Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This is in response to the amendment filed of 06/04/2025. Claims 1-19 are pending and have been considered below.
Priority
19228205 filed 06/04/2025 is a Continuation of 18435759, filed 02/07/2024, now U.S. Patent # 12381906 and having 1 RCE-type filing therein.
Drawings
The drawings filed on 06/04/2025 are accepted.
Specification
The specification filed on 06/04/2025 is accepted.
.Claim Objections
Claims 2 and 12 are objected to because of the following informalities: claim 2 recites “ deploy an inspector workload in the private registry” and subsequently “receiving the inspection result from the “ inspection workload.” There is insufficient antecedent basis for “ the inspection workload.” It is under whether “the inspection workload” refers back to “ an inspector workload” or introduces a different element. Claim 12 is objected to for the same reason. Appropriate correction is required.
Claims 9 and 19: claim 9 teaches detecting a cybersecurity threat based on detecting the cybersecurity object and the second cybersecurity object.. it is unclear to what relationship between the two detected objects rise to the threat and whether any correlation is required. As drafted the limitation reads on merely labeling any two detections as “threat”, which renders the claim unclear. Claim 19 is objected to for the same reason Appropriate correction is required.
Double Patenting
The non-statutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A non-statutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on non-statutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a non-statutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 1-19 are rejected on the ground of non-statutory double patenting as being unpatentable over claims 1-17 of U.S. Patent No. 12,381,906 B1. Although the claims at issue are not identical, they are not patentably distinct from each other because: Claims 1-19 are anticipated by claims 1-1720 of the patent..
A side-by-side comparison of claims 1, 10 and 11 of the pending application and the 12,381,906 patent application is given in the following table to show their similarities and differences:
19/228,205
12381906 B1
1. A method for cybersecurity inspection of private software registries, comprising:
deploying an inspection broker in a computing environment, the inspection broker configured to communicate with: a private registry of the computing environment, and an inspection environment,
wherein the private registry is inaccessible to the computing environment;
configuring the inspection broker to detect in the private registry a plurality of object identifiers, each object identifier corresponding to an object of a plurality of objects stored in the private registry;
selecting an object of the plurality of objects from the private registry for cybersecurity inspection;
initiating inspection of the object for a cybersecurity object by the inspection environment;
receiving an inspection result at the inspection environment; and
initiating a mitigation action in the computing environment based on the inspection result.
10. A non-transitory computer-readable medium storing a set of instructions for cybersecurity inspection of private software registries, the set of instructions comprising:
one or more instructions that, when executed by one or more processing circuitries of a device, cause the device to:
deploy an inspection broker in a computing environment, the inspection broker configured to communicate with: a private registry of the computing environment, and an inspection environment, wherein the private registry is inaccessible to the computing environment;
configure the inspection broker to detect in the private registry a plurality of object identifiers, each object identifier corresponding to an object of a plurality of objects stored in the private registry;
select an object of the plurality of objects from the private registry for cybersecurity inspection;
initiate inspection of the object for a cybersecurity object by the inspection environment;
receive an inspection result at the inspection environment; and
initiate a mitigation action in the computing environment based on the inspection result.
11. A system for cybersecurity inspection of private software registries comprising:
a processing circuitry;
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
deploy an inspection broker in a computing environment, the inspection broker configured to communicate with: a private registry of the computing environment, and an inspection environment, wherein the private registry is inaccessible to the computing environment;
configure the inspection broker to detect in the private registry a plurality of object identifiers, each object identifier corresponding to an object of a plurality of objects stored in the private registry;
select an object of the plurality of objects from the private registry for cybersecurity inspection;
initiate inspection of the object for a cybersecurity object by the inspection environment;
receive an inspection result at the inspection environment; and initiate a mitigation action in the computing environment based on the inspection result.
1. A method for cybersecurity inspection of private software registries, comprising:
deploying an inspection broker in a computing environment, the inspection broker configured to communicate with: a private registry of the computing environment, and an inspection environment;
configuring the inspection broker to access, through the computing environment, the private registry for a list of objects stored in the private registry;
selecting an object from the private registry for cybersecurity inspection, wherein the private registry is configured to communicate only with the computing environment;
inspecting the object for a cybersecurity object in the computing environment;
generating an inspection result based on detection of the cybersecurity object;
sending the inspection result to the inspection environment, the inspection environment including a representation of the computing environment; and
initiating a mitigation action based on the inspection result, the mitigation action generated in response to an instruction from the inspection environment.
