Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-20 are pending.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claims 1-5 and 10-20 are rejected under 35 U.S.C. 102(a)(2) as being anticipated by Westenberg USP 8495037.
For claims 1, 17 and 20, Westenberg discloses:
A non-transitory, computer-readable medium storing code comprising instructions executable by a processor of a device to cause the device to:
store a plurality of snapshots of a target object that is within a computing system, the plurality of snapshots corresponding to a plurality of versions of the target object (col 6, ll 5-7: “The backup manager may be configured to generate and store one or more backup versions 130 of one or more data objects 110 (block 205) using any desired backup technique.”);
obtain an indication that information associated with the target object is flagged for quarantine (col 6, ll 25-30: Backup manager may receive an indication that a data object 110 for which backup versions may have been created earlier is infected by malicious software; col 7, ll 6-15: “The backup manager 120 may be configured to implement a "backup quarantine" technique to mark the suspect or infected backup versions in some embodiments, analogous to the quarantine techniques used by malicious-software detectors such as virus scanners.”);
receive, after obtaining the indication, a request to restore a snapshot of the target object, the snapshot of the target object included in the plurality of snapshots (col 9, ll :30-33: “The backup manager may receive a restore request (block 405) and identify a set of backup versions corresponding to the data objects 110 to be restored (block 410)”); and
determine, based at least in part on the indication, whether to initiate a restoration operation in response to the request to restore the snapshot of the target object based at least in part on whether the snapshot of the target object includes the information flagged for quarantine (col 9, ll 38-48: “The backup manager 120 may then be configured to restore each of the data objects 110 for which an uninfected backup version is available…In some embodiments, the backup manager 120 may have previously marked one or more of the backup versions 130 as being unsuitable for restoration…”).
For claims 2 and 18, Westenberg discloses:
The apparatus of claim 17, wherein the instructions are further executable by the processor to cause the apparatus to:
identify, based at least in part on the request to restore the snapshot of the target object, a chain of snapshots for restoring the snapshot of the target object, the chain of snapshots including the snapshot of the target object (col 9, ll :30-33: “The backup manager may receive a restore request (block 405) and identify a set of backup versions corresponding to the data objects 110 to be restored (block 410)”),
wherein determining whether to initiate the restoration operation comprises determining whether information in one or more snapshots of the chain of snapshots has been flagged for quarantine (col 9, ll 38-48: “The backup manager 120 may then be configured to restore each of the data objects 110 for which an uninfected backup version is available…In some embodiments, the backup manager 120 may have previously marked one or more of the backup versions 130 as being unsuitable for restoration…”; col. 7, ll 6-15: “The backup manager 120 may be configured to implement a "backup quarantine" technique to mark the suspect or infected backup versions in some embodiments…”).
For claim 3, Westenberg discloses:
The method of claim 2, wherein:
determining whether information in the one or more snapshots of the chain of snapshots has been flagged for quarantine comprises determining that there is no stored indication that any snapshots of the chain of snapshots is flagged for quarantine (col 4, ll 65 – col 5, ll 6: Backup manager determines whether any backup versions of data object are to excluded to virus/malware infection. Examiner interprets passage as contemplating detection of NO infected snapshots); and determining whether to initiate the restoration operation comprises determining to initiate the restoration operation for the snapshot of the target object based at least in part on determining that there is no stored indication that any of the snapshots of the chain of snapshots is flagged for quarantine (col 9, ll 25-28 and 38-40: backup manger restoration taught of uninfected backup versions disclosed).
For claim 4, Westenberg discloses:
The method of claim 2, wherein:
determining whether information in the one or more snapshots of the chain of snapshots has been flagged for quarantine comprises obtaining, based at least in part on storing the indication, a first indication that information in a snapshot of the chain of snapshots is flagged for quarantine (col 9, ll 38-48: backup manager examines back up data objects 110 for markers that one or more back up versions is “unsuitable for restoration” (i.e., quarantined for malware or virus)); and determining whether to initiate the restoration operation comprises determining not to initiate the restoration operation for the snapshot of the target object based at least in part on obtaining the first indication (col 9, ll 49-59: backup manger will not restore unsuitable/quarantined file versions).
For claim 5, Westenberg discloses:
The method of claim 4, further comprising:
displaying an indication that the snapshot of the target object is prohibited from being restored based at least in part on determining not to initiate the restoration operation for the snapshot of the target object (col 9, ll 63-66: backup manager informs the user or application that requested the restore that an infected backup version was excluded from the restore.).
