DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant's arguments filed 06/23/2026 have been fully considered.
The amendments to the claims change the scope of the invention.
Applicant argues that Rungta does not teach on validating a deployed policy. In response to the argument, Examiner respectfully disagrees. Rungta teaches on obtaining information of a deployed policy and testing configurations against the deployed policy to ensure compliance.
Rungta teaches determining, by the one or more processors ([0109][0110] processing unit, security assessment system) and based at least in part on the resource information, one or more resource configurations to be tested against the deployed policy for a first resource type of the one or more resource types; see Rungta, [0118] A data analyzer service 756 of the security assessment system 750 can obtain and analyze stored data associated with the request and launch of resources in the virtual computing system. The stored files may include, or define, the configuration of the corresponding virtual resource instance, and may in some cases be specified by a template as described above. The data analyzer service 756 may locate and retrieve the stored files, and execute the desired security checks against them.)
Applicant argues that Rungta teaches on validating virtual resources of the deployed policy only and does not teach on validating the deployed policy. In response to the argument, Examiner respectfully disagrees. Rungta teaches on the claims as recited. The claims recite that resource date, instances of the deployed policy are to be validated. By validating these resources of the deployed policy, the deployed policy is validated. The template may represent multiple policies of the deployed system, but the template configuration is tested to ensure compliance.
Rungta teaches generating, by the one or more processors ([0109][0110] processing unit, security assessment system) and based at least in part on a first resource configuration of the one or more resource configurations, new resource data (ie. template) to validate the deployed policy, wherein the new resource data includes processor-executable instructions to newly instantiate a new resource or modify or disable an existing resource; see Rungta, [0023] The template may identify one or more security policies to be attached to the instance, and may further include instructions or other data that configure the above-described evaluation of the security policies. For example, the template may identify which checks, from a set of preconfigured checks, should be run against the resources and security policies of the template.)
Rungta teaches providing, by the one or more processors ([0109][0110] processing unit, security assessment system), the new resource data (ie. template) to the cloud computing environment to cause the cloud computing environment to instantiate the new resource or modify or disable the existing resource to currently run in the cloud computing environment with the deployed policy enforced; see Rungta, [0019] Some security policies can evaluate the interactions of virtual computing resource instances with the virtual network and other virtual computing resources executing in the client's virtual computing environment. … The virtual network configuration may be changed while an instance is running, and/or between deployments of instances generated from the same template, such that values of checked parameters could change and need to be rechecked upon deployment and periodically thereafter. [0024][0025] In some cases, a transformation service may be utilized to modify the template. The transformed template may cause the resource allocation system to allocate resources to, and/or create, one or more virtual resource instances, as described further below, such that variables and references within configuration parameters and security policies of the original template can be fully resolved so that the configuration and/or security policy can be sent to and evaluated by the configuration analyzer service.)
Applicant argues that Rungta does not teach on validating the policy after it’s been deployed. In response to the argument, Examiner respectfully disagrees. Rungta teaches on validating the deployed configurations (deployment based on the particular policy) periodically as some parameter values may change over time.
Rungta teaches providing, by the one or more processors ([0109][0110] processing unit, security assessment system), the new resource data (ie. template) to the cloud computing environment to cause the cloud computing environment to instantiate the new resource or modify or disable the existing resource to currently run in the cloud computing environment with the deployed policy enforced; see Rungta, [0019] Some security policies can evaluate the interactions of virtual computing resource instances with the virtual network and other virtual computing resources executing in the client's virtual computing environment. … The virtual network configuration may be changed while an instance is running, and/or between deployments of instances generated from the same template, such that values of checked parameters could change and need to be rechecked upon deployment and periodically thereafter.
Please see updated rejection below: Claim(s) 1-20 is/are rejected under 35 U.S.C. 102(a)(1) as being anticipated by US 2019/0278928 Al (Rungta).
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
Claim(s) 1-20 is/are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 1 is rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention. Claim 1 recites “providing, by the one or more processors, the new resource data to the cloud computing environment to cause the cloud computing environment to instantiate the new resource or modify or disable the existing resource to currently run in the cloud computing environment with the deployed policy enforced;”. This renders the claim unclear as to “currently run” when the limitation is in the alternate form and if disabled it will not “currently run” in the cloud computing environment. This same rejection applies to Claims 12, 20.
