DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 9/12/2025 has been entered.
Response to Amendment
Claims 1-20 are amended and pending in the instant application.
Response to Arguments
Applicant’s arguments, see Remarks, filed on 9/12/2025 have been fully considered.
Claim Rejections under 35 U.S.C. 103
Claims 1-8 and 10-20 are rejected under 35 U.S.C. 103 as being unpatentable over Qiao et al. (US 2022/0030495), hereinafter Qiao in view of Zong et al. (US 2024/0380638), hereinafter Zong.
Claim 1 has been amended as follows:
“A computer-implemented method comprising:
receiving input of a customer associated with a customer tenancy hosted by a cloud infrastructure, wherein the customer tenancy comprises customer tenancy network locations, wherein the input indicates one or more egress allowed network locations of the customer tenancy network locations and one or more egress disallowed network locations of the customer tenancy network locations;
generating an egress policy based on the input, wherein the egress policy indicates whether egress traffic from the customer tenancy to a service of a service tenancy hosted by a second cloud infrastructure externally of the customer tenancy is to be allowed or disallowed based on whether the egress traffic from the customer tenancy is received by the service from one of the egress allowed network locations or one of the egress disallowed network locations;
storing the egress policy in a data store; and
causing the service to enforce the egress policy on egress traffic from the customer tenancy that is received by the service.” (Emphasis added)
Claims 10 and 18 are amended with similar features.
On pages 8 and 11 of the Remarks, Applicant argues Qiao is non-analogous art and the cited references fail to disclose or suggest all the elements recited in the claims. Applicant’s arguments are persuasive, therefore, a new ground of rejection is made in light of the amendments.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 9/12/2025 is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Wondra et al. (US 2022/0303244), hereinafter Wondra in view of Wang et al. (US 2023/0081612), hereinafter Wang.
As for claim 1, Wondra teaches a computer-implemented method comprising:
receiving input of a customer associated with a customer tenancy hosted by a cloud infrastructure (paragraphs [0025]-[0026] and [0031] describe traffic directed to a web property of a customer whose private networks include data center networks and virtual private cloud instances, the traffic is received at a distributed cloud computing network which include multiple data centers that includes compute servers), wherein the customer tenancy comprises customer tenancy network locations (paragraph [0026] describes the IP traffic is sent to the distributed cloud computing network because IP addresses of an origin network are advertised by the distributed cloud computing network; paragraph [0042] describes a hostname owner can establish policies (e.g. specifying incoming traffic from only certain IP address and IP address ranges) that are enforced at the compute servers), wherein the input indicates one or more egress allowed network locations of the customer tenancy network locations and one or more egress disallowed network locations of the customer tenancy network locations (paragraphs [0048]-[0050] describe the customer defines policies regarding the traffic. A customer may have secure resource available in their private network at a specific IP address, and may specify that only traffic from devices within the customer’s private network or from devices attributable to the customer may access that secure resource (i.e. allowed). If traffic received at the distributed cloud computing network that is address to that specific IP address is not from a client device that has an agent associated with the customer will be dropped (i.e. disallowed) );
generating an egress policy based on the input (paragraphs [0049]-[0050] describes traffic received at the distributed cloud computing network that is addressed to the specific address will be subject to an identity policy based on the customer specification), wherein the egress policy indicates whether egress traffic from the customer tenancy to a service of a service tenancy hosted by a second cloud infrastructure externally of the customer tenancy is to be allowed or disallowed based on whether the egress traffic from the customer tenancy is received by the service from one of the egress allowed network locations or one of the egress disallowed network locations (paragraphs [0049]-[0050] describes traffic received at the distributed cloud computing network that is addressed to the specific address will be subject to an identity policy based on the customer specification. If the traffic received is not from a device in the customer’s private network, the traffic will be dropped (i.e. disallowed). The security service will only allow traffic to reach the resource at the specific address if that traffic is received from particular user(s));
storing the egress policy (paragraph [0058] describes a security device performs performance services on a traffic that is tagged with the identity information. The security service apply one or more policies to the received traffic to determine whether access is allowed to the target destination. Note: the policies are construed as being stored at the security service); and
causing the service to enforce the egress policy on egress traffic from the customer tenancy that is received by the service (paragraphs [0058]-[0059] describe a security device performs performance services on a traffic that is tagged with the identity information, The security service apply one or more policies to the received traffic to determine whether access is allowed to the target destination).