9. A non-transitory computer-readable medium storing a set of instructions for cybersecurity inspection of private software registries, the set of instructions comprising:
one or more instructions that, when executed by one or more processors of a device, cause the device to:
deploy an inspection broker in a computing environment, the inspection broker configured to communicate with: a private registry of the computing environment, and an inspection environment;
configure the inspection broker to access, through the computing environment, the private registry for a list of objects stored in the private registry;
select an object from the private registry for cybersecurity inspection, wherein the private registry is configured to communicate only with the computing environment;
inspect the object for a cybersecurity object in the computing environment;
generate an inspection result based on detection of the cybersecurity object;
send the inspection result to the inspection environment, the inspection environment including a representation of the computing environment; and
initiate a mitigation action based on the inspection result, the mitigation action generated in response to an instruction from the inspection environment.
10. A system for cybersecurity inspection of private software registries comprising:
a processing circuitry;
a memory, the memory containing instructions that, when executed by the processing circuitry, configure the system to:
deploy an inspection broker in a computing environment, the inspection broker configured to communicate with: a private registry of the computing environment, and an inspection environment;
configure the inspection broker to access, through the computing environment, the private registry for a list of objects stored in the private registry;
select an object from the private registry for cybersecurity inspection, wherein the private registry is configured to communicate only with the computing environment;
inspect the object for a cybersecurity object in the computing environment; generate an inspection result based on detection of the cybersecurity object;
send the inspection result to the inspection environment, the inspection environment including a representation of the computing environment; and
initiate a mitigation action based on the inspection result, the mitigation action generated in response to an instruction from the inspection environment.
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-19 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claims 1, 10 and 11: the claims recite “a private registry of the computing environment” and further recite that the inspection broker, which is “deployed .. in a computing environment,” is “configured to communicate with… a private registry of the computing environment.” the claims then recite “wherein the private registry is inaccessible to the computing environment.” These limitations are mutually irreconcilable. A registry that is (i) of the computing environment and (ii) accessed by a broker within a computing environment cannot simultaneously be inaccessible to that same computing environment. The specification confirms the contradiction is an error rather than a definition:[0047] states that” the private registry is configured to communicate only with the computing environment” and “ is configured to block communication from a public network”. The parent patent claims the feature as “wherein the private registry is configured to communicate only with the computing environment” (US 12,381, 906 B1).
Claims 2-9, 12-19 are rejected as depending from indefinite base claims.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims1-4, 7, 10-14 and 17 are rejected under 35 U.S.C. 103 as being unpatentable over Suarez et al U.S. 2017/0177860 A1 herein after Suarez in view of Stopel et al U.S. 2017/0109536 A1 herein after Stopel.
Claims 1, 10 and 11: Suarez teaches a method for cybersecurity inspection of private software registries (Suarez teaches at ¶[0055], FIG. 4 depicts a security sweep of one or more repositories of a container registry…………… is configured to perform security sweeps based on security vulnerabilities, licensing, or other compliance issues. Suarez further teaches ¶[0029] repositories 188 “assigned to customers” with “policies specifying access types and restricting access to the repository to entities authorized by the customer”(private registry)), comprising:
Suarez teaches a non-transitory computer-readable medium storing a set of instructions for cybersecurity inspection of private software registries, the set of instructions comprising:
one or more instructions that, when executed by one or more processing circuitries of a device (Suarez [0026], [0031]-[0035]), cause the device to:
Suarez teaches a system for cybersecurity inspection of private software registries comprising:
a processing circuitry (Suarez ¶[0031]-[0035]);
a memory, the memory containing instructions that, when executed by the processing circuitry (Suarez teaches ¶[0031]-[0035]), configure the system to:
deploying an inspection broker in a computing environment, the inspection broker configured to communicate with: a private registry of the computing environment, and an inspection environment, wherein the private registry is inaccessible to the computing environment (Suarez teaches ¶[0040] the container registry proxy 262. The container registry proxy 262 may be responsible for communicating with the container registry front-end service 214 to store container images in the………. and repositories of the storage service 290 and serve container images from the storage service 290 to container instances of customers. Suarez further teaches ¶[0042] The container registry proxy 262 may function at least in part as a proxy for communication between the container engine 208 and the application programming interfaces (APIs) of the container registry front-end service 214), wherein the private registry is inaccessible to the computing environment (Suarez ¶[0029] teaches restricting access to the repository to entities authorized by the customer to access the repository. BRI inaccessible from outside the computing environment);
configuring the inspection broker to detect in the private registry a plurality of object identifiers, each object identifier corresponding to an object of a plurality of objects stored in the private registry(Suarez teaches ¶[0028]-[0029] ListImages( ) Returns a list of container Yes images stored in a specified registry DescribeImages( ) Returns metadata about a Yes specified image ¶[0033] A manifest may comprise metadata such as an identity of the container image that corresponds to the manifest, and, for each layer listed in the manifest, a content-addressable identifier that uniquely corresponds to a respective layer and a checksum for verifying the integrity of the content of the layer.Suarez further teaches ¶[0052] a “tag” may refer to a label associated with one or more container images for the purpose of grouping the container images.) ;
selecting an object of the plurality of objects from the private registry for cybersecurity inspection (Suarez teaches ¶[0056], the security sweep may scan the registry 302 for occurrences of a content-addressable identifier associated with that particular layer. the security sweep may discover from the manifest 350B that the content-addressable identifier of layer 2.sub.2 listed in the manifest 350B matches the content-addressable identifier provided to the security sweep associated with the insecure layer. Consequently, the security sweep may flag layer 2.sub.2 as un-referenceable, thereby preventing layer 2.sub.2 from being used.);
initiating a mitigation action in the computing environment based on the inspection result (Suarez teaches [0055], Security actions may include sending an alert/notification to the customer whose repository in which the insecure layer was found, preventing the container image in which the insecure layer was found from being launched, deleting the container image in which the insecure layer was found, automatically updating the container image to include a version of the software application without the security vulnerability (e.g., a previous version, the latest version, etc.), and so on) .
