Detailed Action
This final office Action is in response to amendment filed on 06/05/2026. Claims 1, 10, and 15 have been amended, no claims have been cancelled. Claims 1-20 remain pending in the application.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendment
The amended filed on 06/05/2026 has been entered. See above on lines 1-3 of
this office action.
Response to Arguments/Amendments
Examiner’s response to applicant’s arguments concerning rejection under 35 U.S.C. § 103.
Applicant’s amendments and arguments in pages 9 – 11 and 14 regarding independent claims 1, 10 and 15 are carefully considered and are persuasive however arguments are moot in view of new ground of rejection below.
With respect to applicant’s argument to the remaining claims 2-9, 11-14, and 16-20, on pages 10 - 16 of the remark, the applicant is relying on the newly
added amendments of the independent claims 1, 10, and 15. Please see examiner’s response above and the detail of the rejection below.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1, 4, 7, and 10 are rejected under 35 U.S.C. 103 as being unpatentable over Kumar et al. (US-10771506-B1 hereafter Kumar), in view of INOUE et al. (US-20180241758-A1 hereafter INOUE).
Regarding claim 1 Kumar teaches a method of protecting networks, comprising:
detecting a compromised computing device associated with a security event generated by a unified security policy from a group of sites within a network; (see Kumar Col.1 lines 19-26: “receive network topology information of a network and device capability information corresponding to capabilities of devices in the network; detect a threat to an affected device of the network; determine threat information associated with the threat; select a security policy to mitigate the threat based on the threat information;”;
determining a threat context of the compromised computing device, the threat context including data associated with the security event; (see Kumar Col.10 lines 1-20: “security platform 230 may detect a threat to monitored network 210 and/or cloud computing environment 220 using one or more threat feeds from a threat detection system. For example, security platform 230 may receive threat notifications from a Command and Control (CnC) feed indicating a list of identified malicious entities, a Geographical Internet Protocol (Geo IP) feed indicating a list of locations and/or internet protocol (IP) addresses associated with locations (e.g., countries, regions, etc.) that may include malicious entities, a Malware feed indicating a list of identified malicious files ( or hashes of files), an Infected Host feed indicating a list of entities (e.g., internal entities, such as client devices 215 of monitored network 210) that have been identified as infected with malware, a Distributed Denial of Service (DDoS) feed indicating a list of malicious entities ( e.g., external entities) that may be attacking or attempting to attack a device 215, 217 of monitored network 210, or the like. A malicious entity may be a device that intends to spread malware.”, Col. 10 lines 25-28: “security platform 230 may detect a threat to monitored network 210 to enable security platform 230 to determine threat information associated with the threat to mitigate the threat.”).
propagating the threat context to a controller (see Kumar Col.15 lines 46-54: “The example implementation 500 includes enforcement devices 517 (including firewalls 517-1, switches 517-2, routers 517-3, SDN platforms 517-4, and public cloud platforms 517-5), security platform 525, cloud threat feeds 535 and custom threat feeds 545. In the example implementation 500, security platform 525 may utilize detected threats and/or threat information from cloud threat feeds 535 and/or custom threat feeds 545 to select security policies to deploy to enforcement devices 517”Col.16 lines 4-10: “Using the threats and threat information from cloud threat feeds 535 and custom threat feeds 545, security platform 525 may deploy security policies to enforcement devices 517. According to some implementations herein, security platform 525 may deploy the security policies to enforce the security policies based on the types of threats and capabilities of the enforcement devices 517 (which may include the location of the enforcement devices 517 within a topology of a network, the location of the enforcement devices 517 relative to a location of a threat, or the like.)”;
determining, based at least in part on the threat context, a user associated with the compromised computing device, the user being associated with a user context, at least partially including a geolocation of the user (Kumar see Kumar Col. 10 lines: 1-16: "security platform 230 may detect a threat to monitored network 210 and/or cloud computing environment 220 using one or more threat feeds from a threat detection system. For example, security platform 230 may receive threat notifications from a Command and Control (CnC) feed indicating a list of identified malicious entities, a Geographical Internet Protocol (Geo IP) feed indicating a list of locations and/or internet protocol (IP) addresses associated with locations (e.g., countries, regions, etc.) that may include malicious entities, a Ma/ware feed indicating a list of identified malicious files ( or hashes of files), an Infected Host feed indicating a list of entities (e.g., internal entities, such as client devices 215 of monitored network 210) that have been identified”, Col.15 lines 8-22: “security platform 230 may provide or transmit information associated with the threat. For example, security platform 230 may provide information to cause a user interface to present results of a deployment of a selected security policy to a selected enforcement device to mitigate a detected threat. Example results of the deployment may include a malware report or alert ( e.g., notifying a user of the presence or non-presence of malware) and/or threat information associated with the detected threat, such as threat type, affected or targeted devices, sources or origins of the threat, or the like. In some implementations, security platform 230 may provide information to an intended target of a threat ( e.g., a warning to avoid a particular CnC site, infected host, communication with a flagged Geo IP address, etc.).”);
provisioning the controller with a dynamic list and a data policy matching the dynamic list; (see Kumar Col.15 lines 55-67 – Col.16 lines 1-10: “security platform 525 may detect a threat using cloud threat feeds 535 and/or custom threat feeds 545. Cloud threat feeds 535 may be threat feeds that are available to networks in communication with a cloud computing environment (e.g., cloud computing environment 220). Custom threat feeds 545 may be threat feeds that are specific to a particular monitored network (e.g., when particular threats are known to be present in a monitored network 210, when particular devices of a monitored network 210 are known to be infected, or the like). Accordingly, security platform 230 may use cloud threat feeds 535 and custom threat feeds 545 to detect threats and receive threat information. Using the threats and threat information from cloud threat feeds 535 and custom threat feeds 545, security platform 525 may deploy security policies to enforcement devices 517. According to some implementations herein, security platform 525 may deploy the security policies to enforce the security policies based on the types of threats and capabilities of the enforcement devices 517 (which may include the location of the enforcement devices 517 within a topology of a network, the location of the enforcement devices 517 relative to a location of a threat, or the like).”).
