Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 07/08/2026 has been entered.
Detailed Action
Applicant amended claims 1, 3-4, 6, 14, 16 and 20-22; canceled claims 8-9 and 18; added claim 23 and presented claims 1-7, 10-17 and 19-23 for reconsideration on 07/08/2026.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 16 and 20 are rejected under 35 U.S.C. 103(a) as being unpatentable over Deshpande et al., Pub. No.: US 2015/0332280 A1 (hereinafter Deshpande) in view of Toh et al., “Design and implementation of an audit subsystem for a separation kernel” (hereinafter Toh).
Claim 1. Deshpande teaches:
A method comprising:
generating and storing, by a storage system that provides storage services to one or more clients, audit data in an efficient binary format, the audit data stored as internal metadata within the storage system and representative of data operations within the storage system; (¶ 23, “the datacenter 102 may be hosting an auditing service that uploads/stores data, including audit data, from an auditing application executed on one or more client devices”)
detecting, by the storage system, a request for a portion of the audit data; (¶ 24, “an administrator, such as a compliance officer, may request to receive the stored audit data. In response, the stored audit data may be converted to a format compatible with one or more compliance user interfaces of the auditing application, such as a query user interface and an audit reporting user interface”, ¶ 25, “the audit data may be aggregated periodically to facilitate conversion of the stored audit data to a compatible format for the one or more compliance user interfaces in response to the request from the administrator to receive the stored audit data for the querying and/or reporting”, ¶¶ 29, 40)
generating, by the storage system and on-demand based on the request, an audit log corresponding to the portion of the audit data, the generating comprising converting the portion of the audit data to an expanded data format configured for external use; (¶ 24, “an administrator, such as a compliance officer, may request to receive the stored audit data. In response, the stored audit data may be converted to a format compatible with one or more compliance user interfaces of the auditing application, such as a query user interface and an audit reporting user interface”, ¶ 25, “the audit data may be aggregated periodically to facilitate conversion of the stored audit data to a compatible format for the one or more compliance user interfaces in response to the request from the administrator to receive the stored audit data for the querying and/or reporting”, ¶¶ 29, 40)
providing, by the storage system, the audit log comprising the converted portion of the audit data in the expanded data format. (¶ 24, “The audit data may then be transmitted through the user interfaces of the application executed on another client device associated with the administrator for querying the audit data and/or reporting statistical information associated with the audit data”, ¶¶ 29, 40)
Deshpande did not specifically disclose the stored audit data in an efficient binary format but Toh discloses storing audit data in an efficient binary format. (Toh, pp. 23-24, “A binary format is commonly used by the major operating systems…Based on the survey of the different log formats, binary logs have been selected as the best choice…because the amount of space required for collection of audit records is significantly smaller than the other log formats, and the binary format can be parsed easily”)
Deshpande discloses storing raw audit data in a datacenter and converting the raw data to a required format. It would have been obvious before the effective filling date of the claimed invention to a person having ordinary skill in the art to combine the applied references for disclosing an efficient binary format because doing so would further provide for selecting a format that is “significantly smaller than the other log formats” and “can be parsed easily”).
Claims 16 and 20 are rejected under the same rationale as above.
Claims 2-7, 10-13, 17, and 19-23 are rejected under 35 U.S.C. 103(a) as being unpatentable over Deshpande and Toh as applied to claim 1, 16 and 20 above in view of Dhanapal et al., "An effective mechanism to regenerate HTTP flooding DDoS attack using real time data set” (herein after Dhanapal).
