Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
Currently pending claims are 1 – 20.
Claim Objection
Claim 20 is objected to because of the following informalities (and Examiner respectfully request to correct as follows): “one or more processors” should be replaced with “one or more hardware processors (or processor devices)” – Examiner notes this is because a computer processor could be a software processor (e.g. a Microsoft WORD processor). Appropriate correction(s) is (are) required. // “A computer processor” may include the “software processor” (e.g. a word processor) //
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 2, 4, 6, 7, 9, 10 & 15 – 20 are rejected under 35 U.S.C.103 as being unpatentable over Narayanaswamy et al. (U.S. Patent 2020/0242269), and in view of Duggal et al. (U.S. Patent 10,983,843).
As per claim 1, 19 & 20, Narayanaswamy teaches a method of operating a scanning system, implemented either on-premises or in a cloud-based service, for crawling and analyzing files stored in one or more data repositories, the scanning system comprising a controller, a message broker, and a distributed pool of workers (Narayanaswamy: FIG. 4, FIG. 1A / E-175 & E-184 & Para [0053] – [0054] and Para [0120]), the method comprising:
receiving, by the controller, policy and configuration data associated with at least one organization (Narayanaswamy: see above & Para [0053], Para [0054] Line 1 – 6, Para [0063]: (a) providing a CASB system to secure sensitive data, prevent data loss leakage and protect against security threats (b) an Introspective Analyzer (including a monitor) of the CASB system constitutes a controller using API connectors (message broker) to manage and monitor a plurality of different cloud services, and (c) receiving policies and configuration data associated with company / organization so as to define / change / update / tailor content policies associated with organizations);
generating, by the controller, job assignments corresponding to files to be analyzed according to the received policy and configuration data (Narayanaswamy: see above, FIG. 9 & Para [0068] / [0063], Para [0091] – [0094], Para [0054] / [0047], Para [0120] – [0121] and Para [0074]:
(a) generating / defining, for a new user, a role (i.e. a responsibility of job assignment) so as to enable the determination whether accessing by the new user (post-joining) to a confidential document (a secure file), corresponding to files to be analyzed, is permitted or not so as to invoke a litigation exposure for the organization since the content access policy is sensitive to roles (job assignments) to a particular user / client (Para [0068] / [0094]); while
(b) on another perspective, the security scanning analysis tasks are also assigned (i.e. job (task) assignments) to a plurality of worker nodes (i.e. a distributed pool of workers) including, at least, a content scanner entity such as a DLP engine (Data Leakage Prevention) that applies different content inspection (scanning), a user authentication entity, a policy enforcement action entity (e.g. alerting / blocking), and etc.,) to analyze the changes for detecting anomalous activities);
publishing the job assignments to the message broker for parallel (see Duggal below) distribution among the distributed pool of workers (Narayanaswamy: see above & Para [0054] / [0047], Para [0120] – [0121], Para [0074] and Para [0068]:
(a) distributing / publishing different security scanning tasks which are assigned to a plurality of different worker nodes, i.e. job (task) assignments (see above), via an API connector (i.e. a message broker) associated with an introspective analyzer to crawl through the data / file resident in the cloud-based services to analyze the changes for detecting anomalous activities (e.g.), at least, on a periodical basis (i.e. periodical publishing) via a polling mode (e.g. performed regularly and at a set time interval, wherein
(b) said plurality of worker nodes include a distributed pool of workers such as a content scanner entity such as a DLP engine (Data Leakage Prevention) that applies different content inspection (scanning), a user authentication entity, a policy enforcement action entity (e.g. alerting / blocking), and etc., and
(c) based on policies and rules to crawl through different contents (i.e. different assignments) such as identified documents / emails / files so as to trigger security actions for detecting security threats).
However, Narayanaswamy does not disclose expressly a parallel distribution among the distributed pool of workers.
Duggal (& Narayanaswamy) teaches a plurality of queues configured to store files from the plurality of files for analysis by workers of the plurality of workers from the message broker (Narayanaswamy: see above) || (Duggal: Figure 14 & Col. 25 Line 20 – 30 / Line 39 – 46 and Col. 2 Line 45 – 58: as per a plurality of worker nodes in a distributed (service-mesh) cloud-based microservices FaaS (Function as a Service) system, efficiently providing a plurality of queues to dynamically coordinate collaborating services for processing concurrent (i.e. in-parallel) / multi-threaded event queues) – this is consistent with the disclosure of the instant specification (SPEC-PG.PUB: Para [0004] Line 10 – 15: a plurality of workers operate in parallel to efficiently process a plurality of queues).
