DETAILED ACTION
Applicant has amended claims 21, 28 and 35 in the filed amendment on 6/16/2026. Claims 21-40 are pending in this office action.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant’s arguments with respect to claim(s) 21-40 have been considered but are moot in new ground of rejection.
Applicant argued that prior arts of the record do not teach amended claims.
In response to Applicant’s argument claims are rejected in new ground of rejection.
In additions:
Ahuja teaches limitations
“receive, from a first stage process of another computing node, an event as a possible new event based on……” as receive, from an action as a first stage process of one or more components e.g., network devices, user devices, servers, operating systems, user applications as another computing node, a subevent as an event based on data highway 204 (paragraphs 51-52, 57, 78-79). The network device(s) or the server of servers is represented as another computing node. Since the subevent that is generated and corresponds to an occurrence of an action is interpreted as a possible new event.
For example, subevents may be generated by network devices, user devices, servers, operating systems, user applications, etc. Examples of subevents include, but are not limited to, network status and configuration messages, a device powering on, a device powering off, a device failure, an application error, status and events within a virtual environment, etc. A subevent may correspond to an occurrence of an action itself (e.g., by detecting an incoming/outgoing network message, detecting a device failure, etc.), or a subevent may be represented by data describing a corresponding action (e.g., a log entry describing a received network message, a push notification indicating that a server reboot occurred, etc.) (paragraph 51).
A subevent refers to an action or occurrence related to one or more components of a computing environment, and a security event refers to a defined pattern of one or more particular subevent occurrences (paragraph 57);
“in response to reception of the event as a possible new event from the first stage process of the other computing node: determine, based on a key for the event and a global state, whether the event is……” as in response to the receiving, from an action as a first stage process of one or more components e.g., network devices, user devices, servers, operating systems, user applications as another computing node, the subevent that is generated and corresponds to an occurrence of an action is interpreted as a possible new event (paragraphs 51-52), determine, based on timestamp of the subevent as a key for event and state data, which is stored in a security event state table in a remote storage and accessed by one or more applications or servers for updating (fig. 3, paragraphs 79, 86, 90), is represented as a global state (paragraph 65, fig. 4), whether the subevent is a subevent filter (fig. 6, paragraphs 80-83);
“in response to a determination that the event is……, update the global state based on the key for the event to generate an updated global state that indicates ……” as in response to a determination that event is the subevent filter, update the data state, which is stored in a security event state table in a remote storage and accessed by one or more applications or servers for updating (fig. 3, paragraphs 79, 86, 90), is represented as a global state (paragraph 65, fig. 4), based on the timestamp of the subevent as the key for the event to generate the updated data state as an updated global state that indicates a new security event has occurred (paragraph 82-84, fig. 6).
For example, a subevent processing microservice 340 may update one or more subevent counters, subevent data fields, timestamp fields, security event state data, etc. As described above in reference to FIGS. 4-5, updating the state data may include incrementing/decrementing one or more counters, storing one or more timestamps or other data included with or derived from the associated subevent, determining a next state from a state table based on the subevent matching an associated filter (paragraph 82).
At block 610, in response to determining that the updated state data indicates that a new security event has occurred, security event data is generated. For example, a subevent processing microservice 340 may generate a message, notification, log entry, or any other type of data to indicate that the security event has occurred. The security event data may include data from one or more of the subevents that triggered the security event, based on one or more of the security event state items stored in association with the corresponding security event definition, or based on any other source of information related to the comprising subevents. For example, if a subevent processing microservice 340 detects an occurrence of a brute-force password attack security event, the microservice may generate security event state data indicating the type of security event, one or more source and/or destination IP addresses associated with the event, a time at which the attack started or ended, etc (paragraph 84).
For example, each of security event states 740-760 may correspond to one of a plurality of states of a state table stored in association with the security event definition for the malware security event. In this example, state A 740 is an initial default state at which zero matching subevents are recorded. Thus, state data associated with the state A 740 indicates a subevent counter 742 value of “0”, a subevent data 744 value of “0”, and a subevent timestamp value of “0” (paragraph 90);
“……to indicate that the event is a new event” as generate a message to indicate that the security event has occurred as a new event (paragraph 83);
Chris teaches limitations
“not a local reoccurring event” as a new event, which is a duplicate object i.e., an object that already exists in a forum database of remote site of a network (paragraphs 15, 12), is represented as a global reoccurring event as not a local reoccurring event (paragraphs 127-128, 133 79);
“a global reoccurring event” as a new event, which is a duplicate object i.e., an object that already exists in a forum database of remote site of a network (paragraphs 15, 12), is represented as a global reoccurring event (paragraphs 127-128, 133 79);
“the reception of the event as a possible new event” as reception of the event as a new event (paragraph 99);
“not a global reoccurring event” as the new event, which is not a duplicate object i.e., an object that already exists in a forum database of remote site of a network (paragraphs 15, 12), is represented as a global reoccurring event (paragraphs 129, 133 79).
“the event is not a global reoccurring event” as the new event, which is not a duplicate object i.e., an object that already exists in a forum database of remote site of a network (paragraphs 15, 12), is represented as a global reoccurring event (paragraphs 129, 133 79);
“output the event” as represent the new object version that resulted from an event (paragraph 24).
