DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 103
2. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
3. Claim(s) 1-8 are rejected under 35 U.S.C. 103 as being unpatentable over Shua (US Pub.No.2022/0350931) in view of Pogrebinsky (US Pub.No.2020/0177591).
4. Regarding claim 1 Shua teaches a computer-implemented method comprising: identifying one or more computing services in a target computing environment to scan for data posture analysis (Para:0349-0351 teaches identifying assets of a primary cloud account, including virtual machine, databases and storage resources); obtaining an access permission corresponding to the one or more computing services in the target computing environment (Para:0120 and Para:0353 teaches establishing read only access through a role having storage access and establishing a trust relationship between the primary and secondary accounts);
deploying, to a scanner cloud environment that is distinct from the target computing environment, a scanner based on the access permission (Para:0353 teaches an ephemeral scanner may be operated inside of that secondary account to scan block storage associated with the primary account. Each account may be hosted on different systems);
the scanner result represents a scan of storage resources using the access permission (Para:0353, Para:0356 and Para:0364 teaches producing block storage metadata through the authorized scanner and receiving the metadata from the scanner);
and generating a data posture analysis result based on the scanner result (Para:0353 and Para:0356-0367 teaches analyzing the received metadata, correlating identified vulnerability with assets, and generating a report).
Shua teaches all the above claimed limitations but fails to teach the scanner is deployed to the scanner cloud environment according to a definition.
Pogrebinsky teaches the scanner is deployed to the scanner cloud environment according to a definition (Para:0061 teaches an application manifest identifies application components, installation sequence and deployment information, example include a deployment definition and templates. Para:064 teaches generates deployment scripts based on cloud platform configuration. Para:00066-0067 teaches installs components according to manifest, including executing custom scripts on virtual machines).
It would have been obvious to one of ordinary skill in the art at the time before the effective filling date of the claimed invention to modify Shua’s scanner using Pogrebinsky scanner definition and provisional approach to configure the scanner for the selected cloud provider and scanning task, while retaining Shua’s trusted secondary account deployment.
5. Regarding claim 2, Shua teaches the computer-implemented method of claim 1, wherein the target computing environment comprises a target cloud environment, and the one or more computing services comprise one or more cloud data stores (Para:0348-0351 teaches
the target computing environment is a cloud environment, and the computing service include cloud data stores including databases and other storage resources).
6. Regarding claim 3, Shua teaches the computer-implemented method of claim 2, wherein the target cloud environment comprises public cloud resources (Para:0053 teaches public cloud resources through its disclosed AWS Microsoft Azure, and Google cloud platform implementation).
7. Regarding claim 4, Shua teaches the computer-implemented method of claim 1, wherein the access permission comprises a computing service role, and the computer-implemented method further comprises attaching the computing service role to the scanner using a deployment script of the scanner (Para:0120 teaches establishing a role creation through a template).
8. Regarding claim 5, Shua teaches the computer-implemented method computer-implemented method of claim 1, wherein the access permission comprises a user credential (Para:0074 teaches a user credential as an access permission, including authentication credential. Para:0371 teaches password-based account access).
9. Regarding claim 6, Shua teaches the computer-implemented method of claim 5, wherein the user credential includes a username and a password corresponding to the one or more computing services (Para:0074 teaches username and password authentication to the cloud provider’s system).
10. Regarding claim 7, Shua teaches the computer-implemented method of claim 1, wherein the scanner is deployed to a sidecar account (Para:0353 teaches deploying the scanner in a trusted secondary account to scan the primary account’s storage. The secondary account corresponds to the claimed sidecar account because it separately host the scanner).
11. Regarding claim 8, Shua teaches the computer-implemented method of claim 7, wherein the sidecar account comprises a sidecar account in a public cloud (Para:0353, Para:0053 teaches secondary account deployment, implemented using the public cloud platform. Supports a sidecar account in a public cloud).
12. Claim 9 is rejected under 35 U.S.C. 103 as being unpatentable over Shua (US Pub.No.2022/0350931) in view of in view of Pogrebinsky (US Pub.No.2020/0177591) as applied to claim 8 above and further in view of Choi (US Pub.No.2019/0327258)
13. Regarding claim 9, Shua in view of Pogrebinsky teaches the computer-implemented method of claim 8, wherein the target computing environment comprises a first cloud account associated with a user and the sidecar account comprises a second cloud account associated with the user (Para:0353 teaches establishes primary and secondary accounts), but do not expressly teach the method further comprises retrieving the scanner definition based on the first cloud account.