For claim 10, Westenberg discloses:
The method of claim 2, wherein determining whether information in the one or more snapshots of the chain of snapshots has been flagged for quarantine comprises:
determining whether a table comprises one or more entries identifying information included in any snapshots of the chain of snapshots (col 4, ll 42-46 and col 7, ll 1-6: “backup catalog”/“backup database” contain data on suitability of backup versions (i.e., file infected)).
For claim 11, Westenberg discloses:
The method of claim 2, wherein determining whether information in the one or more snapshots of the chain of snapshots has been flagged for quarantine comprises:
determining whether a table comprises one or more entries identifying any snapshots of the chain of snapshots (col 4, ll 42-46 and col 7, ll 1-6).
For claim 12, Westenberg discloses:
The method of claim 1, further comprising:
determining whether the snapshot of the target object is prohibited from being restored based at least in part on one or more stored indications of whether the information, as included in the one or more snapshots, is flagged for quarantine (col 9, ll 38-48: “The backup manager 120 may then be configured to restore each of the data objects 110 for which an uninfected backup version is available…In some embodiments, the backup manager 120 may have previously marked one or more of the backup versions 130 as being unsuitable for restoration…”; col. 7, ll 6-15: “The backup manager 120 may be configured to implement a "backup quarantine" technique to mark the suspect or infected backup versions in some embodiments…”).
For claim 13, Westenberg discloses:
The method of claim 12, wherein:
determining whether the snapshot of the target object is prohibited from being restored comprises determining whether a table comprises an entry identifying the snapshot of the target object (col 4, ll 42-46 and col 7, ll 1-6: “backup catalog”/“backup database” contain data on suitability of backup versions (i.e., file infected)).
For claim 14, Westenberg discloses:
The method of claim 12, wherein:
determining whether the snapshot of the target object is prohibited from being restored comprises determining that information in the snapshot of the target object is not flagged for quarantine based at least in part on the stored indications (col 4, ll 42-46 and col 7, ll 1-6: “backup catalog”/“backup database” contain data on suitability of backup versions (i.e., file infected OR not infected));
determining whether to initiate the restoration operation comprises determining to initiate the restoration operation for the snapshot of the target object based at least in part on determining that information in the requested snapshot of the target object is not flagged for quarantine; and the method further comprises initiating the restoration operation for the snapshot of the target object based at least in part on determining to initiate the restoration operation (col 9, ll 38-48: “The backup manager 120 may then be configured to restore each of the data objects 110 for which an uninfected backup version is available…In some embodiments, the backup manager 120 may have previously marked one or more of the backup versions 130 as being unsuitable for restoration…”).
For claim 15, Westenberg discloses:
The method of claim 12, wherein:
determining whether the snapshot of the target object is prohibited from being restored comprises determining that information in the snapshot of the target object has been flagged for quarantine based at least in part on an indication of the stored indications indicating that the requested snapshot of the target object is flagged for quarantine (col 4, ll 42-46 and col 7, ll 1-6: “backup catalog”/“backup database” contain data on suitability of backup versions (i.e., file infected OR not infected));
determining whether to initiate the restoration operation comprises determining not to initiate the restoration operation for the snapshot of the target object based at least in part on determining that information in the requested snapshot of the target object has been flagged for quarantine; and the method further comprises preventing the restoration operation for the snapshot of the target object based at least in part on determining not to initiate the restoration operation (col 9, ll 38-48: “The backup manager 120 may then be configured to restore each of the data objects 110 for which an uninfected backup version is available…In some embodiments, the backup manager 120 may have previously marked one or more of the backup versions 130 as being unsuitable for restoration…”).
For claim 16, Westenberg discloses:
The method of claim 15, further comprising:
displaying an indication that the snapshot of the target object is prohibited from being restored based at least in part on preventing the restoration operation for the snapshot of the target object (col 9, ll 63 – col 10, ll 2).
For claim 19, Westenberg discloses:
The apparatus of claim 17, wherein the instructions are further executable by the processor to cause the apparatus to:
determine whether the snapshot of the target object is prohibited from being restored based at least in part on one or more stored indications of whether the information, as included in the one or more snapshots, is flagged for quarantine (col 9, ll 38-48: “The backup manager 120 may then be configured to restore each of the data objects 110 for which an uninfected backup version is available…In some embodiments, the backup manager 120 may have previously marked one or more of the backup versions 130 as being unsuitable for restoration…”).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim 6 is rejected under 35 U.S.C. 103 as being unpatentable over Westenberg USP 8495037, in view of Wright US 20240126882.