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to propose the modification of using a plurality of queues configured to store files from the plurality of files for analysis by workers of the plurality of workers because Duggal teaches efficiently using a plurality of queues via a plurality of event servers in a distributed (service-mesh) microservices FaaS (Function as a Service) system to dynamically coordinate collaborating services for processing concurrent (i.e. in-parallel) / multi-threaded event queues for a plurality of worker nodes (see above) within the Narayanaswamy’s system of utilizing an introspective analyzer to crawl through the data / file resident in the cloud-based services including a plurality of worker nodes to analyze the changes for detecting anomalous activities with a periodical polling mode (see above).
retrieving and scanning, by at least one worker, the files from the one or more data repositories in accordance with the assigned job (Narayanaswamy: see above, FIG. 8. FIG. 9 & Para [0054] / [0047], Para [0120] – [0121] and Para [0074]: retrieving to analyze the accessed file based on (a) an assigned job (role) of a corresponding user w.r.t. its privilege, while (b) on another perspective, the security scanning analysis tasks are assigned (i.e. job (task) assignments) to a plurality of worker nodes (i.e. a distributed pool of workers), which include at least a content scanner entity such as a DLP engine (Data Leakage Prevention) that applies different content inspection (scanning), a user authentication entity, a policy enforcement action entity (e.g. alerting), and etc.,) to analyze the changes for detecting anomalous activities); and
executing, where required by the policy and configuration data, at least one policy- based action on the files within the data repositories (Narayanaswamy: see above & Para [0047] / [0068] / [0121] and Para [0082] Last sentence: e.g. alerting authenticating activity, blocking excessive data transfer, revoking file sharing, quarantining and etc.).
As per claim 2, Narayanaswamy as modified teaches wherein the policy-based action comprises at least one of allowing the file, deleting the file, quarantining the file, or generating a notification (Narayanaswamy: see above & Para [0047] / [0068] / [0082]: for example, alerting authenticating activity) || (Duggal: see above).
As per claim 4, Narayanaswamy as modified teaches wherein at least one worker is configured to forward selected files to a data leakage prevention (DLP) engine for further analysis, and to receive instructions from the DLP engine for enforcement (Narayanaswamy: see above, FIG. 8. FIG. 9 & Para [0054] / [0047] / [0049], Para [0120] – [0121] and Para [0074]: the security scanning analysis tasks are assigned (i.e. job (task) assignments) to a plurality of worker nodes (i.e. a distributed pool of workers), which include at least a content scanner entity such as a DLP engine (Data Leakage Prevention) that applies different content inspection (scanning), a user authentication entity, a policy enforcement action entity (e.g. alerting), and etc.,) to analyze the changes for detecting anomalous activities) || (Duggal: see above).
As per claim 6, Narayanaswamy as modified teaches wherein the distributed pool of workers comprises a plurality of specialized worker types, each configured to perform at least one function selected from the group consisting of file metadata retrieval, content scanning, user authentication, and policy enforcement actions (Narayanaswamy: see above, FIG. 8. FIG. 9 & Para [0054] / [0047], Para [0120] – [0121] and Para [0074]: retrieving to analyze the accessed file based on (a) an assigned job (role) of a corresponding user w.r.t. its privilege, while (b) on another perspective, the security scanning analysis tasks are assigned (i.e. job (task) assignments) to a plurality of worker nodes (i.e. a distributed pool of workers), which include at least a content scanner entity such as a DLP engine (Data Leakage Prevention) that applies different content inspection (scanning), a user authentication entity, a policy enforcement action entity (e.g. alerting), and etc.,) to analyze the changes for detecting anomalous activities) || (Duggal: see above).