propagating the user context into the dynamic list referenced under the data policy (see Kumar Col.11 lines 59-67: “security platform 230 may select the security policy and/or the enforcement device based on which threat feed (e.g., which of the CnC feed, the Geo IP feed, the malware feed, the infected host feed, the DDoS feed, etc.) detected the threat and/or provided information on the threat. Security platform 230 may use the network topology information and the device capability information to select the enforcement device to enforce a selected security policy.”, Col.16 lines 1-10: “Using the threats and threat information from cloud threat feeds 535 and custom threat feeds 545, security platform 525 may deploy security policies to enforcement devices 517. According to some implementations herein, security platform 525 may deploy the security policies to enforce the security policies based on the types of threats and capabilities of the enforcement devices 517 (which may include the location of the enforcement devices 517 within a topology of a network, the location of the enforcement devices 517 relative to a location of a threat, or the like”);
based at least in part on the geolocation of the user associated with the compromised computing device and a first geolocation of a first site of the group of sites indicating that the first site is co-located with the compromised computing device, advertising the dynamic list and the data policy to the first site (see Kumar Col. 10 lines: 1-16: "security platform 230 may detect a threat to monitored network 210 and/or cloud computing environment 220 using one or more threat feeds from a threat detection system. For example, security platform 230 may receive threat notifications from a Command and Control (CnC) feed indicating a list of identified malicious entities, a Geographical Internet Protocol (Geo IP) feed indicating a list of locations and/or internet protocol (IP) addresses associated with locations (e.g., countries, regions, etc.) that may include malicious entities, a Ma/ware feed indicating a list of identified malicious files ( or hashes of files), an Infected Host feed indicating a list of entities (e.g., internal entities, such as client devices 215 of monitored network 210) that have been identified”, Col.15 lines 8-22: “security platform 230 may provide or transmit information associated with the threat. For example, security platform 230 may provide information to cause a user interface to present results of a deployment of a selected security policy to a selected enforcement device to mitigate a detected threat. Example results of the deployment may include a malware report or alert ( e.g., notifying a user of the presence or non-presence of malware) and/or threat information associated with the detected threat, such as threat type, affected or targeted devices, sources or origins of the threat, or the like. In some implementations, security platform 230 may provide information to an intended target of a threat ( e.g., a warning to avoid a particular CnC site, infected host, communication with a flagged Geo IP address, etc.).”)”, Col.8 lines 59-67- Col.9 lines 1-20: “In some implementations, the content of the network topology information may include a number of devices 215, 217 in monitored network 210, communication link information indicating communication links between devices 215, 217 in monitored network 210 (e.g., indicating neighbor relationships between the devices 215, 217), location information of devices 215, 217 in monitored network 210 (e.g., physical location information, such as geographical information, site information, or rack/chassis location information, and/or logical information, such as the location within monitored network 210 relative to other devices of monitored network 210), port and/or socket information associated with communication links between devices 215, 217 in monitored network 210, or the like. The content of the device capability information for devices 215, 217 of monitored network 210 may include device type information of devices 215, 217 in monitored network 210 (e.g., a switch, a router, a gateway, an internal segmentation firewall, a perimeter firewall, an IPS, an IDS, etc.), functionality of devices 215, 217 in monitored network 210 (e.g., a list of the functions that devices 215, 217 are capable of performing), model information associated with devices 215, 217 (e.g., a model name, a model identifier, such as a serial number, or the like), communication protocols of devices 215, 217, bandwidth capabilities of devices 215, 217 (e.g., total bandwidth and/or available bandwidth), capacity of devices 215, 217, current security policies deployed to devices 215, 217, or the like.”); and
Kumar appear do not explicitly teach however, INOUE teaches
based at least in part on the geolocation of the user associated with the compromised computing device and a second geolocation of a second site of the group of sites indicating that the second site is not co-located with the compromised computing device, refraining from advertising the dynamic list and the data policy to the second site advertising the dynamic list and the data policy to the second site (See INOUE par.0051: “the client machines 803 and 811 implement the anti-malware software 104 and a client processing unit 814…The client machines 803 and 811 of the present embodiment further implement a GPS terminal 805. The GPS terminal 805 may be provided externally to the client machine 803. The GPS terminal 805 acquires physical position information (latitude, longitude, and height) of the client machines 803 and 811.” Par.0052: “The client processing unit 814 provides a user information transmission function, a position information processing function, a malware detection information transmission function, and a network control function, through the execution of a program by the CPU. The functions are the same as those of the first embodiment with the exception of the position information processing function. The position information processing function, in accordance with a request for position information, acquires the current position information from the GPS terminal 805, and transmits the current position information to the source of the request (management server 806).”, par.0054-0055 “The position information management function, upon reception of position information from the client machines 803 and 811, registers the received position information in the user database 807. The position information management function, when GPS information output from the GPS terminal 805 is received as position information as is, converts the GPS information as the physical position information into managerial position information…the server processing unit 815 of the management server 806, upon reception of malware detection information, extracts C&C server information from the malware detection information. The server processing unit 815 also searches data 810 in the security policy database 809 on the basis of the current time for policy delivery. In this case, the management server 806 selects a combination of a security policy candidate and position information that is registered with respect to the combination of affiliation and position associated with the current time. The management server 806 also compares the position information of the selected combination with the received position information, and determines a security policy corresponding to the combination including the matching position information as the security policy to be applied to the relevant user.”, furthermore par.0067-0071: “The server processing unit 815 receives malware detection information from the client machine 803…The server processing unit 815 then transmits a position information acquisition request to the client machines 803 and 811 (step 1202). That is, the server processing unit 815 transmits the position information acquisition request not only to the client machine 803 that has detected malware infection, but to all of the client machines being managed…The server processing unit 815 then searches the policy database 809 on the basis of the current time for policy delivery, and selects a combination of a security policy (operation 1005 during policy application) registered with respect to the user having the time 1003 including the current time, and the position information. The server processing unit 815 compares the position information 1004 of the user corresponding to the security policy selected in step 1205 with the position information 905 registered in the user database 807, and identifies the attribute and security policy of the matching user (i.e., the user who satisfies the conditions of both time 1003 and position information 1004). Further, the server processing unit 815 determines from the user database 807 the IP address of the user corresponding to the identified attribute and position information 905…the server processing unit 815 transmits the corresponding security policy and C&C server information to the determined IP address” Examiner construe that the management server (controller) sends the dynamic list and policy only to relevant user and refraining from advertising it to not relevant user which is consistent with applicant’s instant application definition of advertising the dynamic list and policy [par:0025] “Advertising the dynamic list and the data policy to at least one of the plurality of sites may be based on a geolocation of the compromised computing device, based on a site list, based on user-defined criteria, and combinations thereof.”).
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to combine Kumar teaching “Security platform 230 includes one or more devices capable of detecting a threat to monitored network 210 and/or cloud computing environment 220 and/or providing security services over monitored network 210 and/or cloud computing environment 220. In some implementations, security platform 230 may determine threat information associated with the threat and select a security policy and/or an enforcement device to mitigate the threat. In some implementations, security platform 230 may include, may be included within, or may be implemented by a software
defined secure network (SDSN).”, (see Kumar Col. 6 lines 16-26), with INOUE teaching because INOUE teaching of, “The GPS terminal 805 acquires physical position information (latitude, longitude, and height) of the client machines 803 and 811… The position information management function, upon reception of malware detection information, requests the current position information from the client machines 803 and 811. The position information management function, upon reception of position information from the client machines 803 and 811, registers the received position information in the user database 807.”, (see INOUE par.0051 and 0054). The reason to combined would have been to pin point based on the location (GPS) of the client terminal or user that needs the data policy and dynamic list.
Claim 10 is a computer-readable medium claim reciting the same reasons as set forth in the rejections of claim 1 respectively. Therefore, claim 10 is rejected for the same reasons as set forth in the rejections of claim 1. (see Kumar Col.1 lines 29-38: “a non-transitory computer-readable medium storing instructions, the instructions comprising one or more instructions that, when executed by one or more processors,”).