Wondra fails to teach
storing egress policy in a data store.
Wang discloses
storing egress policy in a data store (paragraphs [0023] and [0075] describe when an egress traffic reaches a gateway for security and privacy, the gateway identifies a rule which is written by gateway for security and privacy rule manager to determine if a service is allowed to access destination host. The gateway is configured to receive an egress rule update at a traffic egress rule monitor).
One of ordinary skill in the art before the effective filing date of the claimed invention would have recognized the ability to utilize the teachings of Wang for maintaining egress rules at a gateway. The teachings of Wang, when implemented in the Wondra system, will allow one of ordinary skill in the art to determine what types of traffic is allowed to access a destination host. One of ordinary skill in the art would be motivated to utilize the teachings of Wang in the Wondra system in order to allow a datacenter to control egress traffic control at the application layer to enforce and ensure that only necessary requests are sent out to the internet (Wang: paragraph [0004]).
As for claim 2, the combined system of Wondra and Wang teaches wherein the egress policy indicates an authorized user to send the egress traffic outside the customer tenancy (Wondra: paragraphs [0067]-[0068] describe a compute server determines whether the traffic is attributable to a customer. The ingress traffic is associated with an identity of the user responsible for transmitting the traffic. If the traffic is attributable to a customer), wherein causing the service of the service tenancy to enforce the egress policy comprises determining that the egress traffic is associated with the customer tenancy and allowing the egress traffic to be processed by the service of the service tenancy (Wondra: paragraph [0068] describes the first compute server determines whether the identity attributable to the traffic is allowed to access the target destination. For example, the security service determines whether the identity associated with the traffic is allowed to access the target destination. The policy is at the customer level (e.g., only allow traffic that is attributable from the customer)).
As for claim 3, the combined system of Wondra and Wang teaches wherein the egress policy indicates a compute resource of the customer tenancy or any compute resource is authorized to send or request sending of the egress traffic (Wondra: paragraph [0048] describes the traffic is tagged with identity information, the policies can be enforced based on identity in addition to IP addresses),
that are enforced at the compute servers of the distributed cloud computing network), wherein causing the service of the service tenancy to enforce the egress policy comprises determining that the egress traffic is associated with a particular compute resource (Wondra: paragraph [0050] describes traffic received at the distributed cloud computing network that is addressed to the specific IP address will be subject to the identity policy. If the traffic received is not from a device in the customer’s private network and/or not from a client device that has an agent associated with the customer, the traffic will be dropped).
As for claim 4, the combined system of Wondra and Wang teaches wherein the egress policy indicates one or more network locations defined by the customer and from which the egress traffic can leave the network (Wondra: paragraph [0042] describes a virtual origin is created within the distributed cloud computing network, the virtual origin has its own access rules, authentication policies. For instance, the tunnel hostname owner can establish policies (e.g., specifying incoming traffic from only certain IP addresses and/or IP address ranges), all network gateways associated with the network, or all network locations used by customer instances (Wondra: paragraph [0050] describes a customer has secure resource available in their private network at a specific address, and specifies that only traffic from devices within the customer’s private network may access that secure resource), wherein causing the service of the service tenancy to enforce the egress policy comprises determining that the egress traffic is associated with one of the one or more egress allowed network locations or with one of the one or more egress disallowed network locations (Wondra: paragraphs [0054]-[0055] describe the routing service provides an interface that allows services of the distributed cloud computing network to determine where traffic should be routed. A packet from a private portion of a customer’s network with a target destination IP address is received at the ingress interface. The ingress interface queries the routing service to determine if the target destination IP address is in the customer’s network).
