Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
The Action is responsive to the Amendments and Remarks filed on 8/5/2026. Claims 1-21 are pending claims. Claims 1, 11, and 12 are written in independent form.
Priority
Acknowledgment is made of a claim for priority as a Continuation of Application 18/049096, filed 10/24/2022, which claims priority from Provisional Application 63/377400, filed 9/28/2022.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-21 are rejected under 35 U.S.C. 103 as being unpatentable over Nijjar (U.S. Patent No. 9,069,983) and further in view of Joshi et al. (U.S. Pre-Grant Publication No. 2020/0125746, hereinafter referred to as Joshi) and Ramanathan et al. (U.S. Pre-Grant Publication No. 2015/0378563, hereinafter referred to as Ramanathan).
Regarding Claim 1:
Nijjar teaches a method for agentless detection of sensitive data in a cloud computing environment and rendering the same for display, comprising:
Accessing a database service;
Nijjar teaches “a computer (e.g., the computer 300 of Fig. 3) may host one or more virtual machines (e.g., the virtual machines 114 of Fig. 1) that interface with one or more computer users” (Col. 14 Lines 27-41) and, in relation to figure 3, “the operation system 308 generally manages various computer resources (e.g., network resources, data storage resources, file system resources and/or the like)” (Col. 8 Lines 8-10). Therefore, Nijjar teaches accessing a database service via operation system 308 which manages various computer resources including data storage resources.
Extracting a plurality of data files from the database service of a cloud computing environment;
Nijjar teaches “a snapshot for the virtual machine is created and started” and “in some embodiments, the DLP module calls various virtualization functions using one or more processors to generate a snapshot (e.g., the snapshot 420 of Fig. 4) of the frozen virtual machine in memory at the computer” (Col. 14 Line 56 – Col. 15 Line 3) thereby teaching extracting data files for the snapshot via calling various virtualization functions to generate the snapshot.
Detecting a first data object in the plurality of data files, the first data object including a content;
Nijjar teaches “at step 508, the data objects are examined” (Col. 13 Lines 10-26). Nijjar further teaches “if the DLP module identifies a portion of any data object that exceeds a certain threshold sensitivity level as defined in the DLP policy, the DLP module uses the one or more processors to perform one or more remediate techniques on the virtual disk that includes the identified object” (Col. 13 Lines 27-37]). Therefore, Nijjar teaches detecting a data object including the content of the data object for classification as sensitive information.
Classifying the first data object based on performing a natural language processing (NLP) technique on the content of the first data object, wherein the content is classified as sensitive data or non-sensitive data based on a result of the NLP technique; and
Nijjar teaches classifying particular data objects as sensitive information by applying “the DLP policy to the one or more data objects to assess sensitivity levels for various portions of the one or more data objects” where “if the DLP module identifies a portion of any data object that exceeds a certain threshold sensitivity level as defined in the DLP policy, the DLP module uses the one or more processors to perform one or more remediate techniques on the virtual disk that includes the identified object” (Col. 13 Lines 27-37]). Therefore, Nijjar teaches classifying data objects based on the content of the data object being classified as sensitive or non-sensitive data;Nijjar further teaches the classifying of a data object by performing a natural language processing technique on the content of the data object by teaching “the DLP policy 320 includes one or more unique patterns (e.g., collections of words) that are used to distinguish sensitive information 328 from any other information..[and] may define one or more word patterns (e.g., ‘Security Exchange Filing’) that specify various data having a very high sensitivity level” where “the DLP module 116 may examine the DLP policy 118 to determine a current sensitivity level of one or more data objects that include the sensitive information 328 of the data objects 326” (35) and in an example that “DLP module 318 examines a MICROSOFT word file and identifies a string ‘confidential and/or Privileged Information’. Based on the DLP policy 320, the identification of such a string represents a very strong likelihood that the file includes very sensitive information” (36).
Nijjar explicitly teaches all of the elements of the claimed invention as recited above except:
A data object including a data schema;
Generating a representation in a security database to represent: the first data object and the classification thereof, and the data schema, wherein the security graph further includes a representation of the cloud computing environment;
Detecting a second data object in the plurality of data files, the second data object sharing the data schema of the first data object;
Generating in the security database: a second representation of a data object representing the second data object;
Connecting the data schema representation to: the second data object representation and the generated representation of the first data object, in response to detecting the shared data schema;
Receiving a query to detect a representation of a data object classified as sensitive data; and
Rendering an output based on the classification and the representation of the data schema in response to receiving the query,
Wherein the rendered output comprises a data cluster node connected to the generated representation of the first data object and the second data object representation, the data cluster node being provided as an output to the query in lieu of providing the generated representation of the first data object and the second data object representation as the output to the query.
However, in the related field of endeavor of sensitive data discovery, Joshi teaches:
A data object including a data schema; and
Joshi teaches “contextual information for a database object may include…schema-level context” (Para. [0089]).
