Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Detail Action
2. This office action is response to the application filed on . Claims 1--20 are pending in this communication.
Continued Examination Under 37 CFR 1.114
3. A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 08/08/2025 has been entered.
Response to Arguments
4. Applicant’s arguments filed on 08/08/2025 have been fully considered but they are not persuasive. On the Remarks, Applicant argues that,
Kim and Engdahl do not teach each and every limitation of the claims.
Kim does not teach the step of "…. classify the first communication between a first communication device and a second communication device as a mature communication classification in one or more tables"
The examiner respectfully disagrees.
First, in response to applicant's argument that Kim and Engdahl do not teach each and every limitation of the claims. It is noted that, Kim at Para.0324, Para.0026 discloses, “register entries …. such as … destination IP address… of device 5….. to a bidirectional whitelist …. thus a communication session between device 1 (210a) and device 5 220b is established”, “managing the bidirectional whitelist, and… registering …. information corresponding to the authenticated communication …..device to the bidirectional whitelist” which the examiner interpreted as being the claimed “classify the first communication between a first communication device and a second communication device as a mature communication classification in one or more tables” because the broadest reasonable interpretation of the claimed “classify the first communication between a first communication device and a second communication device as a mature communication classification in one or more tables” includes the established bidirectional communication between the device 220b and device 210a which is equivalent to the claimed ‘mature communication’. From Kim, destination IP address of a bidirectional whitelist is equivalent to the claimed ‘one or more tables’, bidirectional whitelist contains information about bidirectional communication session/registration information corresponding to the authenticated communication devices, which is equivalent to the claimed “classify the first communication between a first communication device and a second communication device as a mature communication classification in one or more tables”. Also, Kim at Para.0021, Para.0098, Para.0055 discloses, “second unidirectional communication from the external network to the internal network…. and transmitting a second data packet…”, “second unidirectional communication …. permitted or physically blocked”, “the internal network …. connected to …devices 210a…. and the external network …. connected to …. devices 220a….” which the examiner interpreted as being the claimed “based at least partially on the first communication being an external communication, classify the first communication between a first communication device and a second communication as a non-mature communication classification” because the broadest reasonable interpretation of the claimed “based at least partially on the first communication being an external communication, classify the first communication between a first communication device and a second communication as a non-mature communication classification” includes second unidirectional communication which is equivalent to the claimed ‘first external communication’/’non mature communication’, as when any entity or device from external network is not trustworthy the communication is blocked, when it is trustworthy the communication is established or become mature.
Second, in response to applicant's argument that Engdahl does not disclose "bypass the at least one of the traffic rate mitigation technique or the traffic analysis technique for communications between ….", it is noted that, Engdahl at Para.0028, Para.0041 discloses “firewall … include a throttle …. or limit transmission … based on the policy applied to the individual packets”, “a throttle … limit the throughput of low priority packets … to process low priority packets in one manner and high priority packets in a different manner” which the examiner interpreted as being the claimed “bypass the at least one of the traffic rate mitigation technique or the traffic analysis technique…..".
Applicant's further arguments with respect to the limitation “a …communication between a …. communication device and a …..communication device to be an internal communication….” in claim(s) 1 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
4. Claims 1-20 are rejected under AIA 35 U.S.C. 103 as being unpatentable over Kim et al. (US 20180351930 A1) in view Prenger et al. (US 20150264083 A1) and further in view of Engdahl et al. (US 2009/0113517 A1)
Regarding Claim 1:
Kim discloses:
a. A system for tracking a maturity classification of a communication (Para.0054; “system …. for supporting bidirectional communication using unidirectional communication…”) comprising:
at least one processor; (Para.0078; “processing devices such as a microprocessor, a CPU…”) and
at least one memory including instructions which when executed by the at least one processor, (Para.0328; “execute program instructions…Random Access Memory….”) causes the at least one processor to:
determine a first communication between a first communication device and a second communication device to be an …..communication (Para.0079, Para.0324; “…..perform bidirectional communication …..”, “a bidirectional …..communication session between device….210a…. and device….220b is established”) or an external communication; (Para.0021; “second unidirectional communication from the external network to the internal network…”) …
b. based at least partially on the first communication being an …. communication, (Para.0079; “perform bidirectional communication”) classify the first communication between a first communication device and a second communication device as a mature communication classification (Para.0324; “a bidirectional …..communication session between device….210a…. and device….220b is established” when the bidirectional communication between the device 220b and device 210a is established, it is construed as mature communication) in one or more tables; (Para.0324, Para.0026; “register entries …. such as … destination IP address… of device 5….. to a bidirectional whitelist …. thus a communication session between device 1 (210a) and device 5 220b is established”, “managing the bidirectional whitelist, and… registering …. information corresponding to the authenticated communication …..device to the bidirectional whitelist” destination IP address of a bidirectional whitelist is construed as one or more tables, bidirectional whitelist contains information about bidirectional communication session/registration information corresponding to the authenticated communication devices)
based at least partially on the first communication being an external communication, (Para.0021; “second unidirectional communication from the external network to the internal network…. and transmitting a second data packet…”) classify the first communication between a first communication device and a second communication as a non-mature communication classification; (Para.0098, Para.0055; “second unidirectional communication …. permitted or physically blocked” second unidirectional communication is construed as first external communication/non mature communication, as when any entity or device from external network is not trustworthy the communication is blocked, when it is trustworthy the communication is established or become mature (disclosed in previous citation), “the internal network …. connected to …devices 210a…. and the external network …. connected to …. devices 220a….”)