As for claim 5, the combined system of Wondra and Wang teaches wherein the egress policy indicates a type of action to be performed by the service of the service tenancy (Wondra: paragraph [0055] describes an ingress interfaces receives a packet from a private portion of a customer, the packet includes identity information attributable for the packet. The security applies policies to the traffic that are defined by the customer, performs denial of service detection and mitigation, performs bot detection and mitigation, etc., ), and wherein causing the service of the service tenancy to enforce the egress policy comprises performing the type of action by the service of the service tenancy on the egress traffic (Wondra: paragraph [0055] describes the security service applies policies that are defined by the customer, performs different types of services).
As for claim 6, the combined system of Wondra and Wang teaches wherein the egress policy indicates an authorized target to receive the egress traffic (Wondra: paragraph [0055] describes the customer sends a packet with a target destination IP address), wherein causing the service of the service tenancy to enforce the egress policy comprises determining that the authorized target includes the service of the service tenancy (Wondra: paragraphs [0058]-[0059] describe the security service applies policies to the received traffic to determine whether access is allowed to the target destination).
As for claim 7, the combined system of Wondra and Wang teaches wherein the egress policy indicates a condition to allow the egress traffic to leave the customer tenancy (Wondra: paragraphs [0066]-[0067] describes the compute server receives traffic and determines whether the traffic is attributable to a customer, for example the ingress traffic may be associated with identity of an organization, identity of the client device that transmitted the traffic etc.,), wherein causing the service of the service tenancy to enforce the egress policy comprises determining that the condition is met (Wondra: paragraphs [0067]-[0069] describe if the traffic is attributable to a customer, the compute server verifies the identity associated with the traffic is allowed to access the target IP address, then determines the outgoing traffic interface for the traffic to reach the target destination).
As for claim 8, the combined system of Wondra and Wang teaches wherein the egress traffic is tagged with at least an identifier of one of the customer tenancy network locations from which the egress traffic is received by the service of the network location other than a network address of the network location (Wondra: paragraphs [0071] describes the encapsulated packets include identity information, which can be encoded in the form of a unique source IP address associated with a specific customer).
As for claim 9, the combined system of Wondra and Wang teaches the computer-implemented method, further comprising:
receiving, by the service of the service tenancy, the egress traffic (Wondra: paragraph [0081] describes a compute server receives traffic from an end user client device);
determining, by the service of the service tenancy, an action to be performed on the egress traffic based on a lookup of the egress policy (Wondra: paragraph [0081] describes the security service can apply policies to the received traffic to determine whether access is allowed to a private resource which is based on the identity information associated with the traffic provided by the client), wherein the action includes either allowing or disallowing the egress traffic, and wherein the lookup is based on the identifier (Wondra: paragraph [0081] describes the security service applies policies to determine whether access is allowed which is based on identity information (e.g. customer identifier, user identifier, and/or device identifier); and
performing, by the service of the service tenancy, the action on the egress traffic (Wondra: paragraph [0081] describes if the traffic is allowed to the destination, the security service forwards the traffic to the routing service).
As for claim 10, Wondra teaches a system comprising:
one or more processors (Fig. 14; Processing system 1420; paragraph [0128] describes a processing system includes processors); and
one or more memory storing instructions that, upon execution by the one or more processors, configure the system to (Fig. 14; Storage Media 1410 and Program Code 1430; paragraph [0128] describes memories that stored software instructions that executed by the processors causing the data processing system to perform operations):
receive input of a customer associated with a customer tenancy hosted by a cloud infrastructure (paragraphs [0025]-[0026] and [0031] describe traffic directed to a web property of a customer whose private networks include data center networks and virtual private cloud instances, the traffic is received at a distributed cloud computing network which include multiple data centers that includes compute servers), wherein the customer tenancy comprises customer tenancy network locations (paragraph [0026] describes the IP traffic is sent to the distributed cloud computing network because IP addresses of an origin network are advertised by the distributed cloud computing network; paragraph [0042] describes a hostname owner can establish policies (e.g. specifying incoming traffic from only certain IP address and IP address ranges) that are enforced at the compute servers), wherein the input indicates one or more egress allowed network locations of the customer tenancy network locations and one or more egress disallowed network locations of the customer tenancy network locations (paragraphs [0048]-[0050] describe the customer defines policies regarding the traffic. A customer may have secure resource available in their private network at a specific IP address, and may specify that only traffic from devices within the customer’s private network or from devices attributable to the customer may access that secure resource (i.e. allowed). If traffic received at the distributed cloud computing network that is address to that specific IP address is not from a client device that has an agent associated with the customer will be dropped (i.e. disallowed) );