Regarding claim 4 Kumar in view of INOUE disclose the method of claim 1, Kumar further teaches wherein the dynamic list comprises an IP address, a port, an application name, a security group tag (SGT), a username, or combinations thereof that are associated with the compromised computing device. (See Kumar Col.10 lines 1-20: “security platform 230 may receive threat notifications from a Command and Control (CnC) feed indicating a list of identified malicious entities, a Geographical Internet Protocol (Geo IP) feed indicating a list of locations and/or internet protocol (IP) addresses associated with locations (e.g., countries, regions, etc.) that may include malicious entities, a Malware feed indicating a list of identified malicious files ( or hashes of files), an Infected Host feed indicating a list of entities (e.g., internal entities, such as client devices 215 of monitored network 210) that have been identified as infected with malware, a Distributed Denial of Service (DDoS) feed indicating a list of malicious entities ( e.g., external entities) that may be attacking or attempting to attack a device 215, 217 of monitored network 210,”).
Regarding claim 7 Kumar in view of INOUE disclose the method of claim 1, Kumar further teaches wherein the user context comprises a username associated with the compromised computing device, a quarantine virtual private network (VPN) associated with the compromised computing device, or combinations thereof. (See Kumar Col. 10 lines: 1-16: “security platform 230 may detect a threat to monitored network 210 and/or cloud computing environment 220 using one or more threat feeds from a threat detection system. For example, security platform 230 may receive threat notifications from a Command and Control (CnC) feed indicating a list of identified malicious entities, a Geographical Internet Protocol (Geo IP) feed indicating a list of locations and/or internet protocol (IP) addresses associated with locations (e.g., countries, regions, etc.) that may include malicious entities, a Malware feed indicating a list of identified malicious files ( or hashes of files), an Infected Host feed indicating a list of entities (e.g., internal entities, such as client devices 215 of monitored network 210) that have been identified as infected with malware,”).
Claims 5, 6, 9, and 12-14 are rejected under 35 U.S.C. 103 as being unpatentable over Kumar in view of INOUE as applied to claim 1, in further view of Dods et al.(US-11902330-B1 hereafter Dods).
Regarding claim 5 Kumar in view of INOUE disclose the method of claim 1, Kumar in view of INOUE do not explicitly teach however Dods teaches wherein the data policy comprises:
pre-crafted rules matching the dynamic list (see Dods Col. 5 lines 52-64: “the machine learning model may generate the security policy by identifying one or more security rules to be implemented by one or more of the network devices and/or one or more of the other endpoint devices. security rules that may be included in the security policy include a security rule that causes the user identity data to be added to a traffic feed of the compromised endpoint device and/or to be associated with a tag and/or metadata; a security rule that causes a network address of the compromised endpoint device to be added to a traffic feed of the compromised endpoint device and/or to be associated with a tag and/or metadata;”); and
at least one action to take based on the pre-crafted rules. (See Dods Col. 6 lines 13-15: “security rule that causes one or more of the network devices to perform an action;”, Col. 7 lines 7-9: “actions include the security system adding the user identity data associated with the compromised endpoint device to a blacklist.”).
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to combine Kumar in view of INOUE teaching of claim 1 with Dods teaching “when utilizing the data identifying malicious behavior, the user identity data, and the endpoint device data to generate the security policy, the security system may generate a security rule for the security policy that causes the user identity data associated with the compromised endpoint device to be added to a traffic feed of the compromised endpoint device; may generate a security rule for the security policy that temporarily adds the user identity data associated with the compromised endpoint device to a blacklist and causes the blacklist to be propagated to the network devices and the other endpoint devices”, (see Dods Col.5 lines 21-31).
Regarding claim 6 Kumar in view of INOUE disclose the method of claim 1, Kumar in view of INOUE do not explicitly teach however Dods teaches further comprising tracking malicious activity metrics for the sites based on at least one parameter, wherein the at least one parameter comprises activity over a period of time, percentage of infected computing devices at the sites, or combinations thereof. (See Dods Col. 6 lines 33-46: “the security system may train the machine learning model, with historical data, to identify security rules (or the machine learning model determines confidence scores for security rules and/or identifies top scoring security rules) for a current malicious behavior situation (e.g., associated with the traffic of the compromised endpoint device, the endpoint device data, and the network device data). The historical data may include data identifying malicious behavior exhibited by compromised endpoint devices; data identifying effects of the malicious behavior on networks, network devices, and/or other endpoint devices; historical traffic associated with compromised endpoint devices; historical endpoint device data; historical network device data; historical topology data;”).
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to combine Kumar in view of INOUE teaching of claim 1 with Dods teaching “a security system that generates a network security policy based on a user identity associated with malicious behavior. For example, the security system may receive data identifying malicious behavior by a compromised endpoint device associated with a network and may receive user identity data identifying a user of the compromised endpoint device associated with the network. The security system may receive endpoint device data identifying the compromised endpoint device and other endpoint devices associated with the network”, (see Dods Col.5 lines 21-31).
Claim 13 is a computer-readable medium claim reciting the same reasons as set forth in the rejections of claim 6 respectively. Therefore, claim 13 is rejected for the same reasons as set forth in the rejections of claim 6.
Regarding claim 9 Kumar in view of INOUE disclose the method of claim 1, Kumar in view of INOUE do not explicitly teach however Dods teaches wherein advertising the dynamic list and the data policy to at least one of the sites is based on a site list, based on user-defined criteria, or combinations thereof. (See Dods Col. 5 lines 57- col. 6 lines 1-6: “security rules that may be included in the security policy include a security rule that causes the user identity data to be added to a traffic feed of the compromised endpoint device... a security rule that temporarily adds the use identity data and/or the network address of the compromised endpoint device to a blacklist and causes the blacklist to be propagated to the network devices and/or the other endpoint devices based on network addresses of the network devices and the other endpoint devices.”).
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to combine Kumar in view of INOUE teaching of claim 1 with Dods teaching “a security rule that utilizes the user identity data to prevent the compromised endpoint device from accessing the network; a security rule that modifies security rules associated with the network devices; a security rule that modifies intrusion prevention system rules associated with the network; a security rule that notifies one or more of the network devices of the compromised endpoint device”, (see Dods Col.6 lines 7-13).
Claim 14 is a computer-readable medium claim reciting the same reasons as set forth in the rejections of claim 9 respectively. Therefore, claim 14 is rejected for the same reasons as set forth in the rejections of claim 9.