Generating a representation in a security database to represent: the first data object and the classification thereof, and the data schema, wherein the security graph further includes a representation of the cloud computing environment.
Joshi teaches “a hierarchical regex may be stored and/or represented as a tree structure or a directed graph comprising a set of nodes and edges” and “SDDE 106 may traverse the tree structured during the evaluation process…to determine the search patterns to use when scanning data objects for sensitive data” (Para. [0087]).
Joshi further teaches “a parent node in a hierarchy corresponds to a generic regex. Nodes that are children of the parent nodes are referred to as specific regexes. A generic regex defines a generic or broader pattern to search for in comparison to the child nodes. The specific regexes in the hierarchy may define more specific or narrower patterns for which to search. For example, a generic node in the hierarchy may define a regex as follows “(?i)credit.*number.” A more specific regex in the hierarchy may define the regex “(?i)credit*.card*.number”. As can be seen, the specific regex added the literal subexpression “card” in between two other subexpressions “credit” and “number” of the generic regex.” (Para. [0083]).
As mentioned in the previous limitation, Joshi teaches the first data object including a data schema (Para. [0089]). Therefore, Joshi teaches a node in the hierarchical regex to represent a first data object and the classification as sensitive data, and the data schema.
Detecting a second data object in the plurality of data files, the second data object sharing the data schema of the first data object;
Joshi teaches “a parent node in a hierarchy corresponds to a generic regex. Nodes that are children of the parent nodes are referred to as specific regexes. A generic regex defines a generic or broader pattern to search for in comparison to the child nodes. The specific regexes in the hierarchy may define more specific or narrower patterns for which to search. For example, a generic node in the hierarchy may define a regex as follows “(?i)credit.*number.” A more specific regex in the hierarchy may define the regex “(?i)credit*.card*.number”. As can be seen, the specific regex added the literal subexpression “card” in between two other subexpressions “credit” and “number” of the generic regex.” (Para. [0083]). Joshi further teaches “a hierarchical regex may be stored and/or represented as a tree structure or a directed graph comprising a set of nodes and edges” and “SDDE 106 may traverse the tree structured during the evaluation process…to determine the search patterns to use when scanning data objects for sensitive data” (Para. [0087]).
Therefore, Joshi teaches adding a data structure of an object to the hierarchical regex to represent the data object and the classification as sensitive data, and then using that data structure in the regex to detect future data objects that are similar or the same in structure.
Generating in the security database: a second representation of a data object representing the second data object;
Joshi further teaches “a parent node in a hierarchy corresponds to a generic regex. Nodes that are children of the parent nodes are referred to as specific regexes. A generic regex defines a generic or broader pattern to search for in comparison to the child nodes. The specific regexes in the hierarchy may define more specific or narrower patterns for which to search. For example, a generic node in the hierarchy may define a regex as follows “(?i)credit.*number.” A more specific regex in the hierarchy may define the regex “(?i)credit*.card*.number”. As can be seen, the specific regex added the literal subexpression “card” in between two other subexpressions “credit” and “number” of the generic regex.” (Para. [0083]). Therefore, Joshi teaches a node in the hierarchical regex to represent a data object and the classification as sensitive data.
Connecting the data schema representation to: the second data object representation and the generated representation of the first data object, in response to detecting the shared data schema;
Joshi teaches “In addition or as an alternative to table-level contexts, SDDE 106 may analyze other contexts. For example, SDDE 106 may determine whether objects in the same schema and/or database are mapped to the same sensitive group classifier.” (Para. [0092]) thereby teaching having connected, or mapped, objects after determining the objects as being in the same schema and/or database.
Receiving a query to detect a representation of a data object classified as sensitive data; and
Joshi teaches “a query analytic system receives a set of one or more queries that accesses data from a set of data objects” (Abstract) and “sensitive data is detected by searching for data and/or metadata that match a set of regular expressions.” (Para. [0046]).
Rendering an output based on the classification and the representation of the data schema in response to receiving the query,
Joshi teaches ““a hierarchical regex may be stored and/or represented as a tree structure or a directed graph comprising a set of nodes and edges” and “SDDE 106 may traverse the tree structured during the evaluation process…to determine the search patterns to use when scanning data objects for sensitive data” (Para. [0087]) thereby teaching a query to detect a node representing a data object classified as sensitive. Joshi further teaches rending an output based on a request/query by teaching “information about the second object may be displayed when information about related objects is requested for the first object” (Para. [0052]).
Thus, it would have been obvious to one of ordinary skill in the art, having the teachings of Joshi and Nijjar at the time that the claimed invention was effectively filed, to have modified the systems and methods for protecting sensitive information form disclosure through virtual machine files, as taught by Nijjar, with the use of comparing data structures in addition to content of data objects, as taught by Joshi.
