Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This Office Action in is response to the amendment filed 3/17/2026 for application 18/807,110.
Claims 21-35 are currently pending. No claims have been amended . Claims 21, 28, and 35 are independent claims. Claims 21-35 have been examined and are pending. This Action is made FINAL.
Response to Arguments
Applicants’ arguments in the instant Amendment, filed on 3/17/2026, with respect to limitations listed below, have been fully considered but they are not persuasive.
Applicant asserts as follows. Double Patenting Rejection The Office Action rejected claims 21-35 under the judicially created doctrine of obviousness-type double patenting as being unpatentable over claims 1-20 of U.S. Patent No. 12093414. Without responding to these rejections on the merits, Applicant respectfully notes that the pending claims of the present application are still in flux. Thus, Applicant respectfully requests that these rejections be held in abeyance for the time being, until some subject matter is indicated to be otherwise allowable in the present application, at which time Applicant will consider whether or not a terminal disclaimer should be submitted.
Examiner respectfully maintains the rejection of claims 21-35 under the judicially created doctrine of obviousness-type double patenting as being unpatentable over claims 1-20 of U.S. Patent No. 12093414.
Applicant asserts as follows. Independent Claim 21 Is Patentable Over Narayanaswamy In View of Abadi The cited combination fails to teach or suggest the following. A computer-implemented method, comprising: determining, based at least in part on a string associated with a data structure of an application, that accesses of one or more categories to the data structure are to be monitored; detecting that a first access of a particular category of the one or more categories has been requested with respect to the data structure; and causing, based at least in part on the particular category, the first access to be rejected, at least in part. The cited combination of references fails to teach or suggest determining, based at least in part on a string associated with a data structure of an application, that accesses of one or more categories to the data structure are to be monitored, as recited in claim 21. On page 6 of the action paragraphs 7, 34, 75, 101, and 104 of Narayanaswamy are quoted with respect to Applicant's above-noted subject matter. But the quotes instead describe preventing unauthorized access of sensitive data, a decision whether to monitor network traffic to/from a cloud-based on its URL, a file system driver that interprets a structure of the file system, and routing URLs on a sensitivity list to a security system. But none of that corresponds to Applicant's determining [...] that accesses of one or more categories to the data structure are to be monitored because none of the former describe the same relationship (e.g., determining) recited in Applicant's claim between accesses of one or more categories to the data structure and monitoring accesses of one or more categories to the data structure.
Examiner respectfully disagrees. Regarding claim 21, Narayanaswamy discloses, paragraph 0034, 0101, 0104, 0007, 0075, a computer-implemented method, comprising, comprising: determining, based at least in part on a string associated with a data structure of an application, that accesses of one or more categories to the data structure are to be monitored preventing unauthorized access of sensitive data; decision about whether to monitor network traffic based on URLs and/or signature in a sensitivity list; URL found in sensitivity list based on string pattern matching; category directed parsers; structure of the file system, applications. Examiner notes that claiming one or more categories includes the case of a single category. The cited paragraphs include a teaching a category directed parsers. Narayanaswamy does not explicitly disclose detecting that a first access of a particular category of the one or more categories has been requested with respect to the data structure; and causing, based at least in part on the particular category, the first access to be rejected, at least in part. Abadi discloses, paragraphs 0050 and 0041, detecting that a first access of a particular category of the one or more categories has been requested with respect to the data structure by disclosing The request is dynamically analyzed in runtime according to a class and/or classification of the requesting process indicating one or more process characteristics; request to access one or more of the data items; paragraph 0072, causing, based at least in part on the particular category, the first access to be rejected, at least in part by disclosing As shown at 130, based on a class and/or classification of the process 250 compared to the characteristic(s) of the requested data item the analysis module 210 determines whether to grant or deny access of the process 250 to the requested data item.
