Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant's arguments with respect to the amendment filed on 02/19/2026 are considered but are moot in view of arguments presented.
As to applicant arguments on Claim 1, “Kim further discloses in par. [0067] that a control unit "inputs the flow information, and the packet number and size obtained by the monitoring unit in the flow table and detects the DRDoS attack by using the flow table." Although the Kim system uses the flow table for attack detection, the flow table still does not store packets and therefore is not the same as an input queue that stores packets for a specific data flow.
Conversely, amended claim 29 of the instant application recites "determining whether an amount of data associated with the data flow in the input queue triggers a flow control operation for the data flow." The present system triggers a flow control operation based on the amount of data stored in the input queue allocated to the data flow. Since Kim does not disclose an input queue that stores packets for a data flow, Kim does not disclose triggering a flow control operation based on the amount of data stored in such an input queue.”
[22]- The monitoring unit and the control unit may be provided in plural, and the plurality of respective control units may transmit and receive the stored flow table to and from each other and detect the DRDoS attack by further using the received flow table.
And [85]- FIG. 3 is a flowchart of a process of determining a DRDoS attack by using packet number and size items of a first entry according to an exemplary embodiment of the present invention.(= packet number and size is of stored packets)
As to applicant remarks to claim 1, “In contrast, the amended claim 29 of the instant application recites "generating, in a content-addressable memory (CAM) of the network device, an entry corresponding to the data flow, wherein the entry comprises the flow identifier and the process identifier" (see the instant application, pars. [0107]-[0109]). Because the flow table of Kim is stored in conventional memory and not in a CAM, the combination of Kim and Rajagopalan does not teach generating, in a CAM, an entry that includes identifying information of a source process.”
As discussed in interview , Kim does not teach a CAM and therefore Rajagopalan is used in Claim 1 rejection to address Kim deficiency in Rajagopalan teaches, generating, in a content-addressable memory (CAM) of the network device [38]- In particular, FIG. 4 illustrates a new manner in which to set up the CAM entries to provide packet or flow distribution across outgoing links, i.e., determine the outgoing links to direct flows, as a function of the incoming flow.
As to claim 1 arguments” Since Lin discloses the delivery of normal flow entries for forwarding traffic, and not flow control messages that regulate transmission rates at a source process, Lin does not suggest the flow control message recited in claim 29 of the instant application.”
Lin teaches, [75]-After the OPENFLOW1.2 protocol, the controller may instruct, using a custom message, the switch to rearrange flow tables in the switch. In this case, the controller may instruct, using the custom message, the switch to adjust the wildcarded table including a source host identifier matching domain to be the last flow table
Claim amendments have been addressed with addition rejection from Kim
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 29,31,32,34,35,37,38,39,41,42,44,46,47,48,50,51,54, are rejected under 35 U.S.C. 103 as being unpatentable over Kim et al. (US20170257386A1) in view of Rajagopalan et al. (US20070280258A1) in further view of Lin et al. (US20190281081A1).
Regarding claim 29, Kim teaches, A method, comprising: receiving by an input port of a network device, one or more packets of a data flow identified by a flow identifier unique to the input port [79]- when the source IP of the data obtained from the monitoring unit is 1.1.1.1, the source port number is 53, the destination IP is 2.2.2.2 and the destination port number is 8080.
storing the one or more packets in an input queue of the input port corresponding to the flow identifier; [59]- In the flow table, a horizontal row is one entry and each entry may be expressed as the packet number and size of the data obtained by the monitoring unit for each flow information.
determining whether an amount of data associated with the data flow in the input queue triggers a flow control operation for the data flow [67]- The control unit as a component that controls an overall operation of the apparatus of detecting a distributed reflection denial of service attack inputs the flow information, and the packet number and size obtained by the monitoring unit in the flow table and detects the DRDoS attack by using the flow table
and in response to the amount of data in the input queue triggering the flow control operation: [80]- When the first entry having the same flow information is not present in the flow table, a new first entry is generated in the flow table(=triggering the flow control operation) by using the flow information of the obtained data and the packet number and size of the data(=the amount of data in the input queue) are input in the new first entry (S132).
generating, in a ; [81] For example, when the source IP of the data obtained from the monitoring unit is 1.5.5.5, the source port number is 53, the destination IP is 2.5.2.2 and the destination port number is 8080, the packet number is 20, the packet size is 300, and there is no first entry having the same flow information, the control unit generates (=generating )the new first entry in the flow table(=addressable memory).[85]- FIG. 3 is a flowchart of a process of determining a DRDoS attack by using packet number and size items of a first entry according to an exemplary embodiment of the present invention.(= packet number and size is of stored packets)
and in response to the amount of data in the input queue triggering the flow control operation: determining a process identifier of a source process generating the data flow executing on an end host coupled to the input port; Fig 3 and [103]- When the packet number item value of the first entry is larger than the predetermined fourth value T4, the control unit determines the host of the destination IP of the corresponding first entry as the victim (S341).
