DETAILED ACTION
This Office action is in response to amendments and remarks filed by Applicant on 1/6/2026.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement PTO-1449
The Information Disclosure Statement submitted by applicant on 1/6/2026 has been considered. The submission is in compliance with the provisions of 37 CFR § 1.97. Form PTO-1449 signed and attached hereto.
Response to Amendment
Applicant presents amendments to claims 1, 5, 8, 12, 15, and 19. All amendments have been fully considered.
Applicant’s amendments are sufficient to overcome the previous combination of references serving as the basis for the rejection under 35 U.S.C. 103. A new search was conducted as well as a review of the previously identified prior art. It was determined that the added subject matter exists in the previously relied upon secondary reference used as part of the previous combination of references in the rejection of claims 7 and 14. The reference is applied to the amended independent claims below and is combined with the previous art to make a new rejection under 35 U.S.C. 103.
Response to Arguments
Applicant presents arguments with respect to independent claims 1, 8, and 15. All arguments have been fully considered.
Applicant argues that the previously cited combination of references fails to disclose the recited untrusted execution node. The Examiner Responds: The recited qualification of the execution node being “untrusted” provides little indication as to what type of trust is being articulated. Under the required broadest reasonable interpretation, the term “untrusted” is evident in both references used in combination supporting the rejection. For example, the primary reference, Sultan, discloses specific policies and policy frameworks limiting the destination of the requested data, which can be interpreted that the remote requesting entities are not wholly trusted. The reference further provides that the request to egress data can come from the isolated environed to some other location that is outside of the isolated environment. See Sultan 15:32–35. Additionally, the teaching by the secondary reference, Brenner, of cryptographically signing data so that a recipient must possess verified decryption means to read the received data also indicates that trust is at issue, and requires some type of authentication to overcome the untrusted requesting entity.
Applicant argues that the previously cited combination of references fails to disclose an environment with the recited container service within a cloud data platform. The Examiner responds: Applicant correctly points out the disclosure by the primary reference, Sultan, receiving the egress request from a remote node. The recitation of a “cloud data platform” has little weight in the field of network computing architecture considering the freedom network architects have to design remote network processors and storage. As such, there is nothing in the claim, either functionally or otherwise, that would make the remote network disclosed in the reference inapplicable to the claimed invention. Applicant’s assertion that the references fail to disclose “a network-layer request originating from a zero-trust worker model” impermissibly imports subject matter from the specification into the claims. Applicant has ample freedom to choose the language used to articulate the invention. If Applicant intends specific conceptual limitations, Applicant best articulate that in the language of the claims.
Applicant argues that the cryptographically signed egress policy taught by the secondary reference fails to cover the functionality of the egress policy recited in the claim. The Examiner Responds: The secondary reference is relied upon to the extent that policies (including egress policies) are known to be cryptographically signed, validate, and transferred. The introduction of this concept is presented to show that the egress policy associated with an egress request can be signed, validated, and transferred, despite the primary reference being silent on this point. The recited limitations of receiving, validating, determining compliance, and granting or denying can be performed with a policy whether signed or unsigned. There is nothing in the claim that requires special functionality requiring the manifestation of the egress policy to signed or unsigned.
Applicant argues that the primary reference discloses validation that is “content-level (file/decoder rules), not validation of a network flow-connection request against a signed egress policy. The Examiner Responds: Applicant asserts that the primary reference fails to teach something that is nowhere in the claims. The reference, Sultan at 2:30–46, specifically discloses “a policy framework” and allows “data egress requests”, where “[t]he requests are validated and the requested data may be egressed upon validation”. Where Applicant finds “content-level (file/decoder rules)” in the reference is unclear, nor is the limitation “validation of a network flow-connection request” anywhere in the claim. If Applicant intends a distinction from how Sultan uses the term “egress request” where some network or object-layered determination is being performed, Applicant should articulate that in the claim. As it stands, the language of Applicant’s claims reads on the previously cited combination of references.
Applicant’s arguments are unpersuasive.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 7–8, 14–15 rejected under 35 U.S.C. 103 as being unpatentable over Sultan (US 11,822,690 B1, issued Nov. 21, 2023) in view of Brenner (US 2015/0172260 A1, published Jun. 18, 2015) in view of Quevedo (US 11,122,083 B1, issued Sep. 14, 2021).
Regarding claims 1, 8, and 15, Sultan discloses: a system comprising: one or more hardware processors of a machine; and at least one memory storing instructions that, when executed by the one or more hardware processors, cause the system to perform operations comprising: receiving a network egress request, via an untrusted execution node, from a container service within a cloud data platform (receiving an egress request 892 from a remote computing device 820 for sending data to a destination 120. Sultan Figure 8 and ¶ 20:59–67.); receiving a [cryptographically signed egress] policy associated with the network egress request (administrators provide policies, which are constraints placed on egress of data of specified types. Sultan 2:47–55.); validating the network egress request against the [cryptographically signed] egress policy (policies are applied by comparing the extracted information to the constraints specified by the relevant policy data. Sultan 2:60–62.); establishing a determination of whether the network egress request complies with the [cryptographically signed] egress policy based on the validating; and granting or denying the network egress request based on the determination (if the data conforms to the applicable policies the data is validated and is denoted as being permissible for egress to the requested location. Sultan 2:60–64.).