Applicant asserts as follows. Uninformative Rejection Additionally, Applicant's attorney has reviewed the latest office action and the reference and has been unable to determine what accesses of one or more **categories** could possibly be mapped to in the cited portions of Narayanaswamy. Thus, because the Office Action has not adequately articulated what feature in the reference is mapped to Applicant's **categories** a prima facie rejection has not been established. In re Jung, 637 F.3d 1356, 1362 (Fed. Cir. 2011) (the PTO fails to establish a prima facie case "when a rejection is so uninformative that it prevents the applicant from recognizing and seeking to counter the grounds for the rejection") (citation omitted).
Examiner respectfully disagrees. Applicant has broadly claimed Applicant’s invention. Claims 21 is properly rejected by the combination of Narayanaswamy and Abadi. Narayanaswamy, paragraph 0080, discloses multiple categories. Abadi, paragraph 0072, discloses class, classification, characteristics – i.e. categories. Regarding claim 21, Narayanaswamy discloses, paragraph 0034, 0101, 0104, 0007, 0075, a computer-implemented method, comprising, comprising: determining, based at least in part on a string associated with a data structure of an application, that accesses of one or more categories to the data structure are to be monitored preventing unauthorized access of sensitive data; decision about whether to monitor network traffic based on URLs and/or signature in a sensitivity list; URL found in sensitivity list based on string pattern matching; category directed parsers; structure of the file system, applications. Examiner notes that claiming one or more categories includes the case of a single category.
Applicant asserts as follows. Narayanaswamy does not explicitly disclose detecting that a first access of a particular category of the one or more categories has been requested with respect to the data structure; and causing, based at least in part on the particular category, the first access to be rejected, at least in part. Abadi discloses, paragraphs 0050 and 0041, detecting that a first access of a particular category of the one or more categories has been requested with respect to the data structure by disclosing The request is dynamically analyzed in runtime according to a class and/or classification of the requesting process indicating one or more process characteristics; request to access one or more of the data items; paragraph 0072, causing, based at least in part on the particular category, the first access to be rejected, at least in part by disclosing As shown at 130, based on a class and/or classification of the process 250 compared to the characteristic(s) of the requested data item the analysis module 210 determines whether to grant or deny access of the process 250 to the requested data item.
Examiner respectfully disagrees. Regarding claim 21, Narayanaswamy discloses, paragraph 0034, 0101, 0104, 0007, 0075, a computer-implemented method, comprising, comprising: determining, based at least in part on a string associated with a data structure of an application, that accesses of one or more categories to the data structure are to be monitored preventing unauthorized access of sensitive data; decision about whether to monitor network traffic based on URLs and/or signature in a sensitivity list; URL found in sensitivity list based on string pattern matching; category directed parsers; structure of the file system, applications. Examiner notes that claiming one or more categories includes the case of a single category. The cited paragraphs include a teaching a category directed parsers.
Applicant asserts as follows. Additionally, the combination with Narayanaswamy fails to teach or suggest detecting that a first access of a particular category of the one or more categories has been requested with respect to the data structure. Over pages 6-7 of the action Narayanaswamy is ceded deficient and quotes from paragraphs 41 and 51 of Abadi are suggested to allegedly cure the deficiency. But the quotes instead describe analyzing a request according to a class and/or classification of the requesting process, [the classification] indicating one or more process characteristics for example, privileges of the requesting process compared to the characteristic(s) of the requested data item(s). Para. 50. Thus, the reference describes privileges of the requesting process and characteristic(s) of the requested data item, instead of accesses of one or more categories, as recited in Applicant's claim. Neither of Abadi's privileges of the requesting process nor characteristic(s) of the requested data item corresponds to Applicant's recited accesses of one or more categories.
