DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendments
This office action responds to the amendments filed on June 19, 2026 for application 18/876,981. Claim 48 is amended, and claims 30-49 remain pending in the application.
Response to Arguments
The Examiner has fully considered the Applicant’s arguments, and the Examiner responds as provided below.
Regarding the Applicant’s response at page 10 of the Remarks that concerns the objection to claim 49, the response is not persuasive. First, the Applicant’s reliance upon MPEP § 2173.05(p) is inapposite because the issue involving the objection is not indefiniteness under § 112(b) within a claim that incorporates both a product and process, i.e., the Examiner did not reject claim 49 under § 112(b) for indefiniteness. Rather, the attendant issue is the form of the claim, and more to the point, claim 49 represents a claim drafting effort that is pursued to brazenly avoid paying the fees for an additional independent claim. According to the Electronic Payment Receipt of December 19, 2024 and the Fee Worksheet of June 19, 2026, Applicant paid for one additional independent claim in excess of three, which encompasses independent claims 30 (method), 40 (method), 44 (first computing device), and 48 (second computing device). The preamble of claim 49 recites a “computer program product,” which is distinct from a method and device. In an effort to avoid the fee for this additional independent claim, Applicant devised an inappropriate means to lower the fees due to the Office.
Either Applicant values the protection afforded by claim 49 or not, and this different type of protection, which may be helpful to the Applicant in an infringement action, is not free. Thus, Applicant can either amend the claim as suggested by the Examiner and pay the Office for the additional independent claim, or cancel the claim.
Regarding the Applicant’s response at pages 10-14 of the Remarks that concerns the § 103 rejection of independent claims 30 and 44, the Applicant argues that “this method is carried out within the first tenant container….” Reply at 11 (emphasis retained). This argument fails, however, because it rests upon an inconsistency. Claim 30 recites, “securing a first tenant container executed by a first computing device, the method being performed within the first tenant container by the first computing device.” In order for the limitation of the claim to logically hold—i.e., the method is performed within the first tenant by the computing device—then the computing device must be within the first tenant container. If any portion of the method is performed by the computing device and the computing device is not within the container, then the limitation requiring the method to be performed within the container is inaccurate.
Applicant further argues that the Brajkovic does not adequately suggest the limitation of “detecting” and “enabled.” See id. at 12-13. Within patent law, a claim may be suggested even though the literal terms of the claim are not employed by reference. See MPEP § 2141(III) (stating “Prior art is not limited just to the references being applied, but includes the understanding of one of ordinary skill in the art. The prior art reference (or references when combined) need not teach or suggest all the claim limitations, however, Office personnel must explain why the difference(s) between the prior art and the claimed invention would have been obvious to one of ordinary skill in the art.”) Although Brajkovic fails to employ the literal terms of “detecting” and “enabled,” one skilled in the art would infer the existence of these claim limitations based upon the application probes within the application awareness system as taught by Brajkovic.
That being said, the Examiner acknowledges that the “additional reasons,” see Reply at 12-14, possess some merit. Depending upon the resolution of the “within” issue, which may lead to a clearer interpretation of the claim language, the Examiner may withdraw the rejection based upon any of the provided reasons.
With regard to independent claims 40 and 48, Applicant similarly argues “that the recited steps are performed within the second container.” Reply at 15. Again, an issue arises because the claim recites the method is performed within the container by the second computing device, yet the computing device hosts the container and cannot be within the container to perform the method.
Perhaps this issue can be resolved by reciting a computer device that executes computer instructions whose steps are performed within the container.
For the reasons provided above, the objection to the claim and the § 103 rejection are maintained.
Claim Objections
Claim 49 is objected to because of the following informalities: the claim is not in proper dependent form with the reference to claim 30. The reference to claim 30 should be removed and the specific limitations of claim 30 recited in the claim. Appropriate correction is required.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The following conventions apply to the mapping of the prior art to the claims:
Italicized text – claim language.
Parenthetical plain text – Examiner’s citation and explanation.
Citation without an explanation – an explanation has been previously provided for the respective limitation(s).
Quotation marks – language quoted from a prior art reference.
Underlining – language quoted from a claim.
Brackets – material altered from either a prior art reference or a claim, which includes the Examiner’s explanation that relates a claim limitation to the quoted material of a reference.
