DETAILED ACTION
This office action is in response to the amendments filed on 05/01/2026.
Claims 1-2, 5-6, 9, 12, 15-16, and 19-20 are amended.
Claims 3-4, 10-11, and 17 are cancelled.
Claims 1-2, 5-9, 12-16, 18-21 are presented for examination.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant’s arguments with respect to the 35 USC 103 rejections to the claims filed on 05/01/2025 in Remarks pg. 7-10 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Applicant further argues in essence:
[a] “Claim 1, as amended, recites the limitations of "encrypting, by the first messaging application using a cryptographic function, the first message to generate first encrypted data, wherein the cryptographic function uses a first cryptographic key that was associated with the first existing message group prior to receiving the content." Amended claim 1 further recites the limitations of "transmitting, by the first messaging application, a composite message to a second messaging application executed by a second node of the mesh network, the composite message including: a first message group section that includes at least the first encrypted data." None of the cited references teaches or suggests these limitations. Therefore, no combination of the references can teach or suggest each and every limitation of amended claim 1” Pg. 7-8
In response to [a], arguments in Remarks are directed towards the Pecka reference, and while examiner still relied upon Pecka to show encrypting multiple portions of a message separately, Pecka is not relied upon to show the newly added limitations of “wherein the cryptographic function uses a first cryptographic key that was associated with the first existing message group prior to receiving the content.”, as Pecka generates a new key every time it combines messages together. This concept is taught by Ramo which was previously relied upon as a primary reference in an embodiment previously not relied upon.
In a separate embodiment of Ramo than the nested messages previously used to reject claim 1, Ramo discloses the concept of authentication keys that are used for communication within a community. When a device first becomes a member of a community, they are assigned a key to be used for communications for that community as described in para.0072 and para.0079 below, therefore the keys are associated with the message group prior to receiving messages to be transmitted for that community.
Therefore, examiner maintains a rejection for the claims with the newly added limitations cited in a separate embodiment of Ramo.
wherein the cryptographic function uses a first cryptographic key that was associated with the first existing message group prior to receiving the content (Ramo: para.0072 “For example, a wireless node 101 may invite another wireless node 101 to join a community by transferring the CID and authentication keys associated with the community to the other wireless node 101.” Para.0074 “In one embodiment, authentication keys are provided when membership in the community is by invitation or otherwise restricted (e.g., when the community is a personal community or a private community). Accordingly, the community layer 205 will be able to encrypt outgoing community specific messages and to decrypt incoming community specific messages. As noted previously, community membership may also be based, at least in part, on a publish or subscription status to information shared over the ad-hoc mesh network 109.” para.0079 “The reply message may be encrypted with the encryption key of the community.” Community message are encrypted using a key associated with that community. Therefore prior to receiving content to be sent for a community, the associated key for that community already exists, and is used to encrypt that message.);
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1, 7, 9, 13, 15, 18-21 is/are rejected under 35 U.S.C. 103 as being unpatentable over Ross et al. (hereinafter Ross, US 2006/0156398 A1) in view of Pecka et al. (hereinafter Pecka, US 2016/0226844 A1) in view of Ramo et al. (hereinafter Ramo, US 2012/0135723 A1).
Regarding Claim 1, Ross discloses A method comprising: receiving, by a first messaging application (Ross: Fig. 1 aggregation agent) executing on a first node (Ross: Fig. 1 host system) of a network (Ross: Fig. 1, network 130 the node is connected to network 130.), content for a first message from a first agent (Ross: Fig. 1 any of agents 111-113) executing on the first node (Ross: Fig. 5 504 para.0052 “Host agents, such as those discussed herein, generate data, 502. This data may be generated in response to a security event, for example, attack of a virus or worm, an attempted hacker intrusion, the disabling of a security measure, the corruption and/or failure of a security routine and/or associated data, etc. An aggregating agent may poll the host agents for data, or the host agents may volunteer data to the aggregating agent. Data may then be exchanged between the host agent and aggregating agent, 504.” Data generated by a host agent is received by the aggregating agent.),
wherein the content for the first message is for a first existing message group (Ross: para.0048 “Alert distribution feature 453 may extract a data element from a received message and determine with the list/table which console or consoles should receive the information. For example, a breach of a host-based firewall may trigger both a host firewall agent and a compliance agent to register security events, which may be sent to the aggregation agent. The aggregation agent may determine that the event alerts overlap, and so aggregates the alert into a single “firewall breach” alert that is transmitted to management console 400. Alert distribution feature 453 may then determine from a look-up table that both the compliance console and the firewall management console want such a message. The message may then be forwarded on to the two (or potentially one or more than two) consoles.” Based on type of message, different groups of consoles 151-153 in Fig. 1, are the recipients for the content of that message. This information is managed at a list/table that defines message groups for particular types of messages. In the case above, a first message may comprise content regarding a firewall breach, and the first existing message group may be the compliance console and the firewall management console.); and
encrypting, by the first messaging application using a cryptographic function, the first message to generate first encrypted data, wherein the cryptographic function uses a first cryptographic key (Ross: para.0022 “In addition to aggregation and correlation, aggregation agent 120 may include capabilities to encrypt and/or sign (attest) alert messages to be sent over network 130. In one embodiment the encryption standard may be specified by a receiving entity, for example, control console 140 of management system 150. Signing the alert message may include use of a cryptographic key to encode the message. Signing the alert may provide assurance to a receiving entity (e.g., a consol) that the entity sending the alert is an entity that should send the alert, and that the entity is indeed who/what it purports to be.” The aggregation agent may encrypt the message using a key. The key in this case is used to encrypt the first message, therefore under broadest reasonable interpretation the key used by the aggregation agent is associated with the first existing message group.);
transmitting, by the first messaging application, a composite message to a second messaging application executed by a second node of the network, (Ross: Fig. 5 518, para.0053 “If the authentication is successful, 510, the aggregating agent may proceed to perform one or more processes on the data to prepare to transmit the data to the management console. For example, the aggregating agent may aggregate the data, 512, taking multiple alert messages and preparing a single alert message with all the alert data. The data may also be compressed according to known techniques, and/or encrypted, 514. Encryption may use any known encryption, whether standard or proprietary. The aggregating agent may also sign the data message, 516, and transmit the data to the management console on a security server, 518.” After encryption, the message is transmitted to the second node via network 130 in Fig. 1, the second node being MGT system 150)
the composite message including: a first message group section that includes at least the first encrypted data (Ross: Fig. 5 518, para.0053 “If the authentication is successful, 510, the aggregating agent may proceed to perform one or more processes on the data to prepare to transmit the data to the management console. For example, the aggregating agent may aggregate the data, 512, taking multiple alert messages and preparing a single alert message with all the alert data. The data may also be compressed according to known techniques, and/or encrypted, 514. Encryption may use any known encryption, whether standard or proprietary. The aggregating agent may also sign the data message, 516, and transmit the data to the management console on a security server, 518.” The composite message includes a first alert message that has been encrypted.), and
a second message group section comprising a second message including content from a second agent for members of a second existing message group (Ross: para.0012 “Just as multiple consoles may be associated with a single agent, a single console may manage multiple agents, and thus be associated with the multiple agents.” Para.0015 “Aggregating and correlating the alert information may include combining multiple alerts from an agent into a single alert message (cross-message aggregation), combining alerts from multiple agents into a single alert message (cross-agent aggregation), a combination of these two, analyzing the alerts and intelligently combining selected ones of the alerts into a single alert message, and generating a tag to associate an alert with an agent.” para.0048 “The message may then be forwarded on to the two (or potentially one or more than two) consoles.” The composite message includes alerts from a plurality of agents on the Host system in Fig. 1, for a plurality of different consoles at the MGT system. Each alert by each agent is associated with a different group of consoles and combined into a single alert message. Another message that is for a different subset of consoles by an agent different from the first message is the second message for a second existing message group.),
wherein at least a portion of the second message group section is encrypted with a cryptographic key that is associated with the second existing message group (Ross: para.0022 “In addition to aggregation and correlation, aggregation agent 120 may include capabilities to encrypt and/or sign (attest) alert messages to be sent over network 130. In one embodiment the encryption standard may be specified by a receiving entity, for example, control console 140 of management system 150. Signing the alert message may include use of a cryptographic key to encode the message. Signing the alert may provide assurance to a receiving entity (e.g., a consol) that the entity sending the alert is an entity that should send the alert, and that the entity is indeed who/what it purports to be.” The aggregation agent may encrypt the message using a key, the aggregated message as a whole is encrypted therefore the second message is also encrypted. The key in this case is used to encrypt the second message, therefore under broadest reasonable interpretation the key used by the aggregation agent is associated with the second existing message group as well as the first.)
