Detailed Action
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
This is the initial office action that has been issued in response to patent application, 18/950,617, filed on 11/18/20224. Claims 1-20, as originally filed, are currently pending and have been considered below. Claim 1, 11 and 19 are independent claim.
Priority
This application claims the priority of PRO 63/606,172 filed on 12/05/2023.
Drawings
The drawings filed on 11/18/2024 are accepted by the examiner.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Pocas (US Patent Application No 2022/0239478 A1) in view of Craggs (US Patent Application Publication No 2023/0031380 A1).
Regarding Claim 1, Pocas discloses a method comprising:
determining that use of an old key for encrypting data on a storage system is to be replaced with use of a new key (Pocas, ¶[0032], each key may be associated with a timestamp. The timestamp allows older keys to be identified. ¶[0041], the index identifies which keys are expired, current, newer, latest. ¶[0046], for keys where x<N, the state of the key DEKx, may be expired and deleted);
in response to determining that use of the old key is to be replaced with use of the new key (Pocas, ¶[0027], if a key reaches the maximum age, the key management engine may scan the storage system to ensure that no data exists that is encrypted with that key. If such data is found, the data is rekeyed with the latest or newest key):
reading a block of data from the storage system that is encrypted with the old key (Pocas, ¶[0057], the key 132 has reached the maximum age. As a result, a rekeying operation is performed and may be mandatory. ¶[0094], Fig-4, a read request is received. The key index is identified);
decrypting the block of data using the old key (Pocas, ¶[0095], once the key index is determined, the data is read, decrypted with the corresponding key and returned to the requestor. ¶[0098], when a key reaches the maximum age, the data encrypted that key should be re-encrypted with the latest key);
encrypting the block of data using the new key (Pocas, ¶[0060], the data 122 is read and the decrypted with the key 132. The decrypted data is then encrypted with the key 142 and written back to storage. Fig-1G. ¶[0076]- ¶[0077], once data 182 is identified, the data 182 can be decrypted with the key ID1 and re-3ncrypted with the latest key ID4); and
writing the block of data encrypted with the new key to the storage system (Pocas, ¶[0060], the data 122 is read and the decrypted with the key 132. The decrypted data is then encrypted with the key 142 and written back to storage. ¶[0061], new encryption key may be introduced in accordance with a key introduction period (daily, weekly or other period). ¶[0081], a block in that extent is then allocated and the data encrypted with the latest key is written to the allocated block);
and updating a progress indicator that indicates which locations on the storage system store data encrypted with the old key and which locations on the storage system store data encrypted with the new key (Pocas, ¶[0082]- ¶[0085], inline metadata, external metadata, N-way associative. The mapping can be used to identify what data is encrypted with which key. When rekeying data associated with an older key, data encrypted with that older key to be identified and rekeyed with the latest key).
Pocas does not explicitly teach the following limitation that Craggs teaches:
progress indicator (Craggs, ¶[0023], there is log for new encryption key. ¶[0024], encryption log may include details for the entire database, an index of a row that has been encrypted or any other details. Encryption log may include table value in the database. ¶[0025], the encryption log may maintain a record that tracks encryption key and their correlated encrypted data. ¶[0072], the encryption log may include a table value in the database, a row number of the database, a column number of the database, a timestamp or a state of the database).
Pocas in view of Craggs are analogous art because they are from the “same field of endeavor” and are from the same “problem solving area”. Namely, they pertain to the field of “encryption keys for encrypting data”. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the invention to modify the invention of Pocas in view of Craggs to include the idea of increasing the data security for protecting digital data from undesirable destructive events (Craggs, ¶[0002] ).
Regarding Claim 2, Pocas in view of Craggs discloses the method of claim 1, wherein the storage system is configured to perform production input/output operations after replacing use of the old key with use of the new key has started but before replacing use of the old key with use of the new key has completed (Pocas, ¶[0064], the ability to perform operations on smaller sized data sets does not incur unreasonable system load or any downtime to satisfy the maximum age constraint, even when input parameters are changed dynamically).