generate an egress policy based on the input (paragraphs [0049]-[0050] describes traffic received at the distributed cloud computing network that is addressed to the specific address will be subject to an identity policy based on the customer specification), wherein the egress policy indicates whether egress traffic from the customer tenancy to a service of a service tenancy hosted by a second cloud infrastructure externally of the customer tenancy is to be allowed or disallowed based on whether the egress traffic from the customer tenancy is received by the service from one of the egress allowed network locations or one of the egress disallowed network locations (paragraphs [0049]-[0050] describes traffic received at the distributed cloud computing network that is addressed to the specific address will be subject to an identity policy based on the customer specification. If the traffic received is not from a device in the customer’s private network, the traffic will be dropped (i.e. disallowed). The security service will only allow traffic to reach the resource at the specific address if that traffic is received from particular user(s));
store the egress policy (paragraph [0058] describes a security device performs performance services on a traffic that is tagged with the identity information. The security service apply one or more policies to the received traffic to determine whether access is allowed to the target destination. Note: the policies are construed as being stored at the security service); and
cause the service to enforce the egress policy on egress traffic from the customer tenancy received by the service (paragraphs [0058]-[0059] describe a security device performs performance services on a traffic that is tagged with the identity information, The security service apply one or more policies to the received traffic to determine whether access is allowed to the target destination).
Wondra fails to teach
storing egress policy in a data store.
Wang discloses
storing egress policy in a data store (paragraphs [0023] and [0075] describe when an egress traffic reaches a gateway for security and privacy, the gateway identifies a rule which is written by gateway for security and privacy rule manager to determine if a service is allowed to access destination host. The gateway is configured to receive an egress rule update at a traffic egress rule monitor).
One of ordinary skill in the art before the effective filing date of the claimed invention would have recognized the ability to utilize the teachings of Wang for maintaining egress rules at a gateway. The teachings of Wang, when implemented in the Wondra system, will allow one of ordinary skill in the art to determine what types of traffic is allowed to access a destination host. One of ordinary skill in the art would be motivated to utilize the teachings of Wang in the Wondra system in order to allow a datacenter to control egress traffic control at the application layer to enforce and ensure that only necessary requests are sent out to the internet (Wang: paragraph [0004]).
As for claim 11, the combined system of Wondra and Wang teaches wherein the egress policy indicates an authorized user to send the egress traffic outside the customer tenancy (Wondra: paragraphs [0067]-[0068] describe a compute server determines whether the traffic is attributable to a customer. The ingress traffic is associated with an identity of the user responsible for transmitting the traffic. If the traffic is attributable to a customer), wherein causing the service of the service tenancy to enforce the egress policy comprises determining that the egress traffic is associated with the customer tenancy and allowing the egress traffic to be processed by the service of the service tenancy (Wondra: paragraph [0068] describes the first compute server determines whether the identity attributable to the traffic is allowed to access the target destination. For example, the security service determines whether the identity associated with the traffic is allowed to access the target destination. The policy is at the customer level (e.g., only allow traffic that is attributable from the customer)).
As for claim 12, the combined system of Wondra and Wang teaches wherein the egress policy indicates a compute resource of the customer tenancy or any compute resource is authorized to send or request sending of the egress traffic (Wondra: Wondra: paragraph [0048] describes the traffic is tagged with identity information, the policies can be enforced based on identity in addition to IP addresses),
that are enforced at the compute servers of the distributed cloud computing network), wherein causing the service of the service tenancy to enforce the egress policy comprises determining that the egress traffic is associated with a particular compute resource (Wondra: paragraph [0050] describes traffic received at the distributed cloud computing network that is addressed to the specific IP address will be subject to the identity policy. If the traffic received is not from a device in the customer’s private network and/or not from a client device that has an agent associated with the customer, the traffic will be dropped).