However Ross does not explicitly disclose mesh network; wherein the cryptographic function uses a first cryptographic key that was associated with the first existing message group prior to receiving the content; subscribers of a second existing message group; wherein at least a portion of the second message group section is encrypted with a second cryptographic key that is associated with the second existing message group, wherein the first message group section is separate from the second message group section.
Pecka discloses wherein the cryptographic function uses a first cryptographic key that was associated with the first existing message group (Pecka: para.0011 “According to principles described herein, a user can divide a message, such as an email, into multiple parts. Each part is encrypted with a different key and is assigned a part identifier. The encrypted message is then sent to multiple recipients. Additionally, the key for each part and the identifier for each part are sent to a security authority. Additionally, the sender provides the security authority with access privileges for each of the recipients. The access privileges define which of the parts of the message a particular recipient is authorized to access.” Fig. 1 key 106-1, part 1 of the message that is for a particular recipient, a first message group, is encrypted with a first key.);
wherein at least a portion of the second message group section is encrypted with a second cryptographic key that is associated with the second existing message group (Pecka: para.0011 “According to principles described herein, a user can divide a message, such as an email, into multiple parts. Each part is encrypted with a different key and is assigned a part identifier. The encrypted message is then sent to multiple recipients. Additionally, the key for each part and the identifier for each part are sent to a security authority. Additionally, the sender provides the security authority with access privileges for each of the recipients. The access privileges define which of the parts of the message a particular recipient is authorized to access.” Fig. 1 key 106-2 the part 2 of the message for a different message group for a different recipient is encrypted with a second key),
wherein the first message group section is separate from the second message group section (Pecka: para.0013 “FIG. 1 is a diagram showing illustrative parts of a message that can be separately encrypted. According to the present example, a message 102 is divided into multiple parts 104, each part 104 being associated with a key 106 and an identifier 108. The message 102 is also associated with recipient access data 110.”, Fig. 1 message 102 is divided into different sections part 1 and part 2.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Ross with Pecka in order to incorporate wherein the cryptographic function uses a first cryptographic key that was associated with the first existing message group; wherein at least a portion of the second message group section is encrypted with a second cryptographic key that is associated with the second existing message group; wherein the first message group section is separate from the second message group section
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved security when sending a combined message (Pecka: para.0011-0012).
However Ross-Pecka does not explicitly disclose mesh network; wherein the cryptographic function uses a first cryptographic key that was associated with the first existing message group prior to receiving the content; subscribers of a second existing message group.
Ramo discloses mesh network (Ramo: para.0003 mesh network);
wherein the cryptographic function uses a first cryptographic key that was associated with the first existing message group prior to receiving the content (Ramo: para.0072 “For example, a wireless node 101 may invite another wireless node 101 to join a community by transferring the CID and authentication keys associated with the community to the other wireless node 101.” Para.0074 “In one embodiment, authentication keys are provided when membership in the community is by invitation or otherwise restricted (e.g., when the community is a personal community or a private community). Accordingly, the community layer 205 will be able to encrypt outgoing community specific messages and to decrypt incoming community specific messages. As noted previously, community membership may also be based, at least in part, on a publish or subscription status to information shared over the ad-hoc mesh network 109.” para.0079 “The reply message may be encrypted with the encryption key of the community.” Community message are encrypted using a key associated with that community. Therefore prior to receiving content to be sent for a community, the associated key for that community already exists, and is used to encrypt that message.);
subscribers of a second existing message group (Ramo: Para.0074 “In one embodiment, authentication keys are provided when membership in the community is by invitation or otherwise restricted (e.g., when the community is a personal community or a private community). Accordingly, the community layer 205 will be able to encrypt outgoing community specific messages and to decrypt incoming community specific messages. As noted previously, community membership may also be based, at least in part, on a publish or subscription status to information shared over the ad-hoc mesh network 109.” A community is defined as a group of devices that are part of the same publish subscribe group, therefore a second existing message group is a separate group of devices subscribed to the same publishing than a first existing message group for a different publish.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Ross-Pecka with that of Ramo in order to incorporate mesh network; wherein the cryptographic function uses a first cryptographic key that was associated with the first existing message group prior to receiving the content; subscribers of a second existing message group, such that the encryption performed in Ross-Pecka for their combined messages use community specific encryption keys that are established for a group, and consoles of Ross subscribe to particular publishes from agents rather than just have a table.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved security in communication (Ramo: para.0001, para.0091)
Regarding Claim 7, Ramo-Ross-Pecka discloses claim 1 as set forth above.
However Ramo-Ross does not explicitly disclose wherein the composite message includes a third message that is not associated with any message group.
Ramo further discloses wherein the composite message includes a third message that is not associated with any message group (Ramo: Para.0075 “When the wireless node 101 is in the active state 259, the community layer 205 encrypts and decrypts community messages as usual for private communities, and enables all outgoing and incoming community specific messages for public communities (e.g., communities with no restrictions on membership)” in addition to messages that can be nested as part of the same query, there are public messages that are not part of any private community.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Ross-Pecka with that of Ramo in order to incorporate wherein the composite message includes a third message that is not associated with any message group, and apply this concept to Ross such that an alert may be sent to all recipients rather than to a particular group, i.e. an alert is broadly relevant rather than particularly relevant to a particular console.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of providing a message to all potential recipients (Ramo: Para.0075).