Regarding claim 12 Kumar in view of INOUE disclose the non-transitory computer-readable medium of claim 10, Kumar further teaches
wherein:
the dynamic list comprises an IP address, a port, an application name, a security group tag (SGT), a username, or combinations thereof that are associated with the compromised computing device; (See Kumar Col.10 lines 1-20: “security platform 230 may receive threat notifications from a Command and Control (CnC) feed indicating a list of identified malicious entities, a Geographical Internet Protocol (Geo IP) feed indicating a list of locations and/or internet protocol (IP) addresses associated with locations (e.g., countries, regions, etc.) that may include malicious entities, a Malware feed indicating a list of identified malicious files ( or hashes of files), an Infected Host feed indicating a list of entities (e.g., internal entities, such as client devices 215 of monitored network 210) that have been identified as infected with malware, a Distributed Denial of Service (DDoS) feed indicating a list of malicious entities ( e.g., external entities) that may be attacking or attempting to attack a device 215, 217 of monitored network 210,”), and
Kumar in view of INOUE do not explicitly teach however Dods teaches
the data policy comprises:
pre-crafted rules matching the dynamic list; (see Dods Col. 5 lines 52-64: “the machine learning model may generate the security policy by identifying one or more security rules to be implemented by one or more of the network devices and/or one or more of the other endpoint devices. security rules that may be included in the security policy include a security rule that causes the user identity data to be added to a traffic feed of the compromised endpoint device and/or to be associated with a tag and/or metadata; a security rule that causes a network address of the compromised endpoint device to be added to a traffic feed of the compromised endpoint device and/or to be associated with a tag and/or metadata;”), and
at least one action to take based on the pre-crafted rules. (See Dods Col. 6 lines 13-15: “security rule that causes one or more of the network devices to perform an action;”, Col. 7 lines 7-9: “actions include the security system adding the user identity data associated with the compromised endpoint device to a blacklist.”).
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to combine Kumar in view of INOUE teaching of claim 10 with Dods teaching “The security system may identify a malicious behavior associated with an endpoint device connected to a network and may identify user identity data ( e.g., an email address, an active directory usemame, a username, a token, and/or the like) associated with the endpoint device”, (see Dods Col.3 lines 7-12).
Claim 8 is rejected under 35 U.S.C. 103 as being unpatentable over Kumar in view of INOUE as applied to claim 1, in further view of Valluri et al. (“20200177606”, hereafter Valluri).
Regarding claim 8 Kumar in view of INOUE disclose the method of claim 1, Kumar in view of INOUE appear to be silence however Valluri teaches wherein the threat context is advertised to the controller via overlay management protocol (OMP).
However, Valluri explicitly teaches wherein the threat context is advertised to the controller via overlay management protocol (OMP). (See Valluri par. 0040: “Threats can be detected by the locally-implemented security services 103, where a threat signature 105 can be sent upstream via an upstream OMP message 107a to the network controller appliances 132. The network controller appliances 132 can add the threat signature 105 (may be specific to the enterprise it is serving) and can push the threat signature 105 downstream via a downstream OMP message 107b propagating
to other edge network devices 142b. The upstream and downstream OMP messages 107a, 107 can be new message types in an address family in the OMP messages.”
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to combine Kumar in view of INOUE teaching of claim 1 with Valluri teaching “OMP messages/updates can include new category of messages for Security and DNS threat is a sub-category of Security. The threat signature 105 detected by the edge network device 142a, 302A and 302B (collectively, 302) may be transmitted back and forth between the network controller appliance 132 and the edge network devices 142A and 142B, respectively.”, (see Valluri par. 0045).
Claim 2 is rejected under 35 U.S.C. 103 as being unpatentable over Kumar et al. (US-10771506-B1 hereafter Kumar), in view of INOUE as applied to claim 1, in further view of Mani et al. (US-20200053169-A1 hereafter Mani), in further view of Pularikkal et al. (US-20210075799-A1 hereafter Pularikkal), in further view of Dods-2 et al. (US-10972508 B1 hereafter Dods-2).
Regarding claim 2 Kumar in view of INOUE disclose the method of claim 1, Kumar in view of INOUE appear to be silence however Mani teaches wherein determining the user comprises fetching a user identity from an identity services engine (ISE), the method (see Mani par.0040: “identifying information of the service device, such as MAC address, IP address, or other identities or metadata like username, serial number, device identity (ID), device make and model, and so on, may be obtained from the service device and exchanged with an authentication services (e.g., an identity services engine or “ISE”).”).
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to combine Kumar in view of INOUE teaching of claim 1 and Mani teaching “where the trusted participant (e.g., edge switch) authenticates the device. In this "pre-provisioning" stage, authentication may take place using one or more of a variety of authentication protocols, such as IEEE 802.lX (dotlx), MAC authentication bypass (MAB), and web authentication (WebAuth). For instance, identifying information of the service device, such as MAC address, IP address, or other identities or metadata like usemame, serial number, device identity (ID), device make and model, and so on, may be obtained from the service device and exchanged with an authentication services ( e.g., an identity services engine or "ISE")”.
Kumar in view of INOUE, and Mani appear to be silence however Pularikkal teaches
notifying the ISE of the compromised computing device (see Pularikkal par.0046: Information regarding application flows classified as anomalous is sent (412) to Identity Services Engine 110 as an anomaly notification,").
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to combine Kumar in view of INOUE, and mani teaching described above with Pularikkal teaching “Anomalous flows are handled by Identity Services Engine 110, which applies change of authorization policies to restrict the incoming application flow. These change of authorization policies take into account user context, device context, and application context.”, (see Pularikkal par.0029).
Kumar in view of INOUE, Mani and Pularikkal appear to be silence however Dods-2 teaches
Dods-2 teaches: registering, with the ISE, changes to an IP address for the compromised computing device. (See Dods-2 Col. 6 lines 54-57: “the security platform may add an address ( e.g., an IP address) of the compromised endpoint device to a blacklist so that the compromised endpoint device may be prevented from accessing the network and/or the other endpoint devices.”).
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to combine Kumar in view of INOUE, Mani and Pularikkal teaching described above with Dods-2 teaching "adding an address (e.g., an IP address) of the compromised endpoint device to a blacklist. In this way, the compromised endpoint device may be prevented from spreading the malicious behavior to the network.", (see Dods-2Col. 6 lines 53-59).
Claims 3 and 11 are rejected under 35 U.S.C. 103 as being unpatentable over Kumar in view of INOUE, Mani, Pularikkal and Dods-2 as applied to claim 2, in further view of Voit et al. (“US-20180139240-A1” hereafter Voit).
Regarding claim 3 Kumar in view of INOUE, Mani, Pularikkal, and Dods-2 disclose the method of claim 2, Kumar in view of INOUE, Mani, Pularikkal, and Dods-2 appear to be silence however Voit teaches
further comprising, based at least in part on the IP address of the compromised computing device changing to a new IP address, updating the dynamic list to include the new IP address. (See Voit par. 0020: “The central security application 105 has a list of potential attackers (from the service 110) and a list of potential intrusion events/attacks (from the host alerts 150 and network alerts 152) that may identify an attacker. The central security application 105 builds a list, identified in FIG. 1 as the ephemeral access control list (ACL) 170, which identifies one or more attackers that should be addressed in the network 115…”). Par. 0021: “The central security application 105 sends information describing the list 170 to the security application 120, for example. The list 170 serves as a dynamic filter that is maintained by the security application 120, and only a subset of the list 170 is downloaded to the equipment in the network 115.”. Par. 0021: “the security policy for that route can be brought down into the network (e.g., to one or more of network devices 140, 142 and 144) from the list 170 maintained by the security application 120.”. Par. 0022: “The security policy for the threat that is known in the network 115 ("y.y.y.y") is downloaded from the list 170 to network device 140, as an example. In general, as routing changes occur, security policies are downloaded and applied only for traffic which might come from a domain where an attack vector is known to exist.”. Examiner interpret that the central security application built and change the list 170 of potential attackers as the dynamic list that is being updated with attacker information. The routing changes occur and applied for traffic that might come from domain where an attack is known. Is being interpret as the change of IP address.