Claim 2. Deshpande as modified taught the method of claim 1 wherein in response to a request “the stored audit data may be converted to a format compatible with one or more compliance user interfaces of the auditing application, such as a query user interface and an audit reporting user interface”. Deshpande as modified did not specifically disclose but Dhanapal discloses:
presenting, by the storage system, an audit data directory including pseudo-files organized by attributes of the audit data, each pseudo-file representing a subset of the audit data; (Dhanapal, secs. B and C, provided tools select a given binary file from partitioned binary files, e.g. a directory of binary files: “To keep the size of the file minimal in any particular day, the collected logs may be divided into one or more intervals. For example, if logs are divided into three intervals, then there 1, 2, 3 are the values of <SUB-INTERVAL>”; also see p. 4 of the document attached to Dhanapal: “Due to the volume of data, the binary log has been split into a number of intervals. Each interval represents one day of the overall log…In order to keep the size of each log file below 50 MB some of the 1 day intervals needed to be divided into subintervals…In total there are 249 binary log files for the 92 days during which the access logs were collected)
receiving, by the storage system, a request to access a pseudo-file included in the audit data directory; and (see above, a given binary file is a split of a larger binary file that can be converted to human readable file)
processing, by the storage system, the request to access the pseudo-file as the request for the portion of the audit data, the portion of the audit data corresponding to the subset of the audit data represented by the pseudo-file. (see above, a given binary file is a split of a larger binary file that can be converted into the human readable log file)
Deshpande discloses that the audit data is searchable based on the properties of the audit data. Deshpande, ¶¶ 29, 32. It would have been obvious before the effective filling date of the claimed invention to a person having ordinary skill in the art to combine the applied references for disclosing presenting, by the storage system, an audit data directory including pseudo-files organized by attributes of the audit data, each pseudo-file representing a subset of the audit data; receiving, by the storage system, a request to access a pseudo-file included in the audit data directory; and processing, by the storage system, the request to access the pseudo-file as the request for the portion of the audit data, the portion of the audit data corresponding to the subset of the audit data represented by the pseudo-file because doing so would provide for an alternative presentation of searchable audit data for achieving the same predictable result of generating result in response to a user query.
Claim 17 is rejected under the same rationale.
Claim 3. The method of claim 2, wherein the converting the portion of the audit data comprises converting the subset of the audit data to the expanded data format; and wherein the providing the audit log comprising the converted portion of the audit data comprises storing the converted portion of the audit data in a directory as a generated file for responding to audit data read requests. (Deshpande, ¶¶ 14, 24, 33, 40, wherein the audit data is converted to a required format in response to a request; Dhanapal, converted /recreated files are used/stored for further analysis, secs. B, C, III.A: “To keep the size of the file minimal in any particular day, the collected logs may be divided into one or more intervals. For example, if logs are divided into three intervals, then there 1, 2, 3 are the values of <SUB-INTERVAL>”; “This module takes the Web Server logs generated using recreate tool as input, processes it and generates output file which contains only HTTP GET requests”; also see p. 8 of the document attached to Dhanapal: “The binary log files were created on an HP PA-RISC machine. As a result, the binary files are in big endian (i.e., network order) format. The three example programs were written knowing that the binary files are in big endian format. Each program attempts to determine the format utilized by the platform you are working on, and convert it accordingly”)
Claim 4. The method of claim 2, wherein the converting the portion of the audit data comprises converting the subset of the audit data to the expanded data format on-the-fly during the processing the request to access the pseudo-file; and wherein the providing the audit log comprising the converted portion of the audit data comprises returning the converted portion in response to the request for the portion of the audit data. (Deshpande, ¶¶ 14, 24, 33, 40, wherein the audit data is converted to a required format in response to a request; Dhanapal, a portion is converted by recreate tool when it is requested, e.g., based on the requested file name and date attribute, secs. B, C, III.A,“To keep the size of the file minimal in any particular day, the collected logs may be divided into one or more intervals. For example, if logs are divided into three intervals, then there 1, 2, 3 are the values of <SUB-INTERVAL>”; “This module takes the Web Server logs generated using recreate tool as input, processes it and generates output file which contains only HTTP GET requests”; also see p. 8 of the document attached to Dhanapal: “The binary log files were created on an HP PA-RISC machine. As a result, the binary files are in big endian (i.e., network order) format. The three example programs were written knowing that the binary files are in big endian format. Each program attempts to determine the format utilized by the platform you are working on, and convert it accordingly”)
Claim 5. The method of claim 1, wherein the detecting the request for the portion of the audit data comprises:
determining that the request includes an embedded query; (Deshpande, ¶¶ 14, 24, 29, 33, 40, wherein the audit data is converted to a required format in response to a request; Dhanapal, sec. B, read tool determines a given file name as a query for reading the file to “to understand the number of request available in the given file”; also see p. 2 of the document attached to Dhanapal: “The read tool is a very simple tool that will read each request in a binary log and print the total number of requests contained in that log”)
extracting the embedded query from the request; and (Deshpande, ¶¶ 14, 24, 29, 33, 40, wherein the audit data is converted to a required format in response to a request; Dhanapal, sec. B, read tool determines a given file name as a query for reading the file to “to understand the number of request available in the given file”; also see p. 2 of the document attached to Dhanapal: “The read tool is a very simple tool that will read each request in a binary log and print the total number of requests contained in that log”)
using the extracted query to query the audit data to identify the portion of the audit data. (Deshpande, ¶¶ 14, 24, 29, 33, 40, wherein the audit data is converted to a required format in response to a request; Dhanapal, sec. B, read tool determines a given file name as a query for reading the file to “to understand the number of request available in the given file”; also see p. 2 of the document attached to Dhanapal: “The read tool is a very simple tool that will read each request in a binary log and print the total number of requests contained in that log”)
Claim 19 is rejected under the same rationale.