Regarding Claim 9, Ross discloses A method comprising: receiving, by a messaging application executing on a node of a network, a composite message (Ross: Fig. 6 602, para.0054 “FIG. 6 is a flow diagram of an embodiment of a console receiving aggregated data and selectively sending the data to multiple management systems. A control console receives data from an aggregating agent, 602. The data may include alerts and/or other security information from a host agent regarding multiple different events, as well as information from multiple host agents.” A composite message comprising messages from a plurality of agents is received by the aggregating agent in Fig. 1 operating in network 130.),
the composite message including: a first message group section comprising a first message including first content generated by a first agent for members of a first existing message group (Ross: para.0048 “Alert distribution feature 453 may extract a data element from a received message and determine with the list/table which console or consoles should receive the information. For example, a breach of a host-based firewall may trigger both a host firewall agent and a compliance agent to register security events, which may be sent to the aggregation agent. The aggregation agent may determine that the event alerts overlap, and so aggregates the alert into a single “firewall breach” alert that is transmitted to management console 400. Alert distribution feature 453 may then determine from a look-up table that both the compliance console and the firewall management console want such a message. The message may then be forwarded on to the two (or potentially one or more than two) consoles.” Based on type of message, different groups of consoles 151-153 in Fig. 1, are the recipients for the content of that message. This information is managed at a list/table that defines message groups for particular types of messages. In the case above, a first message may comprise content, a first message, regarding a firewall breach generated by an agent, and the first existing message group may be the compliance console and the firewall management console.),
wherein at least a portion of the first message group section is encrypted with a first cryptographic key (Ross: para.0022 “In addition to aggregation and correlation, aggregation agent 120 may include capabilities to encrypt and/or sign (attest) alert messages to be sent over network 130. In one embodiment the encryption standard may be specified by a receiving entity, for example, control console 140 of management system 150. Signing the alert message may include use of a cryptographic key to encode the message. Signing the alert may provide assurance to a receiving entity (e.g., a consol) that the entity sending the alert is an entity that should send the alert, and that the entity is indeed who/what it purports to be.” The aggregation agent may encrypt the message using a key. The key in this case is used to encrypt the first message, therefore under broadest reasonable interpretation the key used by the aggregation agent is associated with the first existing message group.), and
a second message group section comprising a second message including second content generated by a second agent for members of a second existing message group (Ross: para.0012 “Just as multiple consoles may be associated with a single agent, a single console may manage multiple agents, and thus be associated with the multiple agents.” Para.0015 “Aggregating and correlating the alert information may include combining multiple alerts from an agent into a single alert message (cross-message aggregation), combining alerts from multiple agents into a single alert message (cross-agent aggregation), a combination of these two, analyzing the alerts and intelligently combining selected ones of the alerts into a single alert message, and generating a tag to associate an alert with an agent.” para.0048 “The message may then be forwarded on to the two (or potentially one or more than two) consoles.” The composite message includes alerts from a plurality of agents on the Host system in Fig. 1, for a plurality of different consoles at the MGT system. Each alert by each agent is associated with a different group of consoles and combined into a single alert message. Another message that is for a different subset of consoles by an agent different from the first message is the second message for a second existing message group.),
wherein at least a portion of the second message group section is encrypted with a cryptographic key that is associated with the second existing message group (Ross: para.0022 “In addition to aggregation and correlation, aggregation agent 120 may include capabilities to encrypt and/or sign (attest) alert messages to be sent over network 130. In one embodiment the encryption standard may be specified by a receiving entity, for example, control console 140 of management system 150. Signing the alert message may include use of a cryptographic key to encode the message. Signing the alert may provide assurance to a receiving entity (e.g., a consol) that the entity sending the alert is an entity that should send the alert, and that the entity is indeed who/what it purports to be.” The aggregation agent may encrypt the message using a key, the aggregated message as a whole is encrypted therefore the second message is also encrypted. The key in this case is used to encrypt the second message, therefore under broadest reasonable interpretation the key used by the aggregation agent is associated with the second existing message group as well as the first.),
decrypting, by the messaging application using a cryptographic function, the first message to acquire the first content, wherein the cryptographic function uses the first cryptographic key (Ross: Fig. 6 612, para.0055 “ If the message is encrypted and/or compressed, the control console may decrypt and/or uncompress the message, 612. This may be based on standard techniques as are known, and would be the reverse procedures of those performed by the aggregating agent.” The reverse of the encryption performed by the aggregating agent is performed, i.e. decrypting the message using the same key, to obtain the messages in the aggregated message) and
delivering, by the messaging application, the first content to at least one agent executing on the node, wherein the at least one agent is included in the first existing message group (Ross: para.0055 “ In this context, correlating the data may refer to the control console determining a console associated with an agent and/or associated with the data in the message that should receive the information. Non-repudiated data may then be sent to the appropriate management system, for example, a management console, or a console associated with the host agent that generated the data, 616.” para.0048 “Alert distribution feature 453 may extract a data element from a received message and determine with the list/table which console or consoles should receive the information. For example, a breach of a host-based firewall may trigger both a host firewall agent and a compliance agent to register security events, which may be sent to the aggregation agent. The aggregation agent may determine that the event alerts overlap, and so aggregates the alert into a single “firewall breach” alert that is transmitted to management console 400. Alert distribution feature 453 may then determine from a look-up table that both the compliance console and the firewall management console want such a message. The message may then be forwarded on to the two (or potentially one or more than two) consoles.” Messages are then sent to appropriate agents, i.e. consoles of the management system, in the example above, based on the look up table, a firewall breach alert is for the group comprising the compliance console and the firewall management console.).
However Ross does not explicitly disclose a mesh network; first content published by a first publisher for subscribers of a first existing message group, a first cryptographic key that was associated with the first existing message group prior to the first publisher publishing the first content; second content published by a second publisher for subscribers of a second existing message group, wherein at least a portion of the second message group section is encrypted with a second cryptographic key that is associated with the second existing message group; wherein the second message group section is separate from the first message group section;
Pecka discloses a first cryptographic key that was associated with the first existing message group (Pecka: para.0011 “According to principles described herein, a user can divide a message, such as an email, into multiple parts. Each part is encrypted with a different key and is assigned a part identifier. The encrypted message is then sent to multiple recipients. Additionally, the key for each part and the identifier for each part are sent to a security authority. Additionally, the sender provides the security authority with access privileges for each of the recipients. The access privileges define which of the parts of the message a particular recipient is authorized to access.” Fig. 1 key 106-1, part 1 of the message that is for a particular recipient, a first message group, is encrypted with a first key.)
wherein at least a portion of the second message group section is encrypted with a second cryptographic key that is associated with the second existing message group (Pecka: para.0011 “According to principles described herein, a user can divide a message, such as an email, into multiple parts. Each part is encrypted with a different key and is assigned a part identifier. The encrypted message is then sent to multiple recipients. Additionally, the key for each part and the identifier for each part are sent to a security authority. Additionally, the sender provides the security authority with access privileges for each of the recipients. The access privileges define which of the parts of the message a particular recipient is authorized to access.” Fig. 1 key 106-2 the part 2 of the message for a different message group for a different recipient is encrypted with a second key)
wherein the second message group section is separate from the first message group section (Pecka: para.0013 “FIG. 1 is a diagram showing illustrative parts of a message that can be separately encrypted. According to the present example, a message 102 is divided into multiple parts 104, each part 104 being associated with a key 106 and an identifier 108. The message 102 is also associated with recipient access data 110.”, Fig. 1 message 102 is divided into different sections part 1 and part 2.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Ross with Pecka in order to incorporate a first cryptographic key that was associated with the first existing message group; wherein at least a portion of the second message group section is encrypted with a second cryptographic key that is associated with the second existing message group; wherein the second message group section is separate from the first message group section
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved security when sending a combined message (Pecka: para.0011-0012).
