DETAILED ACTION
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Applicant's amendments filed on 06/25/2026 has been received and entered. Currently Claims 1-25 are pending.
Response to Arguments
Applicant argues on pages 11-12 of applicant’s remarks that one skilled in the art would understand that, at the time of filing, pinned certificate sessions were considered incompatible with inspection. Therefore, one skilled in the art would not, at the time of filing, take teachings regarding inspection operations for ordinary secure sessions, and apply those teachings to a "pinned certificate session" as recited in claim 1.
The examiner respectfully disagrees. The examiner notes that the instant application was filed on 2/8/2024. The examiner notes that Bannister et al. US 2020/0236093 was filed on 4/8/2020 and published on 7/23/2020. Bannister teaches a key harvesting system 1060 … extracts keys from a set of applications that perform encryption using both pinned 1020 and unpinned 1010 certificates. After keys have been extracted using the disclosed key harvesting techniques, they can be forwarded to a key/data aggregator 1062 that extracts and decrypts encrypted data flows… The extracted (encrypted) data flows can then be decrypted by key/data aggregator 1062, which may in turn pass the decrypted data to one or more analysis tools 1064 that perform additional analysis upon the data stream. ([0076]). Also see below 103 rejections of the claims. Therefore, at the time the instant application was filed, it was known to inspect pinned certificate traffic. Therefore, one of ordinary skill in that art would consider teachings regarding inspection operations for ordinary secure sessions and apply those teachings to a pinned certificate session.
Applicant argues on pages 12-14 of applicant’s remarks that the cited references of Bannister, Rahkonen and Cosgrove do not disclose or suggest “a secure web gateway that is external to the organization network” as recited in the amended claims.
The examiner respectfully disagrees. Bannister teaches an intermediate computing environment that is external to an enterprise network (Fig. 9A, 9B, e.g. cloud system hardware and/or intermediate data center). Also see below 103 rejections of the claims. Therefore, Bannister teaches limitations of the claims.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 3, 5-8, 10, 12, 14, 16, 18-20, 22 and 24-25 are rejected under 35 U.S.C. 103 as being unpatentable over Bannister et al. US2020/0236093 hereinafter referred to as Bannister, in view of Rahkonen et al. US2020/0092264 hereinafter referred to as Rahkonen, and Cosgrove US2022/0360594.
As per claim 1, Bannister teaches a computer-implemented method of security monitoring of and generating alerts during a Transport Layer Security (“TLS”) or other pinned certificate session that is established, in part, through an organization network, the method including: facilitating, via a secure web gateway that is external to the organization network, a new pinned certificate session in a bypass configuration, by: for a new pinned certificate session with a cloud-based resource that uses a pinned certificate, detecting initiation of the new pinned certificate session and sending a request to a key extractor running on a client device to perform a key extraction for one or more keys being used in the new pinned certificate session (Bannister Fig. 9A, 9B, paragraph [0081], [0083], intermediate computing environment which decrypts and analyzes session data is external to the enterprise. Bannister Fig 10B, pinned certificate session data is bypassed. Bannister Fig. 10A, Fig. 10B, paragraph [0005]-[0006], [0042], [0065], [0069], [0074], [0076], communications between client device and remote services are via intermediate computing environment. Detect new session with remote service that uses pinned certificate, and trigger to extract encryption key(s).); and
bi-directionally forwarding the encrypted packets between the client device and the cloud-based resource (Bannister Fig. 9A, 9B, 10A, Fig. 10B, paragraph [0005], [0076], intermediate computing environment provides bidirectionally forwarding of encrypted packets).
Bannister does not explicitly disclose buffering encrypted packets;
switching, by secure web gateway, from bypass configuration to an inspection configuration by: receiving one or more extracted keys, applying the extracted keys to session traffic in the buffer, and decrypting the buffered packets; and
following receipt of a symmetrical session key that is being used during new session, the secure web gateway taking over as an inspection proxy of the new session and changing at least one byte in the new session in at least one direction of the new session, wherein taking over as the inspection proxy includes decrypting traffic in at least one direction.