Chris further teaches limitations
“receive, from a first stage process of another computing node, an event as a possible new event” as receive, from cloud-based platform hosted by the host server 100 as a first stage process of another computing node, an event that is new event as a possible new event (paragraphs 121-22, 125);
“in response to reception of the event as a possible new event: determine……whether the event is a global reoccurring event” as in response to reception of the event as a new event (paragraphs 121, 127): determine the new event, which is a duplicate object i.e., an object that already exists in a forum database of remote site (paragraph 15) of a network (paragraph 12), is represented as a global reoccurring event (paragraphs 129, 133 79);
“ in response to a determination that the event is not a global reoccurring event” as in response to reception of the event as a new event (paragraphs 121, 127): determine the new event, which is not a duplicate object i.e., an object that already exists in a forum database of remote site (paragraph 15) of a network (paragraph 12), is represented as a global reoccurring event (paragraphs 129, 133 79).
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 21-40 are rejected on the ground of nonstatutory double patenting
as being unpatentable over claims 6-20 of U.S. Patent No. 12210497 in view of Christie et al (or hereinafter “Chris”) (US 20050165861) and Brasfield et al (or hereinafter “Bra”) (US 20200034050)
Claims 6-20 of U.S. Patent No. 12210497 teach all limitation of claims 21-40 of
the instant application, except limitation
based on a prior determination by the first stage process of the other computing node that the event is not a local reoccurring event;
that has been received by the second stage process of the computing node from one or more other first stage processes of one or more additional computing nodes different than the other computing node prior to the reception of the event as a possible new event from the first stage process of the other computing node; or
that has been received by the second stage process of the computing node from one or more other first stage processes of one or more additional computing nodes different than the other computing node prior to the reception of the event as a possible new event from the first stage process of the other computing node prior to reception of the event from the first stage process.
Chris teaches limitations
“not a local reoccurring event” as a new event, which is a duplicate object i.e., an object that already exists in a forum database of remote site of a network (paragraphs 15, 12), is represented as a global reoccurring event as not a local reoccurring event (paragraphs 127-128, 133 79);
“the reception of the event as a possible new event” as reception of the event as a new event (paragraph 99) and/or “reception of the event” as reception of the event as a new event (paragraph 99).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to apply Chris’s teaching to Claims 6-20 of U.S. Patent No. 12210497 to minimize unnecessary transmissions, number of messages concurrently in-transit among computing devices, to maintain latency information to determine transmission failures, and further to synchronize information among computing devices such as information must be replicated from one computing device to another computing device.
Bra teaches limitations
“based on a prior determination by the first stage process of the other computing node that the event is not……” as providing a copy of item to the client 114 based on a prior determination by a regional storage system 110 of a local data center 108a as a first stage process of local data center 108a as the other computing node that a digital content item as the event is not stored on intermedia caching layer (fig. 3, paragraphs 73-75);
“……that has been received by the second stage process of the computing node from one or more other first stage processes of one or more additional computing nodes different than the other computing node prior to ……from the first stage process of the other computing node” as a request that has been received by a regional storage system as the second stage process of a remote data center 108b as the computing node from one or more regional storage systems 110 as one or more other first stage processes of one or more remote data centers 108b, 108c as one or more additional computing devices different than prior to providing the copy of content item from the storage system 110 as the first stage process of the local data center 108 as the other computing node (figs. 1-3, paragraphs 73-75); or
“that has been received by the second stage process of the computing node from one or more other first stage processes of one or more additional computing nodes different than the other computing node prior to ……from the first stage process of the other computing node prior to ……from the first stage process” as a request that has been received by a regional storage system as the second stage process of a remote data center 108b as the computing node from one or more regional storage systems 110 as one or more other first stage processes of one or more remote data centers 108b, 108c as one or more additional computing devices different than prior to providing the copy of content item from the storage system 110 as the first stage process of the local data center 108 as the other computing node prior to providing the copy of content item from the storage system 110 (figs. 1-3, paragraphs 73-75).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to apply Bra’s teaching to Claims 6-20 of U.S. Patent No. 12210497 to reduce a number of times that the client device and/or local data center requests access to the remote storage system and further reduce costs associated with accessing the cloud storage system directly in response to each data request.
Claims 21, 28, 35 recite the same limitation as claims 6, 15 of the reference patent 12210497
Claims 22, 29, 36 recite the same limitation as claims 6, 15 of the reference patent 12210497
Claims 23, 30, 37 recite the same limitation as claim 9 of the reference patent 12210497
Claims 24, 31, 38 recite the same limitation as claims 6, 15 of the reference patent 12210497
Claims 25, 32, 39 recite the same limitation as claim 7 of the reference patent 12210497
Claims 26, 33, 40 recite the same limitation as claims 6, 15 of the reference patent 12210497
Claims 27, 34 recite the same limitation as claims 6, 15 of the reference patent 12210497.
The claims of the instant application and the claims of the reference patents are compared in the table below:
The instant application
Reference patent 12210497
21. (New) A system, comprising:
a computing node comprising one or more processors and memory, wherein the computing node is configured to implement a second stage process to:
receive, from a first stage process of another computing node, an event as a possible new event based on a prior determination by the first stage process of the other computing node that the event is not a local reoccurring event;
in response to reception of the event as a possible new event from the first stage process of the other computing node:
determine, based on a key for the event and a global state, whether the event is a global reoccurring event that has been received by the second stage process of the computing node from one or more other first stage processes of one or more additional computing nodes different than the other computing node prior to the reception of the event as a possible new event from the first stage process of the other computing node; and
in response to a determination that the event is not a global reoccurring event, update the global state based on the key for the event to generate an updated global state that indicates the event is not a global reoccurring event and output the event to indicate that the event is a new event.
22. (New) The system of claim 21, wherein the second stage process is configured to output the event as a new event.
23. (New) The system of claim 21, wherein the global state comprises a global lookup table, and wherein to determine that the event is not a global reoccurring event, the second stage process is configured to: determine, based on the key for the event, that an entry for the event does not exist in the global lookup table.
