Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on September 2, 2026 has been entered.
Claims 1, 2, 11, 12, 17, and 18 have been amended.
Claims 3, 8, 13, and 20 have been cancelled.
Claims 1, 2, 4-7, 9-12, and 14-19 are pending.
Response to Arguments
Applicant’s arguments filed on September 2, 2026, have been considered.
With respect to arguments that none of the cited references teach amended claim 1, this argument is moot in view of the new grounds for rejection.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
Claims 12, 14, 15, 18, and 19 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claims 12 and 18 recite the feature "send the generated secure key to first and second side-car modules" which is indefinite since we don't know if it is the same first and second side-car modules as stated in claims 11 and 17. This feature is interpreted as reciting “send the generated secure key to the first and second side-car modules.” Claims 14 and 15 depend on claim 12 and claim 19 depends on claim 18, therefore they inherit this rejection.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1, 9, 11, 15, and 17 is/are rejected under 35 U.S.C. 103 as being unpatentable over Nichols (US 10642593 B2, hereinafter referred to as Nichols) in view of Mestery (US 10764244 B1, hereinafter referred to as Mestery) in further view of Kong (CN 113760454 A, hereinafter referred to as Kong).
Regarding claim 1, Nichols discloses: A [secure] application migration system (Nichols: [Col 2 lines 43-44], [Col 2 lines 51-53], and [Col 6 lines 57-58]. [Col 2 lines 43-44] states, "FIG. 1 is a block diagram of an exemplary network environment 100 that includes a server or a cloud server 102." [Col 2 lines 51-53] states, "The clients 114-1 and 114-2 (collectively referred to as clients 114) can include one or more computing devices or systems." [Col 6 lines 57-58] states, "FIG. 2 illustrates an exemplary method 200 for logical migration of applications and data.") comprising: a computing environment comprising a plurality of computing devices (Nichols: [Col 2 lines 43-44], [Col 2 lines 51-53], and [Col 6 lines 57-58]. [Col 2 lines 43-44] states, "FIG. 1 is a block diagram of an exemplary network environment 100 that includes a server or a cloud server 102." [Col 2 lines 51-53] states, "The clients 114-1 and 114-2 (collectively referred to as clients 114) can include one or more computing devices or systems." [Col 6 lines 57-58] states, "FIG. 2 illustrates an exemplary method 200 for logical migration of applications and data."), but fails to explicitly disclose: A secure application migration system.
However, in the same field of endeavor, Mestery discloses: A secure application migration system (Mestery: [Col 4 lines 13-16] and [col 18 lines 48-40]. [Col 4 lines 13-16] states, "Containers are a lightweight, efficient and standard way for applications to move between different environments (e.g., an on-premises site, a remote site, etc.) and run independently." [col 18 lines 48-40] mentions, "A server or system for enabling end-to-end secured connectivity and global reachability in a constellation of microservices.").
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to modify the teaching of Nichols and include the above limitation with the teaching of Mestery in order to secure the migration between two computing devices.
This motivation applies to the remainder of the claim.
Nichols further discloses: and an Information Handling System (IHS) comprising at least one memory coupled to at least one processor, the at least one memory having program instructions stored thereon that, upon execution by the at least one processor (Nichols: [Col 8 lines 61-67, Col 9 lines 1-2] states that "FIG. 4 shows an exemplary computing device 400 implemented as the cloud server 102 suitable as an environment for practicing aspects of the subject matter, for example to upload software into software/applications library component 104. The components of cloud server 102 can include, but are not limited to, a processing unit 402, a system memory 404, and a system bus 406 that couples various system components including the system memory 404 to the processing unit 402." [Col 9 lines 51-54] states, "RAM 410 typically contains data and/or program modules that are immediately accessible to and/or presently being operated on by processing unit 402." Examiner's note: any computing system is an IHS.), cause the IHS to: receive a request to migrate an application from a first of the computing devices to a second of the computing devices (Nichols: [col 5 lines 37 and 38] states that "receive a request for the migration of the applications and data from the client 114-1."), but fails to explicitly disclose: deploy a first side-car module on the first computing device and a second side-car module on the second computing device, the first side-car module and the second side-car module stored in and deployed from a utility that is stored in the computing environment of the plurality of computing devices.
