Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This final office action is prepared in response to amendments and arguments filed by Applicant on June 23, 2026 as a reply to the non-final office action mailed on March 23, 2026.
Claims 1 and 10 have been amended.
Claims 1-19 are pending.
Claims 1-19 are rejected.
Response to Arguments
The claim amendments and Applicant’s arguments filed on June 23, 2026 have been carefully considered but deemed unpersuasive in view of the new grounds of rejection as set forth below, necessitated by Applicant’s substantial amendments to the claims which significantly affected the scope thereof, and will require further search and consideration.
Accordingly, THIS ACTION IS MADE FINAL. See MPEP 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-19 are rejected under 35 U.S.C. 103 as being obvious over Costante (U.S. 2020/0404010) in view of Rados et al. (US 2015/0067816).
Regarding claim 1, Costante disclosed a method of providing reactive network security for a building automation system, the building automation system including a controller and a network of electronic devices connected in electronic communication (Costante, [0002-0003, 0014]) the method comprising:
monitoring, by the controller, external electronic communications received by the network (Costante, [0076], “Network traffic on a data network is monitored”; [0216], “The data traffic is monitored and attributes are extracted from the data traffic”), which includes:
comparing, by the controller, at least one traffic property of the external electronic communications to a corresponding baseline traffic property (Costante disclosed in Abstract and paragraphs [0008-0013, 0025-0029, 0124, 0250] about a method of detecting anomalous behavior in data traffic on a data communication network using attribute based policies, wherein an attribute based policy comprises declarative policies that define the condition and what has to be done in a protocol generic way, and a whitelist policy describes acceptable data traffic and the associated action (e.g. permit) to take when an incoming data traffic is deemed acceptable. Costante additionally disclosed in [0005] that “whitelisting systems maintain a model of the normal behavior of a system and compare the current activities with it: in case a mismatch occurs, an alert is raised.” In other words, traffic that matches the whitelist policies are considered traffic of normal behavior. Therefore, Examiner considers Costante’s act of determining whether network activities/traffic matches whitelist policies (Costante, Fig. 4, step G) as being equivalent to comparing network activities/traffic to normal/baseline traffic behavior/property to determine whether they match); and
instituting, by the controller, a traffic communication protocol for at least one of the controller and the electronic devices based on said comparison (Costante, [0244] and the table disclosed the traffic control protocol based on comparison), the instituting of the traffic communication protocol causes one or more of:
restricting of at least one type of incoming external electronic communication to the network (Costante, [0244] and table disclosed the policy P3 that deny a set of traffic based on the result of comparison), which includes at least one of:
using a virtual private network to communicate within the network (Costante disclosed in Fig. 5 examples of host and link attributes contained in a host DB and a link DB, and the host DB shows that hosts A, B, and C use private IP addresses 10.10.x.x. This disclosure provides evidence that the hosts A, B and C are in a virtual private network), and
encrypting of the electronic communication within the network (Costante disclosed in para. [0053] that “attributes-based policies such as … ‘A controller can only be reprogrammed over a secure connection (e.g., Secure Sockets Layer (SSL), HyperText Transfer Protocol Secure (HHTPS)” where SSL and HTTPS requires encryption of the communications).
Costante might not have explicitly disclosed but Rados et al. disclosed
enabling a bandwidth limitation for an electric device that is one of the electronic devices in the network and an external electronic device that transmitted at least a portion of the external electronic communications monitored by the controller (Rados disclose din [0060] that “if traffic analysis component 325 identifies that a bandwidth limit was exceeded by a particular user device 210, traffic analysis component 325 may determine that remedial action should be taken.” Rados then disclosed in [0062] that the remedial action could be blocking the traffic, which essentially limit the bandwidth for the particular user device 210 to zero).
One of ordinary skill in the art would have been motivated to combine Costante and Rados because both references disclosed methods for monitoring network traffic to detect anomalous behavior and applying security policies/measures the remediate the impact of the anomalous traffic on the network (Costante, Abstract; Rados, Abstract). Therefore it would have been obvious that Rados’ teaching of the remedial action that limits the bandwidth/traffic from the anomalous user device could be readily integrated into Costante’s system and method as it added a useful way for Costante’s system and method to alleviate the undesirable impact that anomalous traffic would have on its network.
Claim 10 lists substantially the same elements as claim 1, but in system form rather than method form. Therefore, the rejection rationale for claim 1 applies equally as well to claim 10.
Regarding claims 2 and 11, Costante and Rados disclosed the subject matter of claims 1 and 10.
Costante further disclosed wherein the monitoring, by the controller, of the external electronic communications includes: determining, by the controller, the at least one traffic property of the electronic communications (Costante, [0008-0009, 0032-0033], “parsing the data traffic to extract protocol field values of a protocol message of the data traffic; … deriving, from the extracted protocol field values, attribute values of attributes of one of the first host, the second host, and the link”).
Regarding claims 3 and 12, Costante and Rados disclosed the subject matter of claims 1 and 10.