c. based at least partially on the first communication being non-mature, (Para.0178; “second unidirectional communication from the external network to the internal network… at step S701”) subject subsequent communications between the first communication device and the second communication device (Para.0186, Para.0191; “determining whether to communicate with the external network using …. a conditional bidirectional communication”, “bidirectional communication …. transmits … data packet from the external network to the internal network via second unidirectional communication …. at step S705” after second unidirectional communication/first external communication/non mature communication, bidirectional communication/mature communication and conditional bidirectional communication/second external communication/mature communication occurs) …
d. classify a second external communication between the first communication device and the second communication device (Para.0084; “the conditional bidirectional communication …. temporarily permit …. communication …. when a bidirectional communication …. originating from an internal network …. present…”) as a mature communication classification; (Para.0307, Para.0311; “communication …. set to a conditional bidirectional …. and …. session is established”, “conditional bidirectional …. allowable period … 10 minutes…” when the bidirectional communication between the external and internal network is established, conditional bidirectional communication temporarily permits communication between external and internal network for a limited period of time, construed as second external communication/mature communication) and
e. … bypass the at least one of the … technique …. for communications between the first communication device and second communication device received after the mature communication classification. (Para.0100, para.0093; “the switch bypasses data received from the external network … to the internal network ….”, “…. to perform bidirectional communication with the external network, and communicates with the internal network …...”)
however, Kim does not explicitly disclose:
a. ……determine a …communication between a …. communication device and a …..communication device to be an internal communication….
b. based ….. on the ……communication being an internal communication, ….. communication between a …...communication device and a …..communication device as a …..communication ……[Kim discloses a first communication between a first communication device and a second communication device as a mature communication classification, but Kim does not disclose communication between two communication devices to be an internal communication]
c. based at least partially on the first communication …. subject subsequent communications between the first communication device and the second communication device to at least one of a traffic rate mitigation technique or traffic analysis technique; [Kim discloses subsequent communications between the first communication device and the second communication device but Kim does not disclose a traffic rate mitigation technique or traffic analysis technique;]
e. … bypass the at least one of the traffic rate mitigation technique or the traffic analysis technique for communications between the first communication device and second communication device received …. [Kim does not disclose a traffic rate mitigation technique or traffic analysis technique]
In an analogous reference Prenger discloses:
a. ……determine a …communication between a …. communication device and a …. communication device to be an internal communication…. (Para.0027, Para.0034; “communications between two hosts …. inside a network …...”, “an internal network 202 comprises one or more hosts (e.g. ….204a, 204b, 204c, 204d, 204e, and 206 that may communicate with one another” communications between two hosts inside a network or within an internal network is construed as internal communication)
b. based …. on the ……communication being an internal communication, ….. communication between a …...communication device and a …...communication device as a …..communication ………(Para.0035; “the internal network 202 is isolated from other networks”)
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Kim’s method for supporting bidirectional communication using unidirectional communication, by enhancing Kim’s method to include Prenger’s method for detecting malicious relay communication data flows between a plurality of computers.