Sultan does not disclose: a cryptographically signed egress policy; the granting comprising proxying network traffic associated with the network egress request through an egress proxy that performs network address translation to route outbound and corresponding return traffic for the container service.
However, Brenner does disclose: a cryptographically signed egress policy (signing a policy and storing in a cloud environment to be distributed and authenticated for use at an endpoint. Brenner ¶ 49.).
Therefore, it would have been prima facie obvious to one of ordinary skill in the art prior to the effective filing date of the claimed invention to modify the verification of egress requested information based upon policy constraints of Sultan with cryptographically signing policies based upon the teachings of Brenner. The motivation being to apply standard cryptographic operations to secure data being exposed on a network.
Sultan in view of Brenner does not disclose: the granting comprising proxying network traffic associated with the network egress request through an egress proxy that performs network address translation to route outbound and corresponding return traffic for the container service.
However, Quevedo does disclose: the granting comprising proxying network traffic associated with the network egress request through an egress proxy that performs network address translation to route outbound and corresponding return traffic for the container service (network traffic manager routes traffic (which amounts to the recited traffic proxy) and applies policies to determine if the obtained domain name identifies a trusted service by checking whether the name is stored on a list of trusted domain names. Quevedo 8:7–30.).
Therefore, it would have been prima facie obvious to one of ordinary skill in the art prior to the effective filing date of the claimed invention to modify the verification of egress requested information based upon policy constraints of Sultan with a network traffic policy including a list of trusted domain for checking the received request based upon the teachings of Quevedo. The motivation being to determine the destination of protected data and verify it is included on an authorized domain. Quevedo 1:43–57.
Regarding claims 7 and 14, Sultan in view of Brenner discloses the limitations of claims 1 and 8, respectively. Sultan in view of Brenner does not disclose: wherein the cryptographically signed egress policy associated with the network egress request includes a list of trusted domains for DNS resolution, the list of trusted domains is defined by a customer account administrator.
However, Quevedo does disclose: wherein the cryptographically signed egress policy associated with the network egress request includes a list of trusted domains for DNS resolution, the list of trusted domains is defined by a customer account administrator (network traffic manager applies policies to determine if the obtained domain name identifies a trusted service by checking whether the name is stored on a list of trusted domain names. Quevedo 8:7–30.).
Therefore, it would have been prima facie obvious to one of ordinary skill in the art prior to the effective filing date of the claimed invention to modify the verification of egress requested information based upon policy constraints of Sultan with a network traffic policy including a list of trusted domain for checking the received request based upon the teachings of Quevedo. The motivation being to determine the destination of protected data and verify it is included on an authorized domain. Quevedo 1:43–57.
Claims 2, 9, 16 rejected under 35 U.S.C. 103 as being unpatentable over Sultan in view of Brenner in view of Kaciulis (US 2024/0333646 A1, published Oct. 3, 2024).
Regarding claims 2, 9, and 16, Sultan in view of Brenner in view of Quevedo discloses the limitations of claims 1, 8, and 15, respectively. Sultan in view of Brenner in view of Quevedo does not disclose: wherein the network egress request includes a request to access an external service over a public communication network.
However, Kaciulis does disclose: wherein the network egress request includes a request to access an external service over a public communication network (the egress request includes a request to access or electronically communicate with an external or third-party device. Kaciulis ¶ 476.).
Therefore, it would have been prima facie obvious to one of ordinary skill in the art prior to the effective filing date of the claimed invention to modify the verification of egress requested information based upon policy constraints of Sultan with the egress request includes access to an external service over a public network based upon the teachings of Kaciulis. The motivation being to protect access to in a peering relationship. Kaciulis ¶ 476.
Claims 6, 13, 20 rejected under 35 U.S.C. 103 as being unpatentable over Sultan in view of Brenner in view of Gallardo (US 2021/0209243 A1, published Jul. 8, 2021).
Regarding claims 6, 13, and 20, Sultan in view of Brenner in view of Quevedo discloses the limitations of claims 1, 8, and 15, respectively. Sultan in view of Brenner in view of Quevedo does not disclose: wherein validating the network egress request against the cryptographically signed egress policy further comprises: intercepting network traffic originating from the container service using an extended Berkeley Packet Filter (eBPF) program; enforcing a network policy on the network traffic according to the eBPF program; and dropping unauthorized network traffic.
However, Gallardo does disclose: wherein validating the network egress request against the cryptographically signed egress policy further comprises: intercepting network traffic originating from the container service using an extended Berkeley Packet Filter (eBPF) program; enforcing a network policy on the network traffic according to the eBPF program; and dropping unauthorized network traffic (intercepting requests using an extended Berkeley packet filter and applying a security policy provided by the local private network and block operations. Gallardo ¶ 33.).
Therefore, it would have been prima facie obvious to one of ordinary skill in the art prior to the effective filing date of the claimed invention to modify the verification of egress requested information based upon policy constraints of Sultan with intercepting network traffic using an extended Berkeley Packet Filter and enforcing a network policy on network traffic based upon the teachings of Gallardo. The motivation being control access to the protected resources. Gallardo ¶ 3.
Allowable Subject Matter
Claim 3–5, 10–12, 17–19 objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to VANCE LITTLE whose telephone number is (571) 270-0408. The examiner can normally be reached Monday - Friday 9:30am - 5:30pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jung (Jay) Kim can be reached at (571) 272-3804. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/VANCE M LITTLE/Primary Examiner, Art Unit 2494