Suarez fails to teach, however Stopel in the same field of endeavor teaches
initiating inspection of the object for a cybersecurity object by the inspection environment (Stopel teaches [0070], a process for determining if a vulnerability scan for an exported base image is required according to an embodiment.Stopel [007], [0040]-[0041] the detector container 315 does not execute any of the binaries that the base image 312 contains within the newly created software container. Rather, the detector container 315 is configured to execute a scanning process for scanning the filesystem and evaluating the security state of the based image 312 as discussed herein);
receiving an inspection result at the inspection environment (Stopel teaches ¶[0045]-[0046], ¶[0068] Upon detection of a vulnerability, a detection event is generated and reported. The identifier of a malicious base image is saved in the database 350); and
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the disclosure of Suarez with the additional features of Stopel in order to provide the ability for detection of malicious code and activity in image software containers, as suggested by Stopel [0002].
Claims 2 and 12: the combination teaches The method of claim 1, further comprising:
configuring the computing environment to deploy an inspector workload in the private registry (Suarez teaches [0060] scanning mechanism 554 may open each container image and scan through the image files. Stopel teaches ¶[0033] and scan through the image fil he host device 310 is configured to host and execute a detector container 315. The detector container 315 is a software container designed to detect vulnerabilities in any base images stored in the image registry 330 or locally in the host 310);
initiating inspection of the object utilizing the inspector workload(Stopel teaches ¶[0039], A base image that requires scanning is exported to the host device 310. Stopel further teaches [0041] the detector container 315 is configured to execute a scanning process for scanning the filesystem and evaluating the security state of the based image 312); and
receiving the inspection result from the inspection workload (Stopel teaches ¶[0045]-[0046], ¶[0068] Upon detection of a vulnerability, a detection event is generated and reported. The identifier of a malicious base image is saved in the database 350).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the disclosure of Suarez with the additional features of Stopel to instantiate the inspection function of Suarez as the discrete, deployable containerized inspector in order to obtain Stopel ‘s stated benefits of isolating the scanning logic and reusing per-layer signatures to avoid repeated scanning , as suggested by Stopel [0047]-[0051],
Claim 3 and 13: the combination teaches
initiating inspection of each layer of a plurality of container layers, wherein the object is a container image (Suarez teaches ¶[0027] The container image 152 may be one or more software applications corresponding to a software package. The container image 152, as is further described below, may be uploaded and stored as a set of layers); and
receiving the inspection result further indicating a layer of the plurality of container layers in which the cybersecurity object is detected (Stopel teaches ¶[0046], ¶[0068], detection of a vulnerability, a detection event is generated and reported. Such a detection event may include, but is not limited to, a base image identifier, an infected layer or layers, a source register, a type of the detected vulnerability, and so on.).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the disclosure of Suarez with the additional features of Stopel in order to provide layer resolved purporting and layer scoped remediation, as suggested by Stopel ¶[0047],
Claims 4 and 14: the combination teaches The method of claim 3, further comprising:
initiating the mitigation action on the layer of the plurality of container layers (Suarez teaches ¶[0056] detection of a vulnerability, a detection event is generated and reported. Such a detection event may include, but is not limited to, a base image identifier, an infected layer or layers, a source register, a type of the detected vulnerability, and so on. Suarez further teaches ¶[0055] the security sweep of the present disclosure may scan container images in the repository looking for that particular layer).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the disclosure of Suarez with the additional features of Stopel in order to provide layer resolved purporting and layer scoped remediation, as suggested by Stopel ¶[0047],
Claims 7 and 17: the combination fails to teach, however The method of claim 1, wherein initiating the mitigation action further comprises:
initiating a remediation action based on detection of the cybersecurity object (Suarez teaches ¶[0055] Security actions may include sending an alert/notification to the customer whose repository in which the insecure layer was found, preventing the container image in which the insecure layer was found from being launched, deleting the container image in which the insecure layer was found, automatically updating the container image to include a version of the software application without the security vulnerability (e.g., a previous version, the latest version, etc.), and so on) .