The motivation: when an outside entity takes control of a host at a given company or organization, the host can be controlled and used as a source of attacks against other targets or as a means to exfiltrate data from within the organization. Thus, it is important to effectively and efficiently identify an outside entity to attack inside/internal networks.
however, Kim in view of Prenger does not explicitly disclose:
c. based at least partially on the first communication …. subject subsequent communications between the first communication device and the second communication device to at least one of a traffic rate mitigation technique or traffic analysis technique; [Kim in view of Prenger discloses subsequent communications between the first communication device and the second communication device but Kim in view of Prenger does not disclose a traffic rate mitigation technique or traffic analysis technique;]
e. … bypass the at least one of the traffic rate mitigation technique or the traffic analysis technique for communications between the first communication device and second communication device received …. [Kim in view of Prenger does not disclose a traffic rate mitigation technique or traffic analysis technique]
In an analogous reference Engdahl discloses:
c. based at least partially on the first communication (Para.0008, Para.0021; “…When no secure session is associated with the packets, the packets … handled at a low throughput…”, “…. of unsecured communications.”) …. subject subsequent communications between the first communication device and the second communication device to at least one of a traffic rate mitigation technique or traffic analysis technique; (Para.0021, Para.0024; “…firewall…. used …. to … limit communications …. not performed within a secure or authenticated session...”, “During …initial …. establishing a secure session…. firewall … permit the packets …. at a low transmission rate, but after the secure session is established, the subsequent transmissions …. at a high transmission rate”)
e. … bypass the at least one of the traffic rate mitigation technique or the traffic analysis technique (Para.0028, Para.0041; “firewall … include a throttle …. or limit transmission … based on the policy applied to the individual packets”, “a throttle … limit the throughput of low priority packets … to process low priority packets in one manner and high priority packets in a different manner”) for communications between the first communication device and second communication device (Para.0023, Para.0037; “server device …establish a secure session with the client devices”, “The policies… cause …. process authenticated or secure packets with a high priority …”) ….
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Kim in view of Prenger’s method for supporting bidirectional communication using unidirectional communication, by enhancing Kim in view of Prenger’s method to include Engdahl’s method for analyzing and applying policies to packets based on security status in order to include network traffic mitigation technique.
The motivation: A network firewall may apply policies to packets based on a security classification. Packets with an authenticated and established security connection may be handled at a high throughput while packets with unauthenticated connections may be handed at a low throughput or even discarded.
With respect to independent claims 10 and 16, a corresponding reasoning was given earlier in this section with respect to claim 1; therefore, claims 10 and 16 rejected, for similar reasons, under the grounds as set forth for claim 1.
Regarding Claim 2:
Kim in view of Prenger discloses:
f. The system of claim 1, wherein classifying the first communication as a non- mature communication classification …. and classifying the second communication as a mature communication classification (disclosed in claim 1) ….
however, Kim in view of Prenger does not explicitly disclose:
f. …. the first communication …. includes associating a first maturity status with identification information from the first communication, …. the second communication …. includes associating a second maturity status with the identification information previously associated with the first maturity status.
In an analogous reference Engdahl discloses:
f. …. the first communication …. includes associating a first maturity status with identification information from the first communication, (Para.0030, Para.0031, Para.0036; “The tags attached to packets …. have a set of implementation policies….”, “… apply …. policies ….to the packet…. cause a packet … dropped…. a policy …. cause packets in an unsecured or unauthenticated session …. transmitted at a limited transmission rate”, “…. packets …. tagged with low priority or …. low security attributes are transmitted at a reduced transmission rate” The packets that are tagged with low priority and transmitted at a reduced transmission rate or dropped are construed as the packets having a first maturity status with identification information from the first communication /unsecured or unauthenticated communication) …. the second communication …. includes associating a second maturity status with the identification information previously associated with the first maturity status. (Para.0037, Para.0055, Claim 1; “The policies …. cause …. to process authenticated or secure packets with a high priority”, “A high classification …. assigned to those packets associated with a session …. fully established…”, “second policy …. applying a high priority to …. second packet” The packets that are tagged with high priority transmitted within a fully established session, are construed as the packets having a second maturity status)
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Kim in view of Prenger’s method for supporting bidirectional communication using unidirectional communication, by enhancing Kim in view of Prenger’s method to include Engdahl’s method for analyzing and applying policies to packets based on security status.
The motivation: different maturity status helps to maintain a secured established communication between a sender and receiver device.