One would have been motivated to make such combination because Joshi teaches generating confidence scores “as a function of multiple factors, which may help reduce false positives and/or false negatives when classifying data objects as sensitive” (Para. [0048]) and it would be obvious to a person having ordinary skill in the art that it would be beneficial to improve the accuracy and precision of classifying sensitive data objects by reducing false positives and/or false negatives.
Joshi and Nijjar explicitly teach all of the elements of the claimed invention as recited above except:
Wherein the rendered output comprises a data cluster node connected to the generated representation of the first data object and the second data object representation, the data cluster node being provided as an output to the query in lieu of providing the generated representation of the first data object and the second data object representation as the output to the query.
However, in the related field of endeavor of displaying related object information, Ramanathan teaches:
Wherein the rendered output comprises a data cluster node connected to the generated representation of the first data object and the second data object representation, the data cluster node being provided as an output to the query in lieu of providing the generated representation of the first data object and the second data object representation as the output to the query.
Ramanathan teaches ”The dataset aggregator 30 is adapted to selectively retrieve data (e.g., via Structured Query Language statements, web services, and/or other mechanisms) from the backend database 40, e.g., with reference to the settings 28 and any associated data models specified for use in displaying the orbit visualization 20. Retrieved data may be stored in a cache of the dataset aggregator 30, or alternatively, may be maintained at the database 40 and then only retrieved when needed to facilitate generation of the orbit visualization 20.” (Para. [0087]) and “the database 930 includes a relational database that is adapted to store, update, and retrieve data in response to SQL (Structured Query Language) format commands or other database query languages.” (para. [0171]) where “For the purposes of the present discussion, a data attribute (also simply called attribute herein) may be any value or property characterizing data. Accordingly, an attribute of a visualization, node, or associated data, may refer to any characteristic of data used to generate a visualization or any characteristic of a visualization representing a characteristic of the data. The data characteristic and/or visualization characteristic may be employed to group or otherwise organize or visually distinguish the data by adjusting features or characteristics of the visualization” (Para. [0040])
Ramanathan further teaches “The hierarchical relationships are leveraged by the data aggregator 30 of the system 10 of FIG. 1 to generate orbit visualizations, e.g., the orbit visualization 20 of FIG. 1. The example tree diagram 50 may represent hierarchical relationships of the tree tables 38 of the data aggregator 30.” (Para. [0099]) and “providing a first user option to expand the one or more petals, resulting in conversion of the petals to planets (also called planet nodes, orbiting nodes, satellites, or satellite nodes herein) that are positioned on a second orbit path about a second node corresponding to an object of the one or more additional second objects.” (Para. [0018]) where Figure 3 Element 108 of Ramanathan teaches a rendered output comprising a data cluster node 108 connected to but also in lieu of the generated representation of nodes 114-122.
Thus, it would have been obvious to one of ordinary skill in the art, having the teachings of Ramanathan, Joshi, and Nijjar at the time that the claimed invention was effectively filed, to have modified the systems and methods for protecting sensitive information form disclosure through virtual machine files, as taught by Nijjar, and the use of comparing data structures in addition to content of data objects, as taught by Joshi, with the visualization of related data objects, as taught by Ramanathan.
One would have been motivated to make such combination because while Joshi teaches “when a relationship between two objects is detected, the query analytic system stores an indication of the relationship even though there may be no explicitly defined relationship within the database” and “information about the second object may be displayed when information about related objects is requested for the first object” (para. [0052]), Ramanathan teaches “Space-efficient and illustrative visualizations are particularly important for depicting large sets of hierarchically related enterprise data on relatively small mobile device displays, such as smartphone and tablet displays” (para. [0051]) and a specific interface/display for performing the display of objects having determined relationships (Figs. 3-5) with “efficient mechanisms for conveying and interacting with data, such as enterprise data characterized by hierarchical relationships (also simply called hierarchical data), while facilitating maintain context information.” (Para. [0024]).
Regarding Claim 2:
Ramanathan, Joshi and Nijjar further teach:
Detecting that a workload deployed in the cloud computing environment stores data in the database service.
Joshi teaches “RDE 108 determines which of a set of one or more operations to use to discover relationships” where “examples operations may include…analyzing workload repository” (Para. [0183])
Regarding Claim 3:
Ramanathan, Joshi and Nijjar further teach:
Receiving access credentials for the database service, the access credentials providing access to the plurality of data files.
Joshi “These managed applications may be authenticated or plugged in to the microservices manager, for example, with user-supplied application credentials to the manager, without requiring reauthentication each time the managed application is used alone or in combination with other applications” (Para. [0265])
Regarding Claim 4:
Ramanathan, Joshi and Nijjar further teach:
Inspecting only a portion of the plurality of data files for a data object.
Joshi teaches “in one or more embodiments, in a multi-tenant computer network, tenant isolation is implemented to ensure that the applications and/or data of different tenants are not shared with each other. Various tenant isolation approaches may be used.” (Para. [0257]) thereby teaching inspecting only a portion of the plurality of data files for a data object.