[22]- The monitoring unit and the control unit may be provided in plural, and the plurality of respective control units may transmit and receive the stored flow table to and from each other and detect the DRDoS attack by further using the received flow table. Here Kim teaches stored packets that in [103] have the identification of packets mapped to packet flow.
Kim does not teach, generating, in a content-addressable memory (CAM) of the network device
Rajagopalan teaches, generating, in a content-addressable memory (CAM) of the network device [38]- In particular, FIG. 4 illustrates a new manner in which to set up the CAM entries to provide packet or flow distribution across outgoing links, i.e., determine the outgoing links to direct flows, as a function of the incoming flow.
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of KIm, generating, in a content-addressable memory (CAM) of the network device as taught by Rajagopalan to add messaging to slow control.
Kim in view of Rajagopalan does not teach, generating a flow control message comprising the process identifier and an indicator for controlling a data rate at which the data flow is sent from the source process; and sending, the flow control message to the end host executing the source process of the data flow.
Lin teaches, generating a flow control message comprising the process identifier and an indicator for controlling a data rate at which the data flow is sent from the source process; and sending, the flow control message to the end host executing the source process of the data flow. [63]- about a triggering count of the abnormal flow entry and reports(=generating a flow control message) the triggering count to the controller, the controller directly determines, according to the triggering count, whether a malicious attack is initiated from a source host indicated by a source host identifier. [90]- after the destination host B is powered on, when receiving a packet-in message that carries a source host A identifier and a destination host B identifier and that is sent by the first switch, the controller can find the destination host B, and deliver a normal flow entry about the source host A and the destination host B to the first switch.
[75]-After the OPENFLOW1.2 protocol, the controller may instruct, using a custom message, the switch to rearrange flow tables in the switch. In this case, the controller may instruct, using the custom message, the switch to adjust the wildcarded table including a source host identifier matching domain to be the last flow table( = message controlling flow)
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Kim in view of Rajagopalan, generating a flow control message comprising the process identifier and an indicator for controlling a data rate at which the data flow is sent from the source process; and sending, the flow control message to the end host executing the source process of the data flow. as taught by Lin to add messaging to slow control.
Regarding claim 31, Kim does not teach, The method of claim 31, further comprising operating an Ethernet pause mechanism in conjunction with the flow control operation for the data flow.
Rajagopalan teaches, The method of claim 31, further comprising operating an Ethernet pause mechanism in conjunction with the flow control operation for the data flow.[27]- The packet processor 330 executes these functions because it can do so at a significantly greater packet rate than a CPU (e.g., more than 50 million packets per second). [29]- The packet processor 330 then looks at the flow's Ethernet header (not shown) to make sure the packet headers are correct and to identify the flow's VLAN tag or identifier that identifies the VLAN with which the flow 309 is associated.
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Kim, The method of claim 31, further comprising operating an Ethernet pause mechanism in conjunction with the flow control operation for the data flow as taught by Rajagopalan to add messaging to slow control.
Regarding claim 32, Kim teaches, The method of claim 29, further comprising including, in the flow control message, one or more of: a timer value indicating a duration for controlling the data rate and information indicating a protocol used by the data flow. [13]- and a control unit inputting the number and the sizes of packets of data obtained by the monitoring unit for a predetermined time as a first entry for each flow information in the flow table when at least one of the port number.
Regarding claim 34, Kim in view of Rajagopalan does not teach, The method of claim 29, wherein triggering the flow control operation is in response to the amount of data in the input queue exceeding a threshold
Lin teaches, The method of claim 29, wherein triggering the flow control operation is in response to the amount of data in the input queue exceeding a threshold;[96]- and determining, by the controller, whether the triggering rate is greater than a rate threshold, and if the triggering rate is greater than the rate threshold, determining, by the controller, that a malicious attack is initiated from the source host, or, if the triggering rate is not greater than the rate threshold, determining, by the controller, that no malicious attack is initiated from the source host.