However Ross-Pecka does not explicitly disclose a mesh network; first content published by a first publisher for subscribers of a first existing message group, a first cryptographic key that was associated with the first existing message group prior to the first publisher publishing the first content; second content published by a second publisher for subscribers of a second existing message group.
Ramo discloses disclose a mesh network (Ramo: para.0003 mesh network);
first content published by a first publisher for subscribers of a first existing message group (Ramo: Para.0074 “In one embodiment, authentication keys are provided when membership in the community is by invitation or otherwise restricted (e.g., when the community is a personal community or a private community). Accordingly, the community layer 205 will be able to encrypt outgoing community specific messages and to decrypt incoming community specific messages. As noted previously, community membership may also be based, at least in part, on a publish or subscription status to information shared over the ad-hoc mesh network 109.” A community is defined as a group of devices that are part of the same publish subscribe group, therefore a first existing message group is a separate group of devices subscribed to the same publishing by a publisher for that community, i.e. first existing message group),
a first cryptographic key that was associated with the first existing message group prior to the first publisher publishing the first content (Ramo: para.0072 “For example, a wireless node 101 may invite another wireless node 101 to join a community by transferring the CID and authentication keys associated with the community to the other wireless node 101.” Para.0074 “In one embodiment, authentication keys are provided when membership in the community is by invitation or otherwise restricted (e.g., when the community is a personal community or a private community). Accordingly, the community layer 205 will be able to encrypt outgoing community specific messages and to decrypt incoming community specific messages. As noted previously, community membership may also be based, at least in part, on a publish or subscription status to information shared over the ad-hoc mesh network 109.” Para.0075 “When the wireless node 101 is in the active state 259, the community layer 205 encrypts and decrypts community messages as usual for private communities, and enables all outgoing and incoming community specific messages for public communities (e.g., communities with no restrictions on membership” para.0079 “The reply message may be encrypted with the encryption key of the community.” Community message are encrypted using a key associated with that community and decrypted using the same key. Therefore prior to receiving content to be sent for a community, the associated key for that community already exists, and is used to encrypt/decrypt that message.);
second content published by a second publisher for subscribers of a second existing message group (Ramo: Para.0074 “In one embodiment, authentication keys are provided when membership in the community is by invitation or otherwise restricted (e.g., when the community is a personal community or a private community). Accordingly, the community layer 205 will be able to encrypt outgoing community specific messages and to decrypt incoming community specific messages. As noted previously, community membership may also be based, at least in part, on a publish or subscription status to information shared over the ad-hoc mesh network 109.” A community is defined as a group of devices that are part of the same publish subscribe group, therefore a second existing message group is a separate group of devices subscribed to the same publishing than a first existing message group for a different publish.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Ross-Pecka with that of Ramo in order to incorporate a mesh network; first content published by a first publisher for subscribers of a first existing message group, a first cryptographic key that was associated with the first existing message group prior to the first publisher publishing the first content; second content published by a second publisher for subscribers of a second existing message group, such that the encryption/decryption performed in Ross-Pecka for their combined messages use community specific encryption keys that are established for a group, and consoles of Ross subscribe to particular publishes from agents rather than just have a table.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved security in communication (Ramo: para.0001, para.0091)
Regarding Claim 13, Ross-Pecka-Ramo discloses claim 9 as set forth above.
However Ross-Pecka does not explicitly disclose wherein:the composite message includes a third message that is not associated with any message group; and the method further comprises delivering, by the messaging application and to the at least one agent, third content from the third message.
Ramo further discloses wherein the composite message includes a third message that is not associated with any message group (Ramo: Para.0075 “When the wireless node 101 is in the active state 259, the community layer 205 encrypts and decrypts community messages as usual for private communities, and enables all outgoing and incoming community specific messages for public communities (e.g., communities with no restrictions on membership)” in addition to messages that can be nested as part of the same query, there are public messages that are not part of any private community.); and
the method further comprises delivering, by the messaging application and to the at least one agent, third content from the third message (Ramo: para.0092 “For example, the list of active communities includes those communities to which the wireless node 101 belongs (e.g., communities that are private such as a community of personal friends) and those communities that are public and open to all nodes 101 (e.g., a general community of all wireless nodes on the ad-hoc network 109 in which system wide messages may be exchanged).” Para.0124 “At step 919, the node 903 receives the same query and determines that it's publish item is responsive and transmits a response message received by both the node 901 and node 905.” para.0063 “As shown in FIG. 2B, the awareness layer 203 includes a control logic 221 and item storage 223. The control logic 221, for instance, provides the logic for creating, publishing, subscribing to, querying, and/or receiving awareness information over the ad-hoc mesh network 109.” Node 903 obtains the query and determines that it corresponds to the query, i.e. a member of that community and processes the message via the community module and/or awareness layer).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Ross-Pecka with that of Ramo in order to incorporate wherein: the composite message includes a third message that is not associated with any message group; and the method further comprises delivering, by the messaging application and to the at least one agent, third content from the third message, and apply this concept to Ross such that an alert may be sent to all recipients rather than to a particular group, i.e. an alert is broadly relevant rather than particularly relevant to a particular console.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of providing a message to all potential recipients (Ramo: Para.0075).
Regarding Claim 15, Ross discloses One or more non-transitory computer readable media storing instructions that, when executed by one or more processors of a first node of a network, cause the one or more processors to execute (Ross: para.0051) a first messaging application (Ross: Fig. 1 aggregation agent) performing operations comprising:
receiving content for a first message from a first agent (Ross: Fig. 1 any of agents 111-113) executing on the first node (Ross: Fig. 5 504 para.0052 “Host agents, such as those discussed herein, generate data, 502. This data may be generated in response to a security event, for example, attack of a virus or worm, an attempted hacker intrusion, the disabling of a security measure, the corruption and/or failure of a security routine and/or associated data, etc. An aggregating agent may poll the host agents for data, or the host agents may volunteer data to the aggregating agent. Data may then be exchanged between the host agent and aggregating agent, 504.” Data generated by a host agent is received by the aggregating agent.),
wherein content for the first message is for one or more agents that are members of a first existing message group (Ross: para.0048 “Alert distribution feature 453 may extract a data element from a received message and determine with the list/table which console or consoles should receive the information. For example, a breach of a host-based firewall may trigger both a host firewall agent and a compliance agent to register security events, which may be sent to the aggregation agent. The aggregation agent may determine that the event alerts overlap, and so aggregates the alert into a single “firewall breach” alert that is transmitted to management console 400. Alert distribution feature 453 may then determine from a look-up table that both the compliance console and the firewall management console want such a message. The message may then be forwarded on to the two (or potentially one or more than two) consoles.” Based on type of message, different groups of consoles 151-153 in Fig. 1, are the recipients for the content of that message. This information is managed at a list/table that defines message groups for particular types of messages. In the case above, a first message may comprise content regarding a firewall breach, and the first existing message group may be the compliance console and the firewall management console.);
encrypting, using a cryptographic function, the first message to generate first encrypted data, wherein the cryptographic function uses a first cryptographic key (Ross: para.0022 “In addition to aggregation and correlation, aggregation agent 120 may include capabilities to encrypt and/or sign (attest) alert messages to be sent over network 130. In one embodiment the encryption standard may be specified by a receiving entity, for example, control console 140 of management system 150. Signing the alert message may include use of a cryptographic key to encode the message. Signing the alert may provide assurance to a receiving entity (e.g., a consol) that the entity sending the alert is an entity that should send the alert, and that the entity is indeed who/what it purports to be.” The aggregation agent may encrypt the message using a key. The key in this case is used to encrypt the first message, therefore under broadest reasonable interpretation the key used by the aggregation agent is associated with the first existing message group.)