Claim 6. The method of claim 5, wherein:
the request is to access contents of a pseudo-file having a filename, the filename included in the request and comprising the embedded query; and (Deshpande, ¶¶ 14, 24, 29, 33, 40, wherein the audit data is converted to a required format in response to a request; Dhanapal, sec. B, read tool determines a given file name as a query for reading the file “to understand the number of request available in the given file”; also see p. 2 of the document attached to Dhanapal: “The read tool is a very simple tool that will read each request in a binary log and print the total number of requests contained in that log”)
the audit log comprising the converted portion of the audit data is provided as the contents of the pseudo-file. (Deshpande, ¶¶ 14, 24, 29, 33, 40, wherein the audit data is converted to a required format in response to a request; Dhanapal, sec. B, read tool determines a given file name as a query for reading the file to “to understand the number of request available in the given file”; also see p. 2 of the document attached to Dhanapal: “The read tool is a very simple tool that will read each request in a binary log and print the total number of requests contained in that log”)
Claim 7. The method of claim 5, wherein the query comprises a set of metadata values indicating one or more of a set of network addresses, identifying requesting client systems, a set of timestamps, a set of ranges of timestamps, a directory indicating a selection of files within the directory, a set of user identities, or a set of filename patterns. (Deshpande, ¶¶ 14, 24, 29, 33, 40, wherein the audit data is converted to a required format in response to a request; Dhanapal, sec. B, read tool determines a given file name as a query for reading the file to “to understand the number of request available in the given file”; also see p. 2 of the document attached to Dhanapal: “The read tool is a very simple tool that will read each request in a binary log and print the total number of requests contained in that log”)
Claim 10. The method of claim 1, wherein the data operations comprise data access requests, and wherein the audit data comprises one or more of accessed pathnames, timestamps of the data access requests, accessing users, accessing client hosts, elapsed times to complete the data access requests, amounts of data transferred for the data access requests, or completion statuses of the data access requests. (Deshpande, ¶ 14, “The user action may be an action requiring auditing, such as a create, read, update, and/or delete action, a permission change, a forward, a share, a print, and/or a command execution, among other examples”, Dhanapal, sec. II, binary log files comprises “huge diversities of request to multiple servers…1.3 Billion HTTP requests to total number of 89996 unique resources, involving 2770107 different IP addresses to the 33 servers across four geographical locations”, fig. 3; also see p. 1 of the document attached to Dhanapal: “The World Cup access logs have been converted from Common Log Format to a more compact binary format. Each entry in the binary log is a fixed size, and represents a single request to the site. The format of a request in the binary log looks like: struct request { uint32_t timestamp; uint32_t clientID; uint32_t objectID; uint32_t size; uint8_t method; uint8_t status; uint8_t type; uint8_t server;}”)
Claim 11. The method of claim 1, wherein:
generating, by the storage system, the audit data in the efficient binary format comprises using a data reduction algorithm by storing references for a set of audit entries within the audit data to audit metadata associated with an additional set of audit entries within the audit data. (Toh, pp. 23-24, wherein the binary format is an efficient binary format “because the amount of space required for collection of audit records is significantly smaller than the other log formats”; Dhanapal, sec. B, the audit data sets are in compressed binary logs file format suggest storing references for a set of audit entries within the audit data to audit metadata associated with an additional set of audit entries within the audit data)
Claim 12. The method of claim 1, wherein:
generating, by the storage system, the audit data in the efficient binary format using an incremental compression algorithm. (Toh, pp. 23-24, wherein the binary format is an efficient binary format “because the amount of space required for collection of audit records is significantly smaller than the other log formats”; Dhanapal, sec. B, the audit data sets are in compressed binary logs file format suggest using a compression algorithm, e.g., an incremental compression algorithm)
Claim 13. The method of claim 1, further comprising:
receiving, by the storage system, a request to access a pseudo-object included in an object store associated with the storage system; and (Deshpande, ¶¶ 14, 24, 29, 33, 40, wherein the audit data is converted to a required format in response to a request; Dhanapal, sec. B, read tool determines a given file name as a query for reading the file to “to understand the number of request available in the given file”, a given file name is the name of an object/file; also see p. 2 of the document attached to Dhanapal: “The read tool is a very simple tool that will read each request in a binary log and print the total number of requests contained in that log…Example: read each of the 1000 requests in the test_log”)
processing, by the storage system, the request to access the pseudo-object as the request for the portion of the audit data, the portion of the audit data corresponding to a subset of the audit data represented by the pseudo-object. (Deshpande, ¶¶ 14, 24, 29, 33, 40, wherein the audit data is converted to a required format in response to a request; Dhanapal, sec. B, read tool determines a given file name as a query for reading the file to “to understand the number of request available in the given file”, a given file name is the name of an object/file; also see p. 2 of the document attached to Dhanapal: “The read tool is a very simple tool that will read each request in a binary log and print the total number of requests contained in that log…Example: read each of the 1000 requests in the test_log”)
