DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claims 1-19 are pending.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-19 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor, or for pre-AIA the applicant regards as the invention.
Claim 1 recites “the cybersecurity object” in at least line 6. However, it’s unclear whether this refers to “a cybersecurity object” in line 1 of claim 1 or line 3 of claim 1. Claims 2-9 depend from claim 1 and thus also have this issue. For examination purposes, “the cybersecurity object” in at least line 6 has been interpreted as referring to “a cybersecurity object” in line 3 of claim 1.
Claim 10 recites “the cybersecurity object” in at least line 9. However, it’s unclear whether this refers to “a cybersecurity object” in line 2 of claim 10 or line 6 of claim 10. For examination purposes, “the cybersecurity object” in at least line 9 has been interpreted as referring to “a cybersecurity object” in line 6 of claim 10.
Claim 11 recites “the cybersecurity object” in at least line 9. However, it’s unclear whether this refers to “a cybersecurity object” in line 1 of claim 11 or line 6 of claim 11. Claims 12-19 depend from claim 11 and thus also have this issue. For examination purposes, “the cybersecurity object” in at least line 9 has been interpreted as referring to “a cybersecurity object” in line 6 of claim 11.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 1-19 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-17 of U.S. Patent No. 12093384 in view of Stopel (US 20170109536).
Claims 1-17 of U.S. Patent No. 12093384 disclose the limitations recited in claims 1-19 of the instant application except for the following limitations which are disclosed by Stopel: “a cloud computing environment” (e.g. ¶30) and “wherein the second image includes at least a software layer of the first image” (e.g. fig. 2, ¶7, 38). It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the features described by Stopel into the patent claims for the purpose of detecting vulnerabilities in images of software container in a cloud computing environment.
Instant application 18798391
Patent No. 12093384
1
1 + Stopel
2-9
2-8
10
1 + Stopel
11
1 + Stopel
12-19
12-17
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claim 1 is rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more. Claim 1 recites inspecting a first image of a virtual resource in a cloud computing environment for a cybersecurity object; detecting a second image in the cloud computing environment, wherein the second image includes at least a software layer of the first image; inspecting the second image for the cybersecurity object; associating the cybersecurity object with the first image, in response to detecting the cybersecurity object in the first image and detecting the cybersecurity object in the second image; and associating the cybersecurity object with the second image, in response to detecting the cybersecurity object in the second image and not detecting the cybersecurity object in the first image.
The limitation of inspecting a first image of a virtual resource in a cloud computing environment for a cybersecurity object as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. For example, “inspecting” in the context of this claim encompasses the user manually checking, based on a report, a first image of a virtual resource in a cloud computing environment for a cybersecurity object.
The limitation of detecting a second image in the cloud computing environment, wherein the second image includes at least a software layer of the first image as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. For example, “detecting” in the context of this claim encompasses the user notices a second image in the cloud computing environment, wherein the second image includes at least a software layer of the first image.
The limitation of inspecting the second image for the cybersecurity object as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. For example, “inspecting” in the context of this claim encompasses the user manually checking, based on a report, the second image for the cybersecurity object.
The limitation of associating the cybersecurity object with the first image, in response to detecting the cybersecurity object in the first image and detecting the cybersecurity object in the second image as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. For example, “associating” in the context of this claim encompasses the user mentally or manually on a piece of paper connecting or linking the cybersecurity object to the first image in response to detecting the cybersecurity object in the first image and detecting the cybersecurity object in the second image.
The limitation of associating the cybersecurity object with the second image, in response to detecting the cybersecurity object in the second image and not detecting the cybersecurity object in the first image as drafted, is a process that, under its broadest reasonable interpretation, covers performance of the limitation in the mind. For example, “associating” in the context of this claim encompasses the user mentally or manually on a piece of paper connecting or linking the cybersecurity object to the second image in response to detecting the cybersecurity object in the second image and not detecting the cybersecurity object in the first image.