Braces – a limitation taught by another reference, but the limitation is presented with the mapping of the instant reference for context.
Numbered superscript – a first phrase to be moved upwards to the primary reference analysis.
Lettered superscript – a second phrase to be moved after the movement of the first phrase from which it was lifted, or more succinctly, move numbered material first, lettered material last.
A. Claims 30, 33-34, 40-44, and 47-49 are rejected under 35 U.S.C. 103 as being unpatentable over Brajkovic et al. (US 2018/0287897, “Brajkovic”) in view of Stoler (US 10,735,430, “Stoler”).
Regarding Claim 30
Brajkovic discloses
A method for…1 a first tenant container executed by a first computing device (Fig. 1, ¶¶ [0056]-[0057], “For example, a virtual entity may comprise a container. A container is a virtualized computer emulation that shares physical hardware resources [of a first computing device] and portions of an operating system with other containers.”; and ¶ [0197], “These distributed systems may be what are known as enterprise computing systems or, in some embodiments, may be ‘cloud’ [implementing tenant] computing systems.”),
the method being performed within the first tenant container by the first computing device (¶¶ [0056]-[0057]), the method comprising:
detecting whether a probe for collecting information related to the first tenant container is enabled within one or more processes being executed on the first computing device (Figs. 1 & 2, ¶¶ [0091]-[0093], “The system [including the first computing device] may further include an application program interface 220 to access probes and to run [enabled] probes. The probes may use multiple interfaces to collect information from the virtual entities…”);
upon detection that the probe for collecting the information related to the first tenant container is enabled (Figs. 1 & 2, ¶¶ [0091]-[0093]), generating information indicating that the probe is enabled on the first tenant container (¶¶ [0093]-[0094], “Each probe may transmit a specialized program instructions to a virtual entity that, when executed by a virtual entity, is configured to cause the virtual entity [container] to carry out actions to generate information about the application associated with the probe [indicating the probe is enabled on the first tenant container].”); and
in response to the detection (¶¶ [0093]-[0094]), performing one or more of:
transmitting the generated information indicating that the probe is enabled along with the information related to the first tenant container to a second tenant container (¶¶ [0056]-[0057], “For example, a virtual entity may comprise a container. A container is a virtualized computer emulation that shares physical hardware resources [of a first computing device] and portions of an operating system with other [second] containers.”; and “Each virtual entity may have a set of applications installed on it. Virtual entities may be accessed by users 138 using computers or other [first and second] devices (e.g. devices 140), which may be coupled, such as over a computer network, to the hardware resources on which the virtual entities [first and second containers] execute. The user may access the virtual entity over a network such as the Internet.”) or a second computing device, logging the detection of the probe, and modifying at least one functionality within the first tenant container (¶ [0100], “In another embodiment, the application discovery component 320 may remotely execute commands in order to cause the virtual entity [container] 310 to carry out actions [or functions, thereby modifying one functionality of the container].”).
Brajkovic doesn’t disclose
1 …securing…,
Stoler, however, discloses
1 …securing {a first tenant container executed by a first computing device} (Col. 18:60-19:5, “Examples may include changing the virtual instance parameters (e.g., flag settings, permissions, embedded credentials, etc.), changing the dependencies or access rights among two or more virtual instances, applying or modifying a security policy to the virtual instance, attempting to access a host system filesystem, attempting to write or modify data or applications running on the host system, etc.”),
Regarding the combination of Brajkovic and Stoler, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the container system of Brajkovic to arrive at the claimed invention. KSR establishes that a rationale for obviousness is proven by showing a “use of [a] known technique to improve similar devices in the same way.” See MPEP § 2143(I)(C).
To substantiate the conclusion of obviousness under this KSR rationale, the Examiner finds pursuant to MPEP § 2143(I)(C):
1) the prior art contained a base system, namely the container system of Brajkovic, upon which the claimed invention can be seen as an “improvement” through the use of a virtualization security feature;
2) the prior art contained a “comparable” system, namely the virtualization system of Stoler, that has been improved in the same way as the claimed invention through the virtualization security feature; and
3) one of ordinary skill in the art could have applied the known improvement technique of applying the virtualization security feature to the base container system of Brajkovic, and the results would have been predictable to one of ordinary skill in the art.