As per claim 7, Narayanaswamy as modified teaches wherein a regulator component monitors performance metrics of the distributed pool of workers and adjusts the rate of job assignments based on detected load or performance indicators (Narayanaswamy: see above & Figure 1A / E-184 and Para [0047]) || (Duggal: Figure 14 & Col. 25 Line 20 – 30 / Line 39 – 46 and Col. 2 Line 45 – 58: (a) as per a plurality of worker nodes in a distributed (service-mesh) cloud-based system, efficiently providing a plurality of queues to dynamically coordinate collaborating services for processing concurrent (i.e. in-parallel) / multi-threaded event queues to adjust load assignments to assure performance balance by (b) utilizing in-process communications for shared-memory through a Blackboard Coordination Theory to support efficient task assignment coordination of (b-1) at least some system agent programs executing tasks in parallel, and (b-2) at least some system agent programs sharing context between inter-dependent processes) – this is consistent with the disclosure of the instant specification (SPEC-PG.PUB: Para [0004] Line 10 – 15: a plurality of workers operate in parallel to efficiently process a plurality of queues).
As per claim 9, Narayanaswamy as modified teaches storing status updates from the workers in one or more queues managed by the message broker, and aggregating the status updates to generate an audit log of scans and resulting actions (Narayanaswamy: see above & Para [0054], Para [0120] – [0121] and Para [0074]: triggering system security management actions (i.e. event data logs) for securely detecting the threats as needed by utilizing an introspective analyzer to crawl through the data / file resident in the cloud-based services including a plurality of worker nodes to analyze the changes for detecting anomalous activities and based on policies and rules to crawl through different contents of identified documents / emails / files) || (Duggal: Figure 14 & Col. 10 Line 24 – 28 / Line 35 – 38, Col. 25 Line 20 – 30 and Col. 2 Line 45 – 58: to record the relevant system events (i.e. audit logs) using interaction meta-data to translate policies and efficiently provide a plurality of queues via a plurality of event servers to dynamically coordinate collaborating services for processing concurrent (i.e. in-parallel) / multi-threaded event queues) and storing (pushing) an associated file into a corresponding queue in response to a new incoming event of a unique file entry within a batch of files associated with various tenants) || (Duggal: see above).
As per claim 10, Narayanaswamy as modified teaches wherein each worker detects errors or timeout conditions when communicating with the data repositories, and re-publishes the corresponding job assignment for retry without requiring the scanning system to restart the entire crawling process (Narayanaswamy: see above & Para [0054] Line 1 – 9 and Para [0068]: an introspective analyzer can crawl the data / file resident in the cloud-based services with a polling mode (e.g. performed regularly and at a set time interval (e.g. periodical such as on a basis of time of day or day of week and etc.)) analyze the changes for detecting anomalous activities (e.g.) such as on a periodical basis (i.e. periodical publishing) via a polling mode (e.g. repetitively between the set time interval including, at least, effectively for a retry on an occurrence of errors or timeout without the need to restart the entire crawling process for the scanning system) || (Duggal: see above).
As per claim 15, Narayanaswamy as modified teaches authenticating users or administrators via a credentials manager, wherein the controller stores only obfuscated or tokenized credential information necessary to establish secure sessions with the data repositories (Duggal: see above) || (Narayanaswamy: see above & Para [0055]: authenticating users with user identities which is provided by a network security system to a client device in a form of a tokenized credential so as to establish a secure network connection and access to network resources).
As per claim 16, Narayanaswamy as modified teaches wherein the controller interfaces with an external logging or analytics platform to store metadata and scan results, enabling comprehensive reporting and forensic analysis across multiple runs (Duggal: see above) || (Narayanaswamy: see above & Para [0054]).
As per claim 17, Narayanaswamy as modified teaches wherein the controller is configured to communicate with an external cloud-based security system through at least one application programming interface (API), enabling the system to offload certain scanning or policy-enforcement tasks and receive automated instructions for critical security threats (Duggal: see above) || (Narayanaswamy: see above & Para [0053], Para [0054] Line 1 – 6, Para [0063]: (a) providing a CASB system to secure sensitive data, prevent data loss leakage and protect against security threats (b) an Introspective Analyzer (including a monitor) of the CASB system constitutes a controller using API connectors (message broker) to manage and monitor a plurality of different cloud services, and (c) receiving policies and configuration data associated with company / organization so as to define / change / update / tailor content policies associated with organizations).