For claim 6, Westenberg discloses:
The method of claim 5, but fails to teach “further comprising:
receiving, in response to displaying the indication that the snapshot of the target object is prohibited, a command to restore the snapshot of the target object; determining that the command is associated with a user having privileges that satisfy a threshold; and restoring the snapshot of the target object into a sandboxed environment.”
However, in a related field, Wright discloses receiving a request to restore a quarantined file and determining a privilege associated with that request, wherein the file is restored when the requestor has sufficient privilege (Wright, par. 0043).
It would have been obvious to one of ordinary skill before effective filing date of instant claimed invention to have introduced Wright’s teachings alongside Westenberg. The motivation to combine would have been to reduce risk of exposing computer system to malware by restricting such restoration functions to those with trusted, elevated privileges such as an administrator. (Wright, par. 0017).
Claim 7 is rejected under 35 U.S.C. 103 as being unpatentable over Westenberg USP 8495037, in view of Lyon US 20080195676.
For claim 7, Westenberg discloses:
The method of claim 4.
In particular, Westenberg is relied upon for its teachings of “preventing”/prohibiting restoration of infected/quarantined files (see at least col 9, ll 38-48 and 49-59: backup manger will not restore unsuitable/quarantined file versions).
Westenberg fails to teach “further comprising:
initiating a partial restoration operation for the snapshot of the target object based at least in part on preventing the restoration operation for the snapshot of the target object, wherein the partial restoration operation prevents the information identified in the snapshot of the chain of snapshots from being restored.”
However, in a related field, Lyon teaches performing a partial restoration as opposed to a full restoration. Lyon teaches detecting an infected file, not performing a full system restore, and overwriting the infected file with a clean version “as a partial restore” (par. 0038 and 0041)
It would have been obvious to one of ordinary skill before effective filing date of instant claimed invention to have introduced Lyon’s teachings of partial file/system restoration alongside Westenberg. The motivation to combine would have been to utilize well-known restoration techniques in order to achieve malware infection remediation (Lyon, par. 0041).
Claims 8 and 9 are rejected under 35 U.S.C. 103 as being unpatentable over Westenberg USP 8495037, in view of Haustein US 20190354443.
For claim 8, Westenberg discloses:
The method of claim 2, wherein determining whether information in the one or more snapshots of the chain of snapshots has been flagged for quarantine comprises: determining whether a table comprises one or more entries identifying any snapshots of the chain of snapshots (col 9, ll :30-33: “The backup manager may receive a restore request (block 405) and identify a set of backup versions corresponding to the data objects 110 to be restored (block 410); col 4, ll 42-46 and col 7, ll 1-6: “backup catalog”/“backup database” contain data on suitability of backup versions (i.e., file infected)”).
Westenberg fails to explicitly teach “for snapshots identified by a plurality of entries, determining whether a most recent entry indicates a quarantining or a release from quarantine.”.
However, in a related field, Haustein discloses a backup server with a malware detection module that maintains historical data 518 that includes “backup start date” field (in chronological order) along with “abnormal” field (for indicating suspicious/malware infected file) and “[a]fter a backup instance is identified as infected, the MDM 602 may mark the backup run as infected in column 4” (par. 0093,0102 and table 5).
It would have been obvious to one of ordinary skill before effective filing date of instant claimed invention to have introduced Haustein’s teachings alongside Westenberg. The motivation to combine would have been to mitigate potential damage of reintroducing backup malware infected files to a system (Haustein, par. 0102, 0106,0107).
For claim 9, Westenberg-Haustein discloses:
The method of claim 8, wherein determining whether information in the one or more snapshots of the chain of snapshots has been flagged for quarantine further comprises: determining that information in a snapshot of the chain of snapshots has been flagged for quarantine based at least in part on identifying an entry in the table that identifies that the snapshot of the chain of snapshots is currently flagged for quarantine (Westenberg, col 4, ll 42-46 and col 7, ll 1-6: “backup catalog”/“backup database” contain data on suitability of backup versions (i.e., file infected; Haustein, par. 0093,0102 and table 5).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to CLAYTON R WILLIAMS whose telephone number is (571)270-3801. The examiner can normally be reached M-F 10:00am - 6:00pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Nicholas Taylor can be reached at 571-272-3889. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/CLAYTON R WILLIAMS/Primary Examiner, Art Unit 2443