Regarding Claim 5:
Ramanathan, Joshi and Nijjar further teach:
Classifying the first data object further based on any one of: the data schema, the content, a metadata, and any combination thereof.
Nijjar teaches classifying particular data objects as sensitive information by applying “the DLP policy to the one or more data objects to assess sensitivity levels for various portions of the one or more data objects” where “if the DLP module identifies a portion of any data object that exceeds a certain threshold sensitivity level as defined in the DLP policy, the DLP module uses the one or more processors to perform one or more remediate techniques on the virtual disk that includes the identified object” (Col. 13 Lines 27-37]). Therefore, Nijjar teaches classifying data objects based on the content of the data object being classified as sensitive or non-sensitive data;
Nijjar further teaches that “the virtual machine files 108 may includes various data objects 110 (e.g., file system objects, such as data files, directories and/or metadata)” (Col. 5 Lines 39-52) thereby teaching classifying the data object based on metadata.
Joshi teaches “SDDE 106 is configured to automatically search for and discover data using a set of data and/or metadata regexes” (para. [0070]) where “a hierarchical regex may be stored and/or represented as a tree structure or a directed graph comprising a set of nodes and edges” and “SDDE 106 may traverse the tree structured during the evaluation process…to determine the search patterns to use when scanning data objects for sensitive data” (Para. [0087]). Therefore, Joshi teaches using the schema/data structure for classifying data objects.
Regarding Claim 6:
Ramanathan, Joshi and Nijjar further teach:
Extracting from the first data object a file header and a plurality of data blocks.
Nijjar teaches “the mapping information 316 may include an extent…for each and every addressable data block associated with the data objects 326 within the one or more virtual disks” (Col. 8 Line 40-61) and “the DLP module processing the mapping information to perform an address scan of the one or more virtual disks in which each logical portion (e.g., data block) of the one or more data objects is examined” (Col. 13 Line 10-26).
Nijjar also teaches “the DLP module issues read operations for various metadata blocks” (Col. 12 Line 56 – Col. 13 Line 9) thereby teaching extracting a file header in order to access the metadata blocks about the data objects.
Regarding Claim 7:
Ramanathan, Joshi and Nijjar further teach:
Classifying sensitive data further as any one of: personal identifiable information (PII), Personal health information (PHI), Payment card industry (PCI), and any combination thereof.
Joshi teaches “SDDE 106 is configured to analyze and classify data objects that include sensitive data. Sensitive data may include, but is not limited to, personal credit information (PCI), personal identifying information (PII), personal health information (PHI), trade secrets, and/or other confidential information.” (Para. [0060])
Regarding Claim 8:
Ramanathan, Joshi and Nijjar further teach:
Initiating a mitigation action in response to determining that the content is classified as sensitive data.
Joshi teaches “data security operations may be performed based on the confidence scores assigned to data objects” where “example data security operation may include…data deletion” and “one or more operations may be automatically triggered against a data object if there is a high level of confidence that the data object stores sensitive data” (Para. [0050])
Regarding Claim 9:
Ramanathan, Joshi and Nijjar further teach:
initiating the mitigation action in response to determining that the content is classified as sensitive data deployed on a data object in a cloud computing environment which is unauthorized for storing sensitive data.
Joshi teaches “the techniques for automatically detecting sensitive data may be combined with the techniques for automatically discovering relationships between data objects to bolster data security in a cloud or other network environment” (Para. [0053]) and “DPE 110 may automatically delete sensitive data. For example, SDDE 106 may monitor uploads to a cloud environment for sensitive data of a particular sensitive type” (Para. [0173]).
Joshi further teaches that the cloud computing environment is unauthorized for storing sensitive data because the sensitive data is deleted, which indicates that the cloud or other network environment is not authorized for storing the particular sensitive data.
Regarding Claim 10:
Ramanathan, Joshi and Nijjar further teach:
Wherein the mitigation action further comprises:
configuring a storage service to delete the first data object; and
Joshi teaches “the techniques for automatically detecting sensitive data may be combined with the techniques for automatically discovering relationships between data objects to bolster data security in a cloud or other network environment” (Para. [0053]) and “DPE 110 may automatically delete sensitive data. For example, SDDE 106 may monitor uploads to a cloud environment for sensitive data of a particular sensitive type” (Para. [0173]).
Deleting the first data object.
Joshi teaches “the techniques for automatically detecting sensitive data may be combined with the techniques for automatically discovering relationships between data objects to bolster data security in a cloud or other network environment” (Para. [0053]) and “DPE 110 may automatically delete sensitive data. For example, SDDE 106 may monitor uploads to a cloud environment for sensitive data of a particular sensitive type” (Para. [0173]).
Regarding Claim 11:
Some of the limitations herein are similar to some or all of the limitations of Claim 1.