Lin does not teach, and wherein discontinuation of the flow control operation is in response to the amount of data in the input queue being below the threshold.[117]- f the firewall determines that the arriving traffic is significantly less than the predetermined threshold
Callon teaches, and wherein discontinuation of the flow control operation is in response to the amount of data in the input queue being below the threshold.[117]- f the firewall determines that the arriving traffic is significantly less than the predetermined threshold.
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Kim in view of Rajagopalan and Lin, The method of claim 29, wherein triggering the flow control operation is in response to the amount of data in the input queue exceeding a threshold , and wherein discontinuation of the flow control operation is in response to the amount of data in the input queue being below the threshold as taught by Callon to add messaging to slow control.
Regarding claim 35, Kim does not teach, The method of claim 29, further comprising selecting an address of the entry in the CAM as the flow identifier of the data flow.
Rajagopalan teaches, The method of claim 29, further comprising selecting an address of the entry in the CAM as the flow identifier of the data flow.[27]- builds a key 325 based on the contents of the flow 309, and (3) launches a CAM lookup with the key 325.
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Kim in view of Rajagopalan and Lin, The method of claim 29, further comprising selecting an address of the entry in the CAM as the flow identifier of the data flow as taught by Rajagopalan to add messaging to slow control.
Regarding claim 37, Rajagopalan teaches, The method of claim 29, further comprising receiving, at the input port, a second data flow from the end host bypassing the flow control operation for the data flow. See Fig 5 [121]
Regarding claim 38, Rajagopalan teaches, The method of claim 29, wherein the further comprising determining identifying information of associated with the source process, wherein the identifying information comprises one or more of: a virtual local area network (VLAN) identifier, a source and destination Internet Protocol (IP) address pair, and source and destination layer-4 port information.[121]- the same source IP, destination port number, destination IP, and destination port number may already be input and present in the Acc flow table among second entry inputs. .[85]- FIG. 3 is a flowchart of a process of determining a DRDoS attack by using packet number and size items of a first entry according to an exemplary embodiment of the present invention.(= packet number and size is of stored packets)
Regarding claim 39, Kim teaches, A network device, comprising a processor: an input port to couple with an end host and comprising an input queue;Wherein the input port is to receive one or more packets of a data flow identified by a flow identifier unique to the input port; [79]- when the source IP of the data obtained from the monitoring unit is 1.1.1.1, the source port number is 53, the destination IP is 2.2.2.2 and the destination port number is 8080
a content-addressable memory (CAM); and
a non-transitory computer-readable storage medium storing instructions that when executed by the processor cause the network device to:
store the one or more packets in the input queue; [59]- In the flow table, a horizontal row is one entry and each entry may be expressed as the packet number and size of the data obtained by the monitoring unit for each flow information.
determine whether an amount of data associated with the data flow in the input queue exceeds a threshold; flow [67]- The control unit as a component that controls an overall operation of the apparatus of detecting a distributed reflection denial of service attack inputs the flow information, and the packet number and size obtained by the monitoring unit in the flow table and detects the DRDoS attack by using the flow table
generate, in the [81] For example, when the source IP of the data obtained from the monitoring unit is 1.5.5.5, the source port number is 53, the destination IP is 2.5.2.2 and the destination port number is 8080, the packet number is 20, the packet size is 300, and there is no first entry having the same flow information, the control unit generates (=generating )the new first entry in the flow table(=addressable memory). .[85]- FIG. 3 is a flowchart of a process of determining a DRDoS attack by using packet number and size items of a first entry according to an exemplary embodiment of the present invention.(= packet number and size is of stored packets)
Kim does not teach, generate, in the CAM
Rajagopalan teaches, generate, in the CAM [38]- In particular, FIG. 4 illustrates a new manner in which to set up the CAM entries to provide packet or flow distribution across outgoing links, i.e., determine the outgoing links to direct flows, as a function of the incoming flow.
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of KIm, generate in the CAM as taught by Rajagopalan to add messaging to slow control.
Kim in view of Rajagopalan does not teach, determine whether an amount of data associated with the data flow in the input queue exceeds a threshold and in response to the amount of data in the input queue exceeding the threshold: determine a process identifier of a source process generating the data flow executing on the end host; generate a flow control message comprising the process identifier and an indicator for controlling a data rate at which the data flow is sent from the source process.