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to combine the Kumar in view of INOUE, Mani, Pularikkal, and Dods-2 of claim 2 with Voit teaching “a dynamic routing and/or forwarding information (e.g., a route advertisement) results in modification of a filter against a global list (the list 170) maintained by the security application 120.” to properly update using IP address (see Voit par.0025).
Regarding claim 11 Kumar in view of INOUE disclose the non-transitory computer-readable medium of claim 10, Kumar in view of INOUE appear to be silence however Mani teaches wherein determining the user comprises fetching a user identity from an identity services engine (ISE) (see Mani par.0040: “identifying information of the service device, such as MAC address, IP address, or other identities or metadata like username, serial number, device identity (ID), device make and model, and so on, may be obtained from the service device and exchanged with an authentication services (e.g., an identity services engine or “ISE”).”),
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to combine Kumar in view of INOUE teaching of claim 10 with Mani teaching “where the trusted participant (e.g., edge switch) authenticates the device. In this "pre-provisioning" stage, authentication may take place using one or more of a variety of authentication protocols, such as IEEE 802.lX (dotlx), MAC authentication bypass (MAB), and web authentication (WebAuth). For instance, identifying information of the service device, such as MAC address, IP address, or other identities or metadata like usemame, serial number, device identity (ID), device make and model, and so on, may be obtained from the service device and exchanged with an authentication services ( e.g., an identity services engine or "ISE")”
Kumar in view of INOUE and Mani appear to be silence however Pularikkal teaches
the operations further comprising:
notifying the ISE of the compromised computing device (see Pularikkal par.0046: Information regarding application flows classified as anomalous is sent (412) to Identity Services Engine 110 as an anomaly notification,");
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to combine Kumar in view of INOUE, and Mani teaching described above with Pularikkal teaching “Anomalous flows are handled by Identity Services Engine 110, which applies change of authorization policies to restrict the incoming application flow. These change of authorization policies take into account user context, device context, and application context.”, (see Pularikkal par.0029).
Kumar in view of INOUE, Mani and Pularikkal appear to be silence however Dods-2 teaches
registering, with the ISE, changes to an IP address for the compromised computing device (see Dods-2 Col. 6 lines 54-57: “the security platform may add an address ( e.g., an IP address) of the compromised endpoint device to a blacklist so that the compromised endpoint device may be prevented from accessing the network and/or the other endpoint devices.”); and
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to combine Kumar in view of INOUE, Mani, and Pularikkal teaching described above with Dods-2 teaching "adding an address (e.g., an IP address) of the compromised endpoint device to a blacklist. In this way, the compromised endpoint device may be prevented from spreading the malicious behavior to the network.", (see Dods-2Col. 6 lines 53-59).
Kumar in view of INOUE, Mani, Pularikkal, and Dods-2 appear to be silence however Voit teaches
based at least in part on the IP address of the compromised computing device changing to a new IP address, updating the dynamic list to include the new IP address. (See Voit par. 0020: “The central security application 105 has a list of potential attackers (from the service 110) and a list of potential intrusion events/attacks (from the host alerts 150 and network alerts 152) that may identify an attacker. The central security application 105 builds a list, identified in FIG. 1 as the ephemeral access control list (ACL) 170, which identifies one or more attackers that should be addressed in the network 115…”). Par. 0021: “The central security application 105 sends information describing the list 170 to the security application 120, for example. The list 170 serves as a dynamic filter that is maintained by the security application 120, and only a subset of the list 170 is downloaded to the equipment in the network 115.”. Par. 0021: “the security policy for that route can be brought down into the network (e.g., to one or more of network devices 140, 142 and 144) from the list 170 maintained by the security application 120.”. Par. 0022: “The security policy for the threat that is known in the network 115 ("y.y.y.y") is downloaded from the list 170 to network device 140, as an example. In general, as routing changes occur, security policies are downloaded and applied only for traffic which might come from a domain where an attack vector is known to exist.”. Examiner interpret that the central security application built and change the list 170 of potential attackers as the dynamic list that is being updated with attacker information. The routing changes occur and applied for traffic that might come from domain where an attack is known. Is being interpret as the change of IP address.
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to combine Kumar in view of INOUE, Mani, Pularikkal, and Dods-2 teaching described above with Voit teaching “a dynamic routing and/or forwarding information ( e.g., a route advertisement) results in modification of a filter against a global list (the list 170) maintained by the security application 120.”, (see Voit par.0025).
Claims 15 and 18 - 20 are rejected under 35 U.S.C. 103 as being unpatentable over Dods et al.(US-11902330-B1 hereafter Dods), Kumar et al. (US-10771506-B1 hereafter Kumar), in further view of INOUE et al. (US-20180241758-A1 hereafter INOUE).