Costante further disclosed wherein the monitoring, by the controller of the external electronic communications is continuous monitoring (Costante, [0127], “The goal of the Attribute extraction component is to find as much information as possible about the monitored network, a single host, a communication link, etc., by continuously and passively monitoring the network traffic”).
Regarding claims 4 and 13, Costante and Rados disclosed the subject matter of claims 1 and 10.
Costante further disclosed wherein a primary function of the controller is operating the building automation system (Costante, [0053], “In a Building Automation application, attribute extraction may be used to understand if a host is a light, a thermostat, a controller, an IP-camera a card reader etc., and to detect intrusions or malicious activities by matching against attributes-based policies such as”).
Regarding claims 5 and 14, Costante and Rados disclosed the subject matter of claims 1 and 10.
Costante further disclosed wherein the monitoring includes the restricting of the type of incoming electronic communication, said restricting including at least one of:
restricting incoming external electrical communications initiated by a software application that caused a portion of the external electrical communications monitored by the controller,
enabling an inbound traffic rule for incoming external electrical communications based on the at least one traffic property (Costante disclosed in [0006], “The invention aims to provide an anomalous behavior detection that may be adapted more easily to changes, e.g. upgrades, in the network” and in [0265] that “malicious activities that have not been noted before, i.e. for which no specific blacklist policy is available yet, may be lead to new or updated blacklist policies.” Blacklist policies block the activities/communications from/to hosts on the blacklist, which is a form of traffic restriction, or firewall protection),
enabling a dynamic restriction of at least one external internet protocol address, port, and protocol that corresponds to the electrical communications monitored by the controller,
enabling or modifying a firewall protection based on the at least one traffic property, and enabling a bandwidth limitation for an electric device that is one of the electronic devices in the network and an external electronic device that transmitted at least a portion of the external electrical communications monitored by the controller.
Regarding claims 6 and 15, Costante and Rados disclosed the subject matter of claims 1 and 10.
Costante further disclosed wherein the at least one traffic properties of the electronic communications is metadata of the external electronic communications (Costante, Fig. 5 shows examples of attributes extracted from the monitored traffic, where information such as OS, host, vendor and role is the metadata of the communication activities).
Regarding claims 7 and 16, Costante and Rados disclosed the subject matter of claims 1 and 10.
Costante further disclosed wherein the instituting, by the controller, of the traffic communication protocol is in response to the at least one traffic property of the external electronic communications exceeding the corresponding baseline traffic property by a predetermined amount (Costante, [0270, 0271], “If the support to the hypothesis that a host/link in quarantine is malicious exceeds a blacklist threshold, raising an alert and using the data traffic related to the host or link to extract new blacklist policies. … updating the current policies using the extracted new whitelist or blacklist policies”).
Regarding claims 8 and 17, Costante and Rados disclosed the subject matter of claims 7 and 16.
Costante further disclosed wherein the instituting, by the controller, of the traffic communication protocol is configured to reduce the at least one traffic property to no longer exceed the corresponding baseline traffic property by the predetermined amount (Costante, [0342], “The system allows to automatically capture changes in the monitored network behavior with reduced false alerts.”).
Regarding claims 9 and 18, Costante and Rados disclosed the subject matter of claims 7 and 16.
Costante further disclosed wherein the at least one traffic property of the external electronic communications includes a count of the external electronic communications received by one of the electronic devices in a preceding time period, and the corresponding baseline traffic property is an expected total of the external electronic communications received by the one of the electronic devices in said time period, and the instituting is in response to the count of the external electronic communications received by one of the electronic devices exceeding the expected total of the electronic communications received by the one of the electronic devices by the predetermined amount (Costante, [0077], “ A link meta-model is provided which comprises the following attributes: {source IP, destination IP, protocol, source port, destination port, operation, number of occurrences}” and [0122], “the data traffic may be monitored over a relatively long period of time, e.g. hours, days, weeks, to extract the protocol field values that may enable to derive the attribute values as described”).
Regarding claim 19, Costante and Rados disclosed the method of claim 1.
Costante further disclosed wherein the instituting of the traffic communication protocol causes one or more of:
the using of the virtual private network to communicate within the network (Costante disclosed in Fig. 5 examples of host and link attributes contained in host DB and link DB, and the host DB shows that hosts A, B, and C use private IP addresses 10.10.x.x. This disclosure provides evidence that the hosts A, B and C are in a virtual private network), and
the encrypting of the electronic communication within the network (Costante disclosed in para. [0053] that “attributes-based policies such as … ‘A controller can only be reprogrammed over a secure connection (e.g., Secure Sockets Layer (SSL), HyperText Transfer Protocol Secure (HHTPS).” Note that SSL and HTTPS require encryption of the communications).
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SHIRLEY X ZHANG whose telephone number is (571)270-5012. The examiner can normally be reached 8:30am - 5:00pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Joon H Hwang can be reached at 571-272-4036. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SHIRLEY X ZHANG/Primary Examiner, Art Unit 2447