Ramanathan, Joshi and Nijjar further teach:
A non-transitory computer-readable medium storing a set of instructions for agentless detection of sensitive data in a cloud computer environment and rendering the same for display, the set of instructions comprising: one or more instructions that, when executed by one or more processors of a device cause the device to perform steps (Nijjar – Claim 10 & Joshi – Para. [0291])).
Regarding Claim 12:
Some of the limitations herein are similar to some or all of the limitations of Claim 1.
Ramanathan, Joshi and Nijjar further teach a system for agentless detection of sensitive data in a cloud computing environment and rendering the same for display, comprising:
One or more processors configured to perform steps (Nijjar – Col. 7 Line 54 – Col. 8 Line 7 and Joshi – Para. [0280]).
Regarding Claim 13:
All of the limitations herein are similar to some or all of the limitations of Claim 2.
Regarding Claim 14:
All of the limitations herein are similar to some or all of the limitations of Claim 3.
Regarding Claim 15:
All of the limitations herein are similar to some or all of the limitations of Claim 4.
Regarding Claim 16:
All of the limitations herein are similar to some or all of the limitations of Claim 5.
Regarding Claim 17:
All of the limitations herein are similar to some or all of the limitations of Claim 6.
Regarding Claim 18:
All of the limitations herein are similar to some or all of the limitations of Claim 7.
Regarding Claim 19:
All of the limitations herein are similar to some or all of the limitations of Claim 8.
Regarding Claim 20:
All of the limitations herein are similar to some or all of the limitations of Claim 9.
Regarding Claim 21:
All of the limitations herein are similar to some or all of the limitations of Claim 10.
Response to Amendment
Applicant’s Amendments, filed on 8/5/2026, are acknowledged and accepted.
In light of the Amendments filed on 8/5/2026, the 112(a) rejection of Claims 1-21 has been withdrawn.
In light of the Amendments filed on 8/5/2026, the nonstatutory double patenting rejection of Claims 1-21 has been withdrawn.
Response to Arguments
On Pages 4-5 of the Remarks filed on 8/5/2026, Applicant argues that “Joshi does not disclose the [amended] limitation” because “paragraph [0089] states that contextual information for a database object may include schema-level context, and paragraph [0092] states that SDDE 106 may determine whether objects in the same schema and/or database map to the same sensitive group classifier and may increase an associated confidence score. These teachings concern contextual information, same-schema mapping to a sensitive group classifier, and confidence-score adjustment.” and “paragraph [0052] also does not cure these deficiencies. That paragraph states that, when a relationship between two objects is detected, the query analytic system may store an indication of the relationship, propagate operations such as security measures to related objects, and display information about a second object when information about related objects is requested for a first object. Displaying information about a related second object is not the same as providing “the data cluster node” as the query output in lieu of the generated representation of the first data object and the second data object representation”Applicant’s argument is convincing and therefore necessitates the new grounds of rejection presented herein.
On Pages 5-6 of the Remarks filed on 8/5/2026, Applicant states that “Applicant disagrees with the rationale in the Office Action to combine Nijjar and Joshi. The rejection states that it would have been obvious to modify Nijjar’s systems and methods for protecting sensitive information from disclosure through virtual machine files with Joshi’s use of comparing data structures in addition to content of data objects, because Joshi teaches generating confidence scores as a function of multiple factors, which may help reduce false positives and/or false negatives when classifying data objects as sensitive. Applicant respectfully submits that this stated rationale is overly broad and does not provide the required articulated reasoning with rational underpinning for modifying the applied references to arrive at claim 1” and the “rationale does not explain why one of ordinary skill in the art would have modified Nijjar and Joshi so that ‘the rendered output comprises a data cluster node connected to the generated representation of the first data object and the second data object representation,’ or why such a person would have further modified the asserted combination so that ‘the data cluster node [is] provided as an output to the query in lieu of providing the generated representation of the first data object and the second data object representation as the output to the query.’”Applicant’s argument is moot because the rationale being argued was not previously related to the newly added limitations being argued and because the newly added limitations have necessitated the new grounds of rejection presented herein.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Lee et al. (U.S. Pre-Grant Publication No. 2013/0117232) teaches “a captured database model snapshot contains the information that defines the structure of the database model from which it is captured” and “the captured database model snapshot may be generated to have the form of a file system object (e.g., a file), and its contents may be formatted in a generic, human readable form” (Para. [0004]). Lee further teaches “snapshot object generator 408 may convert metadata 414 into XML code” and “generate the database model snapshot object to contain the source database model serialized into XML and packaged into an OPC (open packaging convention) format” (Para. [0047]). Lee also teaches “any type of testing and number of tests may be performed on a database model snapshot object, including validity testing, testing for security violations (e.g., checking whether particular sensitive columns/tables are present in a data model), testing for legal requirements (e.g., checking whether legal requirements for contents of a data model are being met), testing for business requirements, and/or other types of testing” (Para. [0070]).