Regarding claim 15 Dods teaches a controller comprising:
a processor; (see Dods Col. 13 lines 25-28: “Controller 440 includes a processor in the form of, for example, a CPU, a GPU, an APU, a microprocessor, a microcontroller, a DSP, an FPGA, an ASIC, and/or another type of processor. The processor is implemented in hardware, firmware, or a combination of hardware and software.”), and
a non-transitory computer-readable media storing instructions that, when executed by the processor, causes the processor to perform operations comprising: (see Dods Col. 13 lines 49-53: “Controller 440 may perform these processes in response to executing software instructions stored by a non-transitory computer-readable medium. A computer readable medium is defined herein as a non-transitory memory device.”, lines 59-62: “When executed, software instructions stored in a memory and/or storage component associated with controller 440 may cause controller 440 to perform one or more processes described herein.”),
Dods does not explicitly teach however Kumar teaches
receiving a threat context of a compromised computing device associated with a security event generated by a unified security policy from a group of sites within a network; (see Kumar Col.1 lines 19-26: “receive network topology information of a network and device capability information corresponding to capabilities of devices in the network; detect a threat to an affected device of the network; determine threat information associated with the threat; select a security policy to mitigate the threat based on the threat information;”, see Kumar Col.10 lines 1-20: “security platform 230 may detect a threat to monitored network 210 and/or cloud computing environment 220 using one or more threat feeds from a threat detection system. For example, security platform 230 may receive threat notifications from a Command and Control (CnC) feed indicating a list of identified malicious entities, a Geographical Internet Protocol (Geo IP) feed indicating a list of locations and/or internet protocol (IP) addresses associated with locations (e.g., countries, regions, etc.) that may include malicious entities, a Malware feed indicating a list of identified malicious files ( or hashes of files), an Infected Host feed indicating a list of entities (e.g., internal entities, such as client devices 215 of monitored network 210) that have been identified as infected with malware, a Distributed Denial of Service (DDoS) feed indicating a list of malicious entities ( e.g., external entities) that may be attacking or attempting to attack a device 215, 217 of monitored network 210, or the like. A malicious entity may be a device that intends to spread malware.”, Col. 10 lines 25-28: “security platform 230 may detect a threat to monitored network 210 to enable security platform 230 to determine threat information associated with the threat to mitigate the threat.”);
determining, based at least in part on the threat context, a user associated with the compromised computing device, the user being associated with a user context, at least partially including a geolocation of the user (Kumar see Kumar Col.10 lines 1-20: “security platform 230 may detect a threat to monitored network 210 and/or cloud computing environment 220 using one or more threat feeds from a threat detection system. For example, security platform 230 may receive threat notifications from a Command and Control (CnC) feed indicating a list of identified malicious entities, a Geographical Internet Protocol (Geo IP) feed indicating a list of locations and/or internet protocol (IP) addresses associated with locations (e.g., countries, regions, etc.) that may include malicious entities, a Malware feed indicating a list of identified malicious files ( or hashes of files), an Infected Host feed indicating a list of entities (e.g., internal entities, such as client devices 215 of monitored network 210) that have been identified as infected with malware, a Distributed Denial of Service (DDoS) feed indicating a list of malicious entities ( e.g., external entities) that may be attacking or attempting to attack a device 215, 217 of monitored network 210, or the like. A malicious entity may be a device that intends to spread malware.”, Col. 10 lines 25-28: “security platform 230 may detect a threat to monitored network 210 to enable security platform 230 to determine threat information associated with the threat to mitigate the threat.”, Col.15 lines 8-22: “security platform 230 may provide or transmit information associated with the threat. For example, security platform 230 may provide information to cause a user interface to present results of a deployment of a selected security policy to a selected enforcement device to mitigate a detected threat. Example results of the deployment may include a malware report or alert ( e.g., notifying a user of the presence or non-presence of malware) and/or threat information associated with the detected threat, such as threat type, affected or targeted devices, sources or origins of the threat, or the like. In some implementations, security platform 230 may provide information to an intended target of a threat ( e.g., a warning to avoid a particular CnC site, infected host, communication with a flagged Geo IP address, etc.).”);
provisioning a dynamic list and a data policy matching the dynamic list (see Kumar Col.15 lines 55-67 – Col.16 lines 1-10: “security platform 525 may detect a threat using cloud threat feeds 535 and/or custom threat feeds 545. Cloud threat feeds 535 may be threat feeds that are available to networks in communication with a cloud computing environment (e.g., cloud computing environment 220). Custom threat feeds 545 may be threat feeds that are specific to a particular monitored network (e.g., when particular threats are known to be present in a monitored network 210, when particular devices of a monitored network 210 are known to be infected, or the like). Accordingly, security platform 230 may use cloud threat feeds 535 and custom threat feeds 545 to detect threats and receive threat information. Using the threats and threat information from cloud threat feeds 535 and custom threat feeds 545, security platform 525 may deploy security policies to enforcement devices 517. According to some implementations herein, security platform 525 may deploy the security policies to enforce the security policies based on the types of threats and capabilities of the enforcement devices 517 (which may include the location of the enforcement devices 517 within a topology of a network, the location of the enforcement devices 517 relative to a location of a threat, or the like.”);
propagating the user context into the dynamic list referenced under the data policy (see Kumar Col.11 lines 59-67: “security platform 230 may select the security policy and/or the enforcement device based on which threat feed (e.g., which of the CnC feed, the Geo IP feed, the malware feed, the infected host feed, the DDoS feed, etc.) detected the threat and/or provided information on the threat. Security platform 230 may use the network topology information and the device capability information to select the enforcement device to enforce a selected security policy.”, Col.16 lines 1-10: “Using the threats and threat information from cloud threat feeds 535 and custom threat feeds 545, security platform 525 may deploy security policies to enforcement devices 517. According to some implementations herein, security platform 525 may deploy the security policies to enforce the security policies based on the types of threats and capabilities of the enforcement devices 517 (which may include the location of the enforcement devices 517 within a topology of a network, the location of the enforcement devices 517 relative to a location of a threat, or the like);
based at least in part on the geolocation of the user associated with the compromised computing device and a first geolocation of a first site of the group of sites indicating that the first site is co-located with the compromised computing device, advertising the dynamic list and the data policy to the first site (see Kumar Col. 10 lines: 1-16: "security platform 230 may detect a threat to monitored network 210 and/or cloud computing environment 220 using one or more threat feeds from a threat detection system. For example, security platform 230 may receive threat notifications from a Command and Control (CnC) feed indicating a list of identified malicious entities, a Geographical Internet Protocol (Geo IP) feed indicating a list of locations and/or internet protocol (IP) addresses associated with locations (e.g., countries, regions, etc.) that may include malicious entities, a Ma/ware feed indicating a list of identified malicious files ( or hashes of files), an Infected Host feed indicating a list of entities (e.g., internal entities, such as client devices 215 of monitored network 210) that have been identified”, Col.15 lines 8-22: “security platform 230 may provide or transmit information associated with the threat. For example, security platform 230 may provide information to cause a user interface to present results of a deployment of a selected security policy to a selected enforcement device to mitigate a detected threat. Example results of the deployment may include a malware report or alert ( e.g., notifying a user of the presence or non-presence of malware) and/or threat information associated with the detected threat, such as threat type, affected or targeted devices, sources or origins of the threat, or the like. In some implementations, security platform 230 may provide information to an intended target of a threat ( e.g., a warning to avoid a particular CnC site, infected host, communication with a flagged Geo IP address, etc.).”)”, Col.8 lines 59-67- Col.9 lines 1-20: “In some implementations, the content of the network topology information may include a number of devices 215, 217 in monitored network 210, communication link information indicating communication links between devices 215, 217 in monitored network 210 (e.g., indicating neighbor relationships between the devices 215, 217), location information of
devices 215, 217 in monitored network 210 (e.g., physical location information, such as geographical information, site information, or rack/chassis location information, and/or logical information, such as the location within monitored network 210 relative to other devices of monitored network 210), port and/or socket information associated with communication links between devices 215, 217 in monitored network 210, or the like. The content of the device capability information for devices 215, 217 of monitored network 210 may include device type information of devices 215, 217 in monitored network 210 (e.g., a switch, a router, a gateway, an internal segmentation firewall, a perimeter firewall, an IPS, an IDS, etc.), functionality of devices 215, 217 in monitored network 210 (e.g., a list of the functions that devices 215, 217 are capable of performing), model information associated with devices 215, 217 (e.g., a model name, a model identifier, such as a serial number, or the like), communication protocols of devices 215, 217, bandwidth capabilities of devices 215, 217 (e.g., total bandwidth and/or available bandwidth), capacity of devices 215, 217, current security policies deployed to devices 215, 217, or the like.”); and
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to combine Dods teaching “the security system may store the user identity data, the data identifying the malicious behavior, the traffic associated with the compromised endpoint device, the endpoint device data, and/or the network device data in a data structure (e.g., a database, a table, a list, and/or the like) associated with the security system. The security system may store such data so that the security system may process such data to generate a security policy to isolate the compromised endpoint device.”, (see Dods Col.4 lines: 57-65) with Kumar teaching “Security platform 230 includes one or more devices capable of detecting a threat to monitored network 210 and/or cloud computing environment 220 and/or providing security services over monitored network 210 and/or cloud computing environment 220. In some implementations, security platform 230 may determine threat information associated with the threat and select a security policy and/or an enforcement device to mitigate the threat. In some implementations, security platform 230 may include, may be included within, or may be implemented by a software defined secure network (SDSN).”, (see Kumar Col. 6 lines 16-26).