Claim 21. The method of claim 1, wherein the audit data in the efficient binary format is stored as the internal metadata in a binary audit namespace that is not presented to the one or more clients (Deshpande, ¶¶ 23-25, datacenter stores data along with audit data, wherein stored audit data is not presented to the client, the converted audit data is presented; Toh, pp. 23-24, Dhanapal, Abs., wherein “The data sets are stored in processed log format due to security and confidential reasons”; secs. B, C, III.A: “To keep the size of the file minimal in any particular day, the collected logs may be divided into one or more intervals. For example, if logs are divided into three intervals, then there 1, 2, 3 are the values of <SUB-INTERVAL>”; “This module takes the Web Server logs generated using recreate tool as input, processes it and generates output file which contains only HTTP GET requests”; also see p. 8 of the document attached to Dhanapal: “The binary log files were created on an HP PA-RISC machine. As a result, the binary files are in big endian (i.e., network order) format. The three example programs were written knowing that the binary files are in big endian format. Each program attempts to determine the format utilized by the platform you are working on, and convert it accordingly)
Claim 22. The method of claim 21, wherein providing the audit log comprising the converted portion of the audit data comprises storing the audit log comprising the converted portion of the audit data in an audit namespace that is presented to the one or more clients. (Deshpande, ¶¶ 23-25, datacenter stores data along with audit data, wherein stored audit data is not presented to the client, the converted audit data is presented; Toh, pp. 23-24, Dhanapal, wherein converted/recreated files as noted above are used/stored for further analysis, secs. B, C, III.A: “To keep the size of the file minimal in any particular day, the collected logs may be divided into one or more intervals. For example, if logs are divided into three intervals, then there 1, 2, 3 are the values of <SUB-INTERVAL>”; “This module takes the Web Server logs generated using recreate tool as input, processes it and generates output file which contains only HTTP GET requests”; also see p. 8 of the document attached to Dhanapal: “The binary log files were created on an HP PA-RISC machine. As a result, the binary files are in big endian (i.e., network order) format. The three example programs were written knowing that the binary files are in big endian format. Each program attempts to determine the format utilized by the platform you are working on, and convert it accordingly)
Claim 23. The method of claim 1, wherein the generating further comprises:
identifying, based on the request, selections of the audit data stored as the internal metadata within the storage system; and (Deshpande, ¶¶ 23-25, 29, 32, wherein datacenter stores data along with audit data and stored audit data is converted and presented in response to a user request; properties associated with stored audit data is searchable; Toh, pp. 23-24, Dhanapal, wherein converted/recreated files are used/stored for further analysis, secs. B, C, III.A: “To keep the size of the file minimal in any particular day, the collected logs may be divided into one or more intervals. For example, if logs are divided into three intervals, then there 1, 2, 3 are the values of <SUB-INTERVAL>”; “This module takes the Web Server logs generated using recreate tool as input, processes it and generates output file which contains only HTTP GET requests”; also see p. 8 of the document attached to Dhanapal: “The binary log files were created on an HP PA-RISC machine. As a result, the binary files are in big endian (i.e., network order) format. The three example programs were written knowing that the binary files are in big endian format. Each program attempts to determine the format utilized by the platform you are working on, and convert it accordingly)
combining the selections of the audit data to form the portion of the audit data that is converted to the expanded data format. (Deshpande, ¶¶ 23-25, 29, 32, wherein datacenter stores data along with audit data and stored audit data is converted and presented in response to a user request; properties associated with stored audit data is searchable; Toh, pp. 23-24, Dhanapal, wherein converted/recreated files are used/stored for further analysis, secs. B, C, III.A: “To keep the size of the file minimal in any particular day, the collected logs may be divided into one or more intervals. For example, if logs are divided into three intervals, then there 1, 2, 3 are the values of <SUB-INTERVAL>”; “This module takes the Web Server logs generated using recreate tool as input, processes it and generates output file which contains only HTTP GET requests”; also see p. 8 of the document attached to Dhanapal: “The binary log files were created on an HP PA-RISC machine. As a result, the binary files are in big endian (i.e., network order) format. The three example programs were written knowing that the binary files are in big endian format. Each program attempts to determine the format utilized by the platform you are working on, and convert it accordingly)
Claim 14 is rejected under 35 U.S.C. 103(a) as being unpatentable over Deshpande and Toh as applied to claim 1 above in view of Genovese et al., “Data Mesh: the newest paradigm shift for a distributed architecture in the data world and its application” (hereinafter Genovese).