With respect to dependent claims 11 and 18, a corresponding reasoning was given earlier in this section with respect to claim 2; therefore, claims 11 and 18 rejected, for similar reasons, under the grounds as set forth for claim 2.
Regarding Claim 3:
Kim in view of Prenger and further in view of Engdahl discloses:
g. The system of claim 2, wherein the identification information includes at least one of an IP address of the first communication device, (Kim, Para.0096; “the external network …. transmit …. packet …. a destination IP address (i.e., the IP address of the internal network device)”) a protocol of the first communication, or a portion associated with the first communication.
With respect to dependent claim 19, a corresponding reasoning was given earlier in this section with respect to claim 3; therefore, claim 19 rejected, for similar reasons, under the grounds as set forth for claim 3.
Regarding Claim 4:
Kim in view of Prenger and further in view of Engdahl discloses:
h. The system of claim 3, wherein the instructions cause the processor to drop the first communication (Engdahl, Para.0031; “…. packet …. analyzed …by …. firewall …. and apply … policies ….to the packet… cause a packet to be dropped”) if the identification information is previously associated with the first maturity status. (Para.0030, Para.0026; “…tag the packets ….to enforce the policies”, “unauthenticated or unsecured packets…. discarded and not permitted to be transmitted”)
With respect to dependent claim 14, a corresponding reasoning was given earlier in this section with respect to claim 4; therefore, claim 14 rejected, for similar reasons, under the grounds as set forth for claim 4.
Regarding Claim 5:
Kim in view of Prenger and further in view of Engdahl discloses:
i. The system of claim 3, wherein the protocol of the first communication includes at least one of transmission control protocol or user datagram protocol. (Kim, Para.0239; “user datagram protocol …UDP…. inserted into the unidirectional whitelist”)
Regarding Claim 6:
Kim in view of Prenger and further in view of Engdahl discloses:
j. The system of claim 1, wherein the first communication is received at a device communicatively coupling (Engdahl, Para.0013; “…. elements are …. "connected" or "coupled," …. together”) the first communication device to the second communication device. (Para.0023; “A secured or authenticated connection …. established …. packet from a client device …. destined for a server … establish a secure session with the client device”)
Regarding Claim 7:
Kim in view of Prenger and further in view of Engdahl discloses:
k. The system of claim 1, wherein the second communication is classified as a mature communication (Kim, Para.0315; “exchanging TCP SYN, TCP SYN-ACK, and TCP ACK packets between the device …210b and the device …. 220b …. session is established between the two devices”) based on a quantity of communications having occurred between the first communication device and the second communication device. (Para.0314; “the external network …. transmits the TCP SYN packet …transmits the TCP SYN-ACK packet to the internal network….”)
With respect to dependent claim 20, a corresponding reasoning was given earlier in this section with respect to claim 7; therefore, claim 20 rejected, for similar reasons, under the grounds as set forth for claim 7.
Regarding Claim 8:
Kim in view of Prenger and further in view of Engdahl discloses:
l. The system of claim 6, wherein the second communication is classified
as a mature communication (Kim, Para.0315; “exchanging …. packets between the device …. 210b and the device ….220b …. session is established between the two devices”) based on a quantity of communications having occurred within a threshold period of time. (Para.0315, Para.0304, Para.0111; “exchanging TCP SYN, TCP SYN-ACK, and TCP ACK packets …. session is established ...”, “user…. authenticated…. for a pre-allocated time …. transmits a request to use a bidirectional communication ….”, “authentication of a user or …. external network device …. trigger …. the bidirectional communication ….”)
With respect to dependent claim 15, a corresponding reasoning was given earlier in this section with respect to claim 8; therefore, claim 15 rejected, for similar reasons, under the grounds as set forth for claim 8.
Regarding Claim 9:
Kim in view of Prenger and further in view of Engdahl discloses:
m. The system of claim 1, wherein the first communication is received from the first communication device located external to the second communication device. (Engdahl, Para.0023; “an initial packet from a client device …. from outside a …… network…. destined for a server device within the …. network”)
Regarding Claim 12:
Kim in view of Prenger discloses:
n. The method of claim 11, wherein ……. identification information from the first communication includes determining if the identification information is included in a table …. (Para.0021, Para.0087, Para.0096; “second unidirectional communication from the external network to the internal network”, “communication is permitted …. for entries included in the whitelist”, “external network …. transmit …. packet … destination IP address (i.e., the IP address of the internal network device”)
however, Kim in view of Prenger does not explicitly disclose
n. …. associating the first maturity status with identification information from the first communication includes …. identification information …. corresponding to the first maturity status.