All dependents are also rejected as having the same deficiencies as the claims from which they depend.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless – (a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claim(s) 1-20 is/are rejected under 35 U.S.C. 102(a)(1) as being anticipated by US 2019/0278928 Al (Rungta).
Regarding Claim 1:
Rungta teaches A computer-implemented method comprising:
obtaining, by one or more processors ([0109][0110] processing unit, security assessment system) and by querying a cloud computing environment ([0028] cloud environment), policy information of a policy deployed (ie. deployed policy is checked and rechecked) in the cloud computing environment; ([0018] A client may create a security policy and associate the security policy with, for example, a particular end user, a group of end users, a particular virtual computing resource ( e.g., a virtual machine instance), a particular type of virtual computing resource, a particular class of virtual computing resources, a computing network, traffic from a geographic area, and the like. [0019] Some security policies can evaluate the interactions of virtual computing resource instances with the virtual network and other virtual computing resources executing in the client's virtual computing environment. … The virtual network configuration may be changed while an instance is running, and/or between deployments of instances generated from the same template, such that values of checked parameters could change and need to be rechecked upon deployment and periodically thereafter.)
determining (ie. associate), by the one or more processors ([0109][0110] processing unit, security assessment system) and based at least in part on the policy information, resource information (ie. type, class) of one or more resource types; ([0018] A client may create a security policy and associate the security policy with, for example, a particular virtual computing resource ( e.g., a virtual machine instance), a particular type of virtual computing resource, a particular class of virtual computing resources, a computing network, traffic from a geographic area, and the like. [0126] Fig 8, step 806: identify security policies associated with definitions of each identified resource type. The validator is a security policy checker, so at step 806 the system may identify all of the security policies implicated by the designated security checks. The system may use a first resource type (identified in step 804) to identify all of the computing resource definitions 854 that create a virtual resource instance of the first resource type (e.g., by obtaining the value of the "type" parameter in the computing resource definition 854). Then, for each identified computing resource definition 854, the system may identify the security policy definition 856 associated with the computing resource definition 854 ( e.g., by obtaining the value of the resource identifier parameter in the security policy definition 856).)
determining, by the one or more processors ([0109][0110] processing unit, security assessment system) and based at least in part on the resource information, one or more resource configurations to be tested against the deployed policy for a first resource type of the one or more resource types; ([0118] A data analyzer service 756 of the security assessment system 750 can obtain and analyze stored data associated with the request and launch of resources in the virtual computing system. The stored files may include, or define, the configuration of the corresponding virtual resource instance, and may in some cases be specified by a template as described above. The data analyzer service 756 may locate and retrieve the stored files, and execute the desired security checks against them.)
generating, by the one or more processors ([0109][0110] processing unit, security assessment system) and based at least in part on a first resource configuration of the one or more resource configurations, new resource data (ie. template) to validate the deployed policy, wherein the new resource data includes processor-executable instructions to newly instantiate a new resource or modify or disable an existing resource; ([0023] The template may identify one or more security policies to be attached to the instance, and may further include instructions or other data that configure the above-described evaluation of the security policies. For example, the template may identify which checks, from a set of preconfigured checks, should be run against the resources and security policies of the template.)
providing, by the one or more processors ([0109][0110] processing unit, security assessment system), the new resource data (ie. template) to the cloud computing environment to cause the cloud computing environment to instantiate the new resource or modify or disable the existing resource to currently run in the cloud computing environment with the deployed policy enforced; ([0019] Some security policies can evaluate the interactions of virtual computing resource instances with the virtual network and other virtual computing resources executing in the client's virtual computing environment. … The virtual network configuration may be changed while an instance is running, and/or between deployments of instances generated from the same template, such that values of checked parameters could change and need to be rechecked upon deployment and periodically thereafter. [0024][0025] In some cases, a transformation service may be utilized to modify the template. The transformed template may cause the resource allocation system to allocate resources to, and/or create, one or more virtual resource instances, as described further below, such that variables and references within configuration parameters and security policies of the original template can be fully resolved so that the configuration and/or security policy can be sent to and evaluated by the configuration analyzer service.)
and generating, by the one or more processors ([0109][0110] processing unit, security assessment system) and based at least in part on a compliance status of the new resource or the modified or disabled existing resource according to the deployed policy, an indication as to whether the deployed policy is validated. ([0021] The system may generate warnings to the client that describe the failed deployment and may identify the security policies responsible for setting any offending parameters. Security policy analyzer service may be utilized to compare security policies and determine whether two security policies are equivalent, whether a first security policy is more permissive than a second security policy, and more. If the evaluation fails, the system may receive a failure report from the security policy analyzer service, and may provide information to the client for correcting any misconfigurations caused by the security policy. Abstract: Notifications identifying the faulty configuration(s) may be sent to the administrative user.)