Claims 5-6 and 15-16 are rejected under 35 U.S.C. 103 as being unpatentable Suarez et al U.S. 2017/0177860 A1 herein after Suarez in view of Stopel et al U.S. 2017/0109536 A1 herein after Stopel in further view of Abadi et al U.S. 2013/0133075 A1.herein after Abadi.
Claims 5 and 15: the combination fails to teach, however Abada in the same field of endeavor teaches
initiating static analysis on the object, in response to determining that the object is a code object (Abadi ¶[0006]-[0008], Static analysis tools scan the application code using a predefined set of security rules and candidate vulnerabilities detected are reported to the user. Abadi further teaches ¶[0036], A method of fixing a security vulnerability includes receiving an application source code 100, obtaining identification of code that sends tainted data and a corresponding sink in the code 102); and
receiving the inspection result further indicating at least a line of code in which the cybersecurity object is detected (Abadi teaches ¶[0040] The method includes finding 200 a code S that contains statement creation, i.e. a createStatement call, relating to a certain executeQuery sink in application source code and finding a code Q that creates a string query q 210 relating to the same executeQuery sink and with tainted inputs X1, . . . , Xn. The method further includes determining 220 whether the exit of Q dominates the entry of S).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the disclosure of Suarez with the additional features of Abadi in order to provide the to fixing security vulnerabilities in application's source code, as suggested by Abadi [0002].
Claim 6 and 16: the combination teaches
initiating the mitigation action to generate a new code object based on the inspection result and the code object (Abada teaches [0029], [0036]-[0039], automatically fixing the vulnerability by automatically performing a code modification action selected from the group of code modification actions that consists of code motion and code duplication).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the disclosure of Suarez with the additional features of Abadi in order to provide the ability to fixing security vulnerabilities in application's source code, as suggested by Abadi [0002].
Claims 8-9 and 18-19 are rejected under 35 U.S.C. 103 as being unpatentable over Suarez et al U.S. 2017/0177860 A1 herein after Suarez in view of Stopel et al U.S. 2017/0109536 A1 herein after Stopel in further view of Petersen et al U.S. 2019/0311135 A1herein after Petersen.
Claims 8 and 18: the combination fails to teach, however Petersen in the same field of endeavor teaches
detecting a nested object in the object (Petersen teaches ¶[0018], ¶[0024], to detect the existence of a nested file within a computing system and individually parse the individual elements of the file with parsers having formats associated with those individual elements); and
initiating inspection of the nested object for a second cybersecurity object (Petersen teaches ¶[0028], to detect the existence of a nested file within a computing system and individually parse the individual elements of the file with parsers having formats associated with those individual elements).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the disclosure of Suarez with the additional features of Petersen in order to provide for enabling the unpacking and examining of nested files to determine whether there is malicious content (e.g., determining a relative safety level of a shell file)., as suggested by Petersen [002063].
Claims 9 and 19: the combination teaches The method of claim 8, further comprising:
detecting a cybersecurity threat based on detecting the cybersecurity object and the second cybersecurity object (Petersen teaches [0029], [0019]-[0021], to detect the existence of a nested file within a computing system and individually parse the individual elements of the file with parsers having formats associated with those individual elements Peterson further teaches [0042] The additional malicious content analysis can include, for example, quarantining the nested file, prohibit the nested file from interacting with the computer, analyzing the code of the nested file to determine the intent of the nested file, or the like) .
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Ramasamy et al U.S. 2021/0173935 A1 teaches Systems and methods are provided to identify security vulnerabilities related to containerization platforms.
Abdulhayoglu et al U.S. 2009/0235359 A1 teaches A method and system of performing vulnerability and security scans on an internet connected device where the device is behind a network security device such as a firewall.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to FATOUMATA TRAORE whose telephone number is (571)270-1685. The examiner can normally be reached 6:30-3:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, SHEWAYE GELAGAY can be reached at 5712724219. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
Thursday, August 20, 2026
/FATOUMATA TRAORE/Primary Examiner, Art Unit 2436
Prosecution Insights