Choi teaches retrieving the scanner definition based on the first cloud account (Para:0052-0053 teaches matching test criteria against stored record and retrieving scanner settings from a stored data structure. Para:0054-0055 teaches identifies parameters including target content characteristics, the corresponding scanner, and a definition of that scanner, i.e., the record includes a scanner definition. Selecting the scanner records according to the test type and target content characteristics. Para:0064-0067 configure the scanner for the identified target).
It would have been obvious to one of ordinary skill in the art at the time before the effective filling date of the claimed invention to modify Shua in view of Pogrebinsky teachings to include retrieving the scanner settings associated with the scanner include according to the target’s characteristics as taught by Choi, so that the selected scanner is suited to the resources being scanned.
14. Claim(s) 10 and 12 are rejected under 35 U.S.C. 103 as being unpatentable over Shua (US Pub.No.2022/0350931) in view of in view of Pogrebinsky (US Pub.No.2020/0177591) as applied to claim 1 above and further in view of Hosseini (US Pub.No.2023/0262085)
15. Regarding claim 10, Shua in view of Pogrebinsky, teaches all the above claimed limitations but fails to teach the computer-implemented method of claim 1, wherein the one or more computing services comprises a plurality of computing services, and the scanner cloud environment is configured to generate a plurality of scanner instances configured to scan the plurality of computing services in parallel.
Hosseini teaches the one or more computing services comprises a plurality of computing services, and the scanner cloud environment is configured to generate a plurality of scanner instances configured to scan the plurality of computing services in parallel (Figs. 4-5, Fig.6, block.605-615 and Para:0067-0069 teaches receiving multiple scanning requests, generating corresponding scanner instance, and performing parallel scans of targets in separate customer virtual cloud networks).
It would have been obvious to one of ordinary skill in the art at the time before the effective filling date of the claimed invention to modify Shua in view of Pogrebinsky teachings to include parallel scanner instances as taught by Hosseini and the combination would yield a predictable result of scanning multiple identified services concurrently and reduce the time required to complete the scans.
16. Regarding claim 12, Shua teaches the computer-implemented method of claim 10, wherein the scanner is deployed on one or more of: a serverless computing resource in the scanner cloud environment; or a virtual machine in the scanner cloud environment (Para:0256-0258 teaches implementing the secondary scanning system using a virtual machine, container or serverless function)
17. Claim 11 is rejected under 35 U.S.C. 103 as being unpatentable over Shua (US Pub.No.2022/0350931) in view of Pogrebinsky (US Pub.No.2020/0177591) and in view of Hosseini (US Pub.No.2023/0262085) as applied to claim 10 above and further in view of Matear (US Pat.No.12,095,802)
18. Regarding claim 11, Shua, in view of Pogrebinsky and in view of Hosseini, teaches all the above claimed limitations but fails to teach the computer-implemented method of claim 10, wherein the scanner cloud environment is configured to dynamically scale a number of scanner instances, in the plurality of scanner instances, based on a number of computing services in the plurality of computing services to be scanned.
Matear teaches the scanner cloud environment is configured to dynamically scale a number of scanner instances, in the plurality of scanner instances, based on a number of computing services in the plurality of computing services to be scanned (Col.3, lines.9-21, lines.52-63 teaches increasing or decreasing the number of deployed scan engines according to scanning demand, including adjusting the engine count to accommodate pending scan requests.
Fig.3, Col.9, lines.22-67: Col.10, lines.1-20 teaches scan queue data 302 and scan engine provisioning data 306).
It would have been obvious to one of ordinary skill in the art at the time before the effective filling date of the claimed invention to modify Shua in view of Pogrebinsky and in view of Hosseini teachings to include the scanner cloud environment is configured to dynamically scale a number of scanner instances, in the plurality of scanner instances, based on a number of computing services in the plurality of computing services to be scanned as taught by Matear and the combination would yield a predictable result of reducing or eliminating delays associated with deploying scan engines in response to scan requests.
19. Claim 13 is rejected under 35 U.S.C. 103 as being unpatentable over Shua (US Pub.No.2022/0350931) in view of Pogrebinsky (US Pub.No.2020/0177591) and in view of Hosseini (US Pub.No.2023/0262085) as applied to claim 10 above and further in view of Pandurangi (US Pub.No.2022/0046059)
20. Regarding claim 13, Shua, in view of Pogrebinsky and in view of Hosseini, teaches all the above claimed limitations but fails to teach the computer-implemented method of claim 10, wherein the plurality of computing services comprises a first computing service and a second computing service, wherein each computing service, of the first computing service and the second computing service, comprises a different one of: a cloud service; a cloud data warehouse; a software as a service application; or an on-premise computing service.
