DETAILED ACTION
This action is in response to communication filed on 4/26/2024.
Claims 1-20 are pending.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 10/25/2024 is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966), that are applied for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-2, 4-6, 8-9, 15-16 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Cidon et al. (US 2021/0067468) in view of Lin et al. (US 2019/0281014).
Regarding claim 1, Cidon discloses a method for controlling data message flow processing by an edge cluster that comprises (i) a first set of edge machines operating in a first set of locations of a particular public cloud and (ii) a second set of edge machines operating in a second set of locations of the particular public cloud, the method comprising:
at a set of one or more controllers that controls the edge cluster (Cidon discloses a set of controllers (controller cluster) that controls the edge cluster (MFNs, including edge MFNs); see [0079] “a logically centralized controller cluster 160 (e.g., a set of one or more controller servers) operate inside or outside of one or more of the public clouds 105 and 110, and configure the public-cloud components of the managed forwarding nodes 150 to implement the virtual network over the public clouds 105 and 110. In some embodiments, the controllers in this cluster are at various different locations (e.g., are in different public cloud datacenters) in order to improve redundancy and high availability”):
configuring first and second sets of managed forwarding elements (MFEs) operating in the first and second location sets respectively with first and second sets of forwarding rules to respectively forward first and second sets of data message flows to the first and second sets of edge machines for performing a set of services on the first and second sets of data message flows, (Cidon discloses configuring MFEs (cloud forwarding elements, CFE, which are managed forwarding element) in different location (PCD) with forwarding rules to forward data message flows to edge machine (edge MFNs) for services (e.g., firewall, NAT, optimization); see [0098] “The cloud forwarding element 235 is the MFN engine that is responsible for forwarding a data message flow to the next hop MFN's cloud forwarding element (CFE) when the data message flow has to traverse to another public cloud to reach its destination, or to an egress router in the same public cloud when the data message flow can reach its destination through the same public cloud” and [0101] “To deploy a virtual network for a tenant over one or more public clouds, the controller cluster (1) identifies possible ingress and egress routers for entering and exiting the virtual network for the tenant based on locations of the tenant's corporate compute nodes (e.g., branch offices, datacenters, mobile users and SaaS providers), and (2) identifies routes that traverse from the identified ingress routers to the identified egress routers through other intermediate public-cloud routers that implement the virtual network. After identifying these routes, the controller cluster propagates these routes to the forwarding tables of the MFN CFEs 235 in the public cloud(s)”),
the first set of forwarding rules specifying a first set of network addresses associated with the first set of edge machines and the second set of forwarding rules specifying a second set of network addresses associated with the second set of edge machines (Cidon disclose the rules specify network address; see [0100] “the CFE sends the data message with two tunnel headers (1) an inner header that identifies an ingress CFE and egress CFE for entering and exiting the virtual network, and (2) an outer header that identifies the next hop CFE. The inner tunnel header in some embodiments also includes a tenant identifier (TID) in order to allow multiple different tenants of the virtual network provider to use a common set of MFN CFEs of the virtual network provider”);
monitoring each edge machine in the first and second sets of edge machines to determine whether the edge machine is available to perform the set of services (Cidon discloses monitoring each edge machine (edge MFNs) to determine availability (via quality metrics including loss, which indicates unavailability if high); see [0103] “the measurement agent 205 associated with each managed forwarding node 150 repeatedly generates measurement values that quantify the quality of the network connection between its node and each of several other “neighboring” nodes” and [0107] “based on the speed of the reply messages that it receives, the measurement agent 205 computes and updates measurement metric values, such as network-connection throughput speed, delay, loss, and link reliability” and [0239] “absent an MFN failure, the controller cluster in some embodiments at most updates its routing graph for each tenant once during a particular time period (e.g., once every 24 hours or every week) based on received, updated measurements”).
However, the prior art does not explicitly disclose after determining that each edge machine in the first set of edge machines is not available, reassigning the first set of network addresses from the first set of edge machines to the second set of edge machines such that the first MFE set forwards the first set of data message flows to the second set of edge machines based on the first set of forwarding rules.