In an analogous reference Engdahl discloses
n. …. associating the first maturity status with identification information from the first communication includes …. identification information …. corresponding to the first maturity status. (disclosed in claim 2)
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Kim in view of Prenger’s method for supporting bidirectional communication using unidirectional communication, by enhancing Kim in view of Prenger’s method to include Engdahl’s method for analyzing and applying policies to packets based on security status.
The motivation: is the same as claim 2.
Regarding Claim 13:
Kim in view of Prenger discloses:
o. The method of claim 12, wherein if the identification information is included in the table …., removing the identification information from the table (Para.0327; “insert …. IP address entry into a whitelist for a bidirectional communication …. deleting entries of a whitelist….”) and …..
however, Kim in view of Prenger does not explicitly disclose:
o. the identification information …. corresponding to the first maturity status, …. modifying a second table corresponding to the second maturity status to include the identification information.
In an analogous reference Engdahl discloses:
o. the identification information …. corresponding to the first maturity status, (Para.0031, Para.0036; “… apply …. policies ….to the packet…. cause a packet … dropped…. a policy …. cause packets in an unsecured or unauthenticated session …. transmitted at a limited transmission rate”, “…. packets …. tagged with low priority or …. low security attributes are transmitted at a reduced transmission rate” The packets that are tagged with low priority and transmitted at a reduced transmission rate or dropped are construed as the packets having a first maturity status with identification information from the first communication /unsecured or unauthenticated communication) …. modifying a second table (Para.0063; “a policy definition database …. enable ….to modify the policies from time to time.” a policy definition database is construed as second table, which modifies the policies) corresponding to the second maturity status to include the identification information. (Para.0037, Para.0059; “The policies …. cause …. to process authenticated or secure packets with a high priority”, “…. maximum data throughput for packets associated with a secure session….” The packets that are tagged with high priority transmitted within a secure session, are construed as the packets having a second maturity status)
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Kim in view of Prenger’s method for supporting bidirectional communication using unidirectional communication, by enhancing Kim in view of Prenger’s method to include Engdahl’s method for analyzing and applying policies to packets based on security status.
The motivation: is the same as claim 2.
Regarding Claim 14:
Kim in view of Prenger discloses:
p. The method of claim 12, further comprising …the first communication if the identification information is included in the table (disclosed in claim 12) ….
however, Kim in view of Prenger does not explicitly disclose
p. dropping the first communication if the identification information is included in the table corresponding to the first maturity status.
In an analogous reference Engdahl discloses
p. dropping the first communication (Engdahl, Para.0031; “…. packet …. analyzed …by …. firewall …. and apply … policies ….to the packet… cause a packet …. dropped”) if the identification information …. corresponding to the first maturity status. (Para.0030, Para.0026; “…tag the packets ….to enforce the policies”, “unauthenticated or unsecured packets…. discarded and not permitted to be transmitted”)
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Kim in view of Prenger’s method for supporting bidirectional communication using unidirectional communication, by enhancing Kim in view of Prenger’s method to include Engdahl’s method for analyzing and applying policies to packets based on security status.
The motivation: is the same as claim 2.
Regarding Claim 17:
Kim in view of Prenger and further in view of Engdahl discloses:
q. The system of claim 16, wherein the instructions cause the processor to send a third communication to the communication device, (Engdahl, Para.0037, Para.0041; “The policies …. cause …. process authenticated or secure packets with a high priority”, “high priority packets in a different manner” packets with a high priority are construed as third packets or communication) the third communication being sent after the first communication. (Claim.2, Claim.18; “receiving a third packet…. from …. first communication session”, “receiving a third packet …. determining that …. third packet is associated with …. first session “as the third packet is sent from first session or the session having no or low authentication, it is construed that third communication being sent after the first communication)
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SAYEDA SALMA NAHAR whose telephone number is (703)756-4609. The examiner can normally be reached M-F 12:00 PM to 6:00 PM EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Amir Mehrmanesh can be reached on (571) 270-3351. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SAYEDA SALMA NAHAR/Examiner, Art Unit 2491
/AMIR MEHRMANESH/Supervisory Patent Examiner, Art Unit 2491