generating a first composite message including: a first message group section comprising the first encrypted data (Ross: Fig. 5 518, para.0053 “If the authentication is successful, 510, the aggregating agent may proceed to perform one or more processes on the data to prepare to transmit the data to the management console. For example, the aggregating agent may aggregate the data, 512, taking multiple alert messages and preparing a single alert message with all the alert data. The data may also be compressed according to known techniques, and/or encrypted, 514. Encryption may use any known encryption, whether standard or proprietary. The aggregating agent may also sign the data message, 516, and transmit the data to the management console on a security server, 518.” The composite message includes a first alert message that has been encrypted.),
and a second message group section comprising a second message including content from a second agent for members of a second existing message group (Ross: para.0012 “Just as multiple consoles may be associated with a single agent, a single console may manage multiple agents, and thus be associated with the multiple agents.” Para.0015 “Aggregating and correlating the alert information may include combining multiple alerts from an agent into a single alert message (cross-message aggregation), combining alerts from multiple agents into a single alert message (cross-agent aggregation), a combination of these two, analyzing the alerts and intelligently combining selected ones of the alerts into a single alert message, and generating a tag to associate an alert with an agent.” para.0048 “The message may then be forwarded on to the two (or potentially one or more than two) consoles.” The composite message includes alerts from a plurality of agents on the Host system in Fig. 1, for a plurality of different consoles at the MGT system. Each alert by each agent is associated with a different group of consoles and combined into a single alert message. Another message that is for a different subset of consoles by an agent different from the first message is the second message for a second existing message group.),
wherein at least a portion of the second message group section is encrypted with a cryptographic key that is associated with the second existing message group (Ross: para.0022 “In addition to aggregation and correlation, aggregation agent 120 may include capabilities to encrypt and/or sign (attest) alert messages to be sent over network 130. In one embodiment the encryption standard may be specified by a receiving entity, for example, control console 140 of management system 150. Signing the alert message may include use of a cryptographic key to encode the message. Signing the alert may provide assurance to a receiving entity (e.g., a consol) that the entity sending the alert is an entity that should send the alert, and that the entity is indeed who/what it purports to be.” The aggregation agent may encrypt the message using a key, the aggregated message as a whole is encrypted therefore the second message is also encrypted. The key in this case is used to encrypt the second message, therefore under broadest reasonable interpretation the key used by the aggregation agent is associated with the second existing message group as well as the first.),
and sending the first composite message to a second messaging application executed by a second node of the network (Ross: Fig. 5 518, para.0053 “If the authentication is successful, 510, the aggregating agent may proceed to perform one or more processes on the data to prepare to transmit the data to the management console. For example, the aggregating agent may aggregate the data, 512, taking multiple alert messages and preparing a single alert message with all the alert data. The data may also be compressed according to known techniques, and/or encrypted, 514. Encryption may use any known encryption, whether standard or proprietary. The aggregating agent may also sign the data message, 516, and transmit the data to the management console on a security server, 518.” After encryption, the message is transmitted to the second node via network 130 in Fig. 1, the second node being MGT system 150).
However Ross does not explicitly disclose a mesh network; wherein content for the first message is for one or more agents that are subscribed to a first existing message group; the cryptographic function uses a first cryptographic key that was associated with the first existing message group prior to receiving the content; a second message including content from a second agent for subscribers of a second existing message group; wherein at least a portion of the second message group section is encrypted with a second cryptographic key that is associated with the second existing message group; wherein the first message group section is separate from the second message group section;
Pecka discloses the cryptographic function uses a first cryptographic key that was associated with the first existing message group (Pecka: para.0011 “According to principles described herein, a user can divide a message, such as an email, into multiple parts. Each part is encrypted with a different key and is assigned a part identifier. The encrypted message is then sent to multiple recipients. Additionally, the key for each part and the identifier for each part are sent to a security authority. Additionally, the sender provides the security authority with access privileges for each of the recipients. The access privileges define which of the parts of the message a particular recipient is authorized to access.” Fig. 1 key 106-1, part 1 of the message that is for a particular recipient, a first message group, is encrypted with a first key.);
wherein at least a portion of the second message group section is encrypted with a second cryptographic key that is associated with the second existing message group (Pecka: para.0011 “According to principles described herein, a user can divide a message, such as an email, into multiple parts. Each part is encrypted with a different key and is assigned a part identifier. The encrypted message is then sent to multiple recipients. Additionally, the key for each part and the identifier for each part are sent to a security authority. Additionally, the sender provides the security authority with access privileges for each of the recipients. The access privileges define which of the parts of the message a particular recipient is authorized to access.” Fig. 1 key 106-2 the part 2 of the message for a different message group for a different recipient is encrypted with a second key);
wherein the first message group section is separate from the second message group section (Pecka: para.0013 “FIG. 1 is a diagram showing illustrative parts of a message that can be separately encrypted. According to the present example, a message 102 is divided into multiple parts 104, each part 104 being associated with a key 106 and an identifier 108. The message 102 is also associated with recipient access data 110.”, Fig. 1 message 102 is divided into different sections part 1 and part 2.);
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Ross with Pecka in order to incorporate the cryptographic function uses a first cryptographic key that was associated with the first existing message group; wherein at least a portion of the second message group section is encrypted with a second cryptographic key that is associated with the second existing message group; wherein the first message group section is separate from the second message group section.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved security when sending a combined message (Pecka: para.0011-0012).
However Ross-Pecka does not explicitly disclose a mesh network; wherein content for the first message is for one or more agents that are subscribed to a first existing message group; the cryptographic function uses a first cryptographic key that was associated with the first existing message group prior to receiving the content; a second message including content from a second agent for subscribers of a second existing message group;
Ramo discloses a mesh network (Ramo: para.0003 mesh network);
wherein content for the first message is for one or more agents that are subscribed to a first existing message group (Ramo: Para.0074 “In one embodiment, authentication keys are provided when membership in the community is by invitation or otherwise restricted (e.g., when the community is a personal community or a private community). Accordingly, the community layer 205 will be able to encrypt outgoing community specific messages and to decrypt incoming community specific messages. As noted previously, community membership may also be based, at least in part, on a publish or subscription status to information shared over the ad-hoc mesh network 109.” A community is defined as a group of devices that are part of the same publish subscribe group, therefore a first existing message group is a separate group of devices subscribed to the same publishing by a publisher for that community, i.e. first existing message group);
the cryptographic function uses a first cryptographic key that was associated with the first existing message group prior to receiving the content (Ramo: para.0072 “For example, a wireless node 101 may invite another wireless node 101 to join a community by transferring the CID and authentication keys associated with the community to the other wireless node 101.” Para.0074 “In one embodiment, authentication keys are provided when membership in the community is by invitation or otherwise restricted (e.g., when the community is a personal community or a private community). Accordingly, the community layer 205 will be able to encrypt outgoing community specific messages and to decrypt incoming community specific messages. As noted previously, community membership may also be based, at least in part, on a publish or subscription status to information shared over the ad-hoc mesh network 109.” para.0079 “The reply message may be encrypted with the encryption key of the community.” Community message are encrypted using a key associated with that community. Therefore prior to receiving content to be sent for a community, the associated key for that community already exists, and is used to encrypt that message.);
a second message including content from a second agent for subscribers of a second existing message group (Ramo: Para.0074 “In one embodiment, authentication keys are provided when membership in the community is by invitation or otherwise restricted (e.g., when the community is a personal community or a private community). Accordingly, the community layer 205 will be able to encrypt outgoing community specific messages and to decrypt incoming community specific messages. As noted previously, community membership may also be based, at least in part, on a publish or subscription status to information shared over the ad-hoc mesh network 109.” A community is defined as a group of devices that are part of the same publish subscribe group, therefore a second existing message group is a separate group of devices subscribed to the same publishing than a first existing message group for a different publish.);
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Ross-Pecka with that of Ramo in order to incorporate a mesh network; wherein content for the first message is for one or more agents that are subscribed to a first existing message group; the cryptographic function uses a first cryptographic key that was associated with the first existing message group prior to receiving the content; a second message including content from a second agent for subscribers of a second existing message group, such that the encryption performed in Ross-Pecka for their combined messages use community specific encryption keys that are established for a group, and consoles of Ross subscribe to particular publishes from agents rather than just have a table.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved security in communication (Ramo: para.0001, para.0091)
Regarding Claim 18, Ross-Pecka-Ramo discloses claim 15 as set forth above.