Regarding Claim 12:
Rungta teaches A system comprising memory and one or more processors communicatively coupled to the memory, the memory storing instructions ([0109][0110] processing unit, security assessment system. [0130] In another embodiment, the present disclosure provides a system including one or more processors and memory storing computer-executable instructions), that, when executed by the one or more processors, cause the one or more processors to:
obtain, by querying a cloud computing environment ([0028] cloud environment), policy information of a policy deployed (ie. deployed policy is checked and rechecked) in the cloud computing environment; ([0018] A client may create a security policy and associate the security policy with, for example, a particular end user, a group of end users, a particular virtual computing resource ( e.g., a virtual machine instance), a particular type of virtual computing resource, a particular class of virtual computing resources, a computing network, traffic from a geographic area, and the like. [0019] Some security policies can evaluate the interactions of virtual computing resource instances with the virtual network and other virtual computing resources executing in the client's virtual computing environment. … The virtual network configuration may be changed while an instance is running, and/or between deployments of instances generated from the same template, such that values of checked parameters could change and need to be rechecked upon deployment and periodically thereafter.)
determine (ie. associate), based at least in part on the policy information, resource information (ie. type, class) of one or more resource types; ([0018] A client may create a security policy and associate the security policy with, for example, a particular virtual computing resource ( e.g., a virtual machine instance), a particular type of virtual computing resource, a particular class of virtual computing resources, a computing network, traffic from a geographic area, and the like. [0126] Fig 8, step 806: identify security policies associated with definitions of each identified resource type. The validator is a security policy checker, so at step 806 the system may identify all of the security policies implicated by the designated security checks. The system may use a first resource type (identified in step 804) to identify all of the computing resource definitions 854 that create a virtual resource instance of the first resource type (e.g., by obtaining the value of the "type" parameter in the computing resource definition 854). Then, for each identified computing resource definition 854, the system may identify the security policy definition 856 associated with the computing resource definition 854 ( e.g., by obtaining the value of the resource identifier parameter in the security policy definition 856).)
determine, based at least in part on the resource information, one or more resource configurations to be tested against the deployed policy for a first resource type of the one or more resource types; ([0118] A data analyzer service 756 of the security assessment system 750 can obtain and analyze stored data associated with the request and launch of resources in the virtual computing system. The stored files may include, or define, the configuration of the corresponding virtual resource instance, and may in some cases be specified by a template as described above. The data analyzer service 756 may locate and retrieve the stored files, and execute the desired security checks against them.)
generate, based at least in part on a first resource configuration of the one or more resource configurations, new resource data (ie. template) to validate the deployed policy, wherein the new resource data includes processor-executable instructions to newly instantiate a new resource or modify or disable an existing resource; ([0023] The template may identify one or more security policies to be attached to the instance, and may further include instructions or other data that configure the above-described evaluation of the security policies. For example, the template may identify which checks, from a set of preconfigured checks, should be run against the resources and security policies of the template.)
provide the new resource data (ie. template) to the cloud computing environment to cause the cloud computing environment to instantiate the new resource or modify or disable the existing resource to currently run in the cloud computing environment with the deployed policy enforced; ([0019] Some security policies can evaluate the interactions of virtual computing resource instances with the virtual network and other virtual computing resources executing in the client's virtual computing environment. … The virtual network configuration may be changed while an instance is running, and/or between deployments of instances generated from the same template, such that values of checked parameters could change and need to be rechecked upon deployment and periodically thereafter. [0024][0025] In some cases, a transformation service may be utilized to modify the template. The transformed template may cause the resource allocation system to allocate resources to, and/or create, one or more virtual resource instances, as described further below, such that variables and references within configuration parameters and security policies of the original template can be fully resolved so that the configuration and/or security policy can be sent to and evaluated by the configuration analyzer service.)
and generate, based at least in part on a compliance status of the new resource or the modified or disabled existing resource according to the deployed policy, an indication as to whether the deployed policy is validated. ([0021] The system may generate warnings to the client that describe the failed deployment and may identify the security policies responsible for setting any offending parameters. Security policy analyzer service may be utilized to compare security policies and determine whether two security policies are equivalent, whether a first security policy is more permissive than a second security policy, and more. If the evaluation fails, the system may receive a failure report from the security policy analyzer service, and may provide information to the client for correcting any misconfigurations caused by the security policy. Abstract: Notifications identifying the faulty configuration(s) may be sent to the administrative user.)