24. (New) The system of claim 21, wherein the second stage process is configured to send at least a portion of the global state to the first stage process to update a local state of the first stage process.
25. (New) The system of claim 21, wherein the second stage process is configured to: receive, from the first stage process of the other computing node, a promote state event that corresponds to another event obtained by the first stage process; and in response to reception of the promote state event, update a global state based on a key for the other event.
26. (New) The system of claim 21, wherein the second stage process is configured to: receive, from a first stage process of an additional computing node, an additional event as a possible new event; in response to reception of the additional event as a possible new event: determine, based on a key for the additional event and the global state, whether the additional event is a global reoccurring event; and in response to a determination that the additional event is not a global reoccurring event, update the global state based on the key for the additional event.
27. (New) The system of claim 26, wherein the second stage process is configured to: output the additional event as an additional new event; and send at least a portion of the global state to the first stage process of the other computing node and to the first stage process of the additional computing node.
28. (Currently amended) A method, comprising: performing, by a second stage process of a computing node:
receiving, from a first stage process of another computing node, an event as a possible new event based on a prior determination by the first stage process of the other computing node that the event is not a local reoccurring event;
in response to receiving the event as a possible new event from the first stage process of the other computing node:
determining, based on a key for the event and a global state, whether the event is a global reoccurring event that has been received by the second stage process of the computing node from one or more other first stage processes of one or more additional computing nodes different than the other computing node prior to the reception of the event as a possible new event from the first stage process of the other computing node prior to reception of the event from the first stage process; and in response to determining that the event is not a global reoccurring event, updating the global state based on the key for the event to generate an updated global state that indicates the event is not a global reoccurring event and output the event to indicate that the event is a new event.
29. (Previously Presented) The method of claim 28, further comprising outputting the event as a new event.
30. (Previously Presented) The method of claim 28, wherein the global state comprises a global lookup table, and wherein determining that the event is not a global reoccurring event comprises: determining, based on the key for the event, that an entry for the event does not exist in the global lookup table.
31. (New) The method of claim 28, further comprising sending at least a portion of the global state to the first stage process to update a local state of the first stage process.
32. (New) The method of claim 28, further comprising: receiving, from the first stage process of the other computing node, a promote state event that corresponds to another event obtained by the first stage process;and in response to receiving the promote state event, updating a global state based on a key for the other event.
33. (New) The method of claim 28, further comprising: receiving, from a first stage process of an additional computing node, an additional event as a possible new event; in response to receiving the additional event as a possible new event:determining, based on a key for the additional event and the global state, whether the additional event is a global reoccurring event; andin response to determining that the additional event is not a global reoccurring event, updating the global state based on the key for the additional event.
34. (New) The method of claim 33, further comprising: outputting the additional event as an additional new event; and sending at least a portion of the global state to the first stage process of the other computing node and to the first stage process of the additional computing node.
35. One or more non-transitory computer-accessible storage media storing program instructions that when executed on or across one or more processors of a computing node, cause the one or more processors to implement a second stage process to: receive, from a first stage process of another computing node, an event as a possible new event based on a prior determination by the first stage process of the other computing node that the event is not a local reoccurring event; in response to reception of the event as a possible new event from the first stage process of the other computing node:determine, based on a key for the event and a global state, whether the event is a global reoccurring event that has been received by the second stage process of the computing node from one or more other first stage processes of one or more additional computing nodes different than the other computing node prior to the reception of the event as a possible new event from the first stage process of the other computing node prior to reception of the event from the first stage process; andin response to a determination that the event is not a global reoccurring event, update the global state based on the key for the event to generate an updated global state that indicates the event is not a global reoccurring event and output the event to indicate that the event is a new event.
36. (New) The one or more storage media as recited in claim 35, further comprising program instructions that when executed on or across the one or more processors further cause the one or more processors to implement the second stage process to: output the event as a new event.
37. (New) The one or more storage media as recited in claim 35, wherein the global state comprises a global lookup table, and wherein to determine that the event is not a global reoccurring event, the program instructions when executed on or across the one ormore processors further cause the one or more processors to implement the second stage process to:determine, based on the key for the event, that an entry for the event does not exist in the global lookup table.
38. (New) The one or more storage media as recited in claim 35, further comprising program instructions that when executed on or across the one or more processors further cause the one or more processors to implement the second stage process to: send at least a portion of the global state to the first stage process to update a local state of the first stage process.
39. (New) The one or more storage media as recited in claim 35, further comprising program instructions that when executed on or across the one or more processors further cause the one or more processors to implement the second stage process to: receive, from the first stage process of the other computing node, a promote state event that corresponds to another event obtained by the first stage process;and in response to reception of the promote state event, update a global state based on a key for the other event.
40. (New) The one or more storage media as recited in claim 35, further comprising program instructions that when executed on or across the one or more processors further cause the one or more processors to implement the second stage process to: receive, from a first stage process of an additional computing node, an additional event as a possible new event; in response to reception of the additional event as a possible new event:determine, based on a key for the additional event and the global state, whether the additional event is a global reoccurring event; andin response to a determination that the additional event is not a global reoccurring event, update the global state based on the key for the additional event.
6. A method, comprising:
performing, by a first stage process of a computing node: obtaining an event from an input stream of events; determining, based on a key for the event and a local state, whether the event is a local reoccurring event; in response to determining that the event is not a local reoccurring event: updating the local state based on the key for the event; and sending the event to a second stage process as a possible new event; and
performing, by the second stage process of another computing node:
receiving the event as a possible new event;
determining, based on the key for the event and a global state, whether the event is a global reoccurring event; and
in response to determining that the event is not a global reoccurring event: updating the global state based on the key for the event; and
outputting the event as a new event; and sending at least a portion of the global state to the first stage process to update the local state.