If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind then it falls within the “Mental Processes” grouping of abstract ideas. Accordingly, the claim recites an abstract idea.
This judicial exception is not integrated into a practical application because the claim does not recite additional elements that integrate the judicial exception into a practical application.
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception.
Dependent claims 2-9 further clarify the concept recited in claim 1 however this clarification still falls under the concept recited in claim 1 and does not amount to significantly more than the judicial exception. Dependent claims 2-9 are rejected for at least the reasons stated above with respect to claim 1.
Claim 10 although not using the exact claim language, contains similar elements as recited in claim 1 and is also rejected for similar reasons. Claim 10 additionally recites a non-transitory computer-readable medium storing instructions when executed by one or more processors for causing a device to perform the steps. However, these additional elements are recited at a high-level of generality and are generic computer components such that they amount to no more than mere instructions to apply the exception using a generic computer. Mere instructions to apply an exception using a generic computer cannot provide an inventive concept. Accordingly, these additional elements do not integrate the abstract idea into a practical application because they do not impose any meaningful limits on practicing the abstract idea.
Claim 11 although not using the exact claim language, contains similar elements as recited in claim 1 and is also rejected for similar reasons. Claim 11 additionally recites a processing circuitry and a memory containing instructions when executed by the processing circuitry configure the system to perform the steps. However, these additional elements are recited at a high-level of generality and are generic computer components such that they amount to no more than mere instructions to apply the exception using a generic computer. Mere instructions to apply an exception using a generic computer cannot provide an inventive concept. Accordingly, these additional elements do not integrate the abstract idea into a practical application because they do not impose any meaningful limits on practicing the abstract idea.
Dependent claims 12-19 further clarify the concept recited in claim 11 however this clarification still falls under the concept recited in claim 11 and does not amount to significantly more than the judicial exception. Dependent claims 12-19 are rejected for at least the reason stated above with respect to claim 11.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale or otherwise available to the public before the effective filing date of the claimed invention.
Claims 1, 3-8, 10-11, and 13-18 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Stopel (US 20170109536).
Claims 1 and 10, these claims are rejected for similar reasons as in claim 11.
Claims 3-8, these claims are rejected for similar reasons as in claims 13-18.
Claim 11, Stopel discloses A system for detecting a cybersecurity object in virtualization objects, comprising: a processing circuitry; and a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to: (e.g. figs. 3, 5, ¶74)
inspect a first image of a virtual resource in a cloud computing environment for a cybersecurity object; (e.g. abstract, ¶30, 38, 42: As shown in FIG. 3, a host device 310 is communicably connected to a network 320. The host device 310 can be realized as a physical machine, a virtual machine, or a cloud infrastructure (IaaS). Examples for such a cloud infrastructure include, but are not limited to, Amazon Web Services (AWS), Cisco® Metapod, Microsoft Azure®, Google® Compute Engine (GCE), Joyent®, and the like. The host device 310 may be deployed in a datacenter, a cloud computing platform (e.g., a public cloud, a private cloud, or a hybrid cloud), on-premises of an organization, or in a combination thereof…extracting contents of each image layer of each base image; scanning the extracting contents to detect at least one vulnerability…As discussed above, the base image includes a plurality of image layers (e.g., the layers 215, FIG. 2), each of which is uniquely identified…It should be noted that reformatting or creating a filesystem for the base image 312 includes extracting the structured layers of the base image 312. The extracted contents of the base image 312 can be scanned, parsed, or otherwise processed. In an embodiment, when the base image 312 is extracted, the software container 315 is configured to start scanning the contents of the base image 312 to detect vulnerabilities.)
