DETAILED ACTION
This office action is in response to the correspondence filed on 12/04/2024. Claims 1-20 are pending and are examined.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statement (IDS) was submitted on 12/04/2024. The submission is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Claim Objections
Claims 1, 6, and 16 are objected to because of the following informalities:
Claim 1, the two occurrences of “the plurality of VMs are” should be “the plurality of VMs is”.
Claims 6 and 16, the limitations with “if/when…” should be changed to “in response to” to avoid conditional claim interpretation.
Appropriate correction is required.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 7, 10, 17, and 20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor, or for pre-AIA the applicant regards as the invention.
Regarding claims 7 and 17, “the MTD-based file recovery” was never recited before. There is insufficient antecedent basis for this limitation in the claim.
Regarding claims 10 and 20, “the network” was never recited before. There is insufficient antecedent basis for this limitation in the claim.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-2, 4, 11-12, and 14 are rejected under 35 U.S.C. 103 as being unpatentable over HRISTOV et al. (US Pub No. 2017/0171157 A1, referred to as HRISTOV), in view of KABEYA (US Pub No. 2024/0248809 A1, referred to as KABEYA).
Regarding claims 1 and 11, taking claim 1 as exemplary, HRISTOV discloses,
1. A security system for a file system, comprising:
a host computer running a host operating system, and running a plurality of hosted virtual machines (VMs) as an intermediate connection to isolate the host operating system from external networks; and (HRISTOV: Fig. 1; [0012]; hardware platform 106 of each host 104 may include conventional components of a computing device, such as one or more processors (CPUs) 108, system memory 110, a network interface 112, storage 114, and other I/O devices such as, for example, a mouse and keyboard (not shown). Processor 108 is configured to execute instructions, for example, executable instructions that perform one or more operations described herein and may be stored in memory 110 and in local storage.)
Examiner notes that “to isolate…” can be interpreted as intended use language and holds no patentable weight. Applicant should amend it to positively recite the feature.
a plurality of cloud services having indirect connections to the host computer facilitated by the host operating system, (HRISTOV: Fig. 1; [0016]; hybrid cloud manager 132 is configured to control network traffic into network 122 via a gateway component (depicted as a gateway 124). Gateway 124 ( e.g., executing as a virtual appliance) is configured to provide VMs 120 and other components in virtualized computing system 102 with connectivity to an external network 140 (e.g., Internet). [0017]; cloud computing system 150 is configured to dynamically provide an enterprise ( or users of an enterprise) with one or more virtual data centers 180 in which a user may provision VMs 120, deploy multi-tier applications on VMs 120, and/or execute workloads.)
…wherein the plurality of VMs are interconnected to each other via an internal virtual private network, (HRISTOV: Fig. 1; [0002]; a private host computer of the private cloud. [0052]; connecting to a virtual private network (VPN) server that has a private network connection to the on-premise host (internal virtual private network).)
wherein a designated VM serves as a network gateway and manages traffic flow between the internal virtual private network and the external networks, including maintaining network security, (HRISTOV: Fig. 1; [0014]; virtualized computing system 102 includes a virtualization management module (depicted in FIG. 1 as virtualization manager 130 (network gateway)) that may communicate to the plurality of hosts 104 (internal VPN) via a network, sometimes referred to as a management network 126. In one embodiment, virtualization manager 130 is a computer program that resides and executes in a central server, which may reside in virtualized computing system 102, or alternatively, may run in a VM in one of hosts 104. One example of a virtualization management module is the vCenter Server™ product made available from VMware, Inc. Virtualization manager 130 is configured to carry out administrative tasks for computing system 102, including managing hosts 104, managing VMs 120 running within each host 104 (network security), provisioning VMs, migrating VMs from one host to another host, and load balancing between hosts 104. [0016]; hybrid cloud manager 132 is configured to control network traffic into network 122 via a gateway component (depicted as a gateway 124). Gateway 124 ( e.g., executing as a virtual appliance) is configured to provide VMs 120 and other components in virtualized computing system 102 with connectivity to an external network 140 (e.g., Internet).)
wherein the host computer includes a secure controller configured as a bridge between user applications and the host operating system to enforce security protocols and manage core operations to ensure system integrity in the host computer, and (HRISTOV: Fig. 1; [0014]; virtualized computing system 102 includes a virtualization management module (depicted in FIG. 1 as virtualization manager 130 (secure controller)) that may communicate (bridge) to the plurality of hosts 104 via a network, sometimes referred to as a management network 126. In one embodiment, virtualization manager 130 is a computer program that resides and executes in a central server, which may reside in virtualized computing system 102, or alternatively, may run in a VM in one of hosts 104. One example of a virtualization management module is the vCenter Server™ product made available from VMware, Inc. Virtualization manager 130 is configured to carry out administrative tasks for computing system 102, including managing hosts 104, managing VMs 120 running within each host 104, provisioning VMs, migrating VMs from one host to another host, and load balancing between hosts 104. [0016] (security protocols and core operations); hybrid cloud manager 132 is configured to control network traffic into network 122 via a gateway component (depicted as a gateway 124). Gateway 124 ( e.g., executing as a virtual appliance) is configured to provide VMs 120 and other components in virtualized computing system 102 with connectivity to an external network 140 (e.g., Internet). [0055]; a hardware abstraction layer on top of a host computer. The hardware abstraction layer allows multiple contexts to share the hardware resource. In one embodiment, these contexts are isolated from each other, each having at least a user application running therein.)