Examiner respectfully disagrees. The combination of Narayanaswamy and Abadi properly rejects claim 21. Regarding claim 21, Narayanaswamy discloses, paragraph 0034, 0101, 0104, 0007, 0075, a computer-implemented method, comprising, comprising: determining, based at least in part on a string associated with a data structure of an application, that accesses of one or more categories to the data structure are to be monitored preventing unauthorized access of sensitive data; decision about whether to monitor network traffic based on URLs and/or signature in a sensitivity list; URL found in sensitivity list based on string pattern matching; category directed parsers; structure of the file system, applications. Examiner notes that claiming one or more categories includes the case of a single category. The cited paragraphs include a teaching a category directed parsers. Narayanaswamy, paragraph 0080, discloses multiple categories. Abadi, paragraph 0072, discloses class, classification, characteristics.
Applicant asserts as follows. Cited Abadi fails to teach or suggest causing, based at least in part on the particular category, the first access to be rejected, at least in part, as recited in claim 21. Instead quoted paragraph 72 describe analyzing a request according to a class and/or classification of the requesting process, [the classification] indicating one or more process characteristics for example, privileges of the requesting process compared to the characteristic(s) of the requested data item(s). Para. 72. Thus, the reference describes privileges of the requesting process and characteristic(s) of the requested data item, instead of causing, based at least in part on the particular category, the first access to be rejected, at least in part, as recited in Applicant's claim. Neither of Abadi's privileges of the requesting process nor characteristic(s) of the requested data item corresponds to Applicant's recited causing, based at least in part on the particular category, the first access to be rejected, at least in part.
Examiner respectfully disagrees. Regarding claim 21, Narayanaswamy discloses, paragraph 0034, 0101, 0104, 0007, 0075, a computer-implemented method, comprising, comprising: determining, based at least in part on a string associated with a data structure of an application, that accesses of one or more categories to the data structure are to be monitored preventing unauthorized access of sensitive data; decision about whether to monitor network traffic based on URLs and/or signature in a sensitivity list; URL found in sensitivity list based on string pattern matching; category directed parsers; structure of the file system, applications. Examiner notes that claiming one or more categories includes the case of a single category. The cited paragraphs include a teaching a category directed parsers. Preventing unauthorized access encompasses rejecting a first access. Narayanaswamy, paragraph 0080, discloses multiple categories. Abadi, paragraph 0072, discloses class, classification, characteristics.
Applicant asserts as follows. Dependent Claim 22, 29, And 36 Are Patentable Over Narayanaswamy In View of Abadi The cited combination fails to teach or suggest the computer-implemented method as recited in claim 21, wherein the first access of the particular category comprises a write operation. On page 7 of the action paragraph 75 of Narayanaswamy is quoted but instead describes data egress request detection and that example file system calls include "read and write operations." Such description that file system calls include read and write operations (without more) fails to teach or suggest Applicant's recited causing, based at least in part on the particular category, the first access to be rejected, at least in part [from claim 21], wherein the first access of the particular category comprises a write operation at least because paragraph 75 of Narayanaswamy does not tie the type of call (the write operation file system call) to rejection of the call. Instead, paragraph 79 of Narayanaswamy describes [0079] In response to receiving data egress requests, the endpoint policy enforcer 132 A retrieves the sensitivity meta data and enforces a data loss prevention policy at the endpoint, based on the retrieved sensitivity metadata and without performing content sensitivity scan of the document at the endpoint Common rules enforced by endpoint policy enforcer 132A include a rule that once a file has been deemed sensitive, it will remain sensitive for the life of the document. Such description of use of sensitivity metadata of a file does not correspond to Applicant's recited causing, based at least in part on the particular category, the first access to be rejected, at least in part [from claim 21], wherein the first access of the particular category comprises a write operation [claim 22] because the former uses sensitivity metadata of a file, instead. At least for reasons similar to those above for claim 22, the cited combination fails to teach or suggest the subject matter of claims 22, 29 and 36. Reconsideration and withdrawal of the rejection is respectfully requested.