7. The method of claim 6, further comprising: performing, by the first stage process: obtaining another event from the input stream; determining, based on a key for the other event and the local state, that the other event is a local reoccurring event; in response to determining that the other event is a local reoccurring event: determining, based on the key for the other event and a property of the local state, whether to send a promote state event to the second stage process; in response determining to send the promote state event, sending the promote state event to the second stage process; and updating the property of the local state based on the key for the other event; and performing, by the second stage process: receiving the promote state event; and in response to receiving the promote state event, updating a global state based on the key for the other event.
8. The method of claim 7, wherein the local state comprises a local lookup table, and wherein updating the property of the local state based on the key for the other event comprises: re-ordering a group of entries in the local lookup table, wherein an entry that corresponds to the key for the other event is moved ahead within the group of entries according to a most recently used to least recently used ordering, or updating a timestamp for the entry that corresponds to the key for the other event.
9. The method of claim 6, wherein the local state comprises a local lookup table, and wherein determining that the event is not a local reoccurring event comprises: determining, based on the key for the event, that an entry for the event does not exist in the local lookup table.
10. The method of claim 9, wherein determining, based on the key for the event, that an entry for the event does not exist in the local lookup table comprises: generating a digest based on a hash of the key; and determining that the local lookup table does not have an entry for the digest.
11. The method of claim 6, wherein the local state comprises a local lookup table, and wherein updating the local state based on the key for the event comprises: expiring an entry from the local lookup table that corresponds to a key for another event; and inserting a new entry into the local lookup table that corresponds to the key for the event.
12. The method of claim 6, further comprising: identifying a plurality of portions of data based on the obtained event; and generating the key based on the plurality of portions of data.
13. The method of claim 6, further comprising: performing, by a first stage process of a computing node: receiving, from the other computing note, at least a portion of the global state; and in response to receiving at least the portion of the global state, updating the local state based on at least the portion of the global state.
14. The method of claim 6, wherein a network comprises the computing node and another network comprises the other computing node, and wherein the network is remote from the other network, and wherein the first stage process runs concurrent with other first stage processes at other computing nodes that send other events to the second stage process as other possible new events.
15. One or more non-transitory computer-accessible storage media storing program instructions that when executed on or across one or more processors of a second stage computing node of an event deduplication system, cause the one or more processors to implement a second stage process to:
receive, from different first stage processes on different first stage computing nodes of the event deduplication system, a plurality of possible new events obtained by the different first stage processes from different input streams, wherein for an event of the plurality of possible new events obtained by a given first stage process from a given input stream, the one or more processors implement the second stage process to:
determine, based on a key for the event and a global state, whether the event is a global reoccurring event; in response to a determination that the event is not a global reoccurring event, update the global state based on the key for the event and output the event as a new event; and send at least a portion of the global state to the different first stage processes to update a local state associated with the different first stage processes.
16. The one or more storage media as recited in claim 15, wherein the global state comprises a global lookup table, and wherein to update the global state based on the key for the event, the program instructions when executed on or across the one or more processors further cause the one or more processors to implement the second stage process to: insert an entry into the global lookup table that corresponds to the key for the event.
17. The one or more storage media as recited in claim 15, further comprising program instructions that when executed on or across the one or more processors further cause the one or more processors to implement the second stage process to: receive another possible new event from one of the first stage processes; determine, based on a key for the other possible new event and the global state, whether the other possible new event is a global reoccurring event; and in response to a determination that the other possible new event is a global reoccurring event, update the global state based on the key for the other possible new event.
18. The one or more storage media as recited in claim 17, wherein the global state comprises a global lookup table, and wherein to update the global state based on the key for the other possible new event, the program instructions when executed on or across the one or more processors further cause the one or more processors to implement the second stage process to: re-order a group of entries in the global lookup table, wherein an entry that corresponds to the key for the other possible new event is moved ahead within the group of entries according to a most recently used to least recently used ordering, or update a timestamp for the entry that corresponds to the key for the other possible new event.
19. The one or more storage media as recited in claim 15, further comprising program instructions that when executed on or across the one or more processors further cause the one or more processors to implement the second stage process to: receive a promote state event from one of the first stage processes, wherein the promote state event corresponds to a recurring event obtained by the first stage process; and in response to reception of the promote state event, update the global state based on a key for the recurring event.
20. The one or more storage media as recited in claim 15, further comprising program instructions that when executed on or across the one or more processors further cause the one or more processors to implement the second stage process to: receive a request from one of the first stage processes for the global state; and in response to reception of the request, send at least the portion of the global state to the first stage process.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 21-23, 26, 28-30, 33, 35-37, 40 are rejected under 35 U.S.C. 103 as being unpatentable over Ahuja et al (US 20180083985) in view of Christie et al (or hereinafter “Chris”) (US 20050165861) and Brasfield et al (or hereinafter “Bra”) (US 20200034050)
As to claim 21, Ahuja teaches a system comprising:
“a computing node comprising one or more processors and memory, wherein the computing node is configured to implement a second stage process to:” as a security service e.g., 110 (fig. 1, paragraph 36) or 306 as a computing node (fig. 3) includes a processor and memory (fig. 1, paragraphs 33-34), the security service 110 or 306 is configured to perform various actions that includes a second action as a second stage process to (paragraphs 33-34, 58);
“receive, from a first stage process of another computing node, an event as a possible new event based on……” as receive, from an action as a first stage process of one or more components e.g., network devices, user devices, servers, operating systems, user applications as another computing node, a subevent as an event based on data highway 204 (paragraphs 51-52, 57, 78-79). The network device(s) or the server of servers is represented as another computing node. Since the subevent that is generated and corresponds to an occurrence of an action is interpreted as a possible new event.