Lukacs et al. (U.S. Pre-Grant Publication No. 2020/0065131) teaches performing software audits remotely and automatically, on a relatively large number of client systems (e.g., a corporate network, a virtual desktop infrastructure system, etc.) An audit engine executes on each client system, in a hardware virtualization configuration wherein the audit engine executes outside an audited virtual machine. When receiving an audit request from an audit server, some embodiments of the audit engine drop an audit agent into the audited virtual machine, and remove the audit agent upon completion of the audit.
Griffith et al. (U.S. Pre-Grant Publication No. 2017/0323110) teaches generating a secured system snapshot of a system. An example computer-implemented method includes receiving an instruction to generate a system snapshot. The system snapshot captures data from a computer executable object loaded in a memory. The method also includes accessing metadata that is associated with the computer executable object from a mapping list. The method also includes capturing the secured system snapshot by. Capturing the secured system snapshot includes determining sensitivity of the computer executable object by comparing the metadata with a predetermined criteria, and excluding a capture of sensitive data from the computer executable object into the system snapshot in response to the metadata of the computer executable object matching the predetermined criteria. The method also includes storing the secured system snapshot.
Sanvido (U.S. Pre-Grant Publication No. 2022/0253225) teaches protecting sensitive data in snapshots, including: creating a transformed snapshot portion by applying a transformation specified in an access policy to one or more data objects contained within the portion of the stored snapshot, wherein the stored snapshot is a copy of data in a storage system at a particular point in time prior to a request to access the snapshot; and providing access to the transformed snapshot portion.
Bracholdt et al. (U.S. Pre-Grant Publication No. 2020/0349130) teaches a metastructure for representing and manipulating or analyzing a data model is provided herein. A source representation of the first data model may be received. The source representation may include a representation of one or more structural components of the first data model, respectively having identifiers and types. One or more instances of a metastructure schema object datatype may be generated based on the one or more structural components of the source representation. Generating a given instance of the metastructure schema object datatype for a given structural component may include assigning a first identifier of the given structural component to the first data member of the given instance, determining a first type associated with the given structural component, and assigning the first type to the second data member of the given instance. The one or more instances of the metastructure schema object datatype may be stored in association.The reference further teaches “ A lightweight and standardized method or format, such as the matching metastructure technologies disclosed herein, generally makes mapping data models much easier and faster, while being less costly and less labor-intensive, because consistency in format generally increases efficiency, such as by allowing re-use of work, and may be automated or semi-automated.” (Para. [0049]).
Lankford et al. (U.S. Pre-Grant Publication No. 2019/0377713) teaches database schema management systems and methods. An intake engine can receive a platform-specific schema definition language and an intake template for converting the input schema to a platform-neutral schema. The intake template can define one or more translation operations required to convert from the first platform-specific schema definition language to a platform-neutral schema definition language. In embodiments, the intake engine can validate the input schema based on one or more design criteria. A repository can store platform-neutral schemas and deployment information. An output template can define one or more translation operations to convert from the platform-neutral schema definition language to a platform-specific schema definition language. A deployment engine can deploy a selected schema to a target database upon request.The reference further teaches “multiple schema records 302 can be associated with the same schema, such that each schema record 302 is a different version of the parent schema.” (Para. [0034]).
Yan et al. (U.S. Pre-Grant Publication No. 2019/0303459) teaches a search engine identifies external data records that describe similar entities and may each conform to a different data format or source schema. The engine derives mappings capable of translating data values between differently formatted attributes of two source schemas and uses these mappings to identify degrees of similarity between attributes and schemas. When the search engine receives a search request, the engine translates submitted search criteria into values of a first schema's attributes and then uses the mappings to map those values onto selected attributes of other schemas. The search engine then uses each schema's selected attributes to select external data records formatted in that schema. Each selected record is assigned a match score that is weighted by the similarity of the record schema's selected attributes to the search criteria. Records are then retrieved in order of decreasing match score.
Gentleman et al. (U.S. Pre-Grant Publication No. 2022/0207163) teaches the dynamic data classification of data objects. Examples enable prediction of candidate data classification labels for data objects associated with one or more applications, services, or computing devices. Examples enable the assignment of one or more data classification labels to a data object for transmission to one or more computing devices. Examples enable the interactive and progressive application of machine learning techniques to data classification systems to assign data classification labels with probable certainty. Examples enable the tracking, monitoring, storage, sorting, and retrieval of labeled data objects. Examples provide for access control configuration of services to restrict or allow access to data objects based on data classifications and other service parameters.The reference further teaches “API documentation may be parsed to identify and extract parameter names, API call descriptions, schema descriptions, field names and the like for tokenization. The tokenized data may be converted, for example, into natural language processing vector data objects” (Para. [0086]) and “The terms “security related data,” “security data,” or the like refer to a type of data classification that is associated with a data object that contains user account credentials (e.g., account password, security question answer, etc.) and/or information that is determined, by a user, application, or organization to be sensitive (e.g., encryption keys, authentication certificates, trade secrets, patient medical information, etc.)… In some embodiments, the “Security/Secret” data classification label may be associated with a data object that contains sensitive words (e.g., social security number, etc.)” (Para. [0146]).