Pandurangi teaches the plurality of computing services comprises a first computing service and a second computing service, wherein each computing service, of the first computing service and the second computing service, comprises a different one of: a cloud service; a cloud data warehouse; a software as a service application; or an on-premise computing service (Para:0085-0087 and Para:0093-0095 teaches obtaining security information from different services, including AWS, Azure, Google, Cloud and Office 365; and assessing both cloud infrastructure and SaaS applications. i.e., using the cloud infrastructure service as first computing service and SaaS application as the second computing service, thereby supplying two different categories as recited in the claim).
It would have been obvious to one of ordinary skill in the art at the time before the effective filling date of the claimed invention to modify Shua in view of Pogrebinsky and in view of Hosseini teachings to include scanning arrangement to different services categories as taught by Pandurangi and the combination would yield a predictable result of providing security coverage for an organization’s cloud infrastructure and SaaS data through the same analysis system.
21. Claim(s) 14-15 are rejected under 35 U.S.C. 103 as being unpatentable over Shua (US Pub.No.2022/0350931) in view of Pogrebinsky (US Pub.No.2020/0177591) as applied to claim 1 above, and further in view of Ithal (WO 2023043902).
22. Regarding claim 14, Shua in view of Pogrebinsky teaches all the above claimed limitations, but fails to teach the scanner is configured to access sensitivity classification data for objects in the storage resources, and the data posture analysis result is based on the sensitivity classification data
Ithal teaches the computer-implemented method of claim 1, wherein the scanner is configured to access sensitivity classification data for objects in the storage resources, and the data posture analysis result is based on the sensitivity classification data (Para:00128-00132 teaches scanning database data for sensitivity classification, accessing classification data for storage objects, and using that information to assess breach vulnerability).
It would have been obvious to one of ordinary skill in the art at the time before the effective filling date of the claimed invention to modify Shua in view of Pogrebinsky teachings to include scanner is configured to access sensitivity classification data for objects in the storage resources, and the data posture analysis result is based on the sensitivity classification data as taught by Ithal and the combination would yield a predictable result of analyzing the system to identify security risks involving sensitive data.
23. Regarding claim 15, Shua in view of Pogrebinsky and in view of Ithal teaches the computer-implemented method of claim 14, wherein the scanner is configured to identify a set of the storage resources that satisfies a subject vulnerability signature and to return metadata representing the set of storage resources (Ithal: Para:00120-00121 and Para:00136 identifying storage resource that satisfy a subject vulnerability signature. A subject vulnerability signature include risk signature indicative of a risk of vulnerability or breach).
It would have been obvious to one of ordinary skill in the art at the time before the effective filling date of the claimed invention to modify Shua teachings to include identify a set of the storage resources that satisfies a subject vulnerability signature and to return metadata representing the set of storage resources as taught by Ithal and the combination would yield a predictable result of analyzing the system to detect vulnerabilities with the affected storage resources.
24. Claims 16 and 17 are rejected under 35 U.S.C. 103 as being unpatentable over Shua (US Pub.No.2022/0350931) in view of Pogrebinsky (US Pub.No.2020/0177591) and in view of Hosseini (US Pub.No.2023/0262085) and further in view of Matear (US Pat.No.12,095,802).
25. Regarding claim 16 Shua teaches a computing system comprising: at least one processor; memory storing instructions executable by the at least one processor, wherein the instructions, when executed, cause the computing system to: identify a plurality of computing services in one or more target computing environments to scan for data posture analysis (Para:0349-0351 teaches identifying assets of a primary cloud account, including virtual machine, databases and storage resources); obtain access permissions corresponding to the plurality of computing services (Para:0120 and Para:0353 teaches establishing read only access through a role having storage access and establishing a trust relationship between the primary and secondary accounts);
deploy, to a scanner cloud environment that is distinct from the one or more target computing environments (Para:0353 teaches an ephemeral scanner may be operated inside of that secondary account to scan block storage associated with the primary account. Each account may be hosted on different systems);
obtain a scanner result from the scanner cloud environment, the scanner result representing a scan of storage resources in the plurality of computing services (Para:0353, Para:0356 and Para:0364 teaches producing block storage metadata through the authorized scanner and receiving the metadata from the scanner);
and generate a data posture analysis result based on the scanner result (Para:0353 and Para:0356-0367 teaches analyzing the received metadata, correlating identified vulnerability with assets, and generating a report).
Shua teaches all the above claimed limitations but fails to teach establish deployment in accordance with a scanner definition, wherein the scanner cloud environment is configured to dynamically scale a number of scanner instances, in a plurality of scanner instances that execute in parallel to scan the plurality of computing services using the access permissions, based on a number of computing services in the plurality of computing services to be scanned.