Regarding Claim 33
Brajkovic in view of Stoler (“Brajkovic-Stoler”) discloses the method of claim 30, and Brajkovic further discloses
wherein the step of detecting whether the probe is enabled within the one or more processes being executed on the first computing device for collecting the information related to the first tenant container (Figs. 1 & 2, ¶¶ [0091]-[0093]) comprises:
receiving a request for a probe status indicating whether the first tenant container is probed for collecting the information related to the first tenant container (¶¶ [0066]- [0068], “The application awareness system 110 may provide information for the virtual infrastructure management system 150 to use in carrying out one or more services [given a satisfactory probe status that enables collecting information]. Furthermore, the virtual infrastructure management system may request and retrieve information from the application awareness system [associated with the first container] 110.”); and
upon receiving the request, verifying whether the probe is detected as enabled within the one or more processes being executed on the first computing device (¶ [0131], “The probe may submit requests [upon detected as enabled] to retrieve data related to the application [process being executed on the first computing device] from various fields of a dataset. In one example, the queries may comprise database queries to retrieve data from fields of a database. In some embodiments, the probe(s) may transfer program instructions that, when executed by the virtual entity, cause the virtual entity to query databases in order to gather information about the application.”).
Regarding Claim 34
Brajkovic-Stoler discloses the method of claim 33, and Brajkovic further discloses
wherein the request for the probe status (¶¶ [0066]- [0068]) is received from one or more of:
the second tenant container residing in the first computing device;
a tenant container external to the first computing device (¶¶ [0132]-[0133], “The system probe(s) may retrieve information specifying a particular topology or structure of virtual entities [second container] on which a distributed [external to the first computing device] application is installed.”); and
the second computing device.
Regarding Independent Claim 40
Brajkovic discloses
A method for…1 a first tenant container, the method being performed within a second tenant container executed by a second computing device (Fig. 1, ¶¶ [0056]-[0057], “For example, a virtual entity may comprise a container. A container is a virtualized computer emulation that shares physical hardware resources [of a first computing device] and portions of an operating system with other [second] containers.”; “Each virtual entity may have a set of applications installed on it. Virtual entities may be accessed by users 138 using computers or other [first and second] devices (e.g. devices 140), which may be coupled, such as over a computer network, to the hardware resources on which the virtual entities [first and second containers] execute. The user may access the virtual entity over a network such as the Internet.” and ¶ [0197], “These distributed systems may be what are known as enterprise computing systems or, in some embodiments, may be ‘cloud’ [implementing tenant] computing systems.”), the method comprising:
transmitting a request to the first tenant container being executed on a first computing device for a probe status indicating whether the first tenant container is probed for collecting the information related to the first tenant container (¶¶ [0066]- [0068], “The application awareness system 110 may provide information for the virtual infrastructure management system 150 to use in carrying out one or more services. Furthermore, the virtual infrastructure management system may request and retrieve [collected] information from the application awareness system [associated with the first container executed on a first computing device] 110.”);
receiving, from the first tenant container, information indicating whether the probe is enabled on the first tenant container along with the information related to the first tenant container (¶¶ [0066]- [0068], “The application awareness system 110 may provide information for the virtual infrastructure management system 150 to use in carrying out one or more services. Furthermore, the virtual infrastructure management system may request and retrieve information [indicative that the probe was enabled on the first container] from the application awareness system 110.”); and
upon reception of the information indicating that the probe is enabled (¶¶ [0066]-[0067]), controlling transmission of information related to the second tenant container to the first tenant container (¶¶ [0066]-[0068], “In some embodiments, the virtual infrastructure management system 150 may carry out one or more services for the virtual infrastructure 130. The virtual infrastructure management system 150 may retrieve and send [transmit] data from entities [between the second container to the first container] in the virtual infrastructure 130 and also send and receive commands to and from entities in the virtual infrastructure 130.”).