Examiner notes that “to enforce security protocols and manage core operations to ensure system integrity in the host computer” can be interpreted as intended use language and holds no patentable weight. Applicant should amend it to positively recite the features.
wherein the secure controller is configured to manage interactions between the plurality of VMs and the plurality of cloud services. (HRISTOV: Fig. 1; [0014]; virtualized computing system 102 includes a virtualization management module (depicted in FIG. 1 as virtualization manager 130 (secure controller)) that may communicate to the plurality of hosts 104 (plurality of VMs) via a network, sometimes referred to as a management network 126. In one embodiment, virtualization manager 130 is a computer program that resides and executes in a central server, which may reside in virtualized computing system 102, or alternatively, may run in a VM in one of hosts 104. One example of a virtualization management module is the vCenter Server™ product made available from VMware, Inc. Virtualization manager 130 is configured to carry out administrative tasks for computing system 102, including managing hosts 104, managing VMs 120 running within each host 104 (network security), provisioning VMs, migrating VMs from one host to another host, and load balancing between hosts 104. [0016]; hybrid cloud manager 132 is configured to control network traffic into network 122 via a gateway component (depicted as a gateway 124). Gateway 124 ( e.g., executing as a virtual appliance) is configured to provide VMs 120 and other components in virtualized computing system 102 with connectivity to an external network 140 (e.g., Internet). [0017]; cloud computing system 150 is configured to dynamically provide an enterprise ( or users of an enterprise) with one or more virtual data centers 180 in which a user may provision VMs 120, deploy multi-tier applications on VMs 120, and/or execute workloads.)
HRISTOV does not explicitly disclose, however KABEYA teaches,
…wherein the plurality of VMs are configured to systematically back up data to the plurality of cloud services, (KABEYA: [0106]; for each backup task in the backup schedule table 203 (systematically), the backup requirements specified in the backup requirement table 201 are checked for the storage device 50 or the cloud area 30 as the backup destination, and in the case where the policy related to the capacity resource use rate cannot be satisfied (S00.fwdarw.c), the following processing is performed on the VM or the physical server (hereinafter, referred to as a “migration backup target”) to be backed up.)
It would have been obvious to one ordinary skill in the art before the effective filing date of the claimed invention to implement the teachings of KABEYA into the teachings of HRISTOV with a motivation to appropriately manage backups of each environment according to operation requirements such that systems can continuously be operated even when failures occur due to sophisticated and diversified cyberattacks or human errors during the operation of large-sized complicated systems (KABEYA: [0002]).
Regarding claims 2 and 12, taking claim 2 as exemplary, the combination of HRISTOV and KABEYA discloses,
2. The security system of claim 1,
HRISTOV further discloses,
wherein the designated VM is equipped with a Bridged Network Adapter for external access to the internet and an Internal Network Adapter for internal VM communications. (HRISTOV: Fig. 1; [0014]; virtualized computing system 102 includes a virtualization management module (depicted in FIG. 1 as virtualization manager 130 (Bridged Network Adapter)) that may communicate to the plurality of hosts 104 (internal VM) via a network, sometimes referred to as a management network 126 (Internal Network Adapter). In one embodiment, virtualization manager 130 is a computer program that resides and executes in a central server, which may reside in virtualized computing system 102, or alternatively, may run in a VM in one of hosts 104. [0016]; hybrid cloud manager 132 is configured to control network traffic into network 122 via a gateway component (depicted as a gateway 124). Gateway 124 ( e.g., executing as a virtual appliance) is configured to provide VMs 120 and other components in virtualized computing system 102 with connectivity to an external network 140 (e.g., Internet).)
Regarding claims 4 and 14, taking claim 4 as exemplary, the combination of HRISTOV and KABEYA discloses,
4. The security system of claim 1,
HRISTOV further discloses,
wherein the secure controller is configured to manage VM deployment, performance, and resource allocation while enforcing security policies, by continuously monitoring the plurality of VMs for indications of corruption or malicious activities. (HRISTOV: Fig. 1; [0014]; virtualized computing system 102 includes a virtualization management module (depicted in FIG. 1 as virtualization manager 130 (secure controller)) that may communicate to the plurality of hosts 104 via a network, sometimes referred to as a management network 126. In one embodiment, virtualization manager 130 is a computer program that resides and executes in a central server, which may reside in virtualized computing system 102, or alternatively, may run in a VM in one of hosts 104. One example of a virtualization management module is the vCenter Server™ product made available from VMware, Inc. Virtualization manager 130 is configured to carry out administrative tasks for computing system 102, including managing hosts 104, managing VMs 120 running within each host 104, provisioning VMs, migrating VMs from one host to another host, and load balancing between hosts 104. [0016] (security policies and management operations); hybrid cloud manager 132 is configured to control network traffic into network 122 via a gateway component (depicted as a gateway 124). Gateway 124 ( e.g., executing as a virtual appliance) is configured to provide VMs 120 and other components in virtualized computing system 102 with connectivity to an external network 140 (e.g., Internet). [0055]; a hardware abstraction layer on top of a host computer. The hardware abstraction layer allows multiple contexts to share the hardware resource. In one embodiment, these contexts are isolated from each other, each having at least a user application running therein.)