Regarding Claim 3, Pocas in view of Craggs discloses the method of claim 1, wherein reading the block of data from the storage system that is encrypted with the old key is further in response to determining that the progress indicator indicates that the block of data has not yet been reencrypted with the new key (Pocas, ¶[0041], the time variable 106 may include an uptime. When adding a new key, time limit 108 may require a rekeying operation to be performed such that an older key may be deleted. The index 112 identifies which keys are expired, current, newer, latest. Also Craggs, ¶[0023], there is log for new encryption key. ¶[0024], encryption log may include details for the entire database, an index of a row that has been encrypted or any other details. ¶[0025], the encryption log may maintain a record that tracks encryption key and their correlated encrypted data. ¶[0072], the encryption log may include a table value in the database, a row number of the database, a column number of the database, a timestamp or a state of the database).
Regarding Claim 4, Pocas in view of Craggs discloses the method of claim 1, further comprising:
receiving, while reencryption of the storage system with the new key in place of the old key is in progress, a production write operation to store a write block to a target location of the storage system (Pocas, ¶[0042]-¶[0051], for keys where x<N, the state of the key DEKx may be expired and deleted. When x=M, the key DEKM is the latest or newest key. All new data is encrypted and written to storage using this key. Also Craggs, Fig-3B);
selecting between the old key and the new key based on the progress indicator (Pocas, ¶[0053]-¶[0057], Fig-1B thru Fig-1D, rekeying operation is performed); and
encrypting the write block using the selected key (Pocas, ¶[0053]-¶[0057], Fig-1B thru Fig-1D, rekeying operation is performed).
Regarding Claim 5, Pocas in view of Craggs discloses the method of claim 1, further comprising:
receiving, while reencryption of the storage system with the new key in place of the old key is in progress, a production write operation to store a write block to a target location of the storage system that is currently encrypted using the old key (Pocas, ¶[0042]-¶[0051], for keys where x<N, the state of the key DEKx may be expired and deleted. When x=M, the key DEKM is the latest or newest key. All new data is encrypted and written to storage using this key. Also Craggs, Fig-3B);
encrypting the write block using the new key (Pocas, ¶[0053]-¶[0057], Fig-1B thru Fig-1D, rekeying operation is performed); and
updating the progress indicator to reflect that the target location is encrypted using the new key (Pocas, ¶[0082]- ¶[0085], inline metadata, external metadata, N-way associative. The mapping can be used to identify what data is encrypted with which key. When rekeying data associated with an older key, data encrypted with that older key to be identified and rekeyed with the latest key. Also Craggs, ¶[0023], there is log for new encryption key. ¶[0024], encryption log may include details for the entire database, an index of a row that has been encrypted or any other details. ¶[0025], the encryption log may maintain a record that tracks encryption key and their correlated encrypted data. ¶[0072], the encryption log may include a table value in the database, a row number of the database, a column number of the database, a timestamp or a state of the database).
Regarding Claim 6, Pocas in view of Craggs discloses the method of claim 1, further comprising:
receiving, while reencryption of the storage system with the new key in place of the old key is in progress, a production read operation to retrieve a read block from a target location of the storage system (Pocas, ¶[0042]-¶[0051], for keys where x<N, the state of the key DEKx may be expired and deleted. When x=M, the key DEKM is the latest or newest key. All new data is encrypted and written to storage using this key. Also Craggs, Fig-3A);
selecting between the old key and the new key based on the progress indicator (Pocas, ¶[0053]-¶[0057], Fig-1B thru Fig-1D, rekeying operation is performed); and
decrypting the read block using the selected key (Pocas, ¶[0053]-¶[0057], Fig-1B thru Fig-1D, rekeying operation is performed).