However, Mestery further discloses: deploy a first side-car module on the first computing device and a second side-car module on the second computing device, the first side-car module and the second side-car module stored in and deployed from a utility that is stored in the computing environment of the plurality of computing devices (Mestery: Col 5 lines 12-15 states, "The orchestrator may also integrate with platforms such as open-source systems for automating the deployment and management of containerized applications." Col 8 lines 20-25 state, "The endpoints 130 can include general purpose computing devices (e.g., servers, workstations, desktop computers, etc.), mobile computing devices (e.g., laptops, tablets, mobile phones, etc.), wearable devices (e.g., watches, glasses or other head-mounted displays (HMDs), ear devices, etc.), and so forth." Col 8 lines 43-44 state, "Any endpoint can be configured with an agent or a sidecar proxy." Col 12 lines 53-57 states, "To provide connectivity to microservice workloads in a heterogeneous environment, this disclosure focuses on a solution in which an agent or a sidecar proxy is deployed with, within or close to microservice workloads." Col 12 lines 59-61 states, "Agents can have different form factors depending on the microservice deployment type such as whether it is a container, virtual machine, or bare metal." Col 21 lines 8-10 states, "The memory 606 could also hold various software containers and virtualized execution environments and data."), but fails to explicitly disclose: generate a secure key using a current timestamp.
However, in the same field of endeavor, Kong discloses: generate a secure key using a current timestamp (Kong: Paragraph [0049] states, "obtaining a timestamp of the snapshot, encrypting the snapshot data based on the timestamp, and sending the timestamp and the encrypted snapshot data together to the new cloud platform." Paragraph [0050] states, "generating a decryption key based on the timestamp, decrypting the snapshot data based on the decryption key.").
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to modify the teaching of Nichols as modified by Mestery and include the above limitation with the teaching of Kong in order to ensure "that application data is not damaged or lost" (Kong: Paragraph [0005]).
Mestery further discloses: Establish, using the secure key, a secure communication tunnel with the first and second side-car modules (Mestery: [Col 16 lines 51-54] states that "the table shown in FIG. 5C can be accessed for determining whether each individual tunnel between two respective endpoints should be direct or indirect." [Col 17 lines 14-16] states, "Once a connection is been established between two agents, an encrypted tunnel is set up and the peers authorized using a certificate." [Col 11 lines 13-20] states that "the sidecar proxy 324a of the container 330a may handle communication of the service instance 328a with the service instance 328b of the container 330b. The sidecar proxies 324a-c can also support capabilities such as discovery of service instances, load balancing, authentication and authorization, secure communications, etc., in the service mesh 302." Examiner's note: it is shown in fig. 3 that the containers are connected to each other and each container has a sidecar proxy.).
Nichols further discloses: and using the [secure] tunnel, migrate the application from the first computing device to the second computing device (Nichols: Col 5 lines 17-23 states, "The system configurator component 108 can include a processing unit (not shown) that acts as a control unit for application installation system of the network environment 100. The application installation system is a process of migrating the applications and data (e.g., requested settings and customizations) by the cloud server 102 to the target computing device such as the client 114-2." Examiner's note: Mestery teaches a secure communication tunnel.), but fails to explicitly disclose: using the secure tunnel.
However, Mestery further discloses: using the secure tunnel (Mestery: [Col 4 lines 13-16] and [col 18 lines 48-40]. [Col 4 lines 13-16] states, "Containers are a lightweight, efficient and standard way for applications to move between different environments (e.g., an on-premises site, a remote site, etc.) and run independently." [col 18 lines 48-40] mentions, "A server or system for enabling end-to-end secured connectivity and global reachability in a constellation of microservices.").
Regarding claim 9, the combination of Nichols as modified by Mestery and Kong discloses: The secure application migration system of claim 1.
Mestery further discloses: wherein the program instructions, upon execution, further cause IHS to continually update the program instruction at ongoing intervals (Mestery: Col 5 lines 18-22 state that "features and updates to a microservice may be delivered to the service mesh, sometimes in a rapid and incremental fashion, such that newer versions of microservices may be continually integrated into the cloud-native platform.").
The same motivation to modify with Mestery, as in claim 1, applies.
Claim 11 recites features similar to those in claim 1, therefore they are rejected in a similar manner.
Claim 15 recites features similar to those in claim 9, therefore they are rejected in a similar manner.
Claim 17 recites features similar to those in claim 1, therefore they are rejected in a similar manner.
Claim(s) 2, 10, 12, 16, and 18 is/are rejected under 35 U.S.C. 103 as being unpatentable over Nichols (US 10642593 B2, hereinafter referred to as Nichols) in view of Mestery (US 10764244 B1, hereinafter referred to as Mestery) in further view of Kong (CN 113760454 A, hereinafter referred to as Kong) in further view of Guim (DE 112020000054 T5, hereinafter referred to as Guim).