Dods in view of Kumar do not explicitly teach however INOUE teaches
based at least in part on the geolocation of the user associated with the compromised computing device and a second geolocation of a second site of the group of sites indicating that the second site is not co-located with the compromised computing device, refraining from advertising the dynamic list and the data policy to the second site advertising the dynamic list and the data policy to the second site (See INOUE par.0051: “the client machines 803 and 811 implement the anti-malware software 104 and a client processing unit 814…The client machines 803 and 811 of the present embodiment further implement a GPS terminal 805. The GPS terminal 805 may be provided externally to the client machine 803. The GPS terminal 805 acquires physical position information (latitude, longitude, and height) of the client machines 803 and 811.” Par.0052: “The client processing unit 814 provides a user information transmission function, a position information processing function, a malware detection information transmission function, and a network control function, through the execution of a program by the CPU. The functions are the same as those of the first embodiment with the exception of the position information processing function. The position information processing function, in accordance with a request for position information, acquires the current position information from the GPS terminal 805, and transmits the current position information to the source of the request (management server 806).”, par.0054-0055 “The position information management function, upon reception of position information from the client machines 803 and 811, registers the received position information in the user database 807. The position information management function, when GPS information output from the GPS terminal 805 is received as position information as is, converts the GPS information as the physical position information into managerial position information…the server processing unit 815 of the management server 806, upon reception of malware detection information, extracts C&C server information from the malware detection information. The server processing unit 815 also searches data 810 in the security policy database 809 on the basis of the current time for policy delivery. In this case, the management server 806 selects a combination of a security policy candidate and position information that is registered with respect to the combination of affiliation and position associated with the current time. The management server 806 also compares the position information of the selected combination with the received position information, and determines a security policy corresponding to the combination including the matching position information as the security policy to be applied to the relevant user.”, furthermore par.0067-0071: “The server processing unit 815 receives malware detection information from the client machine 803…The server processing unit 815 then transmits a position information acquisition request to the client machines 803 and 811 (step 1202). That is, the server processing unit 815 transmits the position information acquisition request not only to the client machine 803 that has detected malware infection, but to all of the client machines being managed…The server processing unit 815 then searches the policy database 809 on the basis of the current time for policy delivery, and selects a combination of a security policy (operation 1005 during policy application) registered with respect to the user having the time 1003 including the current time, and the position information. The server processing unit 815 compares the position information 1004 of the user corresponding to the security policy selected in step 1205 with the position information 905 registered in the user database 807, and identifies the attribute and security policy of the matching user (i.e., the user who satisfies the conditions of both time 1003 and position information 1004). Further, the server processing unit 815 determines from the user database 807 the IP address of the user corresponding to the identified attribute and position information 905…the server processing unit 815 transmits the corresponding security policy and C&C server information to the determined IP address” Examiner construe that the management server (controller) sends the dynamic list and policy only to relevant user and refraining from advertising it to not relevant user which is consistent with applicant’s instant application definition of advertising the dynamic list and policy [par:0025] “Advertising the dynamic list and the data policy to at least one of the plurality of sites may be based on a geolocation of the compromised computing device, based on a site list, based on user-defined criteria, and combinations thereof.”).
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to combine Dods in view of Kumar teaching described above with INOUE teaching because INOUE teaching of, “The GPS terminal 805 acquires physical position information (latitude, longitude, and height) of the client machines 803 and 811… The position information management function, upon reception of malware detection information, requests the current position information from the client machines 803 and 811. The position information management function, upon reception of position information from the client machines 803 and 811, registers the received position information in the user database 807.”, (see INOUE par.0051 and 0054). The reason to combined would have been to pin point based on the location (GPS) of the client terminal or user that needs the data policy and dynamic list.
Regarding claim 18, Dods in view of Kumar and INOUE teach the controller of claim 15, Dods further teaches wherein the data policy comprises:
pre-crafted rules matching the dynamic list (see Dods Col. 5 lines 52-64: “the machine learning model may generate the security policy by identifying one or more security rules to be implemented by one or more of the network devices and/or one or more of the other endpoint devices. security rules that may be included in the security policy include a security rule that causes the user identity data to be added to a traffic feed of the compromised endpoint device and/or to be associated with a tag and/or metadata; a security rule that causes a network address of the compromised endpoint device to be added to a traffic feed of the compromised endpoint device and/or to be associated with a tag and/or metadata;”); and
at least one action to take based on the pre-crafted rules. (See Dods Col. 6 lines 13-15: “security rule that causes one or more of the network devices to perform an action;”, Col. 7 lines 7-9: “actions include the security system adding the user identity data associated with the compromised endpoint device to a blacklist.”).
Regarding claim 19, Dods in view of Kumar and INOUE disclose the controller of claim 15, Dods further teaches the operations further comprising tracking malicious activity metrics for the sites based on at least one parameter, wherein the at least one parameter comprises activity over a period of time, percentage of infected computing devices at the sites, or combinations thereof. (See Dods Col. 6 lines 33-46: “the security system may train the machine learning model, with historical data, to identify security rules (or the machine learning model determines confidence scores for security rules and/or identifies top scoring security rules) for a current malicious behavior situation (e.g., associated with the traffic of the compromised endpoint device, the endpoint device data, and the network device data). The historical data may include data identifying malicious behavior exhibited by compromised endpoint devices; data identifying effects of the malicious behavior on networks, network devices, and/or other endpoint devices; historical traffic associated with compromised endpoint devices; historical endpoint device data; historical network device data; historical topology data;”).
Regarding claim 20 Dods in view of Kumar and INOUE disclose the controller of claim 15, Dods further teaches wherein advertising the dynamic list and the data policy to at least one of the sites is based on a site list, based on user-defined criteria, or combinations thereof. (See Dods Col. 5 lines 57- col. 6 lines 1-6: “security rules that may be included in the security policy include a security rule that causes the user identity data to be added to a traffic feed of the compromised endpoint device... a security rule that temporarily adds the use identity data and/or the network address of the compromised endpoint device to a blacklist and causes the blacklist to be propagated to the network devices and/or the other endpoint devices based on network addresses of the network devices and the other endpoint devices.”).