detecting a second image in the cloud computing environment, wherein the second image includes at least a software layer of the first image; (e.g. fig. 2, ¶7, 38: FIG. 2 illustrates a typical structure of a software container 200. The software container 200 includes a base image 210 and a container layer 220. The base image 210 includes one or more image layers 215-1 through 215-q (hereinafter referred to individually as a layer 215 and collectively as layers 215, merely for simplicity purposes). The layers 215 are read-only layers that represent filesystem differences. That is, the layers 215 are stacked on top of each other to form a base for the container's 200 root filesystem…As discussed above, the base image includes a plurality of image layers (e.g., the layers 215, FIG. 2), each of which is uniquely identified)
inspect the second image for the cybersecurity object, (e.g. abstract, ¶38, 42: extracting contents of each image layer of each base image; scanning the extracting contents to detect at least one vulnerability…As discussed above, the base image includes a plurality of image layers (e.g., the layers 215, FIG. 2), each of which is uniquely identified…It should be noted that reformatting or creating a filesystem for the base image 312 includes extracting the structured layers of the base image 312. The extracted contents of the base image 312 can be scanned, parsed, or otherwise processed. In an embodiment, when the base image 312 is extracted, the software container 315 is configured to start scanning the contents of the base image 312 to detect vulnerabilities)
associate the cybersecurity object with the first image, in response to detecting the cybersecurity object in the first image and detecting the cybersecurity object in the second image; and (e.g. ¶10, 28, 46: hackers can take advantage and program images to include malicious code, thus such images can be vulnerable when integrated in a software container. Such malicious code may carry any type of malware including, for example, computer viruses, worms, Trojan horses, ransomware, spyware, adware, scareware, and the like…The detected vulnerabilities include at least known malwares or zero-day malware. In an embodiment, detection of vulnerabilities is performed in image registries prior to integration of a base image in a software container, thereby preventing execution of software containers that include malicious code embedded in an image container…Upon detection of a vulnerability, a detection event is generated and reported. Such a detection event may include, but is not limited to, a base image identifier, an infected layer or layers, a source register, a type of the detected vulnerability, and so on.)
associate the cybersecurity object with the second image, in response to detecting the cybersecurity object in the second image and not detecting the cybersecurity object in the first image. (e.g. ¶10, 28, 46: hackers can take advantage and program images to include malicious code, thus such images can be vulnerable when integrated in a software container. Such malicious code may carry any type of malware including, for example, computer viruses, worms, Trojan horses, ransomware, spyware, adware, scareware, and the like…The detected vulnerabilities include at least known malwares or zero-day malware. In an embodiment, detection of vulnerabilities is performed in image registries prior to integration of a base image in a software container, thereby preventing execution of software containers that include malicious code embedded in an image container…Upon detection of a vulnerability, a detection event is generated and reported. Such a detection event may include, but is not limited to, a base image identifier, an infected layer or layers, a source register, a type of the detected vulnerability, and so on.)
Claim 13, Stopel discloses The system of claim 11, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: determine that the cybersecurity object indicates a cybersecurity threat; (e.g. ¶10, 28, 45) and initiate a remediation action based on the indicated cybersecurity threat. (e.g. ¶28, 36, 46, 48)
Claim 14, Stopel discloses The system of claim 13, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: initiate the remediation action on the first image in response to determining that the first image is associated with the cybersecurity object. (e.g. ¶28, 36, 46, 48)
Claim 15, Stopel discloses The system of claim 13, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: initiate the remediation action on the second image in response to determining that the second image is associated with the cybersecurity object. (e.g. ¶28, 36, 46, 48)
Claim 16, Stopel discloses The system of claim 13, wherein the remediation action includes a mitigation action. (e.g. ¶28, 36, 46, 48)
Claim 17, Stopel discloses The system of claim 11, wherein the cybersecurity object is any one of: a vulnerability, an exposure, a misconfiguration, a malware object, a cryptocurrency miner, a ransomware, a spyware, a bot, a weak password, an exposed password, an exposed certificate, an outdated certificate, an operating system identifier, a software application, a user account, a password stored in plaintext, a password stored in cleartext, a certificate, and any combination thereof. (e.g. ¶10, 28, 45)
Claim 18, Stopel discloses The system of claim 11, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: detect that the first image and the second image are generated each based on a build instruction of a common build. (e.g. ¶8, 34)
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 9 and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Stopel (US 20170109536) in view of Knierim (WO 2022253537).