Regarding Claim 7, Pocas in view of Craggs discloses the method of claim 1, wherein reading the block of data from the storage system that is encrypted with the old key is further in response to determining that reencrypting the block of data will not interfere with a production input/output operation by the storage system (Pocas, ¶[0061], new encryption keys may be introduced in accordance with a key introduction period (daily, weekly or other period). Also Craggs, ¶[0036], a majority of the database table may be rotated without interfering with performance and locking out the table for other read/writes).
Regarding Claim 8, Pocas in view of Craggs discloses the method of claim 7, further comprising:
determining that reencrypting the block of data will interfere with at least one production input/output operation by the storage system (Pocas, ¶[0061], keeping and managing a few hundred keys allows the key related operations to be performed consistently, in the background and as resources become available. Craggs, ¶[0036], a majority of the database table may be rotated without interfering with performance and locking out the table for other read/writes); and
delaying reencryption of the block of data until determining that reencrypting the block of data will not interfere with a production input/output operation by the storage system (Pocas, ¶[0074], when a new key is generated, the statuses of the keys are managed. A rekeying may have just completed and a key may have been deleted, the status of other keys can be updated. Craggs, ¶[0036], a majority of the database table may be rotated without interfering with performance and locking out the table for other read/writes).
Regarding Claim 9, Pocas in view of Craggs discloses the method of claim 1, wherein:
the progress indicator comprises an index that divides the storage system into locations that have not yet been reencrypted and locations that have been reencrypted (Pocas, ¶[0037], the keys may be indexed by a key index. The key index 114 may represent to expired keys, non-expired keys, current or in-use keys and a latest or newest key);
reading the block of data comprises selecting the block of data as next to be reencrypted based on being at a location pointed to by the index (Pocas, ¶[0041], the index 112 identifies which keys are expired, current, newer, latest. Pocas, ¶[0045],¶[0094]); and
updating the progress indicator comprises incrementing the index (Pocas, ¶[0081]- ¶[0084]. Also Craggs, ¶[0023], there is log for new encryption key. ¶[0024], encryption log may include details for the entire database, an index of a row that has been encrypted or any other details. ¶[0025], the encryption log may maintain a record that tracks encryption key and their correlated encrypted data. ¶[0072], the encryption log may include a table value in the database, a row number of the database, a column number of the database, a timestamp or a state of the database).
Regarding Claim 10, Pocas in view of Craggs discloses the method of claim 1, wherein:
the progress indicator comprises a map of the storage system that records which locations on the storage system have been reencrypted and which locations on the storage system have not been reencrypted (Pocas, Fig-2, ¶[0078]- ¶[0088]);
and updating the progress indicator comprises marking the map to show that the location of the data block has been reencrypted (Pocas, Fig-2, ¶[0078]- ¶[0088]. Also Craggs, ¶[0023], there is log for new encryption key. ¶[0024], encryption log may include details for the entire database, an index of a row that has been encrypted or any other details. ¶[0025], the encryption log may maintain a record that tracks encryption key and their correlated encrypted data. ¶[0072], the encryption log may include a table value in the database, a row number of the database, a column number of the database, a timestamp or a state of the database).