Pogrebinsky teaches establish deployment in accordance with a scanner definition (Para:0061 teaches an application manifest identifies application components, installation sequence and deployment information, example include a deployment definition and templates. Para:064 teaches generates deployment scripts based on cloud platform configuration. Para:00066-0067 teaches installs components according to manifest, including executing custom scripts on virtual machines).
It would have been obvious to one of ordinary skill in the art at the time before the effective filling date of the claimed invention to modify Shua’s scanner deployment using Pogrebinsky scanner definition and provisional approach to configure the scanner for the selected cloud provider and scanning task, while retaining Shua’s trusted secondary account deployment.
Shua in view Pogrebinsky teaches all the above claimed limitations but fails to teach the scanner cloud environment is configured to dynamically scale a number of scanner instances, in a plurality of scanner instances that execute in parallel to scan the plurality of computing services using the access permissions, based on a number of computing services in the plurality of computing services to be scanned.
Hosseini teaches the one or more computing services comprises a plurality of computing services, and the scanner cloud environment is configured to generate a plurality of scanner instances configured to scan the plurality of computing services in parallel (Figs. 4-5, Fig.6, block.605-615 and Para:0067-0069 teaches receiving multiple scanning requests, generating corresponding scanner instance, and performing parallel scans of targets in separate customer virtual cloud networks).
It would have been obvious to one of ordinary skill in the art at the time before the effective filling date of the claimed invention to modify Shua in view Pogrebinsky teachings to include parallel scanner instances as taught by Hosseini and the combination would yield a predictable result of scanning multiple identified services concurrently and reduce the time required to complete the scans.
Shua, in view Pogrebinsky and in view of Hosseini, teaches all the above claimed limitations but fails to teach wherein the scanner cloud environment is configured to dynamically scale a number of scanner instances, in the plurality of scanner instances, based on a number of computing services in the plurality of computing services to be scanned.
Matear teaches the scanner cloud environment is configured to dynamically scale a number of scanner instances, in the plurality of scanner instances, based on a number of computing services in the plurality of computing services to be scanned (Col.3, lines.9-21, lines.52-63 teaches increasing or decreasing the number of deployed scan engines according to scanning demand, including adjusting the engine count to accommodate pending scan requests.
Fig.3, Col.9, lines.22-67: Col.10, lines.1-20 teaches scan queue data 302 and scan engine provisioning data 306).
It would have been obvious to one of ordinary skill in the art at the time before the effective filling date of the claimed invention to modify Shua in view Pogrebinsky and in view of Hosseini teachings to include the scanner cloud environment is configured to dynamically scale a number of scanner instances, in the plurality of scanner instances, based on a number of computing services in the plurality of computing services to be scanned as taught by Matear and the combination would yield a predictable result of reducing or eliminating delays associated with deploying scan engines in response to scan requests.
26. Regarding claim 17 Shua teaches the computing system of claim 16, wherein the scanner is deployed on one or more of: a serverless computing resource in the scanner cloud environment; or a virtual machine in the scanner cloud environment (Para:0256-0258 teaches implementing the secondary scanning system using a virtual machine, container or serverless function).
27. Claim 18 is rejected under 35 U.S.C. 103 as being unpatentable over Shua (US Pub.No.2022/0350931) in view of Pogrebinsky (US Pub.No.2020/0177591) in view of Hosseini (US Pub.No.2023/0262085) and in view of Matear (US Pat.No.12,095,802) as applied to claim 16 above and further in view of Pandurangi (US Pub.No.2022/0046059)
28. Regarding claim 18, Shua, in view Pogrebinsky, in view of Hossein, and in view of Matear teaches all the above claimed limitations but fails to teach the computing system of claim 16, wherein the plurality of computing services comprises a first computing service and a second computing service, wherein each computing service, of the first computing service and the second computing service, comprises a different one of: a cloud service; a cloud data warehouse; a software as a service application; or an on-premise computing service.
Pandurangi teaches the plurality of computing services comprises a first computing service and a second computing service, wherein each computing service, of the first computing service and the second computing service, comprises a different one of: a cloud service; a cloud data warehouse; a software as a service application; or an on-premise computing service (Para:0085-0087 and Para:0093-0095 teaches obtaining security information from different services, including AWS, Azure, Google, Cloud and Office 365; and assessing both cloud infrastructure and SaaS applications. i.e., using the cloud infrastructure service as first computing service and SaaS application as the second computing service, thereby supplying two different categories as recited in the claim).