Kishi et al. (U.S. Pre-Grant Publication No. 2022/0150065) teaches determining an encryption technique for a modified data object to backup. Deep data inspection is performed on an object using a natural language processing module to determine facets for the object. The facets provide facet values for instances of sensitive information in the object. The facet values for the object are processed to determine a cumulative facet value. A determination is made of an encryption technique comprising one of a plurality of different encryption techniques to use on the object based on the cumulative facet value. The determined encryption technique is used to encrypt the object to transfer to a backup storage.The reference further teaches “The deep data inspection module 134 may utilize a natural language classification program that collects and analyzes content in the data objects 104 to classify sensitive information in the data objects 104 as facets based on processing of the metadata and content of the data objects 104. The deep data inspection module 134 may use natural language processing (NLP) utilizing ontology based natural language classification techniques to extract the facet values for sensitive information instances in the object. The deep data inspection module 134 may use deep inspection techniques such as IBM® Watson™ Explorer Content analytics, StoredIQ, Sentiment Analytics, Contextual Views based on natural language classification as well as Watson™ Application Programming Interfaces (APIs) such as speech to text, visual recognition, etc. These techniques help in capturing metadata information from data objects and determining a classification of sensitive information in the data objects 104. (IBM, Watson, and StoredIQ are trademarks of International Business Machines Corporation throughout the world).” (Para. [0036]).
Tutuianu et al. (U.S. Patent No. 11,599,667) teaches a candidate attribute combination of a first data set is identified, such that the candidate attribute combination meets a data type similarity criterion with respect to a collection of data types of sensitive information for which the first data set is to be analyzed. A collection of input features is generated for a machine learning model from the candidate attribute combination, including at least one feature indicative of a statistical relationship between the values of the candidate attribute combination and a second data set. An indication of a predicted probability of a presence of sensitive information in the first data set is obtained using the machine learning model.
Non-Patent Literature Dias, "Discovery of Sensitive Data With Natural Language Processing", 2019, ISCTE - Instituto Universitario de Lisboa (Portugal) ProQuest Dissertations & Theses (Year: 2019) teaches the study of a hybrid approach to the problem of Named Entities Recognition for the Portuguese language. This approach combines several techniques such as rule-based/lexical-based models, machine learning algorithms and neural networks. The rule-based and lexical-based approaches were used only for a set of specific classes. For the remaining classes of entities, SpaCy and Stanford NLP tools were tested, two statistical models – Conditional Random Fields and Random Forest – were implemented and, finally, a BidirectionalLSTM approach as experimented. The best results were achieved with the Stanford NER model (86.41%), from the Stanford NLP tool. Regarding the statistical models, we realized that Conditional Random Fields is the one that can obtain the best results, with a f1-score of 65.50%. With the Bi-LSTM approach, we have achieved a result of 83.01%. The corpora used for training and testing were HAREM Golden Collection, SIGARRA News Corpus and DataSense NER Corpus.
Barrett et al. (U.S. Pre-Grant Publication No. 2023/0315698) teaches generating, updating, and/or otherwise managing an asset management system and its associated objects. An example embodiment is configured for accessing an asset management repository comprising a plurality of object type identifier nodes and a plurality of object attribute identifier nodes configured in a directed graph structure; receiving an object query comprising a selected object type identifier; traversing the directed graph structure to return a selected object type schema comprising an object attribute identifier node subset associated with the selected object type identifier; and outputting a selected object type interface component based on the selected object type schema for rendering to the object types registry interface.The reference further teaches “in some embodiments, the schema (e.g., schema 600) may also comprise objects with different object attribute identifiers within the same schema (e.g., both Object A′ (615) and Object B′ (665) may also comprise different attributes, such as Object A′ (610) may be associated with Attribute 1′ (630) and Object B′ may be associated with Attribute 2′ (650)).” (Para. [0053]).
Eike et al. (U.S. Pre-Grant Publication No. 2020/0293523) teaches metadata-driven data maintenance. One or more data object queries are obtained from one or more data object frameworks. One or more sets of data objects are received based on the one or more data object queries. One or more data object nets are built based on the one or more sets of data objects and the one or more data object frameworks and respectively associated with one or more processes. The one or more data object nets and their associated processes are analyzed. Data object maintenance is performed on the data objects of the one or more data object nets based on the analysis of the one or more data object nets and their associated processes.