Rahkonen teaches buffering encrypted packets (Rahkonen paragraph [0024]-[0025], buffering encrypted packets. In the event that the security device detects that encrypted application messages are present in the traffic and the secrets are not yet known, the security device may send the application messages to the client without delay and store the encrypted messages for later inspection);
switching, by secure web gateway, from bypass configuration to an inspection configuration by: receiving one or more extracted keys, applying the extracted keys to session traffic in the buffer, and decrypting the buffered packets (Rahkonen paragraph [0024]-[0025], obtain session secrets … If the security device has buffered encrypted application messages, the security device may decrypt such application messages and inspect and monitor application messages); and
following receipt of a symmetrical session key that is being used during new session, changing at least one byte in the new session in at least one direction of the new session; and decrypting traffic of the new session in at least one direction (Rahkonen paragraph [0024]-[0025], obtain session secrets and decrypt encrypted messages and perform operations to traffic such as modifying content and/or delaying the messages. In the event that the security device detects that encrypted application messages are present in the traffic and the secrets are not yet known, the security device may send the application messages to the client without delay and store the encrypted messages for later inspection… obtain session secrets … In the event that the security device detects that encrypted application messages are present in the traffic and the secrets are known… the security device may perform decryption on the application messages and handle the application messages in accordance with the security policy).
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Bannister of an intermediate computing environment external to an enterprise decrypting and analyzing pinned certificate traffic with the teachings of Rahkonen to include buffering data, and decrypting and analyzing buffered data in order to buffer encrypted data when session keys are not available yet and to decrypt and analyze the buffered data when sessions keys are available to ensure that all traffic is analyzed.
Bannister in view of Rahkonen does not explicitly disclose re-encrypting traffic in at least one direction.
Cosgrove teaches re-encrypting traffic in at least one direction (Cosgrove paragraph [0220], re-encrypting traffic).
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Bannister in view of Rahkonen of an intermediate computing environment external to an enterprise decrypting and analyzing pinned certificate traffic with the teachings of Cosgrove to include re-encrypting traffic in order to provide secure communication of the traffic data between the client and the remote services.
As per claim 3, Bannister in view of Rahkonen and Cosgrove teaches the computer-implemented method of claim 1, further including: the new pinned certificate session begins using asymmetrical keys, and the new pinned certificate session includes deriving a symmetrical key; and applying by the secure web gateway the symmetrical key to decrypt the session traffic (Bannister Fig. 10A, Fig. 10B, paragraph [0010], [0042], [0065], [0069], [0074], [0076]-[0077], [0079], on the client device extracting and sending encryption keys to intermediate computing environment. New session begins with asymmetric encryption handshake and a shared symmetric key is derived. Traffic is decrypted with the extracted symmetric key).
As per claim 5, Bannister in view of Rahkonen and Cosgrove teaches the computer-implemented method of claim 1, further including decrypting multiple sessions, wherein: each session of the multiple sessions includes an encrypted substream of session data, and the secure web gateway successively buffers the encrypted substream of session data corresponding to each session of the multiple sessions, and the secure web gateway successively decrypts the encrypted substream of session data corresponding to each session of the multiple sessions as the multiple substreams of session data were buffered (Bannister Fig. 10A, Fig. 10B, paragraph [0010], [0042], [0074], [0076]-[0077], [0079], Traffic is decrypted with the extracted symmetric key and analyzed; Rahkonen Fig. 2, paragraph [0020], [0023]-[0025], plurality of client devices. buffer encrypted messages and obtain session secrets and decrypt encrypted messages and analyze the messages) (It is obvious to one of ordinary skill in the art that each client device has its own sessions) (Although Bannister in view of Rahkonen and Cosgrove does not explicitly disclose decrypting multiple sessions in a sequential order. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to try to decrypting multiple sessions in a sequential order. There are only two options of how to decrypt the sessions, in sequential order or not in sequential order and the result will be the same, the sessions will be decrypted.) (Although Bannister in view of Rahkonen and Cosgrove does not explicitly disclose decrypts … data corresponding to each session … in the same order as the multiple substreams of session data were buffered. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to try to decrypt data in the same order as they were buffered. There are only two options of how to decrypt the data, in the same order as they were buffered or not in the same order as they were buffered and the result will be the same, the data will be decrypted.).