Regarding Claim 11, Pocas discloses a device comprising:
at least one processor (Pocas, Fig-5); and
at least one memory containing instructions that, when executed by the processor, cause the processor to (Pocas, Fig-5):
determine that use of an old key for encrypting data on a storage system is to be replaced with use of a new key (Pocas, ¶[0032], each key may be associated with a timestamp. The timestamp allows older keys to be identified. ¶[0041], the index identifies which keys are expired, current, newer, latest. ¶[0046], for keys where x<N, the state of the key DEKx, may be expired and deleted);
in response to determining that use of the old key is to be replaced with use of the new key (Pocas, ¶[0027], if a key reaches the maximum age, the key management engine may scan the storage system to ensure that no data exists that is encrypted with that key. If such data is found, the data is rekeyed with the latest or newest key):
read a block of data from the storage system that is encrypted with the old key (Pocas, ¶[0057], the key 132 has reached the maximum age. As a result, a rekeying operation is performed and may be mandatory. ¶[0094], Fig-4, a read request is received. The key index is identified);
decrypt the block of data using the old key (Pocas, ¶[0095], once the key index is determined, the data is read, decrypted with the corresponding key and returned to the requestor. ¶[0098], when a key reaches the maximum age, the data encrypted that key should be re-encrypted with the latest key);
encrypt the block of data using the new key (Pocas, ¶[0060], the data 122 is read and the decrypted with the key 132. The decrypted data is then encrypted with the key 142 and written back to storage. Fig-1G. ¶[0076]- ¶[0077], once data 182 is identified, the data 182 can be decrypted with the key ID1 and re-3ncrypted with the latest key ID4); and
write the block of data encrypted with the new key to the storage system (Pocas, ¶[0060], the data 122 is read and the decrypted with the key 132. The decrypted data is then encrypted with the key 142 and written back to storage. ¶[0061], new encryption key may be introduced in accordance with a key introduction period (daily, weekly or other period). ¶[0081], a block in that extent is then allocated and the data encrypted with the latest key is written to the allocated block); and
update a progress indicator that indicates which locations on the storage system store data encrypted with the old key and which locations on the storage system store data encrypted with the new key (Pocas, ¶[0082]- ¶[0085], inline metadata, external metadata, N-way associative. The mapping can be used to identify what data is encrypted with which key. When rekeying data associated with an older key, data encrypted with that older key to be identified and rekeyed with the latest key).
Pocas does not explicitly teach the following limitation that Craggs teaches:
progress indicator (Craggs, ¶[0023], there is log for new encryption key. ¶[0024], encryption log may include details for the entire database, an index of a row that has been encrypted or any other details. Encryption log may include table value in the database. ¶[0025], the encryption log may maintain a record that tracks encryption key and their correlated encrypted data. ¶[0072], the encryption log may include a table value in the database, a row number of the database, a column number of the database, a timestamp or a state of the database).
Pocas in view of Craggs are analogous art because they are from the “same field of endeavor” and are from the same “problem solving area”. Namely, they pertain to the field of “encryption keys for encrypting data”. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the invention to modify the invention of Pocas in view of Craggs to include the idea of increasing the data security for protecting digital data from undesirable destructive events (Craggs, ¶[0002] )
Regarding Claim 12, Pocas in view of Craggs discloses the device of claim 11, wherein the storage system is configured to perform production input/output operations after replacing use of the old key with use of the new key has started but before replacing use of the old key with use of the new key has completed (Pocas, ¶[0064], the ability to perform operations on smaller sized data sets does not incur unreasonable system load or any downtime to satisfy the maximum age constraint, even when input parameters are changed dynamically).
Regarding Claim 13, Pocas in view of Craggs discloses the device of claim 11, wherein reading the block of data from the storage system that is encrypted with the old key is further in response to determining that the progress indicator indicates that the block of data has not yet been reencrypted with the new key (Pocas, ¶[0041], the time variable 106 may include an uptime. When adding a new key, time limit 108 may require a rekeying operation to be performed such that an older key may be deleted. The index 112 identifies which keys are expired, current, newer, latest. Also Craggs, ¶[0023], there is log for new encryption key. ¶[0024], encryption log may include details for the entire database, an index of a row that has been encrypted or any other details. ¶[0025], the encryption log may maintain a record that tracks encryption key and their correlated encrypted data. ¶[0072], the encryption log may include a table value in the database, a row number of the database, a column number of the database, a timestamp or a state of the database).