Brajkovic doesn’t disclose
1 …securing…,
Stoler, however, discloses
1 …securing {a first tenant container} (Col. 18:60-19:5, “Examples may include changing the virtual instance parameters (e.g., flag settings, permissions, embedded credentials, etc.), changing the dependencies or access rights among two or more virtual instances, applying or modifying a security policy to the virtual instance, attempting to access a host system filesystem, attempting to write or modify data or applications running on the host system, etc.”),
Regarding the combination of Brajkovic and Stoler, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the container system of Brajkovic to arrive at the claimed invention. KSR establishes that a rationale for obviousness is proven by showing a “use of [a] known technique to improve similar devices in the same way.” See MPEP § 2143(I)(C).
To substantiate the conclusion of obviousness under this KSR rationale, the Examiner finds pursuant to MPEP § 2143(I)(C):
1) the prior art contained a base system, namely the container system of Brajkovic, upon which the claimed invention can be seen as an “improvement” through the use of a virtualization security feature;
2) the prior art contained a “comparable” system, namely the virtualization system of Stoler, that has been improved in the same way as the claimed invention through the virtualization security feature; and
3) one of ordinary skill in the art could have applied the known improvement technique of applying the virtualization security feature to the base container system of Brajkovic, and the results would have been predictable to one of ordinary skill in the art.
Regarding Claim 41
Brajkovic-Stoler discloses the method of claim 40, and Brajkovic further discloses
wherein the step of receiving the information indicating whether the probe is enabled on the first tenant container along with the information related to the first tenant container (Figs. 1 & 2, ¶¶ [0091]-[0093]) comprises:
receiving, from the first tenant container, an indication that one or more processes being executed on the first computing device are collecting the information related to the first tenant container in accordance with a filtering rule set (¶¶ [0066]-[0067], “In some embodiments, the application awareness system 110 may engage in different types of interactions with the virtual infrastructure 130. For instance, the application awareness system 110 may query [according to a filtering rule set] entities of the virtual infrastructure 130 to discover applications executing on them. Furthermore, the application awareness system 110 may search entities within virtual infrastructure 130 for traces of applications installed on the entities. Additionally, the application awareness system 110 may access entities within virtual infrastructure 130 to determine configuration [collected] information about applications that may be installed on the entities.”).
Regarding Claim 42
Brajkovic-Stoler discloses the method of claim 33, and Brajkovic further discloses
wherein the step of controlling transmission of the information related to the second tenant container (¶¶ [0066]-[0068]) comprises performing one or more of:
terminating transmission of the information related to the second tenant container to the first tenant container (Col. 19:22-34, “In operation 605 of process 600, and operation 705 of process 700, various types of control actions are possible. In some embodiments, a security policy may determine whether to perform a control action, and if so, what control action to apply. Examples of control actions include permitting or blocking [terminating] a virtual instance [and transmission to a container] to proceed from development into deployment, to be spun up, to be enrolled at a security server, to be configured or reconfigured, to have new or different dependencies with other virtual instances,...”);
rejecting the first tenant container as a receiver; and
delivering the information related to the first tenant container only to a secure environment within the first tenant container.
Regarding Claim 43
Brajkovic-Stoler discloses the method of claim 33, and Brajkovic further discloses
wherein the received information comprises one or more of:
an identity of the first computing device;
a geographical location of the first computing device;
a provider identity of the first computing device (¶ [0137], “Program instructions 1522, when executed, further cause the virtual entity to retrieve a host and a role of each virtual entity for the Microsoft SharePoint installation. The pseudo code 1520 may further include program instructions 1524 that cause the virtual entity [container] to output the acquired [generated] information which includes the virtual entities along with their corresponding hosts [provider entity] and roles. A probe may retrieve the outputted information for storing and additional processing.”);
information about a central processing unit, CPU of the first computing device;
information about a kernel of the first computing device; and
information about available drives of the first computing device.
Regarding Independent Claim 44 and Dependent Claim 47
With respect to claims 44 and 47, a corresponding reasoning as given earlier for independent claim 30 and dependent claim 33 applies, mutatis mutandis, to the subject matter of claims 44 and 47, respectively. Therefore, claims 44 and 47 are rejected, for similar reasons, under the grounds set forth for claims 30 and 33.
Regarding Claim 48
With respect to claim 48, a corresponding reasoning as given earlier for independent claim 40 applies, mutatis mutandis, to the subject matter of claim 48. Therefore, claim 48 is rejected, for similar reasons, under the grounds set forth for claim 40.