Regarding Claim 20:
Rungta teaches One or more non-transitory computer-readable storage media including instructions that, when executed by one or more processors ([0109][0110] processing unit, security assessment system. [0130] In another embodiment, the present disclosure provides a system including one or more processors and memory storing computer-executable instructions), cause the one or more processors to:
obtain, by querying a cloud computing environment ([0028] cloud environment), policy information of a policy deployed (ie. deployed policy is checked and rechecked) in the cloud computing environment; ([0018] A client may create a security policy and associate the security policy with, for example, a particular end user, a group of end users, a particular virtual computing resource ( e.g., a virtual machine instance), a particular type of virtual computing resource, a particular class of virtual computing resources, a computing network, traffic from a geographic area, and the like. [0019] Some security policies can evaluate the interactions of virtual computing resource instances with the virtual network and other virtual computing resources executing in the client's virtual computing environment. … The virtual network configuration may be changed while an instance is running, and/or between deployments of instances generated from the same template, such that values of checked parameters could change and need to be rechecked upon deployment and periodically thereafter.)
determine (ie. associate), based at least in part on the policy information, resource information (ie. type, class) of one or more resource types; ([0018] A client may create a security policy and associate the security policy with, for example, a particular virtual computing resource ( e.g., a virtual machine instance), a particular type of virtual computing resource, a particular class of virtual computing resources, a computing network, traffic from a geographic area, and the like. [0126] Fig 8, step 806: identify security policies associated with definitions of each identified resource type. The validator is a security policy checker, so at step 806 the system may identify all of the security policies implicated by the designated security checks. The system may use a first resource type (identified in step 804) to identify all of the computing resource definitions 854 that create a virtual resource instance of the first resource type (e.g., by obtaining the value of the "type" parameter in the computing resource definition 854). Then, for each identified computing resource definition 854, the system may identify the security policy definition 856 associated with the computing resource definition 854 ( e.g., by obtaining the value of the resource identifier parameter in the security policy definition 856).)
determine, based at least in part on the resource information, one or more resource configurations to be tested against the deployed policy for a first resource type of the one or more resource types; ([0118] A data analyzer service 756 of the security assessment system 750 can obtain and analyze stored data associated with the request and launch of resources in the virtual computing system. The stored files may include, or define, the configuration of the corresponding virtual resource instance, and may in some cases be specified by a template as described above. The data analyzer service 756 may locate and retrieve the stored files, and execute the desired security checks against them.)
generate, based at least in part on a first resource configuration of the one or more resource configurations, new resource data (ie. template) to validate the deployed policy, wherein the new resource data includes processor-executable instructions to newly instantiate a new resource or modify or disable an existing resource; ([0023] The template may identify one or more security policies to be attached to the instance, and may further include instructions or other data that configure the above-described evaluation of the security policies. For example, the template may identify which checks, from a set of preconfigured checks, should be run against the resources and security policies of the template.)
provide the new resource data (ie. template) to the cloud computing environment to cause the cloud computing environment to instantiate the new resource or modify or disable the existing resource to currently run in the cloud computing environment with the deployed policy enforced; ([0019] Some security policies can evaluate the interactions of virtual computing resource instances with the virtual network and other virtual computing resources executing in the client's virtual computing environment. … The virtual network configuration may be changed while an instance is running, and/or between deployments of instances generated from the same template, such that values of checked parameters could change and need to be rechecked upon deployment and periodically thereafter. [0024][0025] In some cases, a transformation service may be utilized to modify the template. The transformed template may cause the resource allocation system to allocate resources to, and/or create, one or more virtual resource instances, as described further below, such that variables and references within configuration parameters and security policies of the original template can be fully resolved so that the configuration and/or security policy can be sent to and evaluated by the configuration analyzer service.)
and generate, based at least in part on a compliance status of the new resource or the modified or disabled existing resource according to the deployed policy, an indication as to whether the deployed policy is validated. ([0021] The system may generate warnings to the client that describe the failed deployment and may identify the security policies responsible for setting any offending parameters. Security policy analyzer service may be utilized to compare security policies and determine whether two security policies are equivalent, whether a first security policy is more permissive than a second security policy, and more. If the evaluation fails, the system may receive a failure report from the security policy analyzer service, and may provide information to the client for correcting any misconfigurations caused by the security policy. Abstract: Notifications identifying the faulty configuration(s) may be sent to the administrative user.)
