Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in
37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible
for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been
timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR
1.114. Applicant’s submission filed on 08/26/2026 has been entered.
Claims 1, 8 and 15 are independent claims. The applicant has amended claims 1, 8 and
15, claim 20 has been cancelled, claim 21 has been newly added. Claims 1-19 and 21 have been examined and are pending. This Action is made Non-FINAL.
Response to Arguments
Applicants’ arguments with respect to claim(s) 1, 8 and 15 in the instant Amendment, filed on 08/26/2026, with respect to limitations listed below, have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
The Examiner respectfully suggests that the claim be further amended; details in the
specification be incorporated, to distinguish the claimed invention over prior art of record.
Should the Applicant desire an interview to further clarify the claim interpretation/rejections,
please contact the Examiner at (571) 272-1531 to schedule an interview.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 7, 8, 14 and 15 is/are rejected under 35 U.S.C. 103 as being unpatentable over Chung (US 11,863,528 B1), in further view of Ellard (US 20150358279 A1).
Regarding Claim 1
A method of a firewall for preventing data exfiltration, comprising:
receiving, at the firewall on an egress node of a network, a network request from a client device within the network, the network request including a first domain name and a first IP address (Chung: col. 4, ll. 29-33: firewall security rules determine the egress behavior of network packets entering through the firewall; claim 1: firewall receives a network packet having a first destination IP address corresponding to a domain name; col. 8, ll. 17-30: client 302 generates packet 324 containing destination IP address 326, and firewall 306 intercepts and parses packet 324 to identify destination IP address 326).
in response to receiving the network request, resolving, by the firewall, a second IP address based on the first domain name, wherein resolving the second IP address comprises transmitting, by the firewall to a domain name system (DNS) resolver, a DNS request separate from the network request and including the first domain name, and receiving, by the firewall from the DNS resolver, the second IP address in response to the DNS request (Chung: col. 8, ll. 66 - col. 9, ll. 10: reverse proxy 314 receives packet 324, obtains the domain name associated with packet 324, determines resource IP address 330 based on the identified domain name, and submits the obtained domain name to DNS server 218 or 220; col. 10, ll. 37-47: reverse proxy 514 parses the network packet to identify its domain name, generates and submits a DNS command such as “nslookup example.com,” and receives resource IP address 530C in response; col. 13, ll. 18-32: reverse proxy obtains the domain name associated with the packet and determines the resource IP address by submitting the domain name of the packet to a DNS server); and
inserting, by the firewall, the second IP address into the network request in place of the first IP address by modifying a destination field of the network request prior to forwarding the network request (Chung: col. 9, ll. 8-12: after resource IP address 330 is determined, reverse proxy 314 substitutes IP address 328 with resource IP address 330 and forwards packet 324 to resource 310; col. 13, ll. 32-36: reverse proxy transforms the destination IP address to the resource IP address, attaches the new IP address to the packet, and forwards the packet to the resource IP address; claim 21: identifying a first header including a first network IP address and replacing the first header with a second header including a second network IP address).
Chung does not explicitly disclose wherein the resolving and inserting steps are performed by the firewall itself. Chung discloses firewall receiving and filtering the network packet while a reverse proxy performs the domain name resolution and destination address substitution. However, Ellard discloses a gateway positioned between a protected network and an external network, wherein the gateway may include a router, switch, firewall, proxy, or other network device (Ellard: ¶0020). Ellard further discloses that the gateway itself may query a DNS server for a requested hostname and receive the IP address assigned to the requested hostname (Ellard: ¶0025), and that the gateway may receive an outbound packet and replace the destination address of the packet with the actual address of the server prior to forwarding the packet (Ellard: ¶0029).
It would have been obvious to a POSTIA before the effective filing date of the claimed invention to modify Chung such that the domain name resolution and destination address substitution functionality of the reverse proxy is performed by the firewall/gateway, as taught by Ellard, because Chung and Ellard both address controlling outbound network traffic at a network boundary using DNS derived destination information, and Ellard teaches a gateway architecture in which the gateway itself performs both DNS resolution and destination address translation. Thus, Ellard demonstrates that a gateway device performing both functions was a known and operable configuration, and applying that known configuration to Chung would have predictably resulted in the firewall/gateway performing Chung’s disclosed domain resolution and address substitution operations on outbound traffic. The motivation to combine would be to simplify management of network egress and improve enforcement of outbound traffic security policies and reduced firewall ACL exposure, and Ellard’s teaching that unauthorized applications may mask traffic or change destination addresses resulting in unauthorized exfiltration of sensitive data.
Regarding Claim 7
Chung as modified discloses the limitations of claim 1. Chung further discloses sending the network request to the second IP address (Chung: col. 9, ll. 8-12: reverse proxy 314 substitutes IP address 328 with resource IP address 330 and forwards packet 324 to resource 310; col. 13, ll. 32-36: after transforming the destination IP address to the resource IP address, the reverse proxy forwards the packet to the resource IP address). Same rationale applies here as above in rejecting claim 1.
