Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
1. Applicant’s arguments have been considered but are moot because the new ground of rejection relies upon a new combination of reference, i.e. Gopal in view of Heo and Anderson, that Applicant has not specifically challenged.
In particular, the current rejection incorporates the teachings of Heo et al. (US 20220272070 A1) which explicitly addresses removing the L2-L4 data from a data packet.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
2. Claims 1-7, 9-18, and 20-22 are rejected under 35 U.S.C. 103 as being unpatentable over Gopal et al. (US 20190215307 A1) in view of Heo et al. (US 20220272070 A1) and Anderson et al. (US 20210194894 A1).
Claim 1 Gopal teaches method for performing secure frame capture for an application executing on a data compute node (DCN):
at the application:
receiving (¶0054, receiving a data packet; ¶0048, the data packet including a frame) and parsing a frame for a particular layer 7 (L7) protocol. (¶0055, parsing the frame via a full DPI analysis may be performed on the packet when a particular matching rule includes for example, a name of the Layer 7 protocol) and
identifying an action to perform within the application based on the parsed frame. (FIG. 2, ¶0059-¶0060, identifying an action, i.e. a verb of the verb-based firewall to perform based upon the parsed frame)
However, Gopal does not explicitly teach
removing Layer 2 (L2), Layer 3 (L3), and Layer 4 (L4) information from a received data packet to generate layer 7 (L7) protocol data;
wherein frame having been generated from the L7 protocol data with the L2-L4 information removed; and
based on secure frame capture being enabled for the application, enabling writing of information regarding the frame to a capture file stored at the DCN, said information regarding the frame omitting (i) any L2-L4 information and (ii) any payload data carried by the frame.
From a related technology, Heo teaches removing Layer 2 (L2), Layer 3 (L3), and Layer 4 (L4) information from a received data packet to generate layer 7 (L7) protocol data; (FIG. 9B, ¶0146, removing the header part (including the L2 header, the IP header, i.e. the Layer 3, the TCP/UDP header, i.e. Layer 4), to generate the payload, ¶0078, wherein the payload comprises the application specific data, i.e., L7 protocol data) and wherein the frame having been generated from the L7 protocol data with the L2-L4 information removed. (¶0146, wherein the frame is generated from the remaining L7 data and L2-L4 is removed)
It would be obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Gopal to incorporate the teachings of Heo in order to more effective parse and analyze the useful information contained within data packets.
However, Gopal in view of Heo does not explicitly teach based on secure frame capture being enabled for the application, enabling writing of information regarding the frame to a capture file stored at the DCN, said information regarding the frame omitting (i) any L2-L4 information and (ii) any payload data carried by the frame.
From a related technology, Anderson teaches based on secure frame capture being enabled for the application, enabling writing of information regarding the frame to a capture file stored at the DCN. (¶0105, store the sequence of packet copies processed by telemetry capture process 249) said information regarding the frame omitting (ii) any payload data carried by the frame. (¶0110, where the payload has been stripped)
Further in combination with Heo teaching said information regarding the frame omitting (i) any L2-L4 information. (Heo, FIG. 9B, ¶0146, removing L2-L4 information)
It would be obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Gopal in view of Heo to incorporate the teachings of Anderson regarding packet capture to more effectively utilize network resources.
Claim 2 Gopal in view of Heo and Anderson teaches Claim 1, and further teaches wherein information is written to the capture file (Anderson, ¶0105, store the sequence of packet copies processed by telemetry capture process 249) by a hook that is enabled within the application based on secure frame capture being enabled for the application. (See 112(b) rejection, the hook is not the application, and therefore the claim has not clearly established that it is part of the scope of the claim hence would lack any patentable weight)
Claim 3 Gopal in view of Heo and Anderson teaches Claim 2, and further teaches wherein the hook is enabled on a per-application basis within the DCN such that the hook is enabled to perform secure frame capture for at least one additional application executing on the DCN and is disabled for at least one application executing on the DCN. (Anderson, ¶0105, writing to the capture file, See 112(b) rejection, the hook is not the application, and therefore the claim has not clearly established that it is part of the scope of the claim hence would lack any patentable weight)
Claim 4 Gopal in view of Heo and Anderson teaches Claim 1, and further teaches wherein the particular L7 protocol is HTTP/2. (Gopal, ¶0011, wherein L7 protocol comprises HTTP/2)
Claim 5 Gopal in view of Heo and Anderson teaches Claim 1, and further teaches wherein the capture file is a pcap file. (Anderson, ¶0105, wherein the capture file comprises a pcap file)
Claim 6 Gopal in view of Heo and Anderson teaches Claim 1, and further teaches the identified action comprises dispatching payload data to the application; (Anderson, ¶0100, Table 3, wherein the put application dispatching payload data to the application) and
the information written to the capture file regarding the frame indicates that a data frame was received for a particular connection (Examiner notes that this is an intended use limitation that the data was received “for a particular connection,” and has no patentable weight) but does not include the payload data. (Anderson, ¶0110, basing the information stored on the stripped payload data carried by the frame)