Regarding Claims 2, 13:
Rungta teaches the inventions of claims 1, 12 as described.
Rungta teaches wherein the deployed policy is associated with one or more of: security, compliance, resource management, data management, application management, or user management. ([0018] A client may create a security policy and associate the security policy with, for example, a particular virtual computing resource ( e.g., a virtual machine instance), a particular type of virtual computing resource, a particular class of virtual computing resources, a computing network, traffic from a geographic area, and the like.)
Regarding Claims 3, 14:
Rungta teaches the inventions of claims 1, 12 as described.
Rungta teaches wherein the one or more resource types include one or more of: a storage account resource, a virtual machine resource, or a network address resource. ([0018] A client may create a security policy and associate the security policy with, for example, a particular virtual computing resource ( e.g., a virtual machine instance), a particular type of virtual computing resource, a particular class of virtual computing resources, a computing network, traffic from a geographic area, and the like.)
Regarding Claims 4, 15:
Rungta teaches the inventions of claims 1, 12 as described.
Rungta teaches further comprising: receiving, by the one or more processors ([0109][0110] processing unit, security assessment system), user input indicative of one or more scenarios against which to validate the deployed policy, wherein determining the one or more resource configurations is further based on the user input. ([0018] A client may create a security policy and associate the security policy with, for example, a particular virtual computing resource ( e.g., a virtual machine instance), a particular type of virtual computing resource, a particular class of virtual computing resources, a computing network, traffic from a geographic area, and the like. [0033] The client may use the user interface 108 to configure a virtual network, create templates 114 for launching virtual computing resources 142 and connecting them to the virtual network and/or the external communication network 104, and create security policies 116 that govern how end users can access the virtual computing resources.)
Regarding Claims 5, 16:
Rungta teaches the inventions of claims 1, 12 as described.
Rungta teaches wherein the new resource data is first new resource data, the processor-executable instructions are first processor-executable instructions, and the new resource is a first new resource, and wherein the computer-implemented method further comprises:
generating, by the one or more processors ([0109][0110] processing unit, security assessment system) and based at least in part on a second resource configuration of the one or more resource configurations, second new resource data (ie. template) including second processor-executable instructions to newly instantiate a second new resource; ([0016] One or more services of the computing resource service provider may, as described further below, be responsible for allocating a virtual computing resource, configuring the virtual computing resource, and deploying the virtual computing resource into the client's virtual computing environment. [0019] Some security policies can evaluate the interactions of virtual computing resource instances with the virtual network and other virtual computing resources executing in the client's virtual computing environment. … The virtual network configuration may be changed while an instance is running, and/or between deployments of instances generated from the same template, such that values of checked parameters could change and need to be rechecked upon deployment and periodically thereafter.)
providing, by the one or more processors, the second new resource data to the cloud computing environment to cause the cloud computing environment to instantiate the second new resource, ([0023] The template may identify one or more security policies to be attached to the instance, and may further include instructions or other data that configure the above-described evaluation of the security policies. For example, the template may identify which checks, from a set of preconfigured checks, should be run against the resources and security policies of the template. [0105] At step 606, the system may create a first of the virtual resource instances associated with the request. [0107] If there are more instances to create from the request, the system may return to step 604 and repeat the method 600 for the next instance. At step 630, the system may deploy the new instances into the execution environment.)
obtaining, by the one or more processors ([0109][0110] processing unit, security assessment system), an indication that the second new resource was not instantiated at the cloud computing environment; ([0038] The resource allocation system 120 may additionally collect and/or generate usage data describing aspects of the virtual computing resource 142. Non-limiting examples of such usage data may include: configuration and/or status parameters of the virtual computing resource 142 at the time of launch or failure to launch;)
generating, by the one or more processors ([0109][0110] processing unit, security assessment system), a notification indicating the second new resource was not instantiated at the cloud computing environment; ([0021] The system may generate warnings to the client that describe the failed deployment and may identify the security policies responsible for setting any offending parameters. Security policy analyzer service may be utilized to compare security policies and determine whether two security policies are equivalent, whether a first security policy is more permissive than a second security policy, and more. If the evaluation fails, the system may receive a failure report from the security policy analyzer service, and may provide information to the client for correcting any misconfigurations caused by the security policy.)