For example, subevents may be generated by network devices, user devices, servers, operating systems, user applications, etc. Examples of subevents include, but are not limited to, network status and configuration messages, a device powering on, a device powering off, a device failure, an application error, status and events within a virtual environment, etc. A subevent may correspond to an occurrence of an action itself (e.g., by detecting an incoming/outgoing network message, detecting a device failure, etc.), or a subevent may be represented by data describing a corresponding action (e.g., a log entry describing a received network message, a push notification indicating that a server reboot occurred, etc.) (paragraph 51).
A subevent refers to an action or occurrence related to one or more components of a computing environment, and a security event refers to a defined pattern of one or more particular subevent occurrences (paragraph 57);
“in response to reception of the event as a possible new event from the first stage process of the other computing node: determine, based on a key for the event and a global state, whether the event is……” as in response to the receiving, from an action as a first stage process of one or more components e.g., network devices, user devices, servers, operating systems, user applications as another computing node, the subevent that is generated and corresponds to an occurrence of an action is interpreted as a possible new event (paragraphs 51-52), determine, based on timestamp of the subevent as a key for event and state data, which is stored in a security event state table in a remote storage and accessed by one or more applications or servers for updating (fig. 3, paragraphs 79, 86, 90), is represented as a global state (paragraph 65, fig. 4), whether the subevent is a subevent filter (fig. 6, paragraphs 80-83);
“in response to a determination that the event is……, update the global state based on the key for the event to generate an updated global state that indicates ……” as in response to a determination that event is the subevent filter, update the data state, which is stored in a security event state table in a remote storage and accessed by one or more applications or servers for updating (fig. 3, paragraphs 79, 86, 90), is represented as a global state (paragraph 65, fig. 4), based on the timestamp of the subevent as the key for the event to generate the updated data state as an updated global state that indicates a new security event has occurred (paragraph 82-84, fig. 6).
For example, a subevent processing microservice 340 may update one or more subevent counters, subevent data fields, timestamp fields, security event state data, etc. As described above in reference to FIGS. 4-5, updating the state data may include incrementing/decrementing one or more counters, storing one or more timestamps or other data included with or derived from the associated subevent, determining a next state from a state table based on the subevent matching an associated filter (paragraph 82).
At block 610, in response to determining that the updated state data indicates that a new security event has occurred, security event data is generated. For example, a subevent processing microservice 340 may generate a message, notification, log entry, or any other type of data to indicate that the security event has occurred. The security event data may include data from one or more of the subevents that triggered the security event, based on one or more of the security event state items stored in association with the corresponding security event definition, or based on any other source of information related to the comprising subevents. For example, if a subevent processing microservice 340 detects an occurrence of a brute-force password attack security event, the microservice may generate security event state data indicating the type of security event, one or more source and/or destination IP addresses associated with the event, a time at which the attack started or ended, etc (paragraph 84).
For example, each of security event states 740-760 may correspond to one of a plurality of states of a state table stored in association with the security event definition for the malware security event. In this example, state A 740 is an initial default state at which zero matching subevents are recorded. Thus, state data associated with the state A 740 indicates a subevent counter 742 value of “0”, a subevent data 744 value of “0”, and a subevent timestamp value of “0” (paragraph 90);
“……to indicate that the event is a new event” as generate a message to indicate that the security event has occurred as a new event (paragraph 83);
Ahuja does not explicitly teach the limitations
a prior determination by the first stage process of the other computing node that the event is not a local reoccurring event;
a global reoccurring event that has been received by the second stage process of the computing node from one or more other first stage processes of one or more additional computing nodes different than the other computing node prior to the reception of the event as a possible new event from the first stage process of the other computing node;
not a global reoccurring event;
the event is not a global reoccurring event;
output the event.
Chris teaches limitations
“not a local reoccurring event” as a new event, which is a duplicate object i.e., an object that already exists in a forum database of remote site of a network (paragraphs 15, 12), is represented as a global reoccurring event as not a local reoccurring event (paragraphs 127-128, 133 79);
“a global reoccurring event” as a new event, which is a duplicate object i.e., an object that already exists in a forum database of remote site of a network (paragraphs 15, 12), is represented as a global reoccurring event (paragraphs 127-128, 133 79);
“the reception of the event as a possible new event” as reception of the event as a new event (paragraph 99);
“not a global reoccurring event” as the new event, which is not a duplicate object i.e., an object that already exists in a forum database of remote site of a network (paragraphs 15, 12), is represented as a global reoccurring event (paragraphs 129, 133 79).
“the event is not a global reoccurring event” as the new event, which is not a duplicate object i.e., an object that already exists in a forum database of remote site of a network (paragraphs 15, 12), is represented as a global reoccurring event (paragraphs 129, 133 79);
“output the event” as represent the new object version that resulted from an event (paragraph 24).
Chris further teaches limitations
“receive, from a first stage process of another computing node, an event as a possible new event” as receive, from cloud-based platform hosted by the host server 100 as a first stage process of another computing node, an event that is new event as a possible new event (paragraphs 121-22, 125);
“in response to reception of the event as a possible new event: determine……whether the event is a global reoccurring event” as in response to reception of the event as a new event (paragraphs 121, 127): determine the new event, which is a duplicate object i.e., an object that already exists in a forum database of remote site (paragraph 15) of a network (paragraph 12), is represented as a global reoccurring event (paragraphs 129, 133 79);
“ in response to a determination that the event is not a global reoccurring event” as in response to reception of the event as a new event (paragraphs 121, 127): determine the new event, which is not a duplicate object i.e., an object that already exists in a forum database of remote site (paragraph 15) of a network (paragraph 12), is represented as a global reoccurring event (paragraphs 129, 133 79).