Lin in the field of the same endeavor discloses techniques for maintaining communication during failover in cloud service instances by using network address translation to replace the failover instance’s unique destination address with a shared address, enabling verification against persevered connection information from the primary instance. In particular, Lin teaches the following:
after determining that each edge machine in the first set of edge machines is not available, reassigning the first set of network addresses from the first set of edge machines to the second set of edge machines such that the first MFE set forwards the first set of data message flows to the second set of edge machines based on the first set of forwarding rules (Lin discloses reassigning network addresses upon unavailability for failover in cloud environments across zones; see [0022] “after a failover has occurred with first service instance 130, any subsequent communications from the asset are transitioned, at step 3, to second service instance 131. In transitioning the communications, cloud service provider may transition the connected and shared address from first service instance 130 to second service instance 131. In particular, the software defined networking of cloud service provider 110 may remap communications with the shared address to service instance 131 to ensure high availability of the service. Once a communication is identified, cloud service provider 110 may replace the shared address with a unique private address allocated to second service instance 131, and forward the communication to the instance. After the communication is received at the network interface of the instance, second service instance 131 may change, at step 4, the destination IP address to the shared IP address that was used by first service instance 130 in establishing the connection”).
Therefore, it would have been obvious to a person of ordinary skill in the art at the time the invention was effectively filed to modify the prior art with the teaching of Lin to incorporate techniques for maintaining communication during failover in cloud service instances. One would have been motivated to combine the prior art with Lin because Lin’s teachings would ensure seamless continuity of data message flows during edge machine unavailability without requiring reconfiguration of forwarding rules, improving overall system reliability and reducing service disruptions.
Regarding claim 2, Cidon-Lin discloses the method of claim 1, wherein the edge cluster implements a gateway operating at a boundary between a logical network and an external network to forward data messages exchanged between the logical network and the external network (Lin [0088] “the branch gateway 225 and remote device gateway 230 establish secure VPN connections respectively with one or more branch offices 130 and remote devices (e.g., mobile devices 140) that connect to the MFN 150, as shown in FIG. 2”).
Regarding claim 4, Cidon-Lin discloses the method of claim 1, wherein the first and second MFE sets are configured with the first and second sets of forwarding rules to minimize forwarding data messages between the first and second sets of locations (Cidon [0132] “To assist in identifying the optimal edge points, the controller cluster of some embodiments maintains for an entity a list of the most popular SaaS providers and consumer web destinations and their IP address subnets. For each such destination, the controller cluster assigns one or more of the optimal MFNs (again as judged by physical distance, network connection speed, cost, loss and/or delay, compute cost, etc.) as candidate egress nodes. For each candidate egress MFN, the controller cluster then computes the best route from each possible ingress MFN to the candidate MFN, and sets up the resulting next-hop table in the MFNs accordingly, such that the Internet SaaS provider or web destination is associated to the correct virtual network next-hop node”).
Regarding claim 5, Cidon-Lin discloses the method of claim 1, wherein monitoring each edge machine comprises periodically sending heartbeat data messages to the edge machine to determine whether it is available to perform the set of services (Cidon [0106] “the measurement agent 205 generates measurement values differently in different embodiments. In some embodiments, the measurement agent sends pinging messages (e.g., UDP echo messages) periodically (e.g., once every second, every N seconds, every minute, every M minutes, etc.) to each of the measurement agents of its neighboring managed forwarding nodes” and [0107] “Based on the speed of the reply messages that it receives, the measurement agent 205 computes and updates measurement metric values, such as network-connection throughput speed, delay, loss, and link reliability. By repeatedly doing these operations, the measurement agent 205 defines and updates a matrix of measurement results that expresses the quality of network connections to its neighboring nodes. As the agent 205 interacts with the measurement agents of its neighboring nodes, its measurement matrix only quantifies the quality of the connections to its local clique of nodes”).
Regarding claim 6, Cidon-Lin discloses the method of claim 5 further comprising determining that at least one edge machine in the second set of edge machines is available to perform the set of services (Cidon [0103] “the measurement agent 205 associated with each managed forwarding node 150 repeatedly generates measurement values that quantify the quality of the network connection between its node and each of several other “neighboring” nodes” and [0107] “Based on the speed of the reply messages that it receives, the measurement agent 205 computes and updates measurement metric values, such as network-connection throughput speed, delay, loss, and link reliability. By repeatedly doing these operations, the measurement agent 205 defines and updates a matrix of measurement results that expresses the quality of network connections to its neighboring nodes. As the agent 205 interacts with the measurement agents of its neighboring nodes, its measurement matrix only quantifies the quality of the connections to its local clique of nodes”).
