Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed 08/03/2026 has been entered.
Response to Arguments
Applicant’s arguments filed 08/03/2026 have been fully considered.
Applicant argues the recited “indexing the time-sliced portions of the packet capture data” cannot be practically performed in the human mind or on pen and paper and should therefore meet the requirements of 101 statute.
Applicant argues that the packet capture occurs at potentially gigabits per second speed and involves data volumes which categorically exclude human mental performance. Applicant’s arguments are not persuasive because the claims recite “collecting” and “retaining” the packet data prior to the indexing. Nothing in the claimed subject matter reflects the mass data scale applicant alleges and one of ordinary skill in the art would understand a person capable of “indexing” portions of data.
Regarding the “pruning” step (“pruning the packet capture data in the one or more packet capture caches in accordance with the pruning instructions”), applicant argues a person would be incapable of the pruning because the pruning is an operation performed on data, driven by instructions generated at a remote control-plane entity. Applicant’s arguments are not persuasive as 1) the instructions generated by a remote control-plane entity are absent from the claims; and 2) one of ordinary skill in the art would understand a person capable of selectively removing data or “pruning” data.
Regarding the “expunging” step (“expunging the packet capture data from the one or more packet capture cache…”) applicant argues a person would be incapable of the expunging the packet data because the expunging is a targeted cache eviction event. Applicant’s arguments amount to semantics because a “targeted cache eviction event” is merely another name for expunging the data from a cache.
Applicant argues that a person would be incapable of the expunging because the expunging is “triggered by the completion of transfer of the packet capture data to the tenant packet store”, i.e. the expunging occurs “after the packet capture data is sent to the packet store”. Applicant’s arguments are not persuasive because the expunging occurring “after the packet capture data is sent to the packet store” is inconsequential to a person’s ability to expunge data.
Applicant further argues the expunging cannot be performed by a person because it is a specific machine operation on data and not a mental exercise. Applicant's arguments are not persuasive as the claimed invention is described as a concept that is performed in the human mind and appellant is merely claiming that concept performed 1) on a generic computer, or 2) in a computer environment, or 3) is merely using a computer as a tool to perform the concept. In these situations, the claim is considered to recite a mental process.
In conclusion, applicant argues the recited indexing, pruning, and expunging cannot be fairly characterized as mental processes because they operate on machine-generated data structures. Applicant’s arguments are not persuasive as a general allegation of a computer-based environment does not preclude a mental process type characterization and only generally links the use of the judicial exception to a particular technological field.
Applicant argues the judicial exception is integrated into a practical application by a technical improvement to distributed packet capture systems, to cloud-based security systems, and to the efficient use of storage in decentralized packet capture platforms by (i) distributing packet capture to the capture points where the traffic actually flows, (ii) integrating packet capture with cloud security telemetry through the multi-tenant packet capture central authority, and (iii) deferring pruning decisions to the central authority so that pruning is driven by cross-tenant security signals rather than static local policies and via significant reduction in storage requirements observed by deduplication and by pruning packet capture data to remove mundane data. Applicant’s arguments are not persuasive as the improvements listed are not captured in the claims.
Applicant alleges the claims include “integrating packet capture with cloud security telemetry through the multi-tenant packet capture central authority”, however the “multi-tenant packet capture authority” is only recited in language couched within the receiving step and does little to integrate any practical application as is appears to be merely descriptive of the received data and fails to positively recite a step/function as performed by the multi-tenant packet capture authority. Further, the claims are absent any recitation of deduplication. Applicant’s arguments towards the pruning being an improvement are not persuasive as “pruning” or selectively deleting data is not an improvement to the conventional functioning of a computer.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(B) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
Claim(s) 1-4, 6-14, 16-22 are rejected under 35 U.S.C. 112, second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which applicant regards as the invention.
Regarding claim 1, applicant' s recitation of “receiving, at the one or more capture points from the multi-tenant packet capture central authority, pruning instructions generated by the multi-tenant packet capture central authority based at least in part on the reported index of the time-sliced portions and on telemetry from one or more cloud security systems” would have been unclear to one of ordinary skill in the art. It is unclear whether the method requires a generation step as performed by a multi-tenant packet capture authority, or alternatively, whether the claims only require a receiving step and the “generating” language is merely descriptive of the received data. To overcome the rejection, applicant should 1) positively recite the generation step if it is intended to be a step of the method; or 2) cancel or amend the language accordingly to clarify the obfuscation. Claim 11 recites similar language and is addressed by similar rationale. Dependent claims not addressed are rejected for incorporating the deficiencies of their respective parent claims.