As for claim 13, the combined system of Wondra and Wang teaches wherein causing the service of the service tenancy to enforce the egress policy comprises determining that the egress traffic is associated with one of the one or more egress allowed network location or one of the more of the egress disallowed network locations (Wondra: paragraphs [0054]-[0055] describe the routing service provides an interface that allows services of the distributed cloud computing network to determine where traffic should be routed. A packet from a private portion of a customer’s network with a target destination IP address is received at the ingress interface. The ingress interface queries the routing service to determine if the target destination IP address is in the customer’s network).
As for claim 14, the combined system of Wondra and Wang teaches wherein the egress policy indicates a type of action to be performed by the service of the service tenancy (Wondra: paragraph [0055] describes an ingress interfaces receives a packet from a private portion of a customer, the packet includes identity information attributable for the packet. The security applies policies to the traffic that are defined by the customer, performs denial of service detection and mitigation, performs bot detection and mitigation, etc., ), and wherein causing the service of the service tenancy to enforce the egress policy comprises performing the type of action by the service of the service tenancy on the egress traffic (Wondra: paragraph [0055] describes the security service applies policies that are defined by the customer, performs different types of services).
As for claim 15, the combined system of Wondra and Wang teaches wherein the egress policy indicates an authorized target to receive the egress traffic (Wondra: paragraph [0055] describes the customer sends a packet with a target destination IP address), wherein causing the service of the service tenancy to enforce the egress policy comprises determining that the authorized target includes the service of the service tenancy (Wondra: paragraphs [0058]-[0059] describe the security service applies policies to the received traffic to determine whether access is allowed to the target destination).
As for claim 16, the combined system of Wondra and Wang teaches wherein the egress policy indicates a condition to allow the egress traffic to leave the customer tenancy (Wondra: paragraphs [0066]-[0067] describes the compute server receives traffic and determines whether the traffic is attributable to a customer, for example the ingress traffic may be associated with identity of an organization, identity of the client device that transmitted the traffic etc.,), wherein causing the service of the service tenancy to enforce the egress policy comprises determining that the condition is met (Wondra: paragraphs [0067]-[0069] describe if the traffic is attributable to a customer, the compute server verifies the identity associated with the traffic is allowed to access the target IP address, then determines the outgoing traffic interface for the traffic to reach the target destination).
As for claim 17, the combined system of Wondra and Wang teaches wherein the egress traffic is tagged with at least an identifier of one of the customer tenancy network locations from which the egress traffic is received by the service (Wondra: paragraphs [0071] describes the encapsulated packets include identity information, which can be encoded in the form of a unique source IP address associated with a specific customer).
As for claim 18, the claim lists all the same elements of claim 10, but in one or more non-transitory computer readable storage media storing instructions that, upon execution on a system (Wondra: paragraph [0128] describes memories that stored software instructions that executed by the processors causing the data processing system to perform operations), cause the system to perform functions to carry out the operations of rather than system form (Wondra: paragraph [0128] describes the processors execute instructions to perform operations). Therefore, the supporting rationale of the rejection to claim 10 applies equally as well to claim 18.
As for claims 19 and 20, these claims listed all the same elements of claims 11 and 12, respectively, but in one or more non-transitory computer readable storage media storing instructions that, upon execution on a system (Wondra: paragraph [0128] describes memories that stored software instructions that executed by the processors causing the data processing system to perform operations), cause the system to perform functions to carry out the operations of rather than system form (Wondra: paragraph [0128] describes the processors execute instructions to perform operations). Therefore, the supporting rational of the rejection to claims 19 and 20 applies equally as well to claims 11 and 12, respectively.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Nainar et al. (US 2023/0269190) teach methods for software defined hybrid private and public network
Wondra et al. (US 2023/0045949) teach secure private traffic exchange in a unified network service
Sivan et al. (US 8,687,636) teach extended policy control list keys having backward compatibility
Nguyen et al. (US 12,170,692) teach network security orchestration and management across different clouds.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to L. T N. whose telephone number is (571)272-1013. The examiner can normally be reached M & Th 5:30 am - 2:30 pm EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, TONIA DOLLINGER can be reached at 571-272-4170. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/L. T. N/
Examiner, Art Unit 2459
/TONIA L DOLLINGER/Supervisory Patent Examiner, Art Unit 2459