Regarding claim 2, The combination of Nichols as modified by Mestery and Kong discloses: The secure application migration system of claim 1, but fails to disclose: wherein the program instructions, upon execution, further cause the IHS to establish the secure tunnel, generate the secure key and send the generated secure key to the first and second side-car modules.
However, in the same field of endeavor, Guim discloses: wherein the program instructions, upon execution, further cause the IHS [to establish the secure tunnel], generate the secure key and send the generated secure key to the first and second side-car modules (Guim: Paragraph [0075] and Paragraph [0633]. Paragraph [0075] states that "sidecars can provide trustworthy execution environments for the support of security functions such as generation, storage and use of cryptographic keys." Paragraph [0633] states, "Using an asymmetric secure link, the temporal private key is sent to the devices so that the devices can securely read from and write to a buffer location in the edge base station using the symmetric key. Using the symmetric key, secure access to mass storage, main memory, functions and other resources of the edge base station can be provided, which the respective devices can access. Such an approach can be widely applicable to device-to-device and node-to-node communication environments.").
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to modify the teaching of Nichols as modified by Mestery and Kong and include the above limitation with the teaching of Guim in order to ensure that computing devices "belong to or are linked to the same tenant and consent to a connection," and authentication and a secure communication are carried out. (Guim: Paragraph [0633]).
Guim does not explicitly disclose: to establish the secure tunnel.
However, Mestery discloses: to establish the secure tunnel (Mestery: [Col 16 lines 51-54] states that "the table shown in FIG. 5C can be accessed for determining whether each individual tunnel between two respective endpoints should be direct or indirect." [Col 17 lines 14-16] states, "Once a connection is been established between two agents, an encrypted tunnel is set up and the peers authorized using a certificate." [Col 11 lines 13-20] states that "the sidecar proxy 324a of the container 330a may handle communication of the service instance 328a with the service instance 328b of the container 330b. The sidecar proxies 324a-c can also support capabilities such as discovery of service instances, load balancing, authentication and authorization, secure communications, etc., in the service mesh 302." Examiner's note: it is shown in fig. 3 that the containers are connected to each other and each container has a sidecar proxy.).
The same motivation to modify with Mestery, as in claim 1, applies.
Regarding claim 10, the combination of Nichols as modified by Mestery and Kong discloses: The secure application migration system of claim 1, but fails to explicitly disclose: wherein the program instructions, upon execution, further cause IHS to send data associated with the migration to a machine learning (ML) process, wherein the ML process is configured to perform analytics on the data to learn how to improve ensuing migrations.
However, in the same field of endeavor, Guim discloses: wherein the program instructions, upon execution, further cause IHS to send data associated with the migration to a machine learning (ML) process, wherein the ML process is configured to perform analytics on the data to learn how to improve ensuing migrations (Guim: Paragraph [0352] states that "The method includes a third operation to determine based on the available resources of the second edge location at the first edge location that the Request at the second edge location of the edge cluster can be executed. In one example, determining that the request can be executed at the second edge location includes determining that executing the request at the second edge location requires fewer computing resources or takes less time than executing the request at that first edge location (for example, it is more efficient to execute the request at the second edge location than at the first edge location). The efficiency can be based on a predicted utilization of the first edge location for a period of time or based on a distance from the second edge location to the first edge location. The efficiency can be determined with the help of a machine learning element in order to predict requests that will arrive at the first edge location.").
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to modify the teaching of Nichols as modified by Mestery and Kong and include the above limitation with the teaching of Guim in order to utilize AI to ensure that data communication “requires fewer computing resources or takes less time” (Guim: Paragraph [0352]).
Claims 12 and 18 recite features similar to those in claims 2, therefore they are rejected in a similar manner.
Claim 16 recites features similar to those in claim 10, therefore it is rejected in a similar manner.
Claim(s) 4, 14, and 19 is/are rejected under 35 U.S.C. 103 as being unpatentable over Nichols (US 10642593 B2, hereinafter referred to as Nichols) in view of Mestery (US 10764244 B1, hereinafter referred to as Mestery) in further view of Kong (CN 113760454 A, hereinafter referred to as Kong) in further view of Guim (DE 112020000054 T5, hereinafter referred to as Guim) in further view of Kalley (US 20220413903 A1, Kalley).
