the access to the tenant data, and the duration of the access to the tenant data; and generating the existing principal for the assistant service based upon the verifying (Potter, [0048]-[0050], [0083]). The motivation regarding the obviousness of claim 1 is also applied to claim 3.
As per claim 5, the combination of Chang and Potter discloses the method of claim 1, wherein identifying the existing principal and the possession of the existing permission comprises: identifying, by the assistant service, an existing session created by the assistant service for providing the internal service access to the tenant data (Chang, [0066]-[0067], also see [0045],[0087]).
As per claim 7, the combination of Chang and Potter discloses the method of claim 1, further comprising logging performance of the cloud computing action by the assistant service (Chang, [0063], In an embodiment, the proxy service detects a user selection of a backend service option (Operation 216). For example, the proxy service may detect that the user has selected a URL corresponding to a particular backend service for performing a backend service function (e.g., payment processing) proxied by the proxy service. The selected URL may correspond to a request for an interface (e.g., a web page) that allows the user to supply credentials (e.g., a login and password) to the backend service, to confirm that the user is authorized to access the function of the selected backend service).
As per claim 8, the combination of Chang and Potter discloses the method of claim 1, further comprising determining that the internal service is approved to employ the assistant service, and wherein generating the existing principal comprises:
generating the existing principal based on determining that the internal service is approved to employ the assistant service (Chang, [0025] In an embodiment, the
proxy service obtains an authorization code indicating that a user is authorized to use a function of the backend service. The proxy service generates an authorization session identifier, which it transmits to the user-facing service. The proxy service receives, from the user-facing service, a request to perform the function of the backend service for an account associated with the user. The request includes the authorization session identifier. Responsive to the request, the proxy service determines that the request is authorized. The proxy service transmits, to the backend service, another request to perform the function of the backend service. Responsive to the proxy service's request, the proxy service receives, from the backend service, confirmation that the second request was authorized to perform the function, also see [0067]).
Claim 9, is rejected for similar reasons as stated above, and claim 1.
Claim 15, is rejected for similar reasons as stated above, and claim 1.
Claim 10 rejected for similar reasons as stated above.
Claim 16 rejected for similar reasons as stated above.
Claim 11 rejected for similar reasons as stated above.
Claim 17 rejected for similar reasons as stated above.
Claim 13 rejected for similar reasons as stated above.
Claim 19 rejected for similar reasons as stated above.
Claim 14 rejected for similar reasons as stated above.
Claim 20 rejected for similar reasons as stated above.
4.3. Claims 4, 6, 12 and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Chang and Potter as applied to claim above, and in view of US Patent Application No. 20210377272 to Dasari et al (“Dasari”).
As per claim 4, the combination of Chang and Potter discloses the invention as described above. Potter discloses the method of claim 2, wherein the registration request includes a scope of the access to the tenant data of the tenant, an intent of the access to the tenant data, and a duration of the access to the tenant data, and assigning the existing permission to the assistant service comprises (Potter, [0048]-[0050], [0083]). The motivation regarding the obviousness of claim 1 is also applied to claim 4.
Chang and Potter do not explicitly disclose however, In the same field of endeavor, Dasari discloses generating a custom role based on at least one of at least one of the scope of the access to the tenant data of the tenant, the intent of the access to the tenant data, and the duration of the access to the tenant data and assigning the custom role to the assistant service (Dasari, [0079]-[0081], [0117]).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teaching of Chang with the teaching of Dasari/Potter by including the feature of duration, in order for Chang’s system to to the user interface of the remote principal to affect a redirect of the user interface for access to the secure resource. Methods of secure resource authorization for external identities using remote principal objects are performed by systems and devices. An external entity creates a group of users from within its domain and defines entitlements to a secure resource, of an owner entity of a different domain, as a set of permissions for the group. An access template with the permissions and an access policy for the secure resource are provided to the owning entity for approval. The permissions and access policy are immutable by the owning entity. On approval for the access by the owning entity, a remote principal object is created in the owner directory according to the permissions and access policy. A remote principal that is a member of the group requests access via a user interface to the owner domain using external domain credentials. The claim of the remote principal is verified against the remote principal object by a token service. Verification of resource access permissions for the remote principal causes the generation and issuance of a token, with the enumerated entitlements, to the user interface of the remote principal to affect a redirect of the user interface for access to the secure resource (Dasari, [0016]).