Murthy (U.S. Pre-Grant Publication No. 2010/0228734) teaches providing a user-directed keyword-based search on a large collection of XML documents, and displaying a summary of results to the user. Prior to receiving search requests from a user, an offline analysis of a large collection of XML documents is performed to construct an inverted index of keywords. For each keyword, the index stores a set of location indicators that identify all the instances of the keyword found in the collection of documents. A location indicator may comprise a document identifier, an indication of the position of the node in the hierarchy of nodes within the XML document containing the keyword, and an indication of the pathname of the node containing the keyword. Once the index is constructed, keyword searching can be done efficiently by a keyword lookup in the index. Various display strategies enable the user to see the specific portion of a large XML document containing the keyword and/or path frequency information allowing the user to easily refine the search to specific paths within the collection of documents.The reference further teaches “Large collections of XML (eXtensible Markup Language) documents are increasingly prevalent in the enterprise. Information about the structure of specific types of XML documents may be specified in documents referred to as "XML schemas". For example, the XML schema for a particular type of XML document may specify the names for the data items (tags) contained in that particular type of XML document, the hierarchical relationship between the data items contained in that type of XML document, data types of the data items contained in that particular type of XML document, etc.” (Para. [0003]).
Kwiecien et al. (U.S. Pre-Grant Publication No. 2019/0034047) teaches the present invention provides a platform that enables codeless generation of online mass spectrometry data exploration portals. The platform facilitates upload of generic spreadsheets containing processed mass spectrometry results (e.g., peak tables) and enables on-the-fly hierarchical organization of data. Following data upload, platform users can select individual visualizations to add to their custom web portal from a menu of options. Based on these selections, a complete webpage is constructed with all associated functionality embedded. These custom web portals can then be shared with collaborators and other researchers at the discretion of the creator via a developed user permissions sharing scheme.The reference further teaches “The electronic database is searchable so that data uploaded from multiple peak tables is able to be found through a query, tracked and/or sorted. Additionally, entry of the data into the electronic database allows for easy automated processing. This allows the data to be easily compared and grouped together in different various ways. Through analysis and manipulation of the data, useful points in the data sets and outlying results can be easily detected.” (Para. [0012]).
Shah et al. (U.S. Pre-Grant Publication No. 2018/0150548) teaches recognizing unknown data objects may be implemented for data objects stored in a data store. Data objects that are identified as unknown may be accessed to retrieve a portion of the data object. Different representations of the data object may be generated for recognizing different data schemas. An analysis of the representations may be performed to identify a data schema for the unknown data object. The data schema may be stored in a metadata store for the unknown data object.
Chaudhri et al. (U.S. Pre-Grant Publication No. 2008/0307335) teaches stack elements corresponding to system object are associated with a stack item and aggregated in the stack item. A context engine provides contextual control of the stack item and stack elements.The reference further teaches “FIG. 33A is a block diagram of an example group association 3300 of an example stack item 3310. The group association 3300, can, for example, be based one or more identified association characteristics of the stack elements 3312, 3314, 3316 and 3318. For example, the group association 3300 can comprise a project association, e.g., files associated with a presentation developed with a first project application 3302 and which utilizes data from files associated with a second project application 3304.” (Para. [0220])
Evans et al. (U.S. Patent No. 8,195,646) teaches computer system navigation tools provide "links" to various different files, lists, folders, and/or other storage elements and allow users to organize files, e.g., by hierarchical properties, lists, auto lists, folders, and the like. Such systems and methods allow users to assign properties to a file (optionally in a hierarchical manner), to change assigned properties, to search, view, and retrieve information based on the assigned properties, and the like.The reference further teaches “once expanded, the individual search elements in the hierarchical structure of the navigation panel may remain expanded to display the child elements in the hierarchical structure irrespective of the manner in which the search results are displayed in the display panel (e.g., in a stacked manner, in a grouped manner, in a combined grouped and stacked manner, etc.). The various search elements in the hierarchical structure may include, for example, property values, list elements, auto list elements, folder elements, etc., and the hierarchical structure may be, at least in part, defined by individual user input.” (Col. 6 Lines 26-51).
Gusmorino et al. (U.S. Patent No. 7,694,236) teaches a method and system for use in a computing environment for representing files stored in stacks by using a stack icon. The stack icon may include multiple thumbnail images as top elements, and may use common characteristics among the files to define the appearance of the stack. The system may also use metadata or file characteristics (e.g., time of last edit, size, etc.) to identify one file for top representation in the stack icon. The system may additionally include an empty stack icon, a generic stack icon, property based icons, and custom thumbnail icons.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ROBERT F MAY whose telephone number is (571)272-3195. The examiner can normally be reached Monday-Friday 9:30am to 6pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Boris Gorney can be reached on 571-270-5626. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ROBERT F MAY/Examiner, Art Unit 2154 10/7/2026
/BORIS GORNEY/Supervisory Patent Examiner, Art Unit 2154
Prosecution Insights