As per claim 6, Bannister in view of Rahkonen and Cosgrove teaches the computer-implemented method of claim 1, wherein the one or more extracted keys are extracted from a virtual address space associated with a client device TLS or other pinned certificate handling process (Bannister Fig. 10A, Fig. 10B, paragraph [0006], [0042], [0065], [0069], extract encryption key(s)).
As per claim 7, Bannister in view of Rahkonen and Cosgrove teaches the computer-implemented method of claim 6, wherein the one or more extracted keys are associated with a specific TLS or other pinned certificate protocol, enabling at least one of the secure web gateway to apply the extracted keys to session traffic in the buffer and decrypt the buffered packets (Bannister Fig. 10A, Fig. 10B, paragraph [0006], [0042], [0065], [0069], [0076], use extracted encryption key(s) to decrypt data; Rahkonen paragraph [0024]-[0025], obtain session secrets and decrypt encrypted messages in the buffer).
As per claim 8, Bannister in view of Rahkonen and Cosgrove teaches the computer-implemented method of claim 7, wherein the secure forwarding of the one or more extracted keys further includes matching the one or more extracted keys to the specific TLS or other pinned certificate protocol used in the new pinned certificate session (Bannister Fig. 10A, Fig. 10B, paragraph [0010], [0042], [0074], [0076]-[0077], [0079], obtain extracted keys and Traffic is decrypted with the extracted symmetric key and analyzed; Rahkonen Fig. 2, paragraph [0020], [0023]-[0025], plurality of client devices. buffer encrypted messages and obtain session secrets and decrypt encrypted messages and analyze the messages).
As per claim 10, Bannister in view of Rahkonen and Cosgrove teaches the computer-implemented method of claim 1, wherein the pinned certificate is an accepted certificate located in a local storage on the client device (Bannister Fig. 10A, Fig. 10B, paragraph [0010], Rahkonen paragraph [0003]).
As per claim 12, Bannister in view of Rahkonen and Cosgrove teaches the computer-implemented method of claim 1, wherein session data need to be buffered in order to process the buffered packets (Rahkonen paragraph [0024]-[0025], obtain session secrets and decrypt encrypted messages in the buffer and analyze the messages) (Although Bannister in view of Rahkonen and Cosgrove does not explicitly disclose less than four kilobytes of session data. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to try to have less than four kilobytes of session data. There are only two options for the session data, having less than four kilobytes or not having less than four kilobytes and the result will be the same, the sessions data will be decrypted and analyzed.).
As per claims 14, 16, 18-20, 22 and 24-25, the claims claim a non-transitory computer readable medium and a system essentially corresponding to the method claims 1, 3 and 5-6 above, and they are rejected, at least for the same reasons.
Claims 2, 11, 15 and 21 are rejected under 35 U.S.C. 103 as being unpatentable over Bannister in view of Rahkonen and Cosgrove, and further in view of Bronshtein et al. US2017/0310670 hereinafter referred to as Bronshtein.
As per claim 2, Bannister in view of Rahkonen and Cosgrove teaches the computer-implemented method of claim 1, review of the decrypted traffic of the pinned certificate session (Bannister Fig. 10A, Fig. 10B, paragraph [0076]; Rahkonen paragraph [0025]).
Bannister in view of Rahkonen and Cosgrove does not explicitly disclose further including: detecting, from review of traffic, a security condition that requires injecting data into session; wherein switching to an inspection configuration is delayed until after the detecting.
Bronshtein teaches further including: detecting, from review of traffic, a security condition that requires injecting data into session; wherein switching to an inspection configuration is delayed until after the detecting (Bronshtein paragraph [0058]-[0059], [0072], [0074], detect a security threat and modify response by injecting/simulating a server response).
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Bannister in view of Rahkonen and Cosgrove of decrypting and analyzing traffic with the teachings of Bronshtein to include detecting a security threat and modifying response by injecting/simulating a server response in order to discard data that presents a security threat.
As per claim 11, Bannister in view of Rahkonen and Cosgrove teaches the computer-implemented method of claim 10.
Bannister in view of Rahkonen and Cosgrove does not explicitly disclose wherein pinned certificate is detected in local storage using a signature specific to one or more libraries used by cloud-based resource.