Regarding Claim 49
With respect to claim 49, a corresponding reasoning as given earlier for independent claim 30 applies, mutatis mutandis, to the subject matter of claim 49. Therefore, claim 49 is rejected, for similar reasons, under the grounds set forth for claim 30.
B. Claims 31, 38-39, and 45 are rejected under 35 U.S.C. 103 as being unpatentable over Brajkovic in view of Stoler, and further in view of Beckwith et al. (US 2014/0096270, “Beckwith”).
Regarding Claim 31
Brajkovic-Stoler discloses the method of claim 30, and Brajkovic further discloses
further comprising:
1 …the generated information indicating that the probe is enabled along with the information related to the first tenant container (Figs. 1 & 2, ¶¶ [0091]-[0093]).
Brajkovic-Stoler doesn’t disclose
1 encrypting…
Beckwith, however, discloses
1 encrypting {information}… (¶ [0026], “Various security measures are employed in configuring the computing devices [possessing a container] 100 a-b to communicate with each other. With the computing devices 100 a-b communicating through the network 999, encryption, virtual private network channels and/or other techniques may be employed to enable communications therebetween that protect whatever information is conveyed.”)
Regarding the combination of Brajkovic-Stoler and Beckwith, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the container system of Brajkovic-Stoler to arrive at the claimed invention. KSR establishes that a rationale for obviousness is proven by showing a “use of [a] known technique to improve similar devices in the same way.” See MPEP § 2143(I)(C).
To substantiate the conclusion of obviousness under this KSR rationale, the Examiner finds pursuant to MPEP § 2143(I)(C):
1) the prior art contained a base system, namely the container system of Brajkovic-Stoler, upon which the claimed invention can be seen as an “improvement” through the use of a virtualization security feature;
2) the prior art contained a “comparable” system, namely the virtualization system of Stoler, that has been improved in the same way as the claimed invention through the virtualization security feature; and
3) one of ordinary skill in the art could have applied the known improvement technique of applying the virtualization security feature to the base container system of Brajkovic-Stoler, and the results would have been predictable to one of ordinary skill in the art.
Regarding Claim 38
Brajkovic in view of Stoler, and further in view of Beckwith (“Brajkovic-Stoler-Beckwith”) discloses the method of claim 31, and Brajkovic further discloses
wherein the generated information (¶¶ [0093]-[0094]) comprises one or more of:
an identity of the first computing device;
a geographical location of the first computing device;
a provider identity of the first computing device (¶ [0137], “Program instructions 1522, when executed, further cause the virtual entity to retrieve a host and a role of each virtual entity for the Microsoft SharePoint installation. The pseudo code 1520 may further include program instructions 1524 that cause the virtual entity [container] to output the acquired [generated] information which includes the virtual entities along with their corresponding hosts [provider entity] and roles. A probe may retrieve the outputted information for storing and additional processing.”);
information about a central processing unit, CPU of the first computing device;
information about a kernel of the first computing device;
information about available drives of the first computing device; and
information about a result of identifying whether the at least one file belonging to the first tenant container is being accessed by the process external to the first tenant container.
Regarding Claim 39
Brajkovic-Stoler-Beckwith discloses the method of claim 31, and Brajkovic further discloses
further comprising:
performing one or more of:
aborting transmission of the information from the first tenant container;
transmitting only specific or at least some of the information related to the first tenant container;
transmitting an indication that the first tenant container is probed for collection of the information by the one or more processes executed by the first computing device (Fig. 7, ¶¶ [0140]-[0141], “In some embodiments, the application probe may retrieve information from a virtual entity [executed by the first computing device]. The application probe may, for example, transfer program instructions to the virtual entity that, when executed by the virtual entity, cause the virtual entity to transfer [transmit] the [collected] information to the application awareness system.”);
aborting execution of one or more functions and/or libraries of the first tenant container when the probe is enabled; and
transmitting an indication to indicate that the one or more functions of the first tenant container to be moved to second computing device.
Regarding Dependent Claim 45
With respect to claim 45, a corresponding reasoning as given earlier for dependent claim 31 applies, mutatis mutandis, to the subject matter of claim 45. Therefore, claim 45 is rejected, for similar reasons, under the grounds set forth for claim 31.