It would have been obvious to one of ordinary skill in the art at the time before the effective filling date of the claimed invention to modify Shua, in view Pogrebinsky, in view of Hossein, and in view of Matear teachings to include scanning arrangement to different services categories as taught by Matear and the combination would yield a predictable result of providing security coverage for an organization’s cloud infrastructure and SaaS data through the same analysis system.
29. Claims 19 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Shua (US Pub.No.2022/0350931) in view of Pogrebinsky (US Pub.No.2020/0177591) and in view of Hosseini (US Pub.No.2023/0262085) and further in view of Pandurangi (US Pub.No.2022/0046059).
30. Regarding claim 19 Shua teaches a computing system comprising: at least one processor; memory storing instructions executable by the at least one processor, wherein the instructions, when executed, cause the computing system to: identify a plurality of cloud accounts in one or more target cloud environments to scan for data posture analysis (Para:0349-0351 teaches identifying assets of a primary cloud account, including virtual machine, databases and storage resources);
obtain access permissions corresponding to the plurality of cloud accounts; deploy, to a sidecar cloud account in scanner cloud environment that is distinct from the one or more target cloud environments; a plurality of scanner instances to scan the plurality of cloud accounts using the access permissions (Para:0120 and Para:0353 teaches establishing read only access through a role having storage access and establishing a trust relationship between the primary and secondary accounts. Para:0353 teaches an ephemeral scanner may be operated inside of that secondary account to scan block storage associated with the primary account. Each account may be hosted on different systems); obtain a scanner result from the scanner cloud environment, the scanner result representing a scan of storage resources in the plurality of cloud accounts (Para:0353, Para:0356 and Para:0364 teaches producing block storage metadata through the authorized scanner and receiving the metadata from the scanner); and generate a data posture analysis result based on the scanner result (Para:0353 and Para:0356-0367 teaches analyzing the received metadata, correlating identified vulnerability with assets, and generating a report).
Shua teaches all the above claimed limitations but fails to teach establish deployment in accordance with a scanner definition, wherein the scanner cloud environment is configured to execute, in parallel, a plurality of scanner instances to scan the plurality of cloud accounts using the access permissions.
Pogrebinsky teaches establish deployment in accordance with a scanner definition (Para:0061 teaches an application manifest identifies application components, installation sequence and deployment information, example include a deployment definition and templates. Para:064 teaches generates deployment scripts based on cloud platform configuration. Para:00066-0067 teaches installs components according to manifest, including executing custom scripts on virtual machines).
It would have been obvious to one of ordinary skill in the art at the time before the effective filling date of the claimed invention to modify Shua’s scanner deployment using Pogrebinsky scanner definition and provisional approach to configure the scanner for the selected cloud provider and scanning task, while retaining Shua’s trusted secondary account deployment.
Hosseini teaches the one or more computing services comprises a plurality of computing services, and the scanner cloud environment is configured to generate a plurality of scanner instances configured to scan the plurality of computing services in parallel (Figs. 4-5, Fig.6, block.605-615 and Para:0067-0069 teaches receiving multiple scanning requests, generating corresponding scanner instance, and performing parallel scans of targets in separate customer virtual cloud networks).
It would have been obvious to one of ordinary skill in the art at the time before the effective filling date of the claimed invention to modify Shua in view of Pogrebinsky teachings to include parallel scanner instances as taught by Hosseini and the combination would yield a predictable result of scanning multiple identified services concurrently and reduce the time required to complete the scans.
Shua, in view of Pogrebinsky and in view of Hosseini, teaches all the above claimed limitations but fails to teach a plurality of scanner instances to scan the plurality of cloud accounts using the access permissions.
Pandurangi teaches a plurality of scanner instances to scan the plurality of cloud accounts using the access permissions (Para:0086-0087 teaches onboarding cloud account with relevant permission and supports multiple cloud environment).
It would have been obvious to one of ordinary skill in the art at the time before the effective filling date of the claimed invention to modify Shua in view of Pogrebinsky and in view of Hosseini teachings to include multiple cloud accounts onboard as taught by Pandurangi and the combination would yield a predictable result of scanning multiple identified services concurrently and reduce the time required to complete the scans.
31. Regarding claim 20 Shua teaches the computing system of claim 19, wherein the scanner is deployed on one or more of: a serverless computing resource in the scanner cloud environment; or a virtual machine in the scanner cloud environment (Para:0256-0258 teaches implementing the secondary scanning system using a virtual machine, container or serverless function).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to DEREENA T CATTUNGAL whose telephone number is (571)270-0506. The examiner can normally be reached Mon-Fri : 7:30 AM-5 PM EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lynn Feild can be reached at 571-272-2092. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/DEREENA T CATTUNGAL/Primary Examiner, Art Unit 2431