Bronshtein teaches wherein pinned certificate is detected in local storage using a signature specific to one or more libraries used by cloud-based resource (Bronshtein [0066], detect local stored data and authenticate server).
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Bannister in view of Rahkonen and Cosgrove of establishing a session using a pinned certificate with the teachings of Bronshtein to include detecting local stored data and authenticate server because the results would have been predictable and resulted in authenticating the server based on the locally stored data.
As per claims 15 and 21, the claims claim a non-transitory computer readable medium and a system essentially corresponding to the method claim 2 above, and they are rejected, at least for the same reasons.
Claims 4, 17 and 23 are rejected under 35 U.S.C. 103 as being unpatentable over Bannister in view of Rahkonen and Cosgrove, and further in view of Slovetskiy US2022/0060450.
As per claim 4, Bannister in view of Rahkonen and Cosgrove teaches the computer-implemented method of claim 1, further including: applying, by the secure web gateway, the symmetrical key to decrypt the session traffic (Bannister Fig. 10A, Fig. 10B, paragraph [0010], [0042], [0074], [0076]-[0077], [0079], on the client device extracting and sending encryption keys to intermediate computing environment. Traffic is decrypted with the extracted symmetric key).
Bannister in view of Rahkonen and Cosgrove does not explicitly disclose wherein: new session resumes a prior session with less than a full handshake, including deriving a symmetrical key.
Slovetskiy teaches wherein: new session resumes a prior session with less than a full handshake, including deriving a symmetrical key (Slovetskiy paragraph [0037], resume session without full handshake).
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Bannister in view of Rahkonen and Cosgrove of establishing a session using a pinned certificate with the teachings of Slovetskiy to include resuming a session without full handshake because the results would have been predictable and resulted in a session being resumed without performing full handshake.
As per claims 17 and 23, the claims claim a non-transitory computer readable medium and a system essentially corresponding to the method claim 4 above, and they are rejected, at least for the same reasons.
Claim 9 is rejected under 35 U.S.C. 103 as being unpatentable over Bannister in view of Rahkonen and Cosgrove, and further in view of Willebeek-LeMair et al. US2003/0204632 hereinafter referred to as Willebeek-LeMair.
As per claim 9, Bannister in view of Rahkonen and Cosgrove teaches the computer-implemented method of claim 1.
Bannister in view of Rahkonen and Cosgrove does not explicitly disclose wherein an administrator terminates session in response to an alert received from secure web gateway.
Willebeek-LeMair teaches wherein an administrator terminates session in response to an alert received from secure web gateway (Willebeek-LeMair [0072], alert admin and terminate session).
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Bannister in view of Rahkonen and Cosgrove of decrypting and analyzing traffic with the teachings of Willebeek-LeMair to include alerting an admin and terminating a session in order to alert an admin of a security threat and to terminate the session.
Claim 13 is rejected under 35 U.S.C. 103 as being unpatentable over Bannister in view of Rahkonen and Cosgrove, and further in view of Franzoni Martinez US2017/0063883.
As per claim 13, Bannister in view of Rahkonen and Cosgrove teaches the computer-implemented method of claim 1, decrypted session data stream (Bannister Fig. 10A, Fig. 10B, paragraph [0010], [0042], [0074], [0076]-[0077], [0079], Traffic is decrypted with the extracted symmetric key; Rahkonen paragraph [0024]-[0025], obtain session secrets and decrypt encrypted messages in the buffer).
Bannister in view of Rahkonen and Cosgrove does not explicitly disclose further including an administrator establishing at least one security policy that defines a particular security condition associated with particular content.
Franzoni Martinez teaches further including an administrator establishing at least one security policy that defines a particular security condition associated with particular content (Franzoni Martinez paragraph [0072], admin defines policy).
Thus it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify the invention of Bannister in view of Rahkonen and Cosgrove of decrypting and analyzing traffic with the teachings of Franzoni Martinez to include an admin defining policies in order to provide an interface where an administrator is able to configure/set security polices of the intermediate computing environment for analyzing traffic data.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to HENRY TSANG whose telephone number is (571)270-7959. The examiner can normally be reached M-F 9am - 5pm EST.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Farid Homayounmehr can be reached at (571) 272-3739. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/HENRY TSANG/ Primary Examiner, Art Unit 2495
Prosecution Insights