DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendment / Arguments
Regarding claims rejected under 35 USC 101:
Applicant’s arguments, in view of the amended claim language, been fully considered and are persuasive. The rejection has been withdrawn.
Regarding claims rejected under 35 USC 103:
Applicant’s arguments, in view of the amended claim language, been fully considered and are persuasive. The rejection has been withdrawn.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention. Each of independent claims 1, 8, and 15 recites “wherein the component is selected from a group consisting of another PVP/orchestrator, a cloud tool, and an operating system rules tool” and “in response to the component being the operating system rules tool,” which renders the respective claims indefinite because it is not clear how to interpret the claims in the case where the component is another PVP/orchestrator or a cloud tool. “[I]n response to the component being the operating system rules tool” is considered to be a claim element drawn to a circumstance that has taken place within the claim scope (i.e., that the component is the operating system rules tool). As such, it is not clear how “the component is selected from a group consisting of another PVP/orchestrator, a cloud tool” because the claim is drawn to selection of the operating system rules tool having taken place.
The dependent claims do not rectify this issue and are therefore likewise rejected.
Dependent claims 4, 11, and 18 additionally recite “in response to the component being the another PVP/orchestrator, converting the policy into a policy profile; and in response to the component being the cloud tool, converting the policy into a cloud policy,” which renders these claims indefinite in view of the parent claim because the parent claim is already drawn to the component being the operating system rules tool.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-2, 4-9, 11-16, and 18-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Barry (US 10,691,493 B1) in view of Ferney (“Detection and Prevention of Firewall-Rule Conflicts on Software-Defined Networking”) and Ziring (“Specification for the Extensible Configuration Checklist Description Format (XCCDF) Version 1.1.4 (Draft)”).
Regarding claim 1, Barry discloses: A computer-implemented method, comprising operations for: under control of a Policy Validation Point (PVP)/orchestrator (interpreted as a component “that may act as a PVP, as an orchestrator or as both a PVP and an orchestrator” in view of the definition in [0036] of the instant specification) of a plurality of PVP/orchestrators in a policy assessor hierarchy, wherein the plurality of PVP/orchestrators are located at multiple, different levels, and
Refer to at least FIG. 2-5, Col. 16, Ll. 39-48&63-67, and Col. 18, Ll. 1-4 of Barry with respect to policy ingestion, distribution, and enforcement modules (e.g., Col. 4, Ll. 21-24 of Barry) in a hierarchical arrangement of a multi-layer infrastructure.
Refer to at least Col. 9, Ll. 60-Col. 10, Ll. 4 and Col. 17, Ll. 51-59 of Barry with respect to an example orchestrator performing policy enforcement (i.e., concerning the PVP-and-orchestrator aspect).
wherein a first PVP/orchestrator of the plurality of PVP/orchestrators at a higher-level of the policy assessor hierarchy has more granular controls than a second PVP/orchestrator of the plurality of PVP/orchestrators at a lower-level of the policy assessor hierarchy,
Refer to at least Col. 18, Ll. 47-56 of Barry with respect to policy granularity associated with different levels.
receiving a policy;
Refer to at least Col. 17, Ll. 51-59 and Col. 18, Ll. 11-19&50-56 of Barry with respect to defining policy, receiving policy, and policy ingestion (e.g., at a respective orchestrator of a given layer).
determining a compliance granularity of the policy to be sent to a component of a particular lower-level of the policy assessor hierarchy, wherein the component is selected from a group consisting of another PVP/orchestrator (e.g., Col. 9, Ll. 59-Col. 10, Ll. 8 of Barry), a cloud tool (e.g., Col. 8, Ll. 47-56 and Col. 9, Ll. 36-39 of Barry concerning components in FIG. 1: orchestrators, controllers, M&O);
Refer to at least Col. 7, Ll. 19-36, Col. 12, Ll. 26-29, Col. 14, Ll. 20-50, and Col. 18, Ll. 50-56 of Barry with respect to operational and application policies and associated granularity.
converting the policy based on the determined compliance granularity into a format understood by the component at the particular lower-level by:
converting an access enforcement control of the policy to one or more rules using a mapping of rules to controls;
Refer to at least Col. 13, Ll. 29-35, Col. 18, Ll. 41-46, Col. 18, Ll. 50-56, and Col. 17, Ll. 38-Col. 18, Ll. 26, and Col. 18, Ll. 50-56 of Barry with respect to policy translation from higher level policy to granular policy rules.
Barry discloses policy enforcement after translation (e.g., Col. 18, Ll. 41-50 of Barry), but does not specify: converting the one or more rules to one or more checks using a mapping of rules to checks; and executing the one or more checks on an executing service to determine that the access enforcement control is enforced; and returning a result based on the determination. However, Barry in view of Ferney discloses: converting the one or more rules to one or more checks using a mapping of rules to checks;
Refer to at least sections III.C and III.D of Ferney with respect to obtaining firewall rules and mapping to checks (e.g., “check Shadowing”).
and executing the one or more checks to determine that the access enforcement control is enforced; and returning a result based on the determination.
Refer to at least sections III.D and IV of Ferney with respect to performing the checks concerning rules in conflict.