Regarding claim 4, the combination of Nichols as modified by Mestery, Kong, and Guim discloses: The secure application migration system of claim 2, but fails to explicitly disclose: wherein the program instructions, upon execution, further cause IHS to generate a new secure key each time the application is migrated.
However, in the same field of endeavor, Kalley discloses: wherein the program instructions, upon execution, further cause IHS to generate a new secure key each time the application is migrated (Kalley: Paragraph [0070] states, "the generated key pair is ephemeral in nature i.e., the key pair is valid for a short time-duration (e.g., an amount of time corresponding to an estimated time required for completion of the PaaS application migration process) and is associated uniquely with the migration request.").
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to modify the teaching of Nichols as modified by Mestery, Kong, and Guim and include the above limitation with the teaching of Kalley in order to provide a secure migration each time an application is migrated (Kalley: Paragraph [0070]).
Claims 14 and 19 recite features similar to those in claim 4, therefore they are rejected in a similar manner.
Claim(s) 5-7 is/are rejected under 35 U.S.C. 103 as being unpatentable over Nichols (US 10642593 B2, hereinafter referred to as Nichols) in view of Mestery (US 10764244 B1, hereinafter referred to as Mestery) in further view of Kong (CN 113760454 A, hereinafter referred to as Kong) in further view of Ackerly (WO 2021173716 A1, hereinafter referred to as Ackerly).
Regarding claim 5, the combination of Nichols as modified by Mestery and Kong discloses: The secure application migration system of claim 1, wherein each of the side-car modules comprise a second memory coupled to a second processor, the second memory has logic stored thereon that (Mestery: Col 20 lines 27-33 states, "The CPU 604 may include one or more processors 608, such as a processor from the INTEL X86 family of microprocessors. In some cases, processor 608 can be specially designed hardware for controlling the operations of the network device 600. In some cases, a memory 606 (e.g., non-volatile RAM, ROM, etc.) also forms part of the CPU 604."), but fails to explicitly disclose upon execution by the at least one processor, cause each of the first and second side-car modules to validate data sent to and from its respective computing device.
However, in the same field of endeavor, Ackerly discloses: upon execution by the at least one processor, cause each of the first and second side-car modules to validate data sent to and from its respective computing device (Ackerly: Page 8 lines 20-23 "In some embodiments, the system may leverage a container validation framework (such as the Docker Content Trust framework provided by provided by Docker, Inc., of Palo Alto, CA) to strongly assert that data is decrypted only for the containers specified by data owners.").
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention was made to modify the teaching of Nichols as modified by Mestery and Kong and include the above limitation with the teaching of Ackerly in order to validate the data and ensure that the “data is decrypted only for the containers specified by data owners” (Ackerly: Page 8 lines 20-23).
Regarding claim 6, the combination of the combination of Nichols as modified by Mestery, Kong, and Ackerly discloses: The secure application migration system of claim 5, wherein the logic, upon execution, further cause IHS to validate the data by performing at least one of a flow control test, a session management test, or validation of read/write locks used (Ackerly: Page 8 lines 20-23 "In some embodiments, the system may leverage a container validation framework (such as the Docker Content Trust framework provided by provided by Docker, Inc., of Palo Alto, CA) to strongly assert that data is decrypted only for the containers specified by data owners.").
The same motivation to modify with Ackerly, as in claim 5, applies.
Regarding claim 7, the combination of the combination of Nichols as modified by Mestery and Kong discloses: The secure application migration system of claim 1, but fails to explicitly disclose: wherein the program instructions, upon execution, further cause IHS to, when the validation fails, add information associated with the failed source to a blacklist.
However, in the same field of endeavor, Ackerly discloses: wherein the program instructions, upon execution, further cause IHS to, when the validation fails, add information associated with the failed source to a blacklist (Page 13 lines 12-15 state that "an app developer may want to blacklist a corrupted dataset or an abusive customer. These developers can optionally include system-specific configuration in their container image or registry metadata to indicate access controls the sidecar should impose.").
The same motivation to modify with Ackerly, as in claim 5, applies.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SHREYAJ RAM BHANDARI whose telephone number is (571)272-0727. The examiner can normally be reached 7:30-5:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ali Shayanfar can be reached at (571) 270-1050. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SHREYAJ RAM BHANDARI/ Examiner, Art Unit 2434
/NOURA ZOUBAIR/ Primary Examiner, Art Unit 2434
Prosecution Insights