Claim 9, this claim is rejected for similar reasons as in claim 19.
Claim 19, Stopel discloses The system of claim 11, wherein the memory contains further instructions which when executed by the processing circuitry further configure the system to: detect that the first image is a read only image (e.g. ¶7-8)
Stopel does not appear to explicitly disclose but Knierim discloses detect that the second image is a writable image. (e.g. page 5: identifying at least a second file system layer of the container image, which contains at least one component of the first file system layer, and carrying out steps c) to f) for every second file system layer. Thus, even those layers that are dependent on the vulnerable first layer are recognized and replaced. Since files in particular, such as binary programs, from one of the base layers are often referenced and used in several file system layers, the identified vulnerabilities of this base layer are also found in the several file system layers. These multiple file system layers are thus second file system layers. A second file system layer is dependent on the first file system layer in the sense that they overwrite data provided in the first file system layer with vulnerabilities. It does not necessarily have to be a vulnerability, but can also be the package database or a configuration file that is overwritten in the subsequent file system layer.)
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention to incorporate the features described by Knierim into the invention of Stopel for the purpose of recognizing and replacing layers that are dependent on the vulnerable first layer (Knierim, page 5).
Allowable Subject Matter
Claims 2 and 12 would be allowable if rewritten (a) in independent form including all of the limitations of the base claim and any intervening claims and (b) to overcome the 112(b), double patenting, and 101 rejections set forth above.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure:
Yaron (US 20230315860) discloses a software container, such as built by Docker® is a standard unit of software that packages code and all its dependencies to allow applications to run from one computing environment to another. A software container includes a container image which is a lightweight, standalone, executable package of software that includes all resources to run an application including code, runtime, system tools, system libraries and settings. The build file (e.g., Dockerfile) contains all the commands to assemble and create a container image. The build file allows an automated build of container images. A container image includes several layers, where each layer corresponds to certain instructions in the build file. For example, a base layer would be a version of an operating system (e.g., Ubuntu).
Pieczul (US 20230252157) discloses container images are built using stacked software layers. The layers may include a base layer followed by one or more subsequent layers. The based layer may, for example, may be a layer that is specific to an operating system. For example, if the container is to execute on a LINUX platform, the base layer may be a LINUX specific layer. For example, the base layer may be a standard image provided by a Linux distribution vendor. One or more software layers may be stacked on top of the base layer. In this manner, a container image may contain a hierarchy of multiple layers stacked on top of each other. A layer in the hierarchy may use one or more lower layers in the hierarchy. For example, a particular container image comprising three layers may include a first (base) layer, a second (intermediate) layer that sits on top of the base layer, and a third (top) layer that sits on top of the second layer… As seen in FIG. 3, several layers are shared by different container images. For example, the Linux Slim base layer is shared by all the eight container images; the Java base layer is shared by container images for Services 1, 2, 3, and 4; the Jetty base layer is shared by container images for Services 2, 3, and 4; the Python base layer is shared by container images for Services 5, 6, 7, and 8; the Django base layer is shared by container images for Services 7 and 8. If a vulnerability exits in a particular layer, then that vulnerability impacts and exists in all the container images that contain that layer. For example, if a vulnerability is detected in the Django base, that the container images for Services 7 and 8, which contain the Django layer, will be impacted by that vulnerability.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to TRONG NGUYEN whose telephone number is (571)270-7312. The examiner can normally be reached on Monday through Thursday 9:00 AM - 5:00 PM EST.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, GELAGAY SHEWAYE can be reached on (571)272-4219. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/TRONG H NGUYEN/Primary Examiner, Art Unit 2436