However Ross-Pecka does not explicitly disclose wherein the first composite message further includes a third message that is to be delivered to any agent.
Ramo further discloses wherein the first composite message further includes a third message that is to be delivered to any agent (Ramo: Para.0075 “When the wireless node 101 is in the active state 259, the community layer 205 encrypts and decrypts community messages as usual for private communities, and enables all outgoing and incoming community specific messages for public communities (e.g., communities with no restrictions on membership)” in addition to messages that can be nested as part of the same query, there are public messages that are not part of any private community.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Ross-Pecka with that of Ramo in order to incorporate wherein the first composite message further includes a third message that is to be delivered to any agent, and apply this concept to Ross such that an alert may be sent to all recipients rather than to a particular group, i.e. an alert is broadly relevant rather than particularly relevant to a particular console.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of providing a message to all potential recipients (Ramo: Para.0075).
Regarding Claim 19, Ross-Pecka-Ramo discloses claim 15 as set forth above.
Ross further discloses obtaining a second composite message including: a third message that has been generated and is to be provided to one or more agents that are members of the first existing message group (Ross: para.0048 “Alert distribution feature 453 may extract a data element from a received message and determine with the list/table which console or consoles should receive the information. For example, a breach of a host-based firewall may trigger both a host firewall agent and a compliance agent to register security events, which may be sent to the aggregation agent. The aggregation agent may determine that the event alerts overlap, and so aggregates the alert into a single “firewall breach” alert that is transmitted to management console 400. Alert distribution feature 453 may then determine from a look-up table that both the compliance console and the firewall management console want such a message. The message may then be forwarded on to the two (or potentially one or more than two) consoles.” Based on type of message, different groups of consoles 151-153 in Fig. 1, are the recipients for the content of that message. This information is managed at a list/table that defines message groups for particular types of messages. In the case above, a third message may comprise content after the first content in a second iteration regarding a firewall breach, and the first existing message group may be the compliance console and the firewall management console.), and
a fourth message that has been generated and is to be provided to one or more agents that are members of the second existing message group (Ross: para.0012 “Just as multiple consoles may be associated with a single agent, a single console may manage multiple agents, and thus be associated with the multiple agents.” Para.0015 “Aggregating and correlating the alert information may include combining multiple alerts from an agent into a single alert message (cross-message aggregation), combining alerts from multiple agents into a single alert message (cross-agent aggregation), a combination of these two, analyzing the alerts and intelligently combining selected ones of the alerts into a single alert message, and generating a tag to associate an alert with an agent.” para.0048 “The message may then be forwarded on to the two (or potentially one or more than two) consoles.” The composite message includes alerts from a plurality of agents on the Host system in Fig. 1, for a plurality of different consoles at the MGT system. Each alert by each agent is associated with a different group of consoles and combined into a single alert message. Another message that is for a different subset of consoles by an agent different from the first message is the second message for a second existing message group.); and
sending second content from the third message to the first agent (Ross: para.0055 “ In this context, correlating the data may refer to the control console determining a console associated with an agent and/or associated with the data in the message that should receive the information. Non-repudiated data may then be sent to the appropriate management system, for example, a management console, or a console associated with the host agent that generated the data, 616.” The message is sent to the appropriate agent, i.e. console.).
However Ross does not explicitly disclose a third message that has been published and is to be provided to one or more agents that are subscribed to the first existing message group, and
a fourth message that has been published and is to be provided to one or more agents that are subscribed to the second existing message group.
Ramo discloses a third message that has been published and is to be provided to one or more agents that are subscribed to the first existing message group (Ramo: Para.0074 “In one embodiment, authentication keys are provided when membership in the community is by invitation or otherwise restricted (e.g., when the community is a personal community or a private community). Accordingly, the community layer 205 will be able to encrypt outgoing community specific messages and to decrypt incoming community specific messages. As noted previously, community membership may also be based, at least in part, on a publish or subscription status to information shared over the ad-hoc mesh network 109.” A community is defined as a group of devices that are part of the same publish subscribe group, therefore a first existing message group is a separate group of devices subscribed to the same publishing by a publisher for that community, i.e. first existing message group. The system publishes messages over time, and therefore a third message may be a message published after the first in a second iteration.), and
a fourth message that has been published and is to be provided to one or more agents that are subscribed to the second existing message group (Ramo: Para.0074 “In one embodiment, authentication keys are provided when membership in the community is by invitation or otherwise restricted (e.g., when the community is a personal community or a private community). Accordingly, the community layer 205 will be able to encrypt outgoing community specific messages and to decrypt incoming community specific messages. As noted previously, community membership may also be based, at least in part, on a publish or subscription status to information shared over the ad-hoc mesh network 109.” A community is defined as a group of devices that are part of the same publish subscribe group, therefore a second existing message group is a separate group of devices subscribed to the same publishing than a first existing message group for a different publish. The system publishes messages over time, and therefore a fourth message may be a message published after the first in a second iteration.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Ross-Pecka with that of Ramo in order to incorporate a third message that has been published and is to be provided to one or more agents that are subscribed to the first existing message group, and a fourth message that has been published and is to be provided to one or more agents that are subscribed to the second existing message group.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved security in communication (Ramo: para.0001, para.0091)
Regarding Claim 20, Ross-Pecka-Ramo discloses claim 19 as set forth above.
Ross further discloses wherein the operations further comprise decrypting, using the cryptographic function, the third message using the first cryptographic key to acquire the second content from the third message (Ross: Fig. 6 612, para.0055 “ If the message is encrypted and/or compressed, the control console may decrypt and/or uncompress the message, 612. This may be based on standard techniques as are known, and would be the reverse procedures of those performed by the aggregating agent.” The reverse of the encryption performed by the aggregating agent is performed, i.e. decrypting the message using the same key, to obtain the messages in the aggregated message. This can be performed for a second combined message in a second iteration.).
Regarding Claim 21, Ross-Pecka-Ramo disclose 1 as set forth above.