Chris and Ahuja disclose a method of updating a state in response to receiving an event. These references are same field as application’s field. Thus, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to apply Chris’s teaching to Ahuja’s system to minimize unnecessary transmissions, number of messages concurrently in-transit among computing devices, to maintain latency information to determine transmission failures, and further to synchronize information among computing devices such as information must be replicated from one computing device to another computing device.
Bra teaches limitations
“a prior determination by the first stage process of the other computing node that the event is not……” as providing a copy of item to the client 114 based on a prior determination by a regional storage system 110 of a local data center 108a as a first stage process of local data center 108a as the other computing node that a digital content item as the event is not stored on intermedia caching layer (fig. 3, paragraphs 73-75);
“……that has been received by the second stage process of the computing node from one or more other first stage processes of one or more additional computing nodes different than the other computing node prior to ……from the first stage process of the other computing node” as a request that has been received by a regional storage system as the second stage process of a remote data center 108b as the computing node from one or more regional storage systems 110 as one or more other first stage processes of one or more remote data centers 108b, 108c as one or more additional computing devices different than prior to providing the copy of content item from the storage system 110 as the first stage process of the local data center 108 as the other computing node (figs. 1-3, paragraphs 73-75).
Bras further teaches limitations
“……based on a prior determination by the first stage process of the other computing node that the event is not ……” as providing a copy of item to the client 114 based on a prior determination by a regional storage system 110 of a local data center 108a as a first stage process of local data center 108a as the other computing node that a digital content item is not stored on intermedia caching layer (figs. 1-3, paragraphs 73-75).
Bra and Ahuja disclose a method of updating data in response to receiving an event. These references are same field as application’s field. Thus, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to apply Bra’s teaching to Ahuja’s system to reduce a number of times that the client device and/or local data center requests access to the remote storage system and further reduce costs associated with accessing the cloud storage system directly in response to each data request.
As to claims 22, 29, 36, Ahuja and Chris teach limitation
“wherein the second stage process is configured to output the event as a new event or
outputting the event as a new event or
program instructions that when executed on or across the one or more processors further cause the one or more processors to implement the second stage process to: output the event as a new event” as instructions that are executed by a processor cause the processor to perform the second action of the actions as a second stage to (Ahuja: paragraphs 33-34, 58) obtain the new event (Chris: paragraph 131).
As to claims 23, 30, 37, Ahuja and Chris teach limitation
“wherein the global state comprises a global lookup table” as the state data, which is stored in a security event state table in a remote storage and accessed by one or more applications or servers for updating (Ahuja: fig. 3, paragraphs 79, 86, 90), is represented as the global state includes (Ahuja: paragraph 65, fig. 4), event table or forum database, which is located at each remote site and accessed to determine whether an object exist in the event table, is represented as a global lookup table (Chris: paragraphs 15, 127, 166, 138);
“wherein to determine that the event is not a global reoccurring event, the second stage process is configured to: determine, based on the key for the event, that an entry for the event does not exist in the global lookup table; or
wherein determining that the event is not a global reoccurring event comprises: determining, based on the key for the event, that an entry for the event does not exist in the global lookup table; or
wherein to determine that the event is not a global reoccurring event, the program instructions when executed on or across the one or more processors further cause the one or more processors to implement the second stage process to: determine, based on the key for the event, that an entry for the event does not exist in the global lookup table” as determination that the subevent (Ahuja: paragraph 82-84, fig. 6) is not a duplicate object i.e., an object that already exists in a forum database of the remote site, is represented as a global reoccurring event (Chris: paragraphs 129, 133, 79), instructions that are executed by a processor cause the processor to perform the second action of the actions as a second stage to (Ahuja: paragraphs 33-34, 58) determine, based on timestamp as a key for the subevent as the event , that (Ahuja: paragraphs 82-84, fig. 6) an entry for the event or object does not exist in the remote site’s event table as the global lookup table (Chris: paragraphs 166, 133, 79).
As to claims 26, 33, 40, Ahuja and Chris teach limitations
“wherein the second stage process is configured to” as the second action of the actions as a second stage process to (Ahuja: paragraphs 33-34, 58): or a second process (Chris: paragraphs 33, 116-117): or
“program instructions that when executed on or across the one or more processors further cause the one or more processors to implement the second stage process to:” as instructions that are executed by a processor to perform the action of the actions to (Ahuja: paragraphs 33-34, 58)
“receive, from a first stage process of an additional computing node, an additional event as a possible new event” as receive subevents that includes a second subevent as an additional event from an application of applications 302 of (Ahuja: paragraph 54; Chris: paragraph 131) a second computer of computers 202A as additional computing node (Chris: fig. 2A, paragraphs 49-50);
“in response to reception of the additional event as a possible new event:
determine, based on a key for the additional event and the global state, whether the additional event is a global reoccurring event or
in response to receiving the additional event as a possible new event: determining, based on a key for the additional event and the global state, whether the additional event is a global reoccurring event” as in response to the receiving a second subevent as the additional event that is generated and corresponds to an occurrence of an action is interpreted as a possible new event (Ahuja: paragraphs 51-52), determine, based on timestamp as a key of the second subevent as the additional event and the state data, which is stored in a security event state table in a remote storage and accessed by one or more applications or servers for updating (Ahuja: fig. 3, paragraphs 79, 86, 90), is represented as a global state (Ahuja: paragraph 65, fig. 4), whether the subevent is (Ahuja: fig. 6, paragraphs 80-83) a new event, which is a duplicate object i.e., an object that already exists in a forum database of remote site of a network (Chris: paragraphs 15, 12), is represented as a global reoccurring event (Chris: paragraphs 127-128, 133 79);
“in response to a determination that the additional event is not a global reoccurring event, update the global state based on the key for the additional event” as in response to a determination that the second subevent of the subevents as the additional event is (Ahuja: paragraph 82-84, fig. 6) not a duplicate object i.e., an object that already exists in a forum database of the site e.g., site, is represented as a global reoccurring event (Chris: paragraphs 129, 133, 79), update the data state that is stored in a security event state table in a remote storage, is represented as the global state (Ahuja: paragraph 65, fig. 4), based on a timestamp as the key for the second subevent as the additional event (Ahuja: paragraph 82-84, fig. 6).