Examiner respectfully disagrees. Regarding claim 21, Narayanaswamy discloses, paragraph 0034, 0101, 0104, 0007, 0075, a computer-implemented method, comprising, comprising: determining, based at least in part on a string associated with a data structure of an application, that accesses of one or more categories to the data structure are to be monitored preventing unauthorized access of sensitive data; decision about whether to monitor network traffic based on URLs and/or signature in a sensitivity list; URL found in sensitivity list based on string pattern matching; category directed parsers; structure of the file system, applications. Examiner notes that claiming one or more categories includes the case of a single category. The cited paragraphs include a teaching a category directed parsers which implies at least one category to be parsed. Narayanaswamy does not explicitly disclose detecting that a first access of a particular category of the one or more categories has been requested with respect to the data structure; and causing, based at least in part on the particular category, the first access to be rejected, at least in part. Abadi discloses, paragraphs 0050 and 0041, detecting that a first access of a particular category of the one or more categories has been requested with respect to the data structure by disclosing The request is dynamically analyzed in runtime according to a class and/or classification of the requesting process indicating one or more process characteristics; request to access one or more of the data items; paragraph 0072, causing, based at least in part on the particular category, the first access to be rejected, at least in part by disclosing As shown at 130, based on a class and/or classification of the process 250 compared to the characteristic(s) of the requested data item the analysis module 210 determines whether to grant or deny access of the process 250 to the requested data item. Examiner interprets class and category to correspond. Narayanaswamy, paragraph 0080, discloses multiple categories. Abadi, paragraph 0072, discloses class, classification, characteristics.
The Examiner respectfully suggests that the claim be further amended and details in the specification be incorporated to distinguish the claimed invention over prior art of record. Should the Applicant desire an interview to further clarify the claim interpretation/rejections, please contact the Examiner at (571) 272 5368 to schedule an interview.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP §§ 706.02(l)(1) - 706.02(l)(3) for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/process/file/efs/guidance/eTD-info-I.jsp.
Claims 21-35 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-20 of U.S. Patent No. 12,093414. Although the claims at issue are not identical, they are not patentably distinct from each other because all limitations recited in claims 21-35 of the instant application are encompassed by limitations recited in claims 1-20 of U.S. Patent No. 12,093,414 (see table below).
Instant Application 16/195,392
U.S. Patent No. 12,093,414
Claim 21:
21. A computer-implemented method, comprising:
determining, based at least in part on a string associated with a data structure of an application, that accesses of one or more categories to the data structure are to be monitored;
detecting that a first access of a particular category of the one or more categories has been requested with respect to the data structure; and
causing, based at least in part on the particular category, the first access to be rejected, at least in part.
Claim 6:
6. A method, comprising: performing, at one or more computing devices:
causing a respective memory access tracking agent to be configured at individual ones of one or more sources to track access requests originating from the individual sources directed to a set of target data structures classified as sensitive data structures comprising sensitive data associated with an application, wherein the classification is based at least in part on respective data structure names or other identifiers indicated in respective source code or executable code associated with the target data structures, wherein the respective memory access tracking agent comprises dynamically injected executable code injected into one or more programs associated with the application;
detecting, at a first memory access tracking agent of the respective memory tracking agents, an access request directed to a particular in-memory representation of a first target data structure of the set of indicated target data structures comprising the sensitive data, wherein the access request is detected at least in part using the dynamically injected executable code;
determining, by the first memory access tracking agent, run-time context information pertaining to the access request, wherein the run-time context information comprises at least a portion of a thread stack; and
causing respective indications of (a) the occurrence of the access request and (b) at least a portion of the obtained run-time context information to be provided to one or more destinations, wherein the portion of the obtained context information is transformed in accordance with a transformation descriptor obtained via a programmatic interface..
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 21-23, 28-30, and 35 are rejected under 35 U.S.C. 103 as being unpatentable over Narayanaswamy (US20190268379), filed May 9, 2019, in view of Abadi (US20170213049), filed January 26, 2016.