Ross further discloses wherein the first message group section comprises: an encrypted payload encrypted by the first cryptographic key (Ross: para.0022 “In addition to aggregation and correlation, aggregation agent 120 may include capabilities to encrypt and/or sign (attest) alert messages to be sent over network 130. In one embodiment the encryption standard may be specified by a receiving entity, for example, control console 140 of management system 150. Signing the alert message may include use of a cryptographic key to encode the message. Signing the alert may provide assurance to a receiving entity (e.g., a consol) that the entity sending the alert is an entity that should send the alert, and that the entity is indeed who/what it purports to be.” The aggregation agent may encrypt the message using a key.).
However Ross-Pecka does not explicitly disclose an unencrypted header that includes a first message group identifier.
Ramo further disclose wherein the message comprises: an unencrypted header that includes a first message group identifier (Ramo: para.0073 “In addition, the encryption/decryption module 245 may encrypt or decrypt message data using, for instance, a temporary key that is periodically derived from the authentication key K associated with the CID. These measures hinder the discovery of the CID by outsiders that do not have the authentication key. By way of example, the community layer 205 inserts a special header into the messages that it receives from the awareness layer 203. The special header, for instance, contains a list of anonymized community identifiers corresponding to the communities to which the message is relevant.” The encrypted payload is associated with a special header that has community identifiers for a particular message)
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Ross-Pecka with that of Ramo in order to incorporate a an unencrypted header that includes a first message group identifier.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved security in communication (Ramo: para.0001, para.0091)
Claim(s) 2, 16 is/are rejected under 35 U.S.C. 103 as being unpatentable over Ross et al. (hereinafter Ross, US 2006/0156398 A1) in view of Pecka et al. (hereinafter Pecka, US 2016/0226844 A1) in view of Ramo et al. (hereinafter Ramo, US 2012/0135723 A1) in view of Szigeti et al. (hereinafter Szigeti, US 2023/0081708 A1).
Regarding Claim 2 Ross-Pecka-Ramo discloses claim 1 as set forth above.
However Ross-Pecka-Ramo does not explicitly disclose prior to the transmitting, verifying, by the first messaging application, that a policy permits the first agent to deliver the first message to the first existing message group.
Szigeti discloses prior to the transmitting, verifying, by the first messaging application, that a policy permits the first agent to deliver the first message to the first existing message group (Szigeti: Fig. 4 para.0056 “At 408, at least one of the cloud-native application or the IBN architecture 106 may determine, based at least in part on the resolution, a third set of access policies that defines whether the first applications are allowed or restricted from communicating with the second applications in the network service mesh and the IBN architecture. For instance, the third set of access policies may be matching access policies 128 that are consistently applied policies across the network service mesh 108 and the IBN architecture 106.” When establishing encrypted tunnels for communication between microservices, access polies are obtained and resolved to determine which microservices are allowed to communicate with each other by the NSE of each node, seen in Fig. 2E.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Ross-Pecka-Ramo with Szigeti in order to incorporate prior to the transmitting, verifying, by the first messaging application, that a policy permits the first agent to deliver the first message to the first existing message group.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved network security (Szigeti: para.0002).
Regarding Claim 16, Ross-Pecka-Ramo discloses claim 15 as set forth above.
However Ross-Pecka does not explicitly disclose wherein the operations further comprise: determining whether a policy permits the first agent to provide the first message to one or more agents that are subscribed to the first existing message group; and wherein the sending is performed in response to determining that the policy permits the first agent to provide the first message to one or more agents that are subscribed to the first existing message group.
Ramo further discloses the first agent to provide the first message to one or more agents that are subscribed to the first existing message group (Ramo: para.0124 “ In this case, the query is transmitted to both the node 903 and node 905 over the ad-hoc mesh network 109.” The query is then sent to other nodes of the mesh).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Ross-Pecka with that of Ramo in order to incorporate the first agent to provide the first message to one or more agents that are subscribed to the first message group.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved security in communication (Ramo: para.0001, para.0091)
However Ross-Pecka-Ramo further discloses wherein the operations further comprise: determining whether a policy permits the first agent to provide the first message to one or more agents that are subscribed to the first existing message group; and wherein the sending is performed in response to determining that the policy permits the first agent to provide the first message to one or more agents that are subscribed to the first existing message group.
Szigeti discloses wherein the operations further comprise: determining whether a policy permits the first agent to provide the first message to one or more agents that are of the first existing message group (Szigeti: Fig. 4 para.0056 “At 408, at least one of the cloud-native application or the IBN architecture 106 may determine, based at least in part on the resolution, a third set of access policies that defines whether the first applications are allowed or restricted from communicating with the second applications in the network service mesh and the IBN architecture. For instance, the third set of access policies may be matching access policies 128 that are consistently applied policies across the network service mesh 108 and the IBN architecture 106.” When establishing encrypted tunnels for communication between microservices, access polies are obtained and resolved to determine which groups of microservices are allowed to communicate with each other by the NSE of each node, seen in Fig. 2E.); and
wherein the sending is performed in response to determining that the policy permits the first agent to provide the first message to one or more agents that are of the first existing message group (Szigeti: para.0062 “At 512, the network service mesh 108 may apply the third set of access policies to communications in the network service mesh.” The access policy for communication rules are applied, which allows for a first group of nodes to communicate to another in para.0056 after the policies have been resolved, therefore only sending when the policy allows the destination).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Ross-Pecka-Ramo with Szigeti in order to incorporate wherein the operations further comprise: determining whether a policy permits the first agent to provide the first message to one or more agents that are of the first existing message group and wherein the sending is performed in response to determining that the policy permits the first agent to provide the first message to one or more agents that are of the first existing message group, and apply this technique to the subscribed messages groups of Ross-Pecka-Ramo.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved network security (Szigeti: para.0002).
Claim(s) 5-6, 12 is/are rejected under 35 U.S.C. 103 as being unpatentable over Ross et al. (hereinafter Ross, US 2006/0156398 A1) in view of Pecka et al. (hereinafter Pecka, US 2016/0226844 A1) in view of Ramo et al. (hereinafter Ramo, US 2012/0135723 A1) in view of Kapoor et al. (hereinafter Kapoor, US 2019/0190894 A1).
Regarding Claim 5 Ross-Pecka-Ramo discloses claim 1 as set forth above.
Ross further discloses encrypting, with the first cryptographic key, the content for the first message (Ross: para.0022 “In addition to aggregation and correlation, aggregation agent 120 may include capabilities to encrypt and/or sign (attest) alert messages to be sent over network 130. In one embodiment the encryption standard may be specified by a receiving entity, for example, control console 140 of management system 150. Signing the alert message may include use of a cryptographic key to encode the message. Signing the alert may provide assurance to a receiving entity (e.g., a consol) that the entity sending the alert is an entity that should send the alert, and that the entity is indeed who/what it purports to be.” The aggregation agent may encrypt the message using a key. The key in this case is used to encrypt the first message, therefore under broadest reasonable interpretation the key used by the aggregation agent is associated with the first existing message group.),
However Ross-Pecka-Ramo does not explicitly disclose encrypting, with the first cryptographic key, additional data.
