Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This final action is responsive to application filed on 08/15/2025. In this amendment, claims 1, 9 and 17 are amended; claims 7 and 15 are canceled. Claims 1-6, 8-14 and 16-20 are pending, with claims 1, 9 and 17 being independent.
Priority
This application claims priority to Indian Provisional Patent Application No. 202241069004, filed on November 30, 2022, the entire contents of which is incorporated herein by reference.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 08/15/2025 and 10/29/2025 are in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Response to Arguments
Applicant’s arguments with respect to claim 1 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-4, 6, 8-12, 14 and 16-20 are rejected under 35 U.S.C. 103 as being unpatentable over Ho et al. (US 2024/0015137, Filed: Jul. 6, 2022), in view of Nimmagadda et al. (US 2018/0176252, Pub. Date: Jun. 21, 2018), in view of Lu (US 2020/0136998, Pub. Date: Apr. 30, 2020).
As per claim 1, Ho discloses a network system (Ho fig. 1, system 312) comprising:
processing circuitry (Ho fig. 4, processor 602); and
one or more memories coupled to the processing circuitry and configured to store instructions which (Ho fig. 4, memory 604), when executed by the processing circuitry, cause the network system to:
obtain data (Ho para. [0039], the processor 602 may access the user requests stored in memory 604 (such as those shown in stippled bubble 810); Ho para. [0029], The system 312 receives incoming traffic (e.g. requests) that originate from the user devices 302A to 302M), the data comprising indications of creations of instances of a flow (Ho fig. 5, User requests data 810 comprise Time of Request, IP Address, Device and Resource Request and para. [0039], the processor 602 may access the user requests stored in memory 604 (such as those shown in stippled bubble 810) and determine a pattern of user activity in which the user associated with IP address 192.168.1.1 (i.e. user 1001) has requested to access the same URL (a homepage of a same website) ten times [ten instances of the flow from user 1001 to the website] in the past five seconds);
based on the indications of the creations of the instances of the flow, determine a pattern of creation of the instances of the flow (Ho para. [0039], determine a pattern of user activity in which the user associated with IP address 192.168.1.1 (i.e. user 1001) has requested to access the same URL (a homepage of a same website) ten times [ten instances of the flow from user 1001 to the website] in the past five seconds. This repeated request may be dynamically determined to be a pattern of undesirable user activity that should be mitigated);
based on the pattern of creation of the instances of the flow, generate an action entry in a policy for a particular instance of the flow (Ho para. [0052], FIG. 5 illustrates a rule 850 determined by the system 312 in response to detecting a pattern of user activity; Ho para. [0053], the rule 850 being transmitted to the firewall 304 is: "If user IP address is X, and if web page Y is being requested, then block request") prior to receiving a first packet of the particular instance of the flow (Ho para. [0067], the rule, when implemented, may cause blocking at least some of the traffic matching the pattern prior to that traffic reaching the system 312. For example, the rule may deny/block any request satisfying the "if' condition of the "if-then" rule, where the "if' condition corresponds to the pattern (e.g. the rule may be "If user X is requesting resource Y, then block request", in which case the corresponding pattern of user activity is user X requesting resource Y) [i.e., the rule is implemented to block user X requesting resource Y, it blocks traffic (including a first packet and other packets) from user X requesting resource Y]), the first packet being received prior to all other packets of the particular instance of the flow (Ho para. [0067], the rule, when implemented, may cause blocking at least some of the traffic matching the pattern prior to that traffic reaching the system 312. For example, the rule may deny/block any request satisfying the "if' condition of the "if-then" rule, where the "if' condition corresponds to the pattern (e.g. the rule may be "If user X is requesting resource Y, then block request", in which case the corresponding pattern of user activity is user X requesting resource Y) [i.e., the rule is implemented to block user X requesting resource Y, it blocks traffic (including a first packet and other packets) from user X requesting resource Y]).
Notes: Ho teaches steps obtaining data, the data comprising indications of creations of instances of a flow, and generating an action entry in a policy, but does not explicitly disclose that the data is telemetry data; the policy is policy table;
create, by a network interface card (NIC) having NIC processing circuitry, a flow entry in a flow table, for the particular instance of the flow prior to receiving the first packet;
receive, by the NIC, the first packet of the particular instance of the flow;
determine, based on the flow entry being in the flow table and by the NIC, an action based on the action entry in the policy table; and
execute, by the NIC, the action on the first packet of the particular instance of the flow.