Claims 3, 8, 13, and 18 are rejected under 35 U.S.C. 103 as being unpatentable over HRISTOV, in view of KABEYA and further in view of Burshteyn (US Pub No. US 20190303349 A1, referred to as Burshteyn).
Regarding claims 3 and 13, taking claim 3 as exemplary, the combination of HRISTOV and KABEYA discloses,
3. The security system of claim 1,
HRISTOV discloses,
the secure controller (HRISTOV: Fig. 1; [0014])
The combination of HRISTOV and KABEYA does not explicitly disclose; however, Burshteyn teaches,
wherein …employs Moving Target Defense (MTD) for encoding files in the file system and secret sharing. (Burshteyn: [0094]; SaaS secrets management services may use moving target defense, fragmentation, and decentralized or distributed storage of keys secrets. In an example, security information to be protected is partitioned into multiple files, and each file is obfuscated, such as by being encrypted, to created multiple obfuscated data shards (encoding). The multiple obfuscated data shards are moved around a computer network via a data movement process that includes sending each of the multiple obfuscated data shards to a different randomly selected computer, where the computer further obfuscates the obfuscated data the trace file and sends the further obfuscated data shard and trace file to a next randomly selected computer (secrets are shared).)
It would have been obvious to one ordinary skill in the art before the effective filing date of the claimed invention to implement the teachings of Burshteyn into the combination of HRISTOV and KABEYA with a motivation to improve security of data that is stored at a data store distributed over a computer network by employing Moving Target Defense (Burshteyn abstract).
Examiner notes that “for encoding…” can be interpreted as intended use language and holds no patentable weight. Applicant should amend it to positively recite the feature.
Regarding claims 8 and 18, taking claim 8 as exemplary, the combination of HRISTOV, KABEYA, and Burshteyn discloses,
8. The security system of claim 3,
HRISTOV discloses,
the secure controller (HRISTOV: Fig. 1; [0014])
The combination of HRISTOV and KABEYA does not explicitly disclose; however, Burshteyn teaches,
wherein …employs MTD including strategies of increasing diversity, shuffling parameters, adding redundancy, or using hybrid techniques that combine diversity, shuffling and redundancy. (Burshteyn: [0043]; multiple sets (increasing) of obfuscated data files are created for redundancy or backup reasons. When multiple sets of obfuscated data files are created, any of the sets can be used to regenerate the source data.)
The same motivation that was utilized for combining HRISTOV, KABEYA, and Burshteyn as set forth in claim 3 is equally applicable to claim 8.
Allowable Subject Matter
Claims 5-6, and 15-16 are objected to as being dependent upon rejected base claims, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Claims 7, 9-10, 17, and 19-20 contain allowable subject matter but remain rejected under 112 rejections. They are also objected to as being dependent upon rejected base claims, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims; and the stated rejection(s) are resolved.
The following is an examiner’s statement of reasons for allowance:
Although prior arts HRISTOV, KABEYA and Burshteyn above disclose all the limitations of the prior claims (see rejections above), none of the prior arts of record alone or in combination discloses the secure controller manages a write command which instructs the host file system to perform a write operation, storing an original file, and concurrently initiating a backup process using the MTD, including dividing the original file into shares and distributing the shares among the VMs; and a hypervisor performs VM migration at specified intervals based on a trigger from an Intrusion Detection System, wherein the hypervisor selects a destination host to which an infected VM will be migrated, and deletes the infected VM on the host computer as described in the claims.
At the effective filing date of the application, the above limitations would not have been obvious over the prior arts of record.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
PURUSHOTHAM; RUPESH et al. US-PGPUB US 20160380832 A1 Host management across virtualization management servers
THAKKAR; SACHIN et al. US-PGPUB US 20170060615 A1 Hybrid infrastructure provisioning framework tethering remote datacenters
Any inquiry concerning this communication or earlier communications from the examiner should be directed to KA SHAN CHOY whose telephone number is (571) 272-1569. The examiner can normally be reached on MON - FRI: 9AM-5:30PM EST Alternate Fridays.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Amir Mehrmanesh can be reached at (571) 270-3351. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/KA SHAN CHOY/Primary Examiner, Art Unit 2435
Prosecution Insights