Regarding claim 1, applicant’s recitation of “expunging the packet capture data from the one or more packet capture caches packet capture data from the one or more packet capture caches after the packet capture data is sent to the packet store” would have been unclear to one of ordinary skill in the art. It is unclear what the second recitation of “from the one or more packet capture caches” refers to. Claim 11 recites similar language and is addressed by similar rationale.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-4, 6-14, and 15-22 are rejected under 35 USC 101 because the claimed invention is directed towards nonstatutory subject matter.
The claims are rejected because the claimed invention is directed to a judicial exception (i.e., a law of nature, a natural phenomenon, or an abstract idea) without significantly more. Exemplary claim 1 recites the following:
Claim 1 recites a method comprising steps of:
collecting, at one or more capture points distributed across one or more cloud environments, packet capture data;
retaining the packet capture data at one or more packet capture caches associated with the one or more capture points, the packet capture data being retained locally at the capture points as time-sliced portions;
indexing the time-sliced portions of the packet capture data and reporting an index of the time-sliced portions to a multi-tenant packet capture central authority;
receiving, at the one or more capture points from the multi-tenant packet capture central authority, pruning instructions generated by the multi-tenant packet capture central authority based at least in part on the reported index of the time-sliced portions and on telemetry from one or more cloud security systems;
pruning the packet capture data in the one or more packet capture caches in accordance with the pruning instructions, wherein the pruning is performed before the packet capture data is sent to a packet store associated with a tenant of a cloud-based system and includes retaining only relevant data based on risk scores and event-based triggers;
sending, after the pruning, the packet capture data to the packet store;
expunging the packet capture data from the one or more packet capture caches packet capture data from the one or more packet capture caches after the packet capture data is sent to the packet store.
The broadest reasonable interpretation of element c)’s recitation “indexing the time-sliced portions of the packet capture data”; element e); and element g) is that the indexing, pruning, and expunging functions fall within the mental process groupings of abstract ideas because they cover concepts performed in the human mind (or pen and paper), including observation, evaluation, judgment, and opinion. See MPEP 2106.04(a)(2), subsection III.
The claim recites additional elements in a), b), element c)’s “reporting an index of the time-sliced portions to a multi-tenant packet capture central authority”; d), and f) which are mere data gathering, data reception/transmission recited at a high level of generality and which describe the use of a computer as a tool to perform the generic function of receiving and transmitting data, and thus are insignificant extra solution activity which fail to impose any meaningful limits on the claims . See MPEP 2106.05(g). The additional claim elements directed to the “computable readable medium”, and “one or more processors” are addressed by similar rationale.
The additional elements mentioned above merely dot integrate the exception(s) into a practical application. The additional elements confine the use of the abstract idea to a particular technological environment and thus fail to add an inventive concept to the claims. When viewed in combination, these additional elements do not integrate the recited judicial exception into a practical application. The additional elements do not amount to significantly more than the judicial exception as they add insignificant extra-solution activity to the judicial exception – see MPEP 2106.05(g) and generally link the use of the judicial exception to a particular technological field of use – see MPEP 2106.05(h). Moreover, the additional elements represent well-understood, routine, and conventional activity. See MPEP 2106.05(d), subsection II.
Even when considered in combination, these additional elements represent mere instructions to implement an abstract idea or other exception on a computer and insignificant extra-solution activity, which do not provide an inventive concept. The remaining claims and/or claim language is addressed by similar rationale as provided above.
CONCLUSION
Any inquiry concerning this communication or earlier communications from the examiner should be directed to RYAN J JAKOVAC whose telephone number is (571)270-5003. The examiner can normally be reached on 8-4 PM EST. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Oscar A. Louie can be reached on 572-270-1684. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/RYAN J JAKOVAC/Primary Examiner, Art Unit 2445
Prosecution Insights