Claim 7 Gopal in view of Heo and Anderson teaches Claim 6, and further teaches wherein the information comprises a size of the payload data. (Anderson, ¶0042, determining payload size)
Claim 9 Gopal in view of Heo and Anderson teaches Claim 1, and further teaches the identified action comprises starting a new connection for the application; (Anderson, ¶0100, TABLE 3, wherein the identified action comprises a new connection for the application) and the information written to the capture file specifies the start of a new connection and defines a new identifier for the new connection. (Anderson, ¶0033, wherein the information can comprise new data points regarding new traffic flow, i.e. a new connection, and a new identifier, i.e. new data points)
Claim 10 Gopal in view of Heo and Anderson l teaches Claim 9, and further teaches wherein the new identifier is used to identify the connection for information regarding subsequent frames written to the capture file (Anderson, ¶0033, wherein the new identifier, i.e. data points, identify the new connection regarding subsequent frames) without requiring any L2-L4 information for the connection. (Anderson, ¶0105, store the sequence of packet copies processed by telemetry capture process 249 without L2-L4 information)
Claim 11 Gopal in view of Heo and Anderson teaches Claim 1, and further teaches wherein the frame is a first frame, (Anderson, ¶0090, where the packet is a first packet or frame) the method further comprising, at the application:
identifying a second frame (Anderson, ¶0090, subsequent frames or packets) to be sent from the application; (Examiner notes that “to be sent from the application” comprises an intended use statement, and further notes that this intended use is not performed in the claims and therefore lacks patentable weight) and writing information regarding the second frame to the capture file. (Anderson, ¶0090, capturing acknowledgement information regarding the second packet)
Claim 12 Gopal in view of Heo and Anderson eaches Claim 1, and further teaches wherein an administrator logs into the DCN (Examiner notes that the DCN is merely the computer that executes the program, therefore “logging into” the computer would merely comprise interfacing with the computer; Anderson, ¶0029, network interfaces wherein a user can access, i.e., log into the computer) to analyze the capture file using a network analysis tool. (Examiner notes that “to analyze the capture file…” is an intended use statement without patentable weight)
Claim 13 Gopal in view of Heo and Anderson teaches Claim 12, and further teaches wherein the capture file comprises a global header (Anderson, FIG. 3, 310, ¶0044, wherein the captured packet comprises header information) specifying that the frame information was captured using a particular secure format without L2-L4 data, (Anderson, ¶0105,store the sequence of packet copies processed by telemetry capture process 249 without L2-L4 information) thereby enabling the network analysis tool to parse the capture file. (Examiner notes that “enabling the network tool to parse the capture file” comprises an intended use function, wherein the network analysis tool is not materially changed but rather the intended use has changed)
Claim 14 Gopal in view of Heo and Anderson l teaches Claim 12, and further teaches wherein the DCN is a virtual machine executing on a host computer within a datacenter network. (Examiner notes that the DCN is not a part of claim, rather the claim is directed towards a method for an application executing on the DCN, and the material composition of the DCN does not have patentable weight)
Claim 15 is taught by Gopal in view of Heo and Anderson as described for Claim 1.
Claim 16 is taught by Gopal in view of Heo and Anderson as described for Claim 2.
Claim 17 is taught by Gopal in view of Heo and Anderson as described for Claim 3.
Claim 18 is taught by Gopal in view of Heo and Anderson as described for Claim 6.
Claim 20 is taught by Gopal in view of Heo and Anderson as described for Claim 9.
Claim 21 is taught by Gopal in view of Heo and Anderson as described for Claim 10.
Claim 22 is taught by Gopal in view of Heo and Anderson as described for Claim 11.
3. Claims 8 and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Gopal et al. (US 20190215307 A1) in view of Heo et al. (US 20220272070 A1) and Anderson et al. (US 20210194894 A1) and in further view of Kim (US 20250063440 A1).
Claim 8 Gopal in view of Heo and Anderson teaches Claim 1, but does not explicitly teach further teaches
the frame is a control message indicating a protocol error; and
the information written to the capture file regarding the frame specifies (i) a connection indicator for the frame and (ii) the protocol error.
From a related technology, Kim teaches wherein a frame is a control message indicating a protocol error; (¶0064, wherein the packet comprises a protocol error, i.e. a control message) and the information written to a capture file regarding the frame specifies (i) a connection indicator for the frame (¶0063, wherein the indicator indicates the UE, i.e. the connection indicator for the frame) and (ii) the protocol error. (¶0064, wherein the message trigger comprises the protocol error)
It would be obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the teachings of Anderson in view of Gopal to incorporate the sort of control message technology utilized in Kim in order to more effectively utilize network resources by more effectively communicating and analyze network analytical data.
Claim 19 is taught by Gopal in view of Heo, Anderson and Kim as described for Claim 8.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to CHRISTOPHER PALACA CADORNA whose telephone number is (571)270-0584. The examiner can normally be reached M-F 10:00-7:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, John Follansbee can be reached at (571) 272-3964. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/CHRISTOPHER P CADORNA/Examiner, Art Unit 2444
/JOHN A FOLLANSBEE/Supervisory Patent Examiner, Art Unit 2444