Regarding claim 21, Narayanaswamy discloses a computer-implemented method, comprising, comprising:
determining, based at least in part on a string associated with a data structure of an application, that accesses of one or more categories to the data structure are to be monitored (Narayanaswamy, paragraph 0034, preventing unauthorized access of sensitive data; paragraph 0101, decision about whether to monitor network traffic based on URLs and/or signature in a sensitivity list; paragraph 0104, URL found in sensitivity list based on string pattern matching; paragraph 0007, category directed parsers; paragraph 0075, structure of the file system, applications).
Narayanaswamy does not explicitly disclose detecting that a first access of a particular category of the one or more categories has been requested with respect to the data structure; and causing, based at least in part on the particular category, the first access to be rejected, at least in part.
However, in an analogous art, Abadi discloses detecting that a first access of a particular category of the one or more categories has been requested with respect to the data structure (Abadi, paragraph 0050, The request is dynamically analyzed in runtime according to a class and/or classification of the requesting process indicating one or more process characteristics; paragraph 0041, request to access one or more of the data items);
causing, based at least in part on the particular category, the first access to be rejected, at least in part (Abadi, paragraph 0072, As shown at 130, based on a class and/or classification of the process 250 compared to the characteristic(s) of the requested data item the analysis module 210 determines whether to grant or deny access of the process 250 to the requested data item).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Abadi with the computer-implemented method/ system/ one or more non-transitory computer-accessible storage media of Narayanaswamy to include detecting that a first access of a particular category of the one or more categories has been requested with respect to the data structure; and causing, based at least in part on the particular category, the first access to be rejected, at least in part to provide users with the benefits of dynamically analyzing a data flow to determine access rights to data items to address data security aspects (Abadi: paragraph 0001).
Regarding claim 22, Narayanaswamy and Abadi disclose the computer-implemented method as recited in claim 21. Narayanaswamy and Abadi disclose wherein the first access of the particular category comprises a write operation (Narayanaswamy, paragraph 0075, systems calls, requests, write operations).
Regarding claim 23, Narayanaswamy and Abadi disclose the computer-implemented method as recited in claim 21. Narayanaswamy and Abadi disclose wherein the string comprises at least a portion of a name of the data structure (Abadi, paragraph 0078, string represents the name of a field of requested data).
Regarding claim 28, Narayanaswamy discloses a system, comprising: one or more computing devices; wherein the one or more computing devices include instructions that upon execution on or across the one or more computing devices:(Narayanaswamy, paragraph 0120, memory, processor, storage, instructions)
determine, based at least in part on a string associated with a data structure of an application, that accesses of one or more categories to the data structure are to be monitored (Narayanaswamy, paragraph 0034, preventing unauthorized access of sensitive data; paragraph 0101, decision about whether to monitor network traffic based on URLs and/or signature in a sensitivity list; paragraph 0104, URL found in sensitivity list based on string pattern matching; paragraph 0007, category directed parsers; paragraph 0075, structure of the file system, applications).
Narayanaswamy does not explicitly disclose detect that a first access of a particular category of the one or more categories has been requested with respect to the data structure; and cause, based at least in part on the particular category, the first access to be rejected, at least in part.
However, in an analogous art, Abadi discloses detect that a first access of a particular category of the one or more categories has been requested with respect to the data structure (Abadi, paragraph 0050, The request is dynamically analyzed in runtime according to a class and/or classification of the requesting process indicating one or more process characteristics; paragraph 0041, request to access one or more of the data items);
cause, based at least in part on the particular category, the first access to be rejected, at least in part (Abadi, paragraph 0072, As shown at 130, based on a class and/or classification of the process 250 compared to the characteristic(s) of the requested data item the analysis module 210 determines whether to grant or deny access of the process 250 to the requested data item).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Abadi with the computer-implemented method/ system/ one or more non-transitory computer-accessible storage media of Narayanaswamy to include detect that a first access of a particular category of the one or more categories has been requested with respect to the data structure; and cause, based at least in part on the particular category, the first access to be rejected, at least in part to provide users with the benefits of dynamically analyzing a data flow to determine access rights to data items to address data security aspects (Abadi: paragraph 0001).