As per claim 18, Narayanaswamy as modified teaches generating, by the controller, a comprehensive report of the scan results and policy-based actions for each organization; and providing the report to authorized administrators, including details such as file identifiers, timestamps of actions, and reason codes for any enforcement decisions (Duggal: see above) || (Narayanaswamy: see above, FIG. 7A – 7E & Para [0080]: reporting detected sensitive documents and data exposure details for users with compromised credentials and showing aspects of a visibility dashboard usable for displaying data exposure details due to the compromised credentials of a particular user based on the detected sensitive documents, for an organization).
Claims 3, 8 & 13 are rejected under 35 U.S.C.103 as being unpatentable over Narayanaswamy et al. (U.S. Patent 2020/0242269), in view of Duggal et al. (U.S. Patent 10,983,843), and in view of Begel et al. (U.S. Patent 2010/0211924).
As per claim 3, 8 & 13, Begel (& Narayanaswamy as modified) teaches periodically generating incremental job assignments for newly modified or created files; and publishing these incremental job assignments to the message broker such that subsequent scans only process files that have changed since a previous scan (Narayanaswamy: see above & Para [0054] Line 1 – 9, Para [0068], Para [0049] and Para [0054]: an introspective analyzer can crawl the data / file resident in the cloud-based services with a polling mode (e.g. performed regularly and at a set time interval (e.g. periodical such as on a basis of time of day or day of week and etc.)) analyze the changes for detecting anomalous activities).
(Begel: Para [0208] / [0207]: providing a more efficient crawling mechanism to first start a baseline crawling on each file (code) check-in and then until a later recent check-in (e.g. file changed) such that the changed file’s differences (i.e. incremental difference with respect to a check in/out configuration management system) can be effectively analyzed – i.e. before and after the modified files snapshots can be parsed and compared – this is consistent with the disclosure of the instant specification (SPEC-PG.PUB: Para [0050]).
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to propose the modification of including all files by a first crawl and subsequent performing the crawling periodically crawl incrementally because Begel teaches to provide a more efficient crawling mechanism to first start a baseline crawling on each file (code) check-in and then until a later recent check-in (e.g. file changed) such that the changed file’s differences can be effectively analyzed – i.e. before and after the modified files snapshots can be parsed and compared (see above) within the Narayanaswamy’s system of utilizing an introspective analyzer to crawl through the data / file resident in the cloud-based services with a periodical polling mode to analyze the changes for detecting anomalous activities (see above).
Claim 5 is rejected under 35 U.S.C.103 as being unpatentable over Narayanaswamy et al. (U.S. Patent 2020/0242269), in view of Duggal et al. (U.S. Patent 10,983,843), and in view of Viktorov et al. (U.S. Patent 10,715,540).
As per claim 5, Viktorov (& Narayanaswamy as modified) teaches wherein at least one worker is configured to execute selected files in a sandbox environment to detect malicious behavior (Narayanaswamy: see above & Para [0054] Line 1 – 9 and Para [0068]: an introspective analyzer crawls and analyzes the data / file resident in the cloud-based services to detect the violations of files so as to perform security actions such as quarantining the target files) ||
(Viktorov: Abstract & Col. 9 Line 49 – 55 and Col. 6 Line 40 – 46: providing protection from malicious and harmful content in a cloud-based services with specified actions such as quarantining the target files by using a sandbox processing means).
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to propose the modification of providing a sandbox configured to execute a file of the plurality of files, and provide an action based on the execution and based on the policy and the configuration because Viktorov teaches effectively and securely providing protection from malicious and harmful content in a cloud-based services with specified actions such as quarantining the target files by using a sandbox processing means (see above) within the Narayanaswamy’s system of utilizing an introspective analyzer to crawl through the data / file resident in the cloud-based services to detect the violations of files so as to perform security actions such as quarantining the target files (see above).
Claim 11 is rejected under 35 U.S.C.103 as being unpatentable over Narayanaswamy et al. (U.S. Patent 2020/0242269), in view of Duggal et al. (U.S. Patent 10,983,843), and in view of Rajagopalan et al. (U.S. Patent 11,271,953).
As per claim 11, Rajagopalan (& Narayanaswamy as modified) teaches wherein the controller enforces a throttle rate provided by at least one data repository to limit the frequency of file-access requests by the workers, thereby preventing overuse of application programming interfaces (API) of the data repository (Narayanaswamy: see above & Para [0054] / [0074] and Para [0120]: managing associated with the introspective analyzer (i.e. the controller) using API connectors to crawl through different sensitive data located in different cloud-based services) ||
(Rajagopalan: Col. 4 Line 1 – 13: improving the system throughput to prevent throttling by enforcing an overuse of application programming interfaces (API) event rate in excess of a limit and taking actions to reduce any impact caused by an excessive event rate of a particular user / worker group).