Regarding Claim 14, Pocas in view of Craggs discloses the device of claim 11, the instructions further causing the processor to:
receive, while reencryption of the storage system with the new key in place of the old key is in progress, a production write operation to store a write block to a target location of the storage system (Pocas, ¶[0042]-¶[0051], for keys where x<N, the state of the key DEKx may be expired and deleted. When x=M, the key DEKM is the latest or newest key. All new data is encrypted and written to storage using this key. Also Craggs, Fig-3B);
select between the old key and the new key based on the progress indicator (Pocas, ¶[0053]-¶[0057], Fig-1B thru Fig-1D, rekeying operation is performed); and
encrypt the write block using the selected key (Pocas, ¶[0053]-¶[0057], Fig-1B thru Fig-1D, rekeying operation is performed).
Regarding Claim 15, Pocas in view of Craggs discloses the device of claim 11, the instructions further causing the processor to:
receive, while reencryption of the storage system with the new key in place of the old key is in progress, a production write operation to store a write block to a target location of the storage system that is currently encrypted using the old key (Pocas, ¶[0042]-¶[0051], for keys where x<N, the state of the key DEKx may be expired and deleted. When x=M, the key DEKM is the latest or newest key. All new data is encrypted and written to storage using this key. Also Craggs, Fig-3B);
encrypt the write block using the new key (Pocas, ¶[0053]-¶[0057], Fig-1B thru Fig-1D, rekeying operation is performed); and
update the progress indicator to reflect that the target location is encrypted using the new key (Pocas, ¶[0082]- ¶[0085], inline metadata, external metadata, N-way associative. The mapping can be used to identify what data is encrypted with which key. When rekeying data associated with an older key, data encrypted with that older key to be identified and rekeyed with the latest key. Also Craggs, ¶[0023], there is log for new encryption key. ¶[0024], encryption log may include details for the entire database, an index of a row that has been encrypted or any other details. ¶[0025], the encryption log may maintain a record that tracks encryption key and their correlated encrypted data. ¶[0072], the encryption log may include a table value in the database, a row number of the database, a column number of the database, a timestamp or a state of the database).
Regarding Claim 16, Pocas in view of Craggs discloses the device of claim 11, the instructions further causing the processor to:
receive, while reencryption of the storage system with the new key in place of the old key is in progress, a production read operation to retrieve a read block from a target location of the storage system (Pocas, ¶[0042]-¶[0051], for keys where x<N, the state of the key DEKx may be expired and deleted. When x=M, the key DEKM is the latest or newest key. All new data is encrypted and written to storage using this key. Also Craggs, Fig-3A);
select between the old key and the new key based on the progress indicator (Pocas, ¶[0053]-¶[0057], Fig-1B thru Fig-1D, rekeying operation is performed); and
decrypt the read block using the selected key (Pocas, ¶[0053]-¶[0057], Fig-1B thru Fig-1D, rekeying operation is performed).
Regarding Claim 17, Pocas in view of Craggs discloses the device of claim 11, wherein reading the block of data from the storage system that is encrypted with the old key is further in response to determining that reencrypting the block of data will not interfere with a production input/output operation by the storage system (Pocas, ¶[0061], new encryption keys may be introduced in accordance with a key introduction period (daily, weekly or other period). Also Craggs, ¶[0036], a majority of the database table may be rotated without interfering with performance and locking out the table for other read/writes).
Regarding Claim 18, Pocas in view of Craggs discloses the device of claim 17, wherein the instructions further cause the processor to:
determine that reencrypting the block of data will interfere with at least one production input/output operation by the storage system (Pocas, ¶[0061], keeping and managing a few hundred keys allows the key related operations to be performed consistently, in the background and as resources become available. Craggs, ¶[0036], a majority of the database table may be rotated without interfering with performance and locking out the table for other read/writes); and
delay reencryption of the block of data until determining that reencrypting the block of data will not interfere with a production input/output operation by the storage system (Pocas, ¶[0074], when a new key is generated, the statuses of the keys are managed. A rekeying may have just completed and a key may have been deleted, the status of other keys can be updated. Craggs, ¶[0036], a majority of the database table may be rotated without interfering with performance and locking out the table for other read/writes).