The teachings of Barry and Ferney both concern network security and policy conversion, and are considered to be within the same field of endeavor and combinable as such.
Therefore it would have been obvious to one of ordinary skill in the art before the filing date of Applicant’s invention to modify the teachings of Barry to further implement mapping rules to checks and performing checks to identify proper policy enforcement for at least the purpose of maintaining proper functioning of network security tools.
Barry-Ferney does not specify: selection from the group further comprising an operating system rules tool; executing the one or more checks in response to the component being the operating system rules tool, under control of the component, on an executing service. However, Barr-Ferney in view of Ziring discloses: selection from the group further comprising an operating system rules tool; executing the one or more checks in response to the component being the operating system rules tool, under control of the component, on an executing service.
Refer to at least “Scenario 3” on page 3 of Ziring, where “users download the core checklist and the OS-specific extensions that apply to their installations, then run a checking tool to score their compliance with the checklist” for “a popular commercial server.”
The teachings of Ziring likewise concern network security and policy conversion, and are considered to be within the same field of endeavor and combinable as such.
Therefore it would have been obvious to one of ordinary skill in the art before the filing date of Applicant’s invention to modify the teachings of Barry-Ferney to further implement checking, e.g., a server for OS compliance because the substitution of one known element for another would have yielded predictable results to one of ordinary skill in the art at the time (i.e., the type of component controlled by the policy, and being checked for compliance).
Regarding claim 2, Barry-Ferney-Ziring discloses: The computer-implemented method of claim 1, wherein a specific exchange protocol is provided for communication between components at adjacent levels of the policy assessor hierarchy.
Refer to at least Col. 3, Ll. 40-67 of Barry with respect to example network protocols for communication between components.
Regarding claim 4, Barry-Ferney-Ziring discloses: The computer-implemented method of claim 1, wherein the operations further comprise: in response to the component being the another PVP/orchestrator, converting the policy into a policy profile; and
Refer to at least FIG. 17 and Col. 17, Ll. 62-67 of Barry with respect to converting policy between orchestrators and using templates/profiles.
in response to the component being the cloud tool, converting the policy into a cloud policy.
Refer to at least Col. 9, Ll. 21-25 and Col. 15, Ll. 56-Col. 16, Ll. 2 of Barry with respect to providing policy for cloud-based tools and enforcement.
Regarding claim 5, it is rejected for substantially the same reasons as claim 1 above (e.g., converting to more than one rule).
Regarding claim 6, it is rejected for substantially the same reasons as claim 1 above (e.g., converting to more than one check; conversion of multiple rules).
Regarding claim 7, it is rejected for substantially the same reasons as claim 1 above (e.g., Col. 9, Ll. 60-Col. 10, Ll. 4 and Col. 17, Ll. 51-59 of Barry).
Regarding independent claim 8, it is substantially similar to independent claim 1 above, and is therefore likewise rejected.
Regarding claims 9, 11-13, and 14, they are substantially similar to claims 2, 4-7 above. Claims 9, 11-12, and 14 are therefore likewise rejected.
Regarding independent claim 15, it is substantially similar to independent claim 1 above, and is therefore likewise rejected.
Regarding claims 16 and 18-13, they are substantially similar to claims 2 and 4-7 above. Claims 16 and 18-19 are therefore likewise rejected.
Claim(s) 3, 10, and 17 is/are rejected under 35 U.S.C. 103 as being unpatentable over Barry-Ferney-Ziring as applied to claims 1-2, 4-9, 11-16, and 18-20 above, and further in view of Tummala (US 2023/0359513 A1).
Regarding claim 3, Barry-Ferney-Ziring does not specify: wherein the operations further comprise: under the control of the PVP/orchestrator, receiving multiple results from one or more other PVPs/orchestrators at lower-levels of the policy assessor hierarchy; aggregating the multiple results; and returning the aggregated results. However, Barry-Ferney-Ziring in view of Tummala discloses: wherein the operations further comprise: under the control of the PVP/orchestrator, receiving multiple results from one or more other PVPs/orchestrators at lower-levels of the policy assessor hierarchy; aggregating the multiple results; and returning the aggregated results.
Refer to at least the abstract and [0175]-[0188] of Tammala with respect to an orchestrator aggregating multiple received data and returning a message with aggregated data.
Tammala likewise concerns an orchestration module and converting between formats, and is considered to be within the same field of endeavor and combinable as such.
Therefore it would have been obvious to one of ordinary skill in the art before the filing date of Applicant’s invention to modify the teachings of Barry-Ferney-Ziring to further implement aggregating and responding to multiple responses for at least the purpose of managing policy enforcement across the layers (i.e., keeping respective layer policy components up-to-date on all security events).
Regarding claims 10 and 17, they are substantially similar to claim 3 above, and are therefore likewise rejected.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to VADIM SAVENKOV whose telephone number is (571)270-5751. The examiner can normally be reached 12PM-8PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey L Nickerson can be reached at (469) 295-9235. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/V.S/Examiner, Art Unit 2432
/SYED A ZAIDI/Primary Examiner, Art Unit 2432
Prosecution Insights