Regarding claim 29, Narayanaswamy and Abadi disclose the system as recited in claim 28. Narayanaswamy and Abadi disclose wherein the first access of the particular category comprises a write operation (Narayanaswamy, paragraph 0075, systems calls, requests, write operations).
Regarding claim 30, Narayanaswamy and Abadi disclose the system as recited in claim 28. Narayanaswamy and Abadi disclose wherein the string comprises at least a portion of a name of the data structure (Abadi, paragraph 0078, string represents the name of a field of requested data).
Regarding claim 35, Narayanaswamy discloses one or more non-transitory computer-accessible storage media storing program instructions that when executed on or across one or more processors (Narayanaswamy, paragraph 0120, memory, processor, storage, instructions);
determine, based at least in part on a string associated with a data structure of an application, that accesses of one or more categories to the data structure are to be monitored (Narayanaswamy, paragraph 0034, preventing unauthorized access of sensitive data; paragraph 0101, decision about whether to monitor network traffic based on URLs and/or signature in a sensitivity list; paragraph 0104, URL found in sensitivity list based on string pattern matching; paragraph 0007, category directed parsers; paragraph 0075, structure of the file system, applications).
Narayanaswamy does not explicitly disclose detect that a first access of a particular category of the one or more categories has been requested with respect to the data structure; and cause, based at least in part on the particular category, the first access to be rejected, at least in part.
However, in an analogous art, Abadi discloses detect that a first access of a particular category of the one or more categories has been requested with respect to the data structure (Abadi, paragraph 0050, The request is dynamically analyzed in runtime according to a class and/or classification of the requesting process indicating one or more process characteristics; paragraph 0041, request to access one or more of the data items);
cause, based at least in part on the particular category, the first access to be rejected, at least in part (Abadi, paragraph 0072, As shown at 130, based on a class and/or classification of the process 250 compared to the characteristic(s) of the requested data item the analysis module 210 determines whether to grant or deny access of the process 250 to the requested data item).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Abadi with the computer-implemented method/ system/ one or more non-transitory computer-accessible storage media of Narayanaswamy to include detect that a first access of a particular category of the one or more categories has been requested with respect to the data structure; and cause, based at least in part on the particular category, the first access to be rejected, at least in part to provide users with the benefits of dynamically analyzing a data flow to determine access rights to data items to address data security aspects (Abadi: paragraph 0001).
Claims 24 and 31 are rejected under 35 U.S.C. 103 as being unpatentable over Narayanaswamy (US20190268379), filed May 9, 2019, in view of Abadi (US20170213049), filed January 26, 2016, and further in view of Colvin (US2010042294), filed August 8, 2011.
Regarding claim 24, Narayanaswamy and Abadi disclose a computer-implemented method, comprising as recited in claim 21, comprising.
Narayanaswamy and Abadi do not explicitly disclose receiving, via one or more programmatic interfaces of a network-accessible service of a cloud computing environment, an indication of the string, wherein said detecting is performed at the network-accessible service.
However, in an analogous art, Colvin discloses receiving, via one or more programmatic interfaces of a network-accessible service of a cloud computing environment, an indication of the string, wherein said detecting is performed at the network-accessible service (Colvin, paragraph 0033, detect resource access, resource access reports to the reputation service, URL, paragraph 0032, cloud enabled application; paragraph 0050, network, service).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Colvin with the computer-implemented method/ system/ one or more non-transitory computer-accessible storage media of Narayanaswamy and Abadi to include receiving, via one or more programmatic interfaces of a network-accessible service of a cloud computing environment, an indication of the string, wherein said detecting is performed at the network-accessible service to provide users with the benefits of detecting malware through resource accesses (Colvin: abstract).
Regarding claim 31, Narayanaswamy and Abadi disclose a system as recited in claim 28, comprising.
Narayanaswamy and Abadi do not explicitly disclose wherein the one or more computing devices include further instructions that upon execution on or across the one or more computing devices: receive, via one or more programmatic interfaces of a network-accessible service of a cloud computing environment, an indication of the string, wherein detection that the first access has been requested is performed at the network-accessible service.