Regarding claim 8, Cidon-Lin discloses the method of claim 5, wherein one or more edge machines of the edge cluster also perform one or more middlebox service operations on the data messages exchanged between a logical network and an external network (Cidon [0083] “the components of the MFNs 150 (1) create optimized, multi-path and adaptive centralized routing, (2) provide strong QoS (Quality of Service) guarantees, (3) optimize end-to-end TCP rates through intermediate TCP splitting and/or termination, and (4) relocate scalable application-level middlebox services (e.g., firewalls, intrusion detection systems (IDS), intrusion prevention system (IPS), WAN optimization, etc.) to the compute part of the cloud in a global network function virtualization (NFV)”).
Regarding claim 9, Cidon-Lin discloses the method of claim 8, wherein the one or more middlebox service operations comprise one or more of firewall services, load balancing services, Network Address Translation (NAT) services, Intrusion Detection System (IDS) services, and Intrusion Prevention System (IPS) services (Cidon [0085] “the managed forwarding node 150 includes a measurement agent 205, firewall and NAT middlebox service engines 210 and 215”).
Regarding claim 15, Cidon-Lin discloses the method of claim 1, wherein the first and second locations sets are first and second availability zones of the particular public cloud (Cidon [0103] “one measurement agent is deployed for each MFN in a public cloud datacenter. In other embodiments, multiple MFNs in a public cloud datacenter or in a collection of datacenters (e.g., in a collection of nearby, associated datacenters, such as datacenters in one availability zone) share one measurement agent”).
Regarding claim 16, Cidon-Lin discloses the method of claim 1, wherein each edge machine is one of a virtual machine (VM), a container, or a pod executing on a host computer (Cidon [0084] “each managed forwarding node 150 is a machine (e.g., a VM or container) that executes on a host computer in a public cloud datacenter”).
Regarding claim(s) 20, do(es) not teach or further define over the limitation in claim(s) 1 respectively. Therefore claim(s) 20 is/are rejected for the same rationale of rejection as set forth in claim(s) 1 respectively.
Claims 3, 17-19 are rejected under 35 U.S.C. 103 as being unpatentable over Cidon et al. (US 2021/0067468) in view of Lin et al. (US 2019/0281014) in view of Hira et al. (US 2018/0063086).
Regarding claim 3, Cidon-Lin discloses the invention substantially, however the prior art does not explicitly disclose the method of claim 2, wherein the set of controllers implements a local control plane (LCP) of the logical network.
Hira in the field of the same endeavor discloses techniques for managing logical networks across private and public datacenters by deploying managed forwarding elements within workload virtual machines in public clouds and using gateway controllers to distribute configuration rules for first-hop packet processing. In particular, Hira teaches the following:
wherein the set of controllers implements a local control plane (LCP) of the logical network (Hira [0089] “the network control system within the private datacenter includes a management plane/central control plane (MP/CCP) cluster 115 and a local controller 120 on each of numerous host machines 125. The local controller 120 exercises direct control over a set of managed forwarding elements (MFEs) 130 on the host machine”).
Therefore, it would have been obvious to a person of ordinary skill in the art at the time the invention was effectively filed to modify the prior art with the teaching of Hira to incorporate techniques for managing logical networks across private and public datacenters. One would have been motivated to combine the prior art with the teaching of Hira to enable efficient logical network extension and first-hop packet processing in environments without direct hypervisor control, improving overall scalability and security in multi-datacenter setups.
Regarding claim 17, Cidon-Lin-Hira discloses the method of claim 16, wherein each MFE is one of a managed switch or a managed router (Hira [0089] “The MFE set may be a single managed forwarding element (e.g., a single virtual switch that performs L2, L3, and additional processing) in some embodiments, or may be a combination of various managed forwarding and security elements (e.g., a set of filters, L2 switch(es), L3 router(s), etc. that all operate within the virtualization software)” Rational for the combination is same as claim 3).
Regarding claim 18, Cidon-Lin-Hira discloses the method of claim 17, wherein each MFE set implements one or more instances of one distributed logical forwarding element that spans the first and second location sets (Cidon [0079] “a logically centralized controller cluster 160 (e.g., a set of one or more controller servers) operate inside or outside of one or more of the public clouds 105 and 110, and configure the public-cloud components of the managed forwarding nodes 150 to implement the virtual network over the public clouds 105 and 110”).