Nimmagadda teaches:
telemetry data (Nimmagadda para. [0067], The network virtualization manager keeps polling the virtualization software of the hosts where the seed VMs are hosted and stores the data [telemetry data]. FIG. 6 conceptually illustrates an example of data collected during a monitoring session in some embodiments);
a policy table (Nimmagadda fig. 27 and para. [0157], Once the affinity groups are identified and component and communication paths from application templates are reconciled, micro-segmentation policies are created. Based on the pattern match found by DPI, the application template is generated and is used for policy creation; see Nimmagadda fig. 28, micro-segmentation policies 2840 comprises first entry for flow from source A to Destination B with action Allow).
It would have been obvious to one skilled in the art before the effective filing date of the claimed invention to modify the system of Ho with the teaching of Nimmagadda in order to incorporate telemetry data and policy table for the data and policy respectively.
One of ordinary skilled in the art would have been motivated because it offers the advantage of providing a centralized system to generate policies not only for its system but also for other system that generating the telemetry data and helping in managing policy rules by providing user ability to filter and sort policy rules when they are organized in a table structure.
Ho-Nimmagadda does not explicitly disclose:
create, by a network interface card (NIC) having NIC processing circuitry, a flow entry in a flow table, for the particular instance of the flow prior to receiving the first packet;
receive, by the NIC, the first packet of the particular instance of the flow;
determine, based on the flow entry being in the flow table and by the NIC, an action based on the action entry in the policy table; and
execute, by the NIC, the action on the first packet of the particular instance of the flow.
Lu teaches:
create, by a network interface card (NIC) having NIC processing circuitry (Lu fig. 8, Network interface card 800 comprises a Processor 802), a flow entry in a flow table (Lu para. [0005], The session entry is generated and maintained by the network interface card; Lu para. [0079], A session entry of the session table includes a match field and an action field), for the particular instance of the flow prior to receiving the first packet (Lu para. [0121], The network interface card checks, according to matching information of the first data packet, whether there is a session entry that matches the first data packet in a session table; Lu para. [0012], The network interface card maintains a session table. Different data flows have different matching information, and different data flows may be processed in different manners. Each session entry is corresponding to one data flow. After receiving the data packet [i.e., first packet], the network interface card queries the session table according to the matching information carried in the data packet);
receive, by the NIC, the first packet (Lu fig. 5, step S502 and para. [0109], A network interface card receives a first data packet) of the particular instance of the flow (Lu para. [0012], The network interface card maintains a session table. Different data flows have different matching information, and different data flows may be processed in different manners. Each session entry is corresponding to one data flow. After receiving the data packet, the network interface card queries the session table according to the matching information carried in the data packet. If the session entry that matches the data packet is found, the data packet is processed according to information recorded in the action field of the session entry);
determine, based on the flow entry being in the flow table and by the NIC, an action based on the action entry in the policy table (Lu fig. 5, steps S504-S506 and para. [0121], The network interface card checks, according to matching information of the first data packet, whether there is a session entry that matches the first data packet in a session table. If there is a session entry that matches the first data packet, step S506 is performed; Lu para. [0122], A session entry includes a match field and an action field. The match field is used to match matching information of a data packet. Information recorded in the action field is used to instruct the network interface card to process a data packet that matches the session entry); and
execute, by the NIC, the action on the first packet (Lu fig. 5 and para. [0129], The network interface card processes the first data packet according to the session entry that matches the first data packet; Lu para. [0131], If the session entry that matches the first data packet exists in the session table, after receiving the data packet, the network interface card may directly process the data packet according to the action field of the session entry) of the particular instance of the flow (Lu para. [0012], The network interface card maintains a session table. Different data flows have different matching information, and different data flows may be processed in different manners. Each session entry is corresponding to one data flow).
It would have been obvious to one skilled in the art before the effective filing date of the claimed invention to further modify the system of Ho with the teaching of Lu in order to incorporate a network interface card (NIC) having NIC processing circuitry for creating a flow entry in a flow table for the particular instance of the flow prior to receiving the first packet, receiving, determining and executing, based on the flow entry being in the flow table, an action based on the action entry in the policy table.
One of ordinary skilled in the art would have been motivated because it offers the advantage of utilizing a network interface card to assist processing of data packets (Abstract).
As per claim 2, Ho-Nimmagadda-Lu discloses the system according to claim 1, as set forth above, Ho also discloses wherein the creation of the instances of the flow occurs prior to the creation of the particular instance of the flow (Ho para. [0039], determine a pattern of user activity in which the user associated with IP address 192.168.1.1 (i.e. user 1001) has requested to access the same URL (a homepage of a same website) ten times in the past five seconds [ten instances of the flow from user 1001 to the website]. The pattern of user activity is mitigated by having the firewall 304 implement rule 850 that addresses the undesirable user activity, e.g. by having the firewall 304 implement the following rule 850 for each incoming request that arrives at the firewall 304: "if the request is from IP address 192.168.1.1 (i.e. the request is from user 1001), and if the request is for that URL (i.e. for that homepage), then block the request". [The citations indicate that determining pattern based on repeating requests from user 1001 for the homepage [corresponding to creations of the instances of the flow] occurs prior establishing rule for requests from user 1001 for the homepage. An incoming request from user 1001 for the homepage after policy implemented is corresponding to the creation of the particular instance of the flow]).