Regarding Claim 8
Claim 8 is directed to a computing device corresponding to the processor-implemented method in claim 1. Claim 8 is similar in scope to claim 1 and is therefore rejected under similar rationale.
Regarding Claim 14
Claim 14 is directed to a computing device corresponding to the processor-implemented method in claim 7. Claim 14 is similar in scope to claim 7 and is therefore rejected under similar rationale.
Regarding Claim 15
Claim 15 is directed to an executable instruction corresponding to the processor-implemented method in claim 1. Claim 15 is similar in scope to claim 1 and is therefore rejected under similar rationale.
Claims 2, 9 and 16 is/are rejected under 35 U.S.C. 103 as being unpatentable over Chung (US 11,863,528 B1), in view of Ellard (US 20150358279 A1) as applied to claims 1, 8 and 15 above, and in further view of James (US 20230283591 A1).
Regarding Claim 2
Chung as modified by Ellard discloses the limitations of claim 1. Chung further discloses, after substituting the resource IP address for the destination IP address, forwarding and processing the modified network packet based on the substituted resource IP address (Chung: col. 9, ll. 8-12; col. 13, ll. 32-36). However, Chung and Ellard do not explicitly disclose, after inserting the second IP address into the network request, processing the network request based on the second IP address and the first domain name. James discloses evaluating and controlling network communications based on both an IP address associated with a DNS response and the FQDN associated with that IP address, including determining a traffic rule for the FQDN based on information associated with the IP address and permitting, blocking, or redirecting the associated communication (James: ¶¶0018-0019, 0023-0025, 0033-0035).
Given the teachings of James, a POSTIA would have recognized the desirability of modifying the teachings of Chung and Ellard by processing a network request using a substituted IP address while retaining the original domain association. James teaches that after replacing the original IP address for a FQDN with an alternative IP, the firewall provides the modified response and the client initiates a connection using the new IP while still associated with the same domain name, making it obvious to process the request based on the second IP and first domain name.
Regarding Claim 9
Claim 9 is directed to a computing device corresponding to the processor-implemented method in claim 2. Claim 9 is similar in scope to claim 2 and is therefore rejected under similar rationale.
Regarding Claim 16
Claim 16 is directed to an executable instruction corresponding to the processor-implemented method in claim 2. Claim 16 is similar in scope to claim 2 and is therefore rejected under similar rationale.
Claims 3-4, 10-11 and 17-18 is/are rejected under 35 U.S.C. 103 as being unpatentable over Chung (US 11,863,528 B1), in view of Ellard (US 20150358279 A1) as applied to claims 1, 8 and 15 above, and in further view of Redekop (US 20180019968 A1).
Regarding Claim 3
Chung as modified by Ellard discloses the limitations of claim 1. Chung and Ellard do not explicitly disclose blocking the network request based on a comparison of the first IP address to the second IP address. However, Redekop discloses storing a destination IP address resolved from a DNS query in a source-destination-time-to-live tuple and, upon receiving an IP packet, comparing/verifying the destination address of the received packet against the stored tuple, wherein the packet is blocked when the comparison does not verify the packet (Redekop: ¶0048-¶0049; ¶0055-¶0056).
It would have been obvious to one having ordinary skill in the art before the effective filing date of the claimed invention to further modify Chung as modified by Ellard to compare the first destination IP address of the received network request with the second IP address obtained through DNS resolution, as taught by Redekop, and block the network request when the addresses do not verify in order to prevent traffic from being forwarded to an address that was not validated through DNS. Redekop teaches that such DNS derived address verification is used to block traffic that does not correspond to a previously resolved destination address.
Regarding Claim 4
Chung as modified by Ellard discloses the limitations of claim 1. Chung and Ellard do not explicitly disclose blocking the network request based on the second IP address. However, Redekop discloses allowing IP traffic only when the destination IP address was obtained through a validated DNS resolution, determining whether an address identified in a received packet is authorized by verifying that the address identifies one of the resolved addresses, and blocking the packet when the address is not authorized (Redekop: ¶¶0090-0092; see also ¶¶0048-0049, 0056).
It would have been obvious to one having ordinary skill in the art before the effective filing date of the claimed invention to further modify Chung as modified by Ellard to block the network request based on the second IP address, as taught by Redekop, in order to prevent outbound traffic from being forwarded to an address that is not associated with a validated DNS resolution. Redekop teaches using DNS resolved destination address information to determine whether received traffic is authorized and blocking the traffic when that determination fails.
Regarding Claim 10
Claim 10 is directed to a computing device corresponding to the processor-implemented method in claim 3. Claim 10 is similar in scope to claim 3 and is therefore rejected under similar rationale.
Regarding Claim 11
Claim 11 is directed to a computing device corresponding to the processor-implemented method in claim 4. Claim 11 is similar in scope to claim 4 and is therefore rejected under similar rationale.
Regarding Claim 17
Claim 17 is directed to an executable instruction corresponding to the processor-implemented method in claim 3. Claim 17 is similar in scope to claim 3 and is therefore rejected under similar rationale.