and providing, by the one or more processors ([0109][0110] processing unit, security assessment system), the notification to a computing device. ([0119] The data analyzer service 756 may then determine whether the identified data is properly protected. For example, the data analyzer service 756 may determine whether the information is encrypted at rest and in transit, and whether the information is stored in a secure data store with restricted authorized access. The data analyzer service 756 may compare the evaluated security measures to thresholds associated with the security check and/or best practices, and may report pass/fail results to the security assessment system 750 or another system component.)
Regarding Claims 6, 17:
Rungta teaches the inventions of claims 1, 12 as described.
Rungta teaches wherein: the indication is included in a compliance report; and the computer-implemented method further comprises providing, by the one or more processors ([0109][0110] processing unit, security assessment system), the compliance report to a computing device. ([0119] The data analyzer service 756 may then determine whether the identified data is properly protected. For example, the data analyzer service 756 may determine whether the information is encrypted at rest and in transit, and whether the information is stored in a secure data store with restricted authorized access. The data analyzer service 756 may compare the evaluated security measures to thresholds associated with the security check and/or best practices, and may report pass/fail results to the security assessment system 750 or another system component.)
Regarding Claim 7:
Rungta teaches the invention of claim 1 as described.
Rungta teaches wherein: the one or more resource configurations are a first one or more resource configurations, the new resource data is first new resource data, the processor-executable instructions are first processor-executable instructions, the new resource is a first new resource, and the existing resource is a first existing resource; the computer-implemented method further comprises
determining, by the one or more processors ([0109][0110] processing unit, security assessment system) and based at least in part on the resource information, a second one or more resource configurations for a second resource type of the one or more resource types, ([0018] A client may create a security policy and associate the security policy with, for example, a particular virtual computing resource ( e.g., a virtual machine instance), a particular type of virtual computing resource, a particular class of virtual computing resources, a computing network, traffic from a geographic area, and the like. [0126] Fig 8, step 806: identify security policies associated with definitions of each identified resource type. The validator is a security policy checker, so at step 806 the system may identify all of the security policies implicated by the designated security checks. The system may use a first resource type (identified in step 804) to identify all of the computing resource definitions 854 that create a virtual resource instance of the first resource type (e.g., by obtaining the value of the "type" parameter in the computing resource definition 854). Then, for each identified computing resource definition 854, the system may identify the security policy definition 856 associated with the computing resource definition 854 ( e.g., by obtaining the value of the resource identifier parameter in the security policy definition 856).)
generating, by the one or more processors ([0109][0110] processing unit, security assessment system) and based at least in part on a second resource configuration of the second one or more resource configurations, second new resource data (ie. template) including second processor-executable instructions to newly instantiate a second new resource or modify or disable a second existing resource, ([0023] The template may identify one or more security policies to be attached to the instance, and may further include instructions or other data that configure the above-described evaluation of the security policies. For example, the template may identify which checks, from a set of preconfigured checks, should be run against the resources and security policies of the template. [0105] At step 606, the system may create a first of the virtual resource instances associated with the request. [0107] If there are more instances to create from the request, the system may return to step 604 and repeat the method 600 for the next instance. At step 630, the system may deploy the new instances into the execution environment.)
and providing, by the one or more processors ([0109][0110] processing unit, security assessment system), the second new resource data to the cloud computing environment to cause the cloud computing environment to instantiate the second new resource or modify or disable the second existing resource; ([0019] Some security policies can evaluate the interactions of virtual computing resource instances with the virtual network and other virtual computing resources executing in the client's virtual computing environment. … The virtual network configuration may be changed while an instance is running, and/or between deployments of instances generated from the same template, such that values of checked parameters could change and need to be rechecked upon deployment and periodically thereafter. [0024][0025] In some cases, a transformation service may be utilized to modify the template. The transformed template may cause the resource allocation system to allocate resources to, and/or create, one or more virtual resource instances, as described further below, such that variables and references within configuration parameters and security policies of the original template can be fully resolved so that the configuration and/or security policy can be sent to and evaluated by the configuration analyzer service.)
and generating the indication is further based at least in part on a compliance status of the second new resource or the modified or disabled second existing resource according to the deployed policy. ([0021] The system may generate warnings to the client that describe the failed deployment and may identify the security policies responsible for setting any offending parameters. Security policy analyzer service may be utilized to compare security policies and determine whether two security policies are equivalent, whether a first security policy is more permissive than a second security policy, and more. If the evaluation fails, the system may receive a failure report from the security policy analyzer service, and may provide information to the client for correcting any misconfigurations caused by the security policy. Abstract: Notifications identifying the faulty configuration(s) may be sent to the administrative user.)