As per claim 3, Ho-Nimmagadda-Lu discloses the system according to claim 1, as set forth above, Ho also discloses wherein as part of determining the pattern of creation of the instances of the flow, the instructions cause the network system to execute a machine learning model (Ho para. [0041], a pattern of user activity may be detected using machine learning (ML). For example, an ML model may be trained using sequences of user activity that have been determined to be undesirable, such as multiple attempts to request a same resource in a short period of time).
As per claim 4, Ho-Nimmagadda-Lu discloses the system according to claim 1, as set forth above, Ho also discloses wherein as part of the generating the action entry, the instructions cause the network system to execute a machine learning model (Ho para. [0041], The ML model might also be trained to output an indication of the rule to be implemented in response to the detected pattern of user activity, e.g. the ML model may issue a recommendation such as block the request or delay the request, etc.).
As per claim 6, Ho-Nimmagadda-Lu discloses the system according to claim 4, as set forth above, Ho also discloses wherein the machine learning model is trained using respective indications of a plurality of creations of instances of a plurality of flows (Ho para. [0041], a pattern of user activity may be detected using machine learning (ML). For example, an ML model may be trained using sequences of user activity that have been determined to be undesirable, such as multiple attempts to request a same resource in a short period of time).
As per claim 8, Ho-Nimmagadda-Lu discloses the system according to claim 1, as set forth above, Nimmagadda also discloses wherein the action entry relates to a backup service (Nimmagadda fig. 16, policy/rule table including action entry for backup service (ID6)).
Similar rationale in claim 1 is applied.
Per claims 9-12, 14 and 16, they do not teach or further define over the limitations in claims 1-4, 6 and 8 respectively. As such, claims 9-12, 14 and 16 are rejected for the same reasons as set forth in claims 1-4, 6 and 8 respectively.
Per claims 17-20, they do not teach or further define over the limitations in claims 1-4 respectively. As such, claims 17-20 are rejected for the same reasons as set forth in claims 1-4 respectively. Ho also discloses non-transitory computer-readable storage media (Ho para. [0030], The processor 408 may be implemented as one or more processors configured to execute instructions stored in a memory (e.g. in memory 410) or in another non-transitory computer readable medium).
Claims 5 and 13 are rejected under 35 U.S.C. 103 as being unpatentable over Ho et al. (US 2024/0015137, Filed: Jul. 6, 2022), in view of Nimmagadda et al. (US 2018/0176252, Pub. Date: Jun. 21, 2018), in view of Lu (US 2020/0136998, Pub. Date: Apr. 30, 2020), in view of Gupta et al. (US 2022/0166756, Pub. Date: May 26, 2022).
As per claim 5, Ho-Nimmagadda-Lu discloses the system according to claim 4, as set forth above, Ho does not explicitly disclose wherein the machine learning model is an unsupervised machine learning model.
Gupta teaches:
the machine learning model is an unsupervised machine learning model (Gupta para. [0028], the aforementioned process can be iteratively performed, using supervised or unsupervised machine learning, to generate multiple sets of firewall rules).
It would have been obvious to one skilled in the art before the effective filing date of the claimed invention to further modify the system of Ho with the teaching of Gupta for the machine learning model is an unsupervised machine learning model.
One of ordinary skilled in the art would have been motivated because it offers the advantage of allowing the model to generate policy rule based on unlabeled data thus saving resources for not preparing labeled data for the model.
Per claim 13, it does not teach or further define over the limitations in claim 5. As such, claim 13 is rejected for the same reasons as set forth in claim 5.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Phillips (US 10237240) Assessing Risk Associated With Firewall Rules;
Ballard et al. (US 20210357242) System And Method For Hardware Offloading Of Nested Virtual Switches;
Kamisetty et al. (US 12278762) Systems And Methods To Prevent Packet Reordering When Establishing A Flow Entry;
Guo et al. (US 20250141803) Cloud System, Packet Processing Method And Apparatus, And Network Interface Card.
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to VINH NGUYEN whose telephone number is (571)272-4487. The examiner can normally be reached Monday-Friday: 7:30 AM - 5:30 PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, KAMAL B DIVECHA can be reached at (571)272-5863. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/VINH NGUYEN/Examiner, Art Unit 2453
/KAMAL B DIVECHA/Supervisory Patent Examiner, Art Unit 2453