Regarding claim 19, Cidon-Lin-Hira discloses the method of claim 17, wherein each MFE is a managed router, and the first and second sets of forwarding rules are first and second sets of policy-based routing (PBR) rules (Cidon [0079] “the controllers in this cluster are at various different locations (e.g., are in different public cloud datacenters) in order to improve redundancy and high availability. The controller cluster in some embodiments scales up or down the number of public cloud components that are used to establish the virtual network, or the compute or network resources allocated to these components”).
Claims 7 and 14 are rejected under 35 U.S.C. 103 as being unpatentable over Cidon et al. (US 2021/0067468) in view of Lin et al. (US 2019/0281014) in view of Sanakkayala et al. (US 2020/0334113).
Regarding claim 7, Cidon-Lin discloses the invention substantially, however the prior art does not explicitly disclose the method of claim 6, wherein: determining that the at least one edge machine in the second set of edge machines is available to perform the set of services comprises receiving, from the at least one edge machine, one or more reply heartbeat data messages indicating that the at least one edge machine is available to perform the set of services
Sanakkayala in the field of the same endeavor discloses techniques for controlling data message flow processing in an edge cluster spanning multiple availability zone of a public cloud by monitoring edge machine for availability and reassigning network addresses for unavailable machine in one zone to available machine in another zone to maintain service continuity. In particular, Sanakkayala discloses the following:
determining that the at least one edge machine in the second set of edge machines is available to perform the set of services comprises receiving, from the at least one edge machine, one or more reply heartbeat data messages indicating that the at least one edge machine is available to perform the set of services (Sanakkayala [0432] “At block 1906, the present worker monitor node executes ping monitoring logic 610 relative to the assigned target VM(s) (e.g., 411). This includes continuously sending customized packets to each target VM, waiting for a responsive packet, analyzing the response, if any, and provisionally determining that the target VM has failed when no response is received, followed by confirmation”), and
determining that each edge machine in the first set of edge machines is not available comprises not receiving, from each edge machine in the first set of edge machines, a reply heartbeat data message indicating that each edge machine in the first set of edge machines is unavailable to perform the set of services (Sanakkayala [0432] “…continuously sending customized packets to each target VM, waiting for a responsive packet, analyzing the response, if any, and provisionally determining that the target VM has failed when no response is received, followed by confirmation” and [0462] “when the given VM is confirmed failed (or treated as such), control passes from block 1906 to block 1908 for confirming the VM failure to the master monitor node (so that it can notify storage manager 340 to call failover for the failed VM). When a worker node confirms a VM as failed (or treats it as such), the worker node updates its entry in data structure 802 (Failed_VM list), which change is detected by the master monitor node using a watch process 922”).
Therefore, it would have been obvious to a person of ordinary skill in the art at the time the invention was effectively filed to modify the prior art with the teaching of Sanakkayala to incorporate techniques for controlling data message flow processing in an edge cluster spanning multiple availability zone of a public cloud. One would have been motivated to combine the prior art with Sanakkayala to provide seamless high-availability data message processing during edge machine failures in multi-zone environment, improving system resilience and minimizing downtime.
Regarding claim 14, Cidon-Lin-Sanakkayala discloses the method of claim 1 further comprising:
after a particular period of time, determining that the first set of edge machines is available to perform the set of services (Sanakkayala [0482] “if, responsive to the querying, the operational status of the second virtual machine is reported to be undergoing maintenance, (i) suspending for a time period the transmitting of data packets by the first worker monitor node to the second virtual machine, and (ii) after the time period expires, querying again about the operational status of the second virtual machine”); and
reassigning the first set of network addresses back to the first set of edge machines such that the first MFE set forwards subsequent data messages of the first set of data message flows to the first set of edge machines (Lin [0022] “the software defined networking of cloud service provider 110 may remap communications with the shared address to service instance 131 to ensure high availability of the service”. Rationale to combine is same as claim 7).
Allowable Subject Matter
Claims 10-13 are objected to as being dependent upon a rejected base claim, but would be allowable if rewritten in independent form including all of the limitations of the base claim and any intervening claims.
Conclusion
For the reason above, claims 1-9 and 14-20 have been rejected and remain pending.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JIMMY H TRAN whose telephone number is (571)270-5638. The examiner can normally be reached Monday-Friday 9am-5pm PST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Chris Parry can be reached at 571-272-8328. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
JIMMY H TRAN
Primary Examiner
Art Unit 2451
/JIMMY H TRAN/Primary Examiner, Art Unit 2451