Claim 14. Deshpande as modified taught the method of claim 1; Deshpande as modified did not teach but Genovese teaches wherein the converted portion of the audit data is provided from an object store using an application programming interface. (Genovese, wherein a user can access data stored in an object store such as Amazon S3 using an application programming interface: pp. 40-43, “Amazon Simple Storage Service (Amazon S3) is an object storage cloud service. The primary goal of S3 is to store any type of file in any quantity in the cloud for a variety of use cases (including data lake, data mesh, websites, mobile applications, backup and restore, storage, enterprise applications, IoT devices, and big data analytics), while providing industry-leading scalability, data availability, security, and performance. It can be stored static content for serving it directly to the end users, or internal data (configuration, system state, intermediate states and logs)… Buckets and objects are AWS resources in terms of implementation, and Amazon S3 provides APIs to manage them…”, pp. 45-46, “A REST API, often referred to as a RESTful API, is an application programming interface (API or web API) that adheres to the REST architecture style’s restrictions and allows interaction with RESTful web services… the API defines the content sought by the consumer (the request) and the content demanded by the producer (the response). As a result, the API serves as a bridge between users or customers and the online resources or services they wish to access”)
Deshpande as modified provides converted audit data in response to a user request. It would have been obvious before the effective filling date of the claimed invention to a person having ordinary skill in the art to combine the applied references for disclosing wherein the converted portion of the audit data is provided from an object store using an application programming interface because doing so would further provide for using any available services as needed for achieving the same predictable outcome of converting a requested file to a format as needed by a request.
Claim 15 is rejected under 35 U.S.C. 103(a) as being unpatentable over Deshpande and Toh as applied to claim 1 above in view of Lu et al. "A High Performance Cluster File System with Standard Network File System Interface” (Lu).
Claim 15. Deshpande as modified taught the method of claim 1; Deshpande as modified did not but Lu teaches wherein the storage system comprises a file server, and wherein the data operations comprise one or more of Network File System (NFSl requests or Server Message Block (SMB) requests. (Lu, secs. I, II wherein a file system can be accessed using a standard network file system: “This paper provides a novel high performance cluster file system with standard network file system access interface: CFS-SI. CFS-SI has not only the high performance of cluster file system, but also the standard network file system access interface. Then, the client can make use of high performance file service without modifying their own software… the FSN runs as Network File System [4] (NFS) or Common Internet File System [5] CIFS) daemon. So, the client can access the CFSSI by standard NFS or CIFS client software”)
Deshpande as modified provides for processing data stored in a datacenter (Deshpande, ¶¶ 32-35) in binary format (Toh, pp. 23-24, and converting a requested audit data to another format (Deshpande, ¶¶ 23-25) . It would have been obvious before the effective filling date of the claimed invention to a person having ordinary skill in the art to combine the applied references for disclosing wherein the converted portion of the audit data is provided from an object store using an application programming interface because doing so would further provide for processing audit data generated based on accessing a file server using a standard network file system access interface for achieving the same predictable outcome of processing binary file format in response to a user request.
Claims 8-9 and 18. (Cancelled)
Response to Amendment and Arguments
Applicant’s arguments with respect to rejected claims have been fully considered but are moot in view of the new ground of rejections as provided above.
Conclusion
The prior arts made of record in PTO-326 and not relied upon are considered pertinent to applicant's disclosure.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MOHSEN ALMANI whose telephone number is (571)270-7722. The examiner can normally be reached on M-F, 9:00 to 5:00.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ann J. Lo can be reached on 571-272-9767. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only.
For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MOHSEN ALMANI/Primary Examiner, Art Unit 2159
Prosecution Insights