Regarding Claim 19, Pocas discloses a system comprising:
a storage device (Pocas, Fig-5);
at least one processor (Pocas, Fig-5); and
at least one memory containing instructions that, when executed by the processor, cause the processor to (Pocas, Fig-5):
determine that use of an old key for encrypting data on the storage device is to be replaced with use of a new key (Pocas, ¶[0032], each key may be associated with a timestamp. The timestamp allows older keys to be identified. ¶[0041], the index identifies which keys are expired, current, newer, latest. ¶[0046], for keys where x<N, the state of the key DEKx, may be expired and deleted);
in response to determining that use of the old key is to be replaced with use of the new key (Pocas, ¶[0027], if a key reaches the maximum age, the key management engine may scan the storage system to ensure that no data exists that is encrypted with that key. If such data is found, the data is rekeyed with the latest or newest key):
read a block of data from the storage device that is encrypted with the old key (Pocas, ¶[0057], the key 132 has reached the maximum age. As a result, a rekeying operation is performed and may be mandatory. ¶[0094], Fig-4, a read request is received. The key index is identified);
decrypt the block of data using the old key (Pocas, ¶[0095], once the key index is determined, the data is read, decrypted with the corresponding key and returned to the requestor. ¶[0098], when a key reaches the maximum age, the data encrypted that key should be re-encrypted with the latest key);
encrypt the block of data using the new key; and write the block of data encrypted with the new key to the storage device (Pocas, ¶[0060], the data 122 is read and the decrypted with the key 132. The decrypted data is then encrypted with the key 142 and written back to storage. Fig-1G. ¶[0076]- ¶[0077], once data 182 is identified, the data 182 can be decrypted with the key ID1 and re-3ncrypted with the latest key ID4); and
update a progress indicator that indicates which locations on the storage device store data encrypted with the old key and which locations on the storage device store data encrypted with the new key (Pocas, ¶[0082]- ¶[0085], inline metadata, external metadata, N-way associative. The mapping can be used to identify what data is encrypted with which key. When rekeying data associated with an older key, data encrypted with that older key to be identified and rekeyed with the latest key).
Pocas does not explicitly teach the following limitation that Craggs teaches:
progress indicator (Craggs, ¶[0023], there is log for new encryption key. ¶[0024], encryption log may include details for the entire database, an index of a row that has been encrypted or any other details. Encryption log may include table value in the database. ¶[0025], the encryption log may maintain a record that tracks encryption key and their correlated encrypted data. ¶[0072], the encryption log may include a table value in the database, a row number of the database, a column number of the database, a timestamp or a state of the database).
Pocas in view of Craggs are analogous art because they are from the “same field of endeavor” and are from the same “problem solving area”. Namely, they pertain to the field of “encryption keys for encrypting data”. It would have been obvious to a person of ordinary skill in the art before the effective filing date of the invention to modify the invention of Pocas in view of Craggs to include the idea of increasing the data security for protecting digital data from undesirable destructive events (Craggs, ¶[0002] ).
Regarding Claim 20, Pocas in view of Craggs discloses the system of claim 19, wherein the storage device is configured to perform production input/output operations after replacing use of the old key with use of the new key has started but before replacing use of the old key with use of the new key has completed (Pocas, ¶[0064], the ability to perform operations on smaller sized data sets does not incur unreasonable system load or any downtime to satisfy the maximum age constraint, even when input parameters are changed dynamically).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure (see PTO-Form 892).
Any inquiry concerning this communication or earlier communications from the examiner should be directed to WASIKA NIPA whose telephone number is (571)272-8923. The examiner can normally be reached on M-F, 8 am to 5 pm. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Pwu can be reached on 571-272-6798. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, Applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/WASIKA NIPA/ Primary Examiner, Art Unit 2433
Prosecution Insights