Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
Claims 1-5, 7 and 9-13 are pending in the application.
Claim Objections
Claims 10 and 13 are objected to because of the following informalities:
Claim 10 – “to perform to” should read --to perform--.
Claims 12-13, these claims are rejected for the same reason as claim 10 above. Furthermore, as to claim 13, lines 2-3, “causing the processing circuitry to perform to: processing circuitry configured to” should read --causing the processing circuitry to perform--
Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 2 and 12 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor, or for pre-AIA the applicant regards as the invention.
The following are indefinite:
As to claim 2, it is unclear how “when a container host is activated based on a container image”. More specifically, it is unclear how a container host or host of a container is activated based on a container image (i.e. image of a container). For examination purpose, the limitation is treated as the timing for starting monitoring being --when a container host is activated or when a container is first generated based on a container image arranged within the container host-- in light of applicant’s specification [paragraphs 5 and 35] or --when a container is generated on a container host based on a container image arranged within the container host or upon activation of the container host-- as recited substantially in claim 6 and in light of applicant’s specification [paragraphs 5 and 35] for the remainder of this office action.
As to claim 12, this claim is rejected for the same reason as claim 2 above.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claim(s) 1-5, 7 and 10 is/are rejected under 35 U.S.C. 102(a)(1) as being anticipated by “PROTECT: Container Process Isolation using System Call Interpretation” to Win et al. (hereafter Win).
Win was cited in applicant’s IDS filed on 10/23/24.
As to claim 10, Win teaches the invention as claimed including a method to be executed by a computer including a processing circuitry [implementation of the technology using physical resources of a server, p. 191, section II. Virtualization Technologies, lines 1-4; p. 194, section VI, subsection A. Experiment Setup], the method causing the processing circuitry to perform:
monitor a system call of a container host’s kernel [system/architecture implemented on a server, namely a host, hosting a container (i.e. container host) in user space, where system call is issue from kernel of the host which contains the container (i.e. kernel of the container host or container host’s kernel); system call interceptor, located in kernel space, “monitoring any attempts by the host…by intercepting…system calls”, Fig. 1 and corresponding text; p. 193, subsection C. System call table; p. 194, subsection B. Implementation];
obtain a parameter at a time when a first system call function is called
by the system call [interception of system calls in invoking respective functions such as open files or terminate a running process, when a user opens a file, section of the director (i.e., proc and 111) are extracted from the function argument; process ID (i.e., 111) is extracted, Section V, Subsection B: Implementation];
call the first system call function from a kernel, and returning a
processing result of the first system call function, when a processing target in
the first system call function to be called that is indicated by the parameter is not
a monitoring target that affects an identity of data to be protected [interception of system calls in invoking respective functions such as open files or terminate a running process, such that a determination is made as to whether an opened file belongs to a
guest container and the access via system calls by the host is denied access to the target file if it belongs to a guest container process (i.e. access not denied or granted for access or processing if it does NOT belong to a guest container process), Section V, Subsection B: Implementation]; and
return a result as in a case where processing by the first system call
function is successfully executed, or a processing result indicating an error, without calling the first system call function, when the processing target in the first system call function to be called that is indicated by the parameter is the monitoring target [interception of system calls in invoking respective functions such as open files or terminate a running process, such that a determination is made as to whether an opened file belongs to a guest container and the access via system calls by the host is denied access to the target file if it belongs to a guest container process, Section V, Subsection B: Implementation].
As to claim 1, Win teaches the method for method of executing various steps as recited in claim 10, therefore Win teaches the apparatus including a processor comprising: processing circuitry [implementation on a server with processor, Section VI, Subsection A: Experiment Setup] for implementing the method.
As to claim 2, Win teaches the invention as claimed including herein the data to be protected is a container image in a container-type virtualization environment [protecting access to a container, a running instance of a container image, abstract; Section V, Subsection B: Implementation]. Furthermore, Win teaches starting monitoring of the parameter by the step of obtaining at a timing when a container host is activated based on a container image in the container-type virtualization environment, and the step of returning the processing result [setup or implementation begin with installation of LXC platform and creating an Ubuntu guest container on the host, Section VI, Subsections A and B] (Note: see examiner’s interpretation of the limitations in rejection under 35 USC 112(b) above).
As to claim 3, Win teaches the invention as claimed including wherein the monitoring target is defined in advance as a combination of a content of processing of a process that calls the first system call function, and at least one of a target file and a target directory of the processing of the process [defined security policies/profiles containing path entries, Section IV, Subsection A: Mandatory Access Control (MAC), numeral 3; Section V, Subsection B: Implementation, numeral 4].