However, in an analogous art, Colvin discloses wherein the one or more computing devices include further instructions that upon execution on or across the one or more computing devices: receive, via one or more programmatic interfaces of a network-accessible service of a cloud computing environment, an indication of the string, wherein detection that the first access has been requested is performed at the network-accessible service (Colvin, paragraph 0033, detect resource access, resource access reports to the reputation service, URL, paragraph 0032, cloud enabled application; paragraph 0050, network, service).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Colvin with the computer-implemented method/ system/ one or more non-transitory computer-accessible storage media of Narayanaswamy and Abadi to include wherein the one or more computing devices include further instructions that upon execution on or across the one or more computing devices: receive, via one or more programmatic interfaces of a network-accessible service of a cloud computing environment, an indication of the string, wherein detection that the first access has been requested is performed at the network-accessible service to provide users with the benefits of detecting malware through resource accesses (Colvin: abstract).
Claims 25 and 32 are rejected under 35 U.S.C. 103 as being unpatentable over Narayanaswamy (US20190268379), filed May 9, 2019, in view of Abadi (US20170213049), filed January 26, 2016, and further in view of Stern (US20190182558), filed December 12, 2017.
Regarding claim 25, Narayanaswamy and Abadi disclose a computer-implemented method as recited in claim 21, further comprising.
Narayanaswamy and Abadi do not explicitly disclose receiving, via one or more programmatic interfaces of a network-accessible service of a cloud computing environment, an indication of a source from which accesses to one or more data structures of the application originate; and causing an access tracking agent to be configured at the source, wherein said detecting is performed at least in part by the access tracking agent.
However, in an analogous art, Stern discloses receiving, via one or more programmatic interfaces of a network-accessible service of a cloud computing environment, an indication of a source from which accesses to one or more data structures of the application originate; and causing an access tracking agent to be configured at the source, wherein said detecting is performed at least in part by the access tracking agent (Stern, paragraph 0035, accesses monitoring module, service configuration; paragraph 0036, configured, access monitoring module, paragraph 0043, URL, queues, interface).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Stern with the computer-implemented method/ system/ one or more non-transitory computer-accessible storage media of Narayanaswamy and Abadi to include receiving, via one or more programmatic interfaces of a network-accessible service of a cloud computing environment, an indication of a source from which accesses to one or more data structures of the application originate; and causing an access tracking agent to be configured at the source, wherein said detecting is performed at least in part by the access tracking agent to provide users with the benefits of conserving bandwidth by controlling access to resources (Stern: abstract).
Regarding claim 32, Narayanaswamy and Abadi disclose a system as recited in claim 28.
Narayanaswamy and Abadi do not explicitly disclose wherein the one or more computing devices include further instructions that upon execution on or across the one or more computing devices: receive, via one or more programmatic interfaces of a network-accessible service of a cloud computing environment, an indication of a source from which accesses to one or more data structures of the application originate; and cause an access tracking agent to be configured at the source, wherein detection that the first access has been requested is performed at least in part by the access tracking agent.
However, in an analogous art, Stern discloses wherein the one or more computing devices include further instructions that upon execution on or across the one or more computing devices: receive, via one or more programmatic interfaces of a network-accessible service of a cloud computing environment, an indication of a source from which accesses to one or more data structures of the application originate; and cause an access tracking agent to be configured at the source, wherein detection that the first access has been requested is performed at least in part by the access tracking agent (Stern, paragraph 0035, accesses monitoring module, service configuration; paragraph 0036, configured, access monitoring module, paragraph 0043, URL, queues, interface).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Stern with the computer-implemented method/ system/ one or more non-transitory computer-accessible storage media of Narayanaswamy and Abadi to include wherein the one or more computing devices include further instructions that upon execution on or across the one or more computing devices: receive, via one or more programmatic interfaces of a network-accessible service of a cloud computing environment, an indication of a source from which accesses to one or more data structures of the application originate; and cause an access tracking agent to be configured at the source, wherein detection that the first access has been requested is performed at least in part by the access tracking agent to provide users with the benefits of conserving bandwidth by controlling access to resources (Stern: abstract).