Kapoor discloses encrypting, with the first cryptographic key, additional data (Kapoor: para.0038 “Encrypted payload portion includes application data 610 and private addressing information 620,” para.0041 “ Second, packet 600 includes group identifier information 640, which is used by the destination computing system to identify group (overlay network) associated with the packet, and decrypt information for decrypting the packet. This information may include information about the length of the data payload, information about the sequence number of the packet, a keyed-hash message authentication code (HMAC), a peer identifier (peerID), an initialization vector (IV) or seed for encryption” additional data 620 is encrypted along with the application data.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Ross-Pecka-Ramo with Kapoor in order to incorporate encrypting, with the first cryptographic key, additional data.
One of ordinary skill in the art before the effective filing date of the claimed invention would have been motivated to combine because of the expected benefit of improved security by providing private addressing information (Kapoor: para.0039-0040).
Regarding Claim 6, Ross-Pecka-Ramo disclose claim 5 as set forth above.
However Ross-Pecka-Ramo does not explicitly disclose wherein encrypting the first message with the first cryptographic key further comprises initializing the cryptographic function with an encryption initialization vector, wherein the composite message includes the encryption initialization vector separately from the first message group section.
Kapoor discloses wherein encrypting the first message with the first cryptographic key further comprises initializing the cryptographic function with an encryption initialization vector (Kapoor: para.0041 “Second, packet 600 includes group identifier information 640, which is used by the destination computing system to identify group (overlay network) associated with the packet, and decrypt information for decrypting the packet. This information may include information about … an initialization vector (IV) or seed for encryption,” the encryption of the packet is performed using an initialization vector),
wherein the composite message includes the encryption initialization vector separately from the first message group section (Kapoor: para.0041 “Second, packet 600 includes group identifier information 640, which is used by the destination computing system to identify group (overlay network) associated with the packet, and decrypt information for decrypting the packet. This information may include information about … an initialization vector (IV) or seed for encryption,” the encryption of the packet is performed using an initialization vector, and the IV is provided in group identifier infor 640 in Fig.6 which remains unencrypted and not part of the encrypted application data 610).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Ross-Pecka-Ramo with Kapoor in order to incorporate wherein encrypting the first message with the first cryptographic key further comprises initializing the cryptographic function with an encryption initialization vector, wherein the composite message includes the encryption initialization vector separately from the first message group section.
One of ordinary skill in the art before the effective filing date of the claimed invention would have been motivated to combine because of the expected benefit of improved security (Kapoor: para.0039-0041).
Regarding Claim 12, Ross-Pecka-Ramo discloses claim 9 as set forth above.
However Ross-Pecka-Ramo does not explicitly disclose wherein decrypting the first message with the first cryptographic key further comprises initializing the cryptographic function with an encryption initialization vector, and wherein the composite message includes the encryption initialization vector separately from the first message group section.
Kapoor discloses wherein decrypting the first message with the first cryptographic key further comprises initializing the cryptographic function with an encryption initialization vector (Kapoor: para.0041 “Second, packet 600 includes group identifier information 640, which is used by the destination computing system to identify group (overlay network) associated with the packet, and decrypt information for decrypting the packet. This information may include information about … an initialization vector (IV) or seed for encryption,” the information used to decrypt the message includes the initialization vector used for the encryption, and therefore used to decrypt the packet.), and
wherein the composite message includes the encryption initialization vector separately from the first message group section (Kapoor: para.0041 “Second, packet 600 includes group identifier information 640, which is used by the destination computing system to identify group (overlay network) associated with the packet, and decrypt information for decrypting the packet. This information may include information about … an initialization vector (IV) or seed for encryption,” the encryption of the packet is performed using an initialization vector, and the IV is provided in group identifier infor 640 in Fig.6 which remains unencrypted and not part of the encrypted application data 610).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Ross-Pecka-Ramo with Kapoor in order to incorporate wherein decrypting the first message with the first cryptographic key further comprises initializing the cryptographic function with an encryption initialization vector, and wherein the composite message includes the encryption initialization vector separately from the first message group section.
One of ordinary skill in the art before the effective filing date of the claimed invention would have been motivated to combine because of the expected benefit of improved security (Kapoor: para.0039-0041).
Claim(s) 8 and 14 is/are rejected under 35 U.S.C. 103 as being unpatentable over Ross et al. (hereinafter Ross, US 2006/0156398 A1) in view of Pecka et al. (hereinafter Pecka, US 2016/0226844 A1) in view of Ramo et al. (hereinafter Ramo, US 2012/0135723 A1) in view of Savage et al. (hereinafter Savage, US 2018/0019869 A1).
Regarding Claim 8, Ross-Pecka-Ramo discloses claim 7 as set forth above.
However Ross-Pecka-Ramo does not explicitly disclose wherein the third message is encrypted by the first messaging application with a default cryptographic key that is not associated with any message group.
Savage discloses wherein the third message is encrypted by the first messaging application with a default cryptographic key that is not associated with any message group (Savage: para.0006 “In one aspect, a disclosed method for secure messaging between distributing computing nodes includes receiving an encrypted message from a node, decrypting the message using a default key, sending a message, rotating a group key, and distributing a key rotation message. The message received may be to discover a master of a group. The message sent may welcome the node into the group as a member. The welcome message may be encrypted with the default key and may include information to determine the group key. The group key may be rotated based on expiration of a group key rotation window. The group key may become a prior group key and the rotated group key may be a current group key. The key rotation message may be encrypted with one of the default key or the prior group key, and may include information to determine the current group key.” Messages can be encrypted with a default key and not a group key).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Ross-Pecka-Ramo with Savage in order to incorporate wherein the third message is encrypted by the first messaging application with a default cryptographic key that is not associated with any message group.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved security even for public messages (Savage: para.0006 and abstract).
Regarding Claim 14 Ross-Pecka-Ramo discloses claim 13 as set forth above.
However Ross-Pecka-Ramo does not explicitly disclose further comprising decrypting, by the messaging application, the third message included in the composite message with a default cryptographic key that is not associated with any message group to generate the third content from the third message.
Savage discloses further comprising decrypting, by the messaging application, the third message included in the composite message with a default cryptographic key that is not associated with any message group to generate the third content from the third message (Savage: para.0006 “In one aspect, a disclosed method for secure messaging between distributing computing nodes includes receiving an encrypted message from a node, decrypting the message using a default key, sending a message, rotating a group key, and distributing a key rotation message. The message received may be to discover a master of a group. The message sent may welcome the node into the group as a member. The welcome message may be encrypted with the default key and may include information to determine the group key. The group key may be rotated based on expiration of a group key rotation window. The group key may become a prior group key and the rotated group key may be a current group key. The key rotation message may be encrypted with one of the default key or the prior group key, and may include information to determine the current group key.” Messages can be encrypted with a default key and not a group key).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Ross-Pecka-Ramo with Savage in order to incorporate further comprising decrypting, by the messaging application, the third message included in the composite message with a default cryptographic key that is not associated with any message group to generate the content from the third message.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved security even for public messages (Savage: para.0006 and abstract).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. Srinivasan et al. US 20180227239, combining messages in queue, see para21, 0024 and Fig. 3A.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to EUI H KIM whose telephone number is (571)272-8133. The examiner can normally be reached 7:30-5 M-R, M-F alternating.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Kamal B Divecha can be reached on 5712725863. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/EUI H KIM/Examiner, Art Unit 2453
/KAMAL B DIVECHA/Supervisory Patent Examiner, Art Unit 2453