As to claim 4, Win teaches the invention as claimed including wherein the processing circuitry further configured to rewrite an address of the first system call function of the monitoring target of a system call table to an address of a second system call function that returns a result as in a case where processing by the first system call function is successfully executed, or a result indicating an error, and in obtaining the parameter, a parameter at a time when the second system call function is called by the system call is obtained [rewrite/rerouting or replacing original addresses with the system call functions, Section V, Subsection B: Implementation, numeral 1)].
As to claim 5, Win teaches the invention as claimed including wherein the processing circuitry further configured to display a screen for receiving specification of at least one or more container images of a plurality of container images in the container-type virtualization environment, and in obtaining the parameter, the parameter is obtained for the system call for the specified one or more container images [user and user interaction with the host in accessing various data or container data via identification of container such as the container’s PID, Section III; Section V, Subsection B: Implementation, Numeral 2) ].
As to claim 7, Win teaches the invention as claimed including wherein the processing circuitry further configured to end, when all containers are deleted, monitoring of the parameter by the step of obtaining and the step of returning the processing result [setup or implementation begin with installation of LXC platform and creating an Ubuntu guest container on the host such that the absence of any container would end/stop or render monitoring of access to container(s) non-existing, Section VI, Subsections A and B].
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 9 is/are rejected under 35 U.S.C. 103 as being unpatentable over Win as applied to claim 1 above.
As to claim 9, Win does not specifically teach wherein the data to be protected is a container image in a container-type virtualization environment, and difference data used for backup of the container image. However, Win disclosed protecting containers (i.e. running instance of container image(s)) and their data [abstract] and monitoring of all resource access requests [Section VI, Subsections A and B]. Furthermore, difference data used for backup of container image is well known. It would have been obvious before the effective filing date of the claimed invention to have extended Win’s container access control and data protection method to include a variety of data as a matter of design choice without departing from the scope of container access control.
Allowable Subject Matter
Claims 11 and 13 are allowed.
The following is a statement of reasons for the indication of allowable subject matter:
The prior art(s) of record when taken individually or in combination do not expressly teach or render obvious, in the context of the claims taken as a whole, the claim limitation of "start monitoring of the parameter by the step of obtaining at a timing when difference data used for backup of a container image is generated in the container-type virtualization environment" as recited in independent claims 11 and 13. Neither a reference uncovered that would have provided a basis of evidence for asserting a motivation, nor one of ordinary skilled in the art before the effective filing date of the claimed invention knowing the teaching of the prior arts of record would have combined them to arrive at the present invention as recited in the context of independent claims 11 and 13 as a whole.
Response to Arguments
Applicant's arguments filed 7/29/26 have been fully considered.
Claim 10 is no longer invokes 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph.
Amended title overcomes the objection to the specification.
Amendment to claim 7 overcomes the claim objection.
Rejections of claims 1-10 under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph are overcome in light of applicant’s amendment.
In the remarks, Applicant argued in substance that:
Pertaining to claim 1, Win does not disclose nor suggest the special technical feature of “monitor a system call of a container host’s kernel” because Win does not teach communicating with container kernels. Cited reference disclosed monitor system calls from within a container, it cannot monitor system calls from the container host, cannot monitor or block system calls directed at the container image from other programs or commands running on the container host.
Examiner respectfully traversed Applicant's remarks:
As to point (a), the examiner respectfully disagrees and submits that Win’s system/architecture implemented on a server, namely a host, hosting a container (i.e. container host) in user space, where system call is issue from kernel of the host which contains the container (i.e. kernel of the container host or container host’s kernel); system call interceptor, located in kernel space, “monitoring any attempts by the host…by intercepting…system calls” [Fig. 1 and corresponding text; p. 193, subsection C. System call table; p. 194, subsection B. Implementation] which clearly satisfy the limitations of “monitor a system call of a container host’s kernel”. Furthermore, while Win disclosed the scenario of root break out (i.e. monitoring of system calls from within a container), such scenario was not depended upon for the rejection. Win disclosed the interception of system calls in invoking respective functions such as open files or terminate a running process, such that a determination is made as to whether an opened file belongs to a guest container and the access via system calls by the host is denied access to the target file if it belongs to a guest container process [Section V, Subsection B: Implementation], therefore applicant’s argument is not persuasive. In response to applicant's argument that the references fail to show certain features of the invention, it is noted that the features upon which applicant relies (i.e., “container image”) are not recited in the rejected claim(s). Although the claims are interpreted in light of the specification, limitations from the specification are not read into the claims. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993).
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should a be directed to QING YUAN WU whose telephone number is (571)272-3776. The examiner can normally be reached on M-F 9AM-6PM EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lewis Bullock can be reached on 571-272-3759. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would
like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/QING YUAN WU/Primary Examiner, Art Unit 2199
Prosecution Insights