C. Claims 32 and 46 are rejected under 35 U.S.C. 103 as being unpatentable over Brajkovic in view of Stoler and Beckwith, and further in view of Metsch et al. (US 2022/0124009, “Metsch”).
Regarding Claim 32
Brajkovic-Stoler-Beckwith discloses the method of claim 31, and Beckwith further discloses
further comprising:
transmitting the information for execution of the encryption…1 (¶ [0026]).
Regarding the combination of Brajkovic-Stoler and Beckwith, the rationale to combine is the same as provided for claim 31 due to the overlapping subject matter of claims 31 and 32.
Brajkovic-Stoler-Beckwith doesn’t disclose
1 …in a secure environment before transmission.
Metsch, however, discloses
1 …in a secure environment before transmission (¶¶ [0057]-[0059], “In further examples, an Edge computing system is extended to provide for orchestration of multiple applications through the use of containers (a contained, deployable unit of software that provides code and needed dependencies) in a multi-owner, multi-tenant environment. A multi-tenant orchestrator may be used to perform key management, trust anchor management, and other security functions [in a secure environment] related to the provisioning and lifecycle of the trusted ‘slice’ concept in FIG. 4.”).
Regarding the combination of Brajkovic-Stoler-Beckwith and Metsch, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the container system of Brajkovic-Stoler-Beckwith to arrive at the claimed invention. KSR establishes that a rationale for obviousness is proven by showing a “use of [a] known technique to improve similar devices in the same way.” See MPEP § 2143(I)(C).
To substantiate the conclusion of obviousness under this KSR rationale, the Examiner finds pursuant to MPEP § 2143(I)(C):
1) the prior art contained a base system, namely the container system of Brajkovic-Stoler-Beckwith, upon which the claimed invention can be seen as an “improvement” through the use of a secure environment feature;
2) the prior art contained a “comparable” system, namely the platform system of Metsch, that has been improved in the same way as the claimed invention through the secure environment feature; and
3) one of ordinary skill in the art could have applied the known improvement technique of applying the secure environment feature to the base container system of Brajkovic-Stoler-Beckwith, and the results would have been predictable to one of ordinary skill in the art.
Regarding Dependent Claim 46
With respect to claim 46, a corresponding reasoning as given earlier for dependent claim 32 applies, mutatis mutandis, to the subject matter of claim 46. Therefore, claim 46 is rejected, for similar reasons, under the grounds set forth for claim 32.
D. Claims 35-37 are rejected under 35 U.S.C. 103 as being unpatentable over Brajkovic in view of Stoler and Beckwith, and further in view of Leenstra et al. (US 2021/0232693, “Leenstra”).
Regarding Claim 35
Brajkovic-Stoler-Beckwith discloses the method of claim 31, and Brajkovic further discloses
wherein the step of detecting whether the probe is enabled within the one or more processes being executed on the first computing device (Figs. 1 & 2, ¶¶ [0091]-[0093]) comprises:
1 …; and
2 ….
Brajkovic-Stoler-Beckwith doesn’t disclose
1 monitoring one or more libraries of the first tenant container;
2 identifying whether one or more libraries of the first tenant container are being accessed from outside of the first tenant container.
Leenstra, however, discloses
1 monitoring one or more libraries of the first tenant container (Figs. 1A & 1B, ¶¶ [0056]-[0058], “In contrast, secure containers 180N includes a secure version of the application and a secure library operation system. As used herein the secure version of the application and a secure library operation system of secure containers 180N have a higher level of security when compared to the versions of the application and library operation system found in containers 180A and containers 180B. The container manager 170 may for example be Docker or LXC. A [first and second] container of the containers 180A-N may be created using the container manager [for monitoring] 170. A container may for example comprise an application and required libraries. The secure containers 180N may comprise a secure application that can perform secure library calls for accessing data in the first and second memory components.”); and
2 identifying whether one or more libraries of the first tenant container are being accessed from outside of the first tenant container (Figs. 1A & 1B, ¶¶ [0056]-[0058], “In contrast, secure containers 180N includes a secure version of the application and a secure library operation system. As used herein the secure version of the application and a secure library operation system of secure containers 180N have a higher level of security when compared to the versions of the application and library operation system found in containers 180A and containers 180B. The container manager 170 may for example be Docker or LXC. A container of the containers 180A-N may be created using the container manager 170. A container may for example comprise an application and required libraries. The secure containers 180N may comprise a secure application that can perform secure library calls for accessing data in the first and second [outside of the first tenant container] memory components.”).