Claim 28 has the same limitation as discussed in claim 21; thus claim 28 is rejected under the same reason as discussed in claim 21. In addition, Ahuja further teaches limitations:
“performing, by a second stage process of a computing node:” as performing, by a second action as a second stage process of a security service e.g., 110 (fig. 1, paragraph 36) or 306 as a computing node (fig. 3) (paragraphs 33-34, 58):
“in response to receiving the event as a possible new event from the first stage process of the other computing device node: determining, based on a key for the event and a global state, whether the event is……” as in response to the receiving, from an action as a first stage process of one or more components e.g., network devices, user devices, servers, operating systems, user applications as another computing node, the subevent that is generated and corresponds to an occurrence of an action is interpreted as a possible new event (paragraphs 51-52), determine, based on timestamp of the subevent as a key for subevent and state data that is stored in a security event state table in a remote storage (paragraph 65, fig. 4), whether the subevent as the event is e.g., matches a subevent filter (fig. 6, paragraphs 80-83);
“in response to determining that the event is……, updating the global state based on the key for the event to generate an updated global state that indicates ……” as in response to a determination that event is the subevent filter, update the data state, which is stored in a security event state table in a remote storage and accessed by one or more applications or servers for updating (fig. 3, paragraphs 79, 86, 90), is represented as a global state (paragraph 65, fig. 4), based on the timestamp of the subevent as the key for the event to generate the updated data state as an updated global state that indicates a new security event has occurred (paragraph 82-84, fig. 6).
For example, a subevent processing microservice 340 may update one or more subevent counters, subevent data fields, timestamp fields, security event state data, etc. As described above in reference to FIGS. 4-5, updating the state data may include incrementing/decrementing one or more counters, storing one or more timestamps or other data included with or derived from the associated subevent, determining a next state from a state table based on the subevent matching an associated filter (paragraph 82).
At block 610, in response to determining that the updated state data indicates that a new security event has occurred, security event data is generated. For example, a subevent processing microservice 340 may generate a message, notification, log entry, or any other type of data to indicate that the security event has occurred. The security event data may include data from one or more of the subevents that triggered the security event, based on one or more of the security event state items stored in association with the corresponding security event definition, or based on any other source of information related to the comprising subevents. For example, if a subevent processing microservice 340 detects an occurrence of a brute-force password attack security event, the microservice may generate security event state data indicating the type of security event, one or more source and/or destination IP addresses associated with the event, a time at which the attack started or ended, etc (paragraph 84).
For example, each of security event states 740-760 may correspond to one of a plurality of states of a state table stored in association with the security event definition for the malware security event. In this example, state A 740 is an initial default state at which zero matching subevents are recorded. Thus, state data associated with the state A 740 indicates a subevent counter 742 value of “0”, a subevent data 744 value of “0”, and a subevent timestamp value of “0” (paragraph 90).
Ahuja does not explicitly teach limitations
global reoccurring event that has been received by the second stage process of the computing node from one or more other first stage processes of one or more additional computing nodes different than the other computing node prior to the reception of the event as a possible new event from the first stage process of the other computing node prior to reception of the event from the first stage process.
Chris teaches limitations
the reception of the event as a possible new event; reception of the event;
as reception of the event as a new event (paragraph 99).
Chris and Ahuja disclose a method of updating a state in response to receiving an event. These references are same field as application’s field. Thus, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to apply Chris’s teaching to Ahuja’s system to minimize unnecessary transmissions, number of messages concurrently in-transit among computing devices, to maintain latency information to determine transmission failures, and further to synchronize information among computing devices such as information must be replicated from one computing device to another computing device.
Bra teaches limitations
“that has been received by the second stage process of the computing node from one or more other first stage processes of one or more additional computing nodes different than the other computing node prior to ……from the first stage process of the other computing node prior to ……from the first stage process” as a request that has been received by a regional storage system as the second stage process of a remote data center 108b as the computing node from one or more regional storage systems 110 as one or more other first stage processes of one or more remote data centers 108b, 108c as one or more additional computing devices different than prior to providing the copy of content item from the storage system 110 as the first stage process of the local data center 108 as the other computing node prior to providing the copy of content item from the storage system 110 (figs. 1-3, paragraphs 73-75).
Bra and Ahuja disclose a method of updating data in response to receiving an event. These references are same field as application’s field. Thus, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to apply Bra’s teaching to Ahuja’s system to reduce a number of times that the client device and/or local data center requests access to the remote storage system and further reduce costs associated with accessing the cloud storage system directly in response to each data request.
Claim 35 has the same limitation as discussed in claims 21, 28; thus claim 35 is rejected under the same reason as discussed in claim 21, 28. In addition, Ahuja further teaches one or more non-transitory computer-accessible storage media storing program instructions that when executed on or across one or more processors of a computing node, cause the one or more processors to implement a second stage process to (paragraphs 33, 116-117).