Claim 16 is rejected under 35 U.S.C. 103 as being unpatentable over Dods in view of Kumar and INOUE as applied to claim 15, in further view of Hooda et al. (US-20200177629-A 1 hereafter Hooda), in further view of Pularikkal et al. (US-20210075799-A1 hereafter Pularikkal), in further view of Dods-2 et al. (US-10972508 B1 hereafter Dods-2).
Regarding claim 16 Dods in view of Kumar and INOUE disclose the controller of claim 15, Dods in view of Kumar and INOUE do not explicitly teach however Hooda teaches wherein determining the user comprises fetching a user identity from an identity services engine (ISE), ( see Hooda par.0097: “a data center network controller, and databases and directories containing information for users, devices, things, policies, billing, and similar information to provide authentication, authorization, and accounting services. In this example, the AAA system 612 can function as the centralized authority for identity and access to the campus network 152 and the branch office 154. However, it will be appreciated that the AAA system 612 can also be co-located in the data center 150, the other sites 158, or other networks (e.g., a co-location center, a Cloud Service Provider network (e.g., IaaS, PaaS, SaaS, etc.) in other embodiments. The AAA system 612 can utilize various technologies, such as Remote Authentication Dial-In User Service (RADIUS), Diameter, and the like, to communicate with hosts, network devices, applications, and so on. An example of an implementation of the AAA system 612 is the Cisco® Identity Services Engine (ISE).” the operations further comprising:
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to combine Dods in view of Kumar and INOUE teaching of claim 15 with Hooda teaching “User identity, group or organizational identity, user location, client device type, and other contextual information regarding users can be shared across the network environment 600 via the AAA system 612.”, (see par.0029)
Dods in view of Kumar, INOUE and Hooda appear to be silence however Pularikkal teaches
notifying the ISE of the compromised computing device (see Pularikkal par.0046: Information regarding application flows classified as anomalous is sent (412) to Identity Services Engine 110 as an anomaly notification,");
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to combine Dods in view of Kumar, INOUE, and Hooda teaching described above with Pularikkal teaching “Anomalous flows are handled by Identity Services Engine 110, which applies change of authorization policies to restrict the incoming application flow. These change of authorization policies take into account user context, device context, and application context.”, (see Pularikkal par.0029).
Dods in view of Kumar, INOUE, Hooda and Pularikkal appear to be silence however Dods-2 teaches
registering, with the ISE, changes to an IP address for the compromised computing device. (See Dods-2 Col. 6 lines 54-57: “the security platform may add an address ( e.g., an IP address) of the compromised endpoint device to a blacklist so that the compromised endpoint device may be prevented from accessing the network and/or the other endpoint devices.”).
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to combine Dods in view of Kumar INOUE, Hooda and Pularikkal teaching described above with Dods-2 “a security system that generates a network security policy based on a user identity associated with malicious behavior.”, (see Dods-2 Col. 2 lines 54-56).
Claim 17 rejected under 35 U.S.C. 103 as being unpatentable over Dods in view of Kumar, INOUE, Hooda, Pularikkal, Dods-2 as applied to claim 16, in further view of Voit et al. (“US-20180139240-A1” hereafter Voit).
Regarding claim 17 Dods in view of Kumar INOUE, Hooda, Pularikkal and Dods-2 disclose the controller of claim 16, Dods in view of Kumar, INOUE, Hooda, Pularikkal and Dods-2 appear to be silence however Void teaches
based at least in part on the IP address of the compromised computing device changing to a new IP address: updating the controller with the new IP address (See Voit par. 0017: “system for the network 115 may be a Software-Defined Network (SDN) controller. For example, a (local) security application 120 running on the SDN controller 122 may receive response from the central security application 105 and locally perform filtering. The SDN controller 122 is a computing resource.”, par. 0020: “The central security application 105 has a list of potential attackers (from the service 110) and a list of potential intrusion events/attacks (from the host alerts 150 and network alerts 152) that may identify an attacker. The central security application 105 builds a list, identified in FIG. 1 as the ephemeral access control list (ACL) 170, which identifies one or more attackers that should be addressed in the network 115…”, Par. 0021: “The central security application 105 sends information describing the list 170 to the security application 120, for example. The list 170 serves as a dynamic filter that is maintained by the security application 120, and only a subset of the list 170 is downloaded to the equipment in the network 115.”). Examiner interpret that the list built by the applications 105 is being modified and send to the controller 122 for potential threat.); and
updating the dynamic list to include the new IP address. (See Voit Par. 0021: “the security policy for that route can be brought down into the network (e.g., to one or more of network devices 140, 142 and 144) from the list 170 maintained by the security application 120.”. Par. 0022: “The security policy for the threat that is known in the network 115 ("y.y.y.y") is downloaded from the list 170 to network device 140, as an example. In general, as routing changes occur, security policies are downloaded and applied only for traffic which might come from a domain where an attack vector is known to exist.”. Examiner interpret that the central security application built and change the list 170 of potential attackers as the dynamic list that is being updated with attacker information.
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the claimed invention was made to combine the teaching of Dods in view of Kumar INOUE, Hooda, Pularikkal, and Dods-2 of claim 16 with Voit teaching “The security policies associated with threats are filtered so that just current attack vectors from within subnets learned via the routing and/or forwarding information (at the network level of the network) are installed in the local ACL/policy database of the network devices. As routing changes occur, the list of applied policies are continually refined/revisited”, (see Voit par.0040).
Conclusion
The prior art made of record and not relied upon is considered pertinent to
applicant's disclosure:
Ptacek et al. (US-7596807-B2) in response to an attack, a control plane is used to instruct the access control devices to allow network communications between the compartments of the computer network based on a usage model describing legitimate.
Amidon et al. (US-10237287-B1) network communications while restricting other network communications between the compartments. Communication between a user computer and a destination computer is monitored by a security appliance. Selective information from the communication is extracted.
Robertson et al. (US-20190104144-A1) network threat detection system that looks at network flow data and adds meaning to it by matching each flow to network “zones” such as groups of devices. The system receives flow metadata like source IP, destination IP, ports, protocol, and timing, then builds a flow record from that data. It also receives zone definitions from other security or management systems, such as tags or group memberships, that identify which devices belong to which zone. Using those zone definitions, the system annotates the flow record with the source zone and destination zone. It also receives security policies that describe what kinds of communication are allowed or forbidden between zones. The annotated flow record is then compared against the policy to decide whether the flow indicates a security threat. If the policy is violated, the system can generate a notification or alarm.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to DUILIO MUNGUIA whose telephone number is (571)270-5277. The examiner can normally be reached M-F 9:30AM - 5:00Pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Eleni A Shiferaw can be reached at (571) 272-3867. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/DUILIO MUNGUIA/Examiner, Art Unit 2497
/ELENI A SHIFERAW/Supervisory Patent Examiner, Art Unit 2497
Prosecution Insights