Regarding Claim 18
Claim 18 is directed to an executable instruction corresponding to the processor-implemented method in claim 4. Claim 18 is similar in scope to claim 4 and is therefore rejected under similar rationale.
Claims 5, 12 and 19 is/are rejected under 35 U.S.C. 103 as being unpatentable over Chung (US 11,863,528 B1), in view of Ellard (US 20150358279 A1) as applied to claims 1, 8 and 15 above, and in further view of Jung (US 20180367619 A1).
Regarding Claim 5
Chung as modified by Ellard discloses the limitations of claim 1. Chung and Ellard do not explicitly disclose determining a service associated with the network request and modifying the network request based on a comparison of a port identified in the network request to a conventional port associated with the service. However, Jung discloses a proxy device receiving a connection request identified as an HTTP connection request through port 80 and, in response to determining that the connection is to be redirected from HTTP to HTTPS, establishing the connection through a changed port by transmitting a connection request to HTTPS port 443 (Jung: ¶¶0158-0162, 0167-0169).
It would have been obvious to one having ordinary skill in the art before the effective filing date of the claimed invention to further modify Chung as modified by Ellard to determine a service associated with the network request and modify the network request based on the relationship between the port identified in the request and the port conventionally used for the determined service, as taught by Jung, in order to redirect communications to the port appropriate for the selected service. Jung teaches recognizing an HTTP connection request on port 80 and changing the connection to HTTPS port 443 when redirecting the communication from HTTP to HTTPS.
Regarding Claim 12
Claim 12 is directed to a computing device corresponding to the processor-implemented method in claim 5. Claim 12 is similar in scope to claim 5 and is therefore rejected under similar rationale.
Regarding Claim 19
Claim 19 is directed to an executable instruction corresponding to the processor-implemented method in claim 5. Claim 19 is similar in scope to claim 5 and is therefore rejected under similar rationale.
Claims 6 and 13 is/are rejected under 35 U.S.C. 103 as being unpatentable over Chung (US 11,863,528 B1), in view of Ellard (US 20150358279 A1) as applied to claims 1 and 8 above, and in further view of Salcedo (US 20160006693 A1).
Regarding Claim 6
Chung as modified by Ellard discloses the limitations of claim 1. Chung and Ellard do not explicitly disclose obtaining a second domain name based on a reverse lookup of the first IP address at the firewall. However, Salcedo discloses that when a network request includes an IP address instead of a domain name, a processor of the firewall may perform a reverse domain name lookup (reverse DNS lookup) and extract a domain name associated with the IP address from the reverse domain name lookup (Salcedo: ¶¶0005, 0063, 0070, 0085-0086).
It would have been obvious to one having ordinary skill in the art before the effective filing date of the claimed invention to further modify Chung as modified by Ellard to obtain a second domain name based on a reverse lookup of the first IP address at the firewall, as taught by Salcedo, in order to determine domain-name information associated with an IP address and enable application of domain security policies to network traffic identified by IP address. Salcedo expressly teaches performing a reverse DNS lookup at the firewall to recover a domain name associated with an IP address in a network request and using the resolved domain name for security policy enforcement.
Regarding Claim 13
Claim 13 is directed to a computing device corresponding to the processor-implemented method in claim 6. Claim 13 is similar in scope to claim 6 and is therefore rejected under similar rationale.
Claims 21 is/are rejected under 35 U.S.C. 103 as being unpatentable over Chung (US 11,863,528 B1), in view of Ellard (US 20150358279 A1) as applied to claim 1, and in further view of Kudla (US 20070300296 A1).
Regarding Claim 21
Chung as modified by Ellard discloses the limitations of claim 1. Chung and Ellard do not explicitly disclose filtering the first IP address based on geographic location. However, Kudla discloses filtering network traffic based on geographic location by mapping IP addresses to geographic regions, comparing an IP address extracted from network traffic with IP addresses associated with geographic regions, and performing a filtering action based on the geographic association (Kudla: ¶¶0040, 0045-0048, 0054-0055).
It would have been obvious to one having ordinary skill in the art before the effective filing date of the claimed invention to further modify Chung as modified by Ellard to filter the first IP address based on geographic location, as taught by Kudla, in order to control outbound network communications according to geographic access control policies and block traffic associated with disallowed geographic regions. Kudla expressly teaches applying geographic security assertions to IP address ranges to permit or block network traffic based on the geographic region associated with the IP address.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SAAD ABDULLAH whose telephone number is 571 -272-1531.
The examiner can normally be reached on Monday-Friday 9am-5pm EST. If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, LYNN FIELD can be
reached on 571-272-2092.
Information regarding the status of an application may be obtained from the Patent
Application Information Retrieval (PAIR) system. Status information for published applications
may be obtained from either Private PAIR or Public PAIR. Status information for unpublished
applications is available through Private PAIR only. For more information about the PAIR
system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR
system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would
like assistance from a USPTO Customer Service Representative or access to the automated
information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SAAD AHMAD ABDULLAH/ Examiner, Art Unit 2431
/MICHAEL R VAUGHAN/ Primary Examiner, Art Unit 2431