As per claim 6, the combination of Chang, Potter and Dasari discloses method of claim 5, wherein the service request is a first service request, the cloud computing action is a first cloud computing action, and further comprising: determining that predefined amount of time has elapsed since creation of the existing session (Chang, [0067], [0092]-[0095]);
Chang and Potter do not explicitly disclose however, In the same field of endeavor, Dasari discloses terminating, based upon determining the predefined amount of time has elapsed, the existing session by unassigning the existing permission and removing the existing principal from the tenant ([0036], [0080], [0118], [0121]);
receiving, from the internal service, by the assistant service, a second service request to perform a second cloud computing action over the tenant data of the tenant of the cloud computing environment ([0104], also see [0031]-[0033]).
identifying, by the assistant service, that the existing session has been terminated; and denying performance, by the assistant service, of the second cloud computing action ([0036], [0080]-[0082], [0118], [0121]). The motivation regarding the obviousness of claim 4 is also applied to claim 6.
Claim 12 rejected for similar reasons as stated above.
Claim 18 rejected for similar reasons as stated above.
5.1. The prior art made of record and not relied upon is considered pertinent to applicant's disclosure as the prior art discloses many of the claim features (See PTO-form 892).
5.2. a). US Patent Application No. 20240364509 to Potlapally et al., discloses techniques for enabling a customer operator of a cloud service provider (CSP) the ability to disable operator access to resources in a customer cloud environment are disclosed. Operator access may be disabled or suspended by operators of the CSP customer initiating a disable command. Disabling operator access includes (a) terminating existing sessions that provide operators access to the resources, (b) rejecting new requests for credentials to establish sessions that provide operator access, and/or (c) revoking existing credentials used to establish sessions that provide operator access. Disabling operator access may apply to resources in the customer cloud environment or to a subset of resources and/or may apply to some operators but not to other operators. The operators may be of the same or different categories of operators. At the conclusion of a designated period of time, the ability of operator to access the customer cloud environment may be restored.
b). US Patent Application No. 20200036599 to Savov et al., discloses methods, apparatus and articles of manufacture for custom interface specification in a cloud management system are disclosed. An example cloud management system includes: a first interface to communicate with a second interface external to the cloud management system; and a host to manage requests from the second interface and allocate resources to the second interface as a reverse proxy for the second interface with respect to a backend. The example host is to at least: add, at a first request from the second interface, an endpoint with respect to the second interface; fetch, at a second request from the second interface, data for the endpoint from the backend, the backend identified for the endpoint based on metadata in a component registry; and provide the data from the backend to the second interface.
c). US Patent Application No. 20240129298 to Obulareddy et al., discloses a cloud computing platform provides zero trust network access as a service to customers that maintain applications on-premises, and a zero trust network access appliance at the customer premises that couples the on-premises applications to the cloud computing platform. In this context, the number of secure tunnels maintained for an application between the customer premises and the cloud computing platform may be dynamically managed to support variations in user demand for the application.
Conclusion
6. Any inquiry concerning this communication or earlier communications from the examiner should be directed to HARUNUR RASHID whose telephone number is (571)270-7195. The examiner can normally be reached 9 AM to 5PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Eleni A. Shiferaw can be reached at (571) 272-3867. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
HARUNUR . RASHID
Primary Examiner
Art Unit 2497
/HARUNUR RASHID/Primary Examiner, Art Unit 2497
Prosecution Insights