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to propose the modification of enforcing a throttle rate provided by at least one data repository to limit the frequency of file-access requests by the workers, thereby preventing overuse of application programming interfaces (API) of the data repository because Rajagopalan teaches efficiently improving the system throughput to prevent throttling by enforcing an overuse of application programming interfaces (API) event rate in excess of a limit and taking actions to reduce any impact caused by an excessive event rate of a particular user / worker group (see above) within the Narayanaswamy’s system of utilizing an introspective analyzer to crawl through the data / file resident in the cloud-based services including a plurality of worker nodes to analyze the changes for detecting anomalous activities and managing associated with the introspective analyzer (i.e. the controller) using API connectors to crawl through different sensitive data located in different cloud-based services (see above).
Claim 12 is rejected under 35 U.S.C.103 as being unpatentable over Narayanaswamy et al. (U.S. Patent 2020/0242269), in view of Duggal et al. (U.S. Patent 10,983,843), and in view of Bidare et al. (U.S. Patent 2013/0179954).
As per claim 12, Bidare (& Narayanaswamy as modified) teaches using short-lived credentials to enable secure access to the data repositories, thereby avoiding permanent storage of sensitive authentication data (Narayanaswamy: see above) ||
(Bidare: Para [0129] & Para [0077]: generating a limited duration one-time password because there is a possibility that the secrecy associated with the authentication credentials might be compromised and further, the authentication credentials might be subjected to hacker/phishing/spoofing attacks and subsequently get misused).
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to propose the modification of using short-lived credentials to enable secure access to the data repositories, thereby avoiding permanent storage of sensitive authentication data because Bidare teaches securely generating a limited duration one-time password because there is a possibility that the secrecy associated with the authentication credentials might be compromised and also might be subjected to hacker/phishing/spoofing attacks and subsequently get misused (see above) within the Narayanaswamy’s system of utilizing an introspective analyzer to crawl through the data / file resident in the cloud-based services including a plurality of worker nodes to analyze the changes for detecting anomalous activities and managing associated with the introspective analyzer (i.e. the controller) using API connectors to crawl through different sensitive data located in different cloud-based services (see above).
Claim 14 is rejected under 35 U.S.C.103 as being unpatentable over Narayanaswamy et al. (U.S. Patent 2020/0242269), in view of Duggal et al. (U.S. Patent 10,983,843), and in view of Zhang et al. (CN 104123182 B - Zhang @ 9-30-2015).
As per claim 14, Zhang (& Narayanaswamy as modified) teaches wherein the distributed pool of workers scales dynamically, adding or removing worker instances based on factors including the volume of files to be processed, the number of organizations, and the processing time required for assigned tasks (Narayanaswamy: see above) ||
(Zhang: Page 6 / Last Para & Page 7 / 1st Para: presetting task scheduling algorithm by a resource manager based on a size of input data and reduced number of tasks according to the task requests, system performance and load condition information using state information within a collected group of functional (working) entities).
It would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to propose the modification of adding or removing worker instances based on factors including the volume of files to be processed, the number of organizations, and the processing time required for assigned tasks because Zhang teaches presetting task scheduling algorithm by a resource manager based on a size of input data and reduced number of tasks according to the task requests, system performance and load condition information using state information within a collected group of functional (working) entities (see above) within the Narayanaswamy’s system of utilizing an introspective analyzer to crawl through the data / file resident in the cloud-based services including a plurality of worker nodes to analyze the changes for detecting anomalous activities and managing associated with the introspective analyzer (i.e. the controller) using API connectors to crawl through different
sensitive data located in different cloud-based services (see above).
Any inquiry concerning this communication or earlier communications from the examiner should be directed to LONGBIT CHAI whose telephone number is (571)272-3788. The examiner can normally be reached Monday - Friday 9:00am-5:00pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lynn D. Feild can be reached at 571-272-2092. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
---------------------------------------------------
/Longbit Chai/
Longbit Chai E.E. Ph.D.
Primary Examiner, Art Unit 2431
No. #2608 – 2026 ---------------------------------------------------
Prosecution Insights