DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claim(s) 1 – 15 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Kosaka, publication number: US 2020/0218798.
As per claims 1 and 15, Kosaka teaches a method for dynamic integrity-monitoring of a container runtime environment executed on a host computer, wherein in the container runtime environment at least one container instance is executed and is managed by as an orchestration device, the method comprising: in the orchestration device (policy container 470, [0064][0121]);
creating, in a course of starting of the at least one container instance in the container runtime environment by the orchestration device, an instance-specific integrity rule concerning at least one resource of the host computer that has been allotted for a purpose of executing the least one container instance (generating security policy after container initiation, [0123-0126]);
adding the instance-specific integrity rule to a host-computer-specific integrity guideline which comprises an instance-specific integrity rule for each container instance already being executed in the container runtime environment of the host computer and which is arranged in the orchestration device (periodic updates, [0076]);
communicating the host-computer-specific integrity guideline to the host computer, in the host computer (loading security policy, [0127]);
checking the resources allocated on the host computer by container instances against the host-computer-specific integrity guideline (checking performed actions, [0127]); and
outputting an alarm message if a violation of the host-computer-specific integrity guideline was ascertained in the course of the checking (sending alerts, [0083][0086]).
As per claim 2, Kosaka teaches further comprising: receiving a notification in the orchestration device if one of the container instances on the host computer is terminated; and communicating a host-computer-specific integrity guideline, updated with respect to the notification, to the host computer (Security policy based on container initiation, [0123]).
As per claim 3, Kosaka teaches wherein the host-computer-specific integrity guideline is updated if an event that changes the composition and/or configuration of the container instances on the host computer is detected in the orchestration device, and the updated host-computer-specific integrity guideline is communicated to the host computer (Periodic updates, [0076]).
As per claim 4, Kosaka teaches wherein the event is: a failure of a container instance on the host computer, starting of a new container instance on the host computer, updating of the container instance in accordance with an amended container image, and/or detection of an application crash and restart of affected container instances on the host computer (Based on initiation, [0123-0126]).
As per claim 5, Kosaka teaches wherein the instance-specific integrity rule is created in a manner depending on information relating to a container image from which the at least one container instance is constructed (Generating security policy, [0126]).
As per claim 6, Kosaka teaches wherein the instance-specific integrity rule is created in a manner depending on information from an item of provisioning information that specifies the configuration of the at least one container instance at a start of the at least one container instance in the respective container runtime environment (Generating security policy, [0126]).
As per claim 7, Kosaka teaches wherein the host-computer-specific integrity guideline and/or the individual instance-specific integrity rules contained therein is/are protected by a digital signature of the orchestration device (Encryption, [0114]).
As per claim 8, Kosaka teaches wherein the checking of the host-computer-specific integrity guideline concerns the resources of a file system allocated to the container instances, and/or concerns network-connection resources and/or process resources (resource usage, [0039][0069][0074]).
As per claim 9, Kosaka teaches wherein the checking of at least a part of the host-computer-specific integrity guideline is carried out outside the host computer (management container 455, [0119]).
As per claim 10, Kosaka teaches wherein the alarm message is forwarded to a central alarm-triggering device-, and alarm actions are executed by the alarm-triggering device in accordance with an alarm-triggering guideline (Alerts, [0083][0085]).
As per claim 11, Kosaka teaches wherein the host-computer-specific integrity guideline has a predetermined maximum period of validity, and/or the host-computer-specific integrity guideline is updated at cyclic time intervals (periodic updates, [0076]).
As per claim 12, Kosaka teaches a system for dynamic integrity-monitoring of a container runtime environment executed on a host computer, wherein in the container runtime environment at least one container instance is executed and is managed by an orchestration device, the system comprising:
the orchestration device, including an integrity unit (policy container 470 and security container 450, [0121-0122]) which is configured:
to create, in a course of the starting of a container instance in the container runtime environment by the orchestration device, an instance-specific integrity rule concerning at least one resource of the host computer that has been allotted for a purpose of executing the container instance (Generating security policy after container initiation, [0123-0126]); and
to add the instance-specific integrity rule to a host-computer-specific integrity guideline which comprises an instance-specific integrity rule for each container instance already being executed in the container runtime environment of the host computer and which is arranged in the orchestration device (periodic updates, [0076]); and
an orchestration interface which is configured to communicate the host-computer-specific integrity guideline to the host computer (loading security policy, [0127]); and the host computer, including a container runtime environment; and also
a receiving unit which is configured to receive a host-computer-specific integrity guideline (loading security policy, [0127]),
an integrity-detection unit which is configured to check resources allocated to at the least one container instance against the host-computer-specific integrity guideline (Checking performed actions, [0127]); and
an output unit which is configured to output an alarm message if a violation of the host-computer-specific integrity guideline was ascertained in a course of the checking (Alerting, [0083][0086]).
As per claim 13, Kosaka teaches a host computer comprising: a container runtime environment:
a receiving unit which is configured to receive a host-computer-specific integrity guideline (policy container 470 [0064][0122]);
an integrity-detection unit which is configured to check resources allocated to at least one container instance against the host-computer-specific integrity guideline (checking actions, [0127]); and
an output unit which is configured to output an alarm message if a violation of the host-computer-specific integrity guideline was ascertained in a course of the checking (Sending alerts, [0083][0086]).
As per claim 14, Kosaka teaches an orchestration device comprising: an integrity unit which is configured:
to create, in a course of the starting of a container instance in the container runtime environment by the orchestration device, an instance-specific integrity rule concerning at least one resource of the host computer that has been allotted for the purpose of executing the container instance (Generating security policy after container initiation, [0123-126]); and
to add the instance-specific integrity rule to a host-computer-specific integrity guideline which comprises an instance-specific integrity rule for each container instance already being executed in the container runtime environment of the host computer and which is arranged in the orchestration device (periodic updates, [0076]); and
an orchestration interface which is configured to communicate the host-computer-specific integrity guideline to the host computer (loading security policy, [0127]).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to OLUGBENGA O IDOWU whose telephone number is (571)270-1450. The examiner can normally be reached Monday-Friday 8am - 5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jung Kim can be reached at 5712723804. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/OLUGBENGA O IDOWU/Primary Examiner, Art Unit 2494