Regarding the combination of Brajkovic-Stoler-Beckwith and Leenstra, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the container system of Brajkovic-Stoler-Beckwith to arrive at the claimed invention. KSR establishes that a rationale for obviousness is proven by showing a “use of [a] known technique to improve similar devices in the same way.” See MPEP § 2143(I)(C).
To substantiate the conclusion of obviousness under this KSR rationale, the Examiner finds pursuant to MPEP § 2143(I)(C):
1) the prior art contained a base system, namely the container system of Brajkovic-Stoler-Beckwith, upon which the claimed invention can be seen as an “improvement” through the use of a library feature;
2) the prior art contained a “comparable” system, namely the virtualization system of Leenstra, that has been improved in the same way as the claimed invention through the library feature; and
3) one of ordinary skill in the art could have applied the known improvement technique of applying the library feature to the base container system of Brajkovic-Stoler-Beckwith, and the results would have been predictable to one of ordinary skill in the art.
Regarding Claim 36
Brajkovic-Stoler-Beckwith discloses the method of claim 31, and Brajkovic further discloses
wherein the step of detecting whether the probe is enabled within the one or more processes being executed on the first computing device (Figs. 1 & 2, ¶¶ [0091]-[0093]) comprises:
1 ….
Leenstra further discloses
1 identifying whether at least one file belonging to the first tenant container is being accessed by a process external to the first tenant container (Figs. 3B & 3C, ¶¶ [0070]-[0071], “A first memory component (herein called normal memory 310A) of process-based virtualization system [first container] 100 comprises an encrypted secure application [file] and a secure library operating system 302, a VM 150, which may include a docker engine, a guest OS 160, and secure containers in encrypted format.”; and “In step 303, the firmware 120 [identifies and] moves the encrypted secure application [file] into the second [external] memory component [container].”).
Regarding the combination of Brajkovic-Stoler-Beckwith and Leenstra, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the container system of Brajkovic-Stoler-Beckwith to arrive at the claimed invention. KSR establishes that a rationale for obviousness is proven by showing a “use of [a] known technique to improve similar devices in the same way.” See MPEP § 2143(I)(C).
To substantiate the conclusion of obviousness under this KSR rationale, the Examiner finds pursuant to MPEP § 2143(I)(C):
1) the prior art contained a base system, namely the container system of Brajkovic-Stoler-Beckwith, upon which the claimed invention can be seen as an “improvement” through the use of a file feature;
2) the prior art contained a “comparable” system, namely the virtualization system of Leenstra, that has been improved in the same way as the claimed invention through the file feature; and
3) one of ordinary skill in the art could have applied the known improvement technique of applying the file feature to the base container system of Brajkovic-Stoler-Beckwith, and the results would have been predictable to one of ordinary skill in the art.
Regarding Claim 37
Brajkovic-Stoler-Beckwith-Leenstra discloses the method of claim 36, and Leenstra further discloses
wherein the at least one file comprises one or more of: a cryptographic key, and a filtering rule set (Figs. 3B & 3C, ¶¶ [0070]-[0071], “In step 303, the firmware 120 moves the encrypted [using a cryptographic key] secure application [file] into the second memory component.”; and “The integrity check may be performed using a hash [implementing a filtering rule set between valid and invalid] associated with the unencrypted content of the secure application e.g. to make sure that nothing has been changed in the code (e.g. a bit is flipped).”).
Regarding the combination of Brajkovic-Stoler-Beckwith and Leenstra, the rationale to combine is the same as provided for claim 36 due to the overlapping subject matter of claims 36 and 37.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to D'ARCY WINSTON STRAUB whose telephone number is (303)297-4405. The examiner can normally be reached Monday-Friday 9:00-5:00 Mountain Time.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, WILLIAM KORZUCH can be reached at (571)272-7589. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/D'Arcy Winston Straub/Primary Examiner, Art Unit 2491
Prosecution Insights