Regarding Claims 8, 18:
Rungta teaches the inventions of claims 1, 12 as described.
Rungta teaches wherein the resource information includes at least one resource attribute (ie. virtual machine instance), and at least one corresponding attribute value (ie. particular type, geographic area), for at least one resource type of the one or more resource types. ([0018] A client may create a security policy and associate the security policy with, for example, a particular virtual computing resource ( e.g., a virtual machine instance), a particular type of virtual computing resource, a particular class of virtual computing resources, a computing network, traffic from a geographic area, and the like.
Regarding Claim 9:
Rungta teaches the invention of claim 8 as described.
Rungta teaches wherein the at least one resource attribute includes one or more of: public accessibility, a storage amount, or a geographic region. ([0018] A client may create a security policy and associate the security policy with, for example, a particular virtual computing resource ( e.g., a virtual machine instance), a particular type of virtual computing resource, a particular class of virtual computing resources, a computing network, traffic from a geographic area, and the like.
Regarding Claim 10:
Rungta teaches the invention of claim 1 as described.
Rungta teaches wherein generating the new resource data includes using a machine-learned model to generate the processor-executable instructions to newly instantiate the new resource. ([0045] Operating on target data, the configuration analyzer service 160 produces results that correspond to the desired security model 190. The assessment may be made, in various embodiments, using machine learning and other statistical models, and based on comparisons to historical patterns. [0052] A virtual machine instance 244 and a data store instance 246 are illustrated as examples; it is contemplated that the described operations can be adapted, without undue experimentation, for use on any type of virtual resource instances, including … a machine learning service.)
Regarding Claim 11:
Rungta teaches the invention of claim 10 as described.
Rungta teaches wherein generating the new resource data includes: generating initial new resource data including initial processor-executable instructions to newly instantiate the new resource, providing the initial new resource data to the cloud computing environment to cause the cloud computing environment to instantiate the new resource, ([0118] a virtual resource instance may be launched by executing one or more software programs. Additionally or alternatively, the virtual resource instance may itself execute one or more software programs, such as a web application. The data analyzer service 756 may analyze the source code and/or object code of such software programs in accordance with the security checks.)
obtaining an indication that the new resource was not instantiated at the cloud computing environment; ([0038] The resource allocation system 120 may additionally collect and/or generate usage data describing aspects of the virtual computing resource 142. Non-limiting examples of such usage data may include: configuration and/or status parameters of the virtual computing resource 142 at the time of launch or failure to launch;)
and using the machine-learned model to generate the processor-executable instructions in response to the indication that the new resource was not instantiated. ([0049] If the instance creation fails due to a fault in the template 114 and/or policy 116, the validation API may receive a notification identifying the part of the template 114 or policy 116 that failed the security check(s), so the client can fix the error and rerun the validation.)
Regarding Claim 19:
Rungta teaches the invention of claim 12 as described.
Rungta teaches wherein the instructions cause the one or more processors to generate the new resource data at least in part by using a machine-learned model to generate the processor-executable instructions. ([0045] Operating on target data, the configuration analyzer service 160 produces results that correspond to the desired security model 190. The assessment may be made, in various embodiments, using machine learning and other statistical models, and based on comparisons to historical patterns. [0052] A virtual machine instance 244 and a data store instance 246 are illustrated as examples; it is contemplated that the described operations can be adapted, without undue experimentation, for use on any type of virtual resource instances, including … a machine learning service.)
Conclusion & Contact Information
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to RACHEL J HACKENBERG whose telephone number is (571)272-5417. The examiner can normally be reached 9am-5pm M-F.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Glenton B Burgess can be reached at (571)272-3949. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/RACHEL J HACKENBERG/Primary Examiner, Art Unit 2454
Prosecution Insights