Claims 26, 27, 33, and 34 are rejected under 35 U.S.C. 103 as being unpatentable over Narayanaswamy (US20190268379), filed May 9, 2019, in view of Abadi (US20170213049), filed January 26, 2016, and further in view of Haupt (US20130263116), filed March 27, 2012.
Regarding claim 26, Narayanaswamy and Abadi disclose the. computer-implemented method as recited in claim 21, further comprising.
Narayanaswamy and Abadi do not explicitly disclose obtaining run-time context information pertaining to the first access; and causing at least a portion of the run-time context information to be presented via one or more programmatic interfaces.
However, in an analogous art, Haupt discloses obtaining run-time context information pertaining to the first access; and causing at least a portion of the run-time context information to be presented via one or more programmatic interfaces (Haupt, paragraph 0015, runtime environment, thread stack, resource map; paragraph 0023, runtime environment, executing thread, thread stack, paragraph 0048, programming language of the runtime environment provide an interface for interaction with native objects).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Stern with the computer-implemented method/ system/ one or more non-transitory computer-accessible storage media of Narayanaswamy and Abadi to include obtaining run-time context information pertaining to the first access; and causing at least a portion of the run-time context information to be presented via one or more programmatic interfaces to provide users with the benefits of resource (Haupt: abstract).
Regarding claim 27, Narayanaswamy, Abadi, and Haupt disclose the computer-implemented method as recited in claim 26. Narayanaswamy, Abadi, and Haupt disclose wherein the run-time context information comprises a thread stack (Haupt, paragraph 0015, runtime environment, thread stack, resource map; paragraph 0023, runtime environment, executing thread, thread stack, paragraph 0048, programming language of the runtime environment provide an interface for interaction with native objects).
Regarding claim 33, Narayanaswamy and Abadi disclose the. system as recited in claim 28.
Narayanaswamy and Abadi do not explicitly disclose wherein the one or more computing devices include further instructions that upon execution on or across the one or more computing devices: obtain run-time context information pertaining to the first access; and cause at least a portion of the run-time context information to be presented via one or more programmatic interfaces.
However, in an analogous art, Haupt discloses wherein the one or more computing devices include further instructions that upon execution on or across the one or more computing devices: obtain run-time context information pertaining to the first access; and cause at least a portion of the run-time context information to be presented via one or more programmatic interfaces (Haupt, paragraph 0015, runtime environment, thread stack, resource map; paragraph 0023, runtime environment, executing thread, thread stack, paragraph 0048, programming language of the runtime environment provide an interface for interaction with native objects).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Haupt with the computer-implemented method/ system/ one or more non-transitory computer-accessible storage media of Narayanaswamy and Abadi to include wherein the one or more computing devices include further instructions that upon execution on or across the one or more computing devices: obtain run-time context information pertaining to the first access; and cause at least a portion of the run-time context information to be presented via one or more programmatic interfaces to provide users with the benefits of resource (Haupt: abstract).
Regarding claim 34, Narayanaswamy, Abadi, and Haupt disclose the system as recited in claim 33. Narayanaswamy, Abadi, and Haupt disclose wherein the run-time context information comprises a thread stack (Haupt, paragraph 0015, runtime environment, thread stack, resource map; paragraph 0023, runtime environment, executing thread, thread stack, paragraph 0048, programming language of the runtime environment provide an interface for interaction with native objects).
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to WALTER J MALINOWSKI whose telephone number is (571)272-5368. The examiner can normally be reached 8-6:30 MTWH.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, LUU PHAM can be reached at 5712705002. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/W.J.M/Examiner, Art Unit 2439
/LUU T PHAM/Supervisory Patent Examiner, Art Unit 2439
Prosecution Insights