Claims 24, 27, 31, 38 are rejected under 35 U.S.C. 103 as being unpatentable over Ahuja in view of Chris and Bra and further in view of FÄRNLÖF et al (or hereinafter “Fa”) (US 20220159061)
As to claims 24, 31, 38, Ahuja and Chris teach limitation
“wherein the second stage process is configured to” as the second action as a second stage process to (Ahuja: paragraphs 33-34, 58) obtain the new event (Chris: paragraph 131; Chris: figs. 4-5, paragraphs 103-104) or
“program instructions that when executed on or across the one or more processors further cause the one or more processors to implement the second stage process to” as instructions that executed by a processor to perform the action of the actions to (Ahuja: paragraphs 33-34, 58) obtain the new event (Chris: paragraph 131; Chris: figs. 4-5, paragraphs 103-104).
Ahuja and Chris do not explicitly teach limitations
send at least a portion of the global state to the first stage process to update a local state of the first stage process.
Fa teaches limitations “send at least a portion of the global state to the first stage process to update a local state of the first stage process” as publish update(s) of the global state as a portion of the global state to a first sequencer service of a node e.g., client as the first stage process to write the update(s) into a locally maintained copy of the global state that exists in shared memory on each one of the nodes (abstract, fig. 1A, 8, paragraphs 126-130, 133). Writing the update(s) into a locally maintained copy of the global state that exists in shared memory on each one of the nodes is representing as updating a local state of the first stage process.
In particularly, one of the computing nodes includes a sequencer service that receives updates from the plurality of computing nodes. The sequencer service maintains or annotates messages added to the global state of the system. Updates to the global state are published to the plurality of computing nodes. Monitoring services on the other computing nodes write the updates into a locally maintained copy of the global state that exists in shared memory on each one of the nodes. Client computer processes on the nodes may then subscribe to have updates “delivered” to the respective client computer processes (abstract).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to apply Fa’s teaching to Ahuja’s system in order to allow for faster processing and decreased usage of network bandwidth as the content of the message may be irrelevant to the sequencer service and its logical location within the global state of the distributed system.
As to claims 27, 34, Ahuja and Chris teach limitations
“wherein the second stage process is configured to:” as the second action as a second stage process to (Ahuja: paragraphs 33-34, 58);
“output the additional event as an additional new event” as to obtain the next new even as additional new event (Chris: paragraph 131).
Ahuja and Chris do not explicitly teach limitation
send at least a portion of the global state to the first stage process of the other computing node and to the first stage process of the additional computing node.
Fa teaches limitations
“send at least a portion of the global state to the first stage process of the other computing node and to the first stage process of the additional computing node” as publish updates of the global state as a portion of the global state to a first sequencer service of first computing node e.g., client 110A or 112A as other computing node and a second sequencer of second computing node e.g., client 110B or 112B as the additional computing node (abstract, fig. 1A, 8, paragraphs 126-130, 133).
In particularly, one of the computing nodes includes a sequencer service that receives updates from the plurality of computing nodes. The sequencer service maintains or annotates messages added to the global state of the system. Updates to the global state are published to the plurality of computing nodes. Monitoring services on the other computing nodes write the updates into a locally maintained copy of the global state that exists in shared memory on each one of the nodes. Client computer processes on the nodes may then subscribe to have updates “delivered” to the respective client computer processes (abstract).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to apply Fa’s teaching to Ahuja’s system in order to allow for faster processing and decreased usage of network bandwidth as the content of the message may be irrelevant to the sequencer service and its logical location within the global state of the distributed system.
Claims 25, 32, 39 are rejected under 35 U.S.C. 103 as being unpatentable over Ahuja in view of Chris and Bra and further in view of Sawyer et al (US 20140379586).
As to claims 25, 32, 39, Ahuja and Chris teach limitation
“wherein the second stage process is configured to:” as the second action as a second stage process to (Ahuja: paragraphs 33-34, 58) or
“program instructions that when executed on or across the one or more processors further cause the one or more processors to implement the second stage process to” as instructions that executed by a processor to perform the second action of the actions as the second state process to (Ahuja: paragraphs 33-34, 58);
“receive, from the first stage process of the other computing node, ……that corresponds to another event obtained by the first stage process” as receive, from application(s) or microservice(s) (Ahuja: paragraph 57), subevent(s) that correspond to network message as another event sent by (Ahuja: paragraph 89) a first process as the first stage process (Chris: paragraph 28);
“in response to reception of……, update a global state based on a key for the other event or
in response to receiving of……, updating a global state based on a key for the other event” as in response to the receiving a second subevent (Ahuja: paragraphs 51-52), determining that second subevent is the subevent filter, and then updating the data state, which is stored in a security event state table in a remote storage and accessed by one or more applications or servers for updating (Ahuja: fig. 3, paragraphs 79, 86, 90), is represented as a global state (Ahuja: paragraph 65, fig. 4), based on a second timestamp as key of the second subevent as the other event (Ahuja: paragraph 82-84, fig. 6).
Ahuja and Chris do not explicitly teach limitations
a promote state event; the promote state event.
Sawyer teaches limitations
a promote state event; the promote state event (as newer state event as a promote state event that is used to move the item from its current state on the mobile device 500 to its newer state in the event, for example including updating icon repository file 582: paragraph 127).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to apply Sawyer’s teaching to Ahuja’s system to allow for communication between a remote synchronization client and remote devices and further to reduce data duplication stored in storage device.
Contact Information
Any inquiry concerning this communication or earlier communications from the examiner should be directed to CAM-Y T TRUONG whose telephone number is (571)272-4042. The examiner can normally be reached (571) 272 4042.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, SHERIEF BADAWI can be reached at (571) 272-9782. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/CAM Y T TRUONG/Primary Examiner, Art Unit 2169
Prosecution Insights