Lin teaches, determine whether an amount of data associated with the data flow in the input queue exceeds a threshold and in response to the amount of data in the input queue exceeding the threshold: determine a process identifier of a source process generating the data flow executing on the end host ; [96]- by the controller, whether the triggering rate is greater than a rate threshold, and if the triggering rate is greater than the rate threshold, determining, by the controller, that a malicious attack is initiated from the source host.[97]- determining, by the controller, that a malicious attack is initiated from the source host,
generate a flow control message comprising the process identifier and an indicator for controlling a data rate at which the data flow is sent from the source process. [63]- about a triggering count of the abnormal flow entry and reports (=generating a flow control message) the triggering count to the controller, the controller directly determines, according to the triggering count, whether a malicious attack is initiated from a source host indicated by a source host identifier. [90]- after the destination host B is powered on, when receiving a packet-in message that carries a source host A identifier and a destination host B identifier and that is sent by the first switch, the controller can find the destination host B, and deliver a normal flow entry about the source host A and the destination host B to the first switch.
[75]-After the OPENFLOW1.2 protocol, the controller may instruct, using a custom message, the switch to rearrange flow tables in the switch. In this case, the controller may instruct, using the custom message, the switch to adjust the wildcarded table including a source host identifier matching domain to be the last flow table( = message controlling flow)
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Kim in view of Rajagopalan, in response to the amount of data in the input queue exceeding the threshold: determine identifying information of a source process of the dataflow executing the end host; generate a flow control message comprising the process identifier and an indicator for controlling a data rate at which the data flow is sent from the source process. as taught by Lin to add messaging to slow control.
Regarding claim 41, Kim does not teach, The network device of claim 39, wherein the instructions when executed by the processor cause the network device are further to operate an Ethernet pause mechanism in conjunction with the flow control operation for the data flow.
Rajagopalan teaches, The network device of claim 39, wherein the instructions when executed by the processor cause the network device are further to operate an Ethernet pause mechanism in conjunction with the flow control operation for the data flow.[27]- The packet processor 330 executes these functions because it can do so at a significantly greater packet rate than a CPU (e.g., more than 50 million packets per second). [29]- The packet processor 330 then looks at the flow's Ethernet header (not shown) to make sure the packet headers are correct and to identify the flow's VLAN tag or identifier that identifies the VLAN with which the flow 309 is associated.
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Kim, The network device of claim 39, wherein the instructions when executed by the processor cause the network device are further to operate an Ethernet pause mechanism in conjunction with the flow control operation for the data flow.as taught by Rajagopalan to add messaging to slow control.
Regarding claim 42, Kim teaches, The network device of claim 39, wherein the instructions when executed by the processor cause the network device are further to include, in the flow control message, one or more of: a timer value indicating a duration for controlling the data rate and information indicating a protocol used by the data flow. [13]- and a control unit inputting the number and the sizes of packets of data obtained by the monitoring unit for a predetermined time as a first entry for each flow information in the flow table when at least one of the port number.
Regarding claim 44, Kim does not teach, The network device of claim 39, wherein the instructions when executed by the processor cause the network device are further to select an address of the entry in the CAM as the flow identifier of the data flow.
Rajagopalan teaches, The network device of claim 39, wherein the instructions when executed by the processor cause the network device are further to select an address of the entry in the CAM as the flow identifier of the data flow.[27]- builds a key 325 based on the contents of the flow 309, and (3) launches a CAM lookup with the key 325.
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Kim in view of Rajagopalan and Lin, The network device of claim 39, wherein the instructions when executed by the processor cause the network device are further to select an address of the entry in the CAM as the flow identifier of the data flow as taught by Rajagopalan to add messaging to slow control.
Regarding claim 46, Rajagopalan teaches, The method of claim 29, further comprising receiving, at the input port, a second data flow from the end host bypassing the flow control operation for the data flow. See Fig 5 [121]
Regarding claim 47, Kim teaches, The network device of claim 39, wherein the instructions when executed by the processor cause the network device further to determine identifying information associated with of the source process, wherein the identifying information comprises one or more of: a virtual local area network (VLAN) identifier, a source and destination Internet Protocol (IP) address pair, and source and destination layer-4 port information. [79]- In this case, when the source IP of the data obtained from the monitoring unit is 1.1.1.1, the source port number is 53, the destination IP is 2.2.2.2 and the destination port number is 8080, the packet number is 20, and the packet size is 300. .[85]- FIG. 3 is a flowchart of a process of determining a DRDoS attack by using packet number and size items of a first entry according to an exemplary embodiment of the present invention.(= packet number and size is of stored packets)
Regarding claim 48, Kim teaches, A non-transitory computer-readable storage medium storing instructions that when executed by a processor of a network device cause the processor to perform a method, the method comprising: receiving, by storing, in an input queue of an input port of the network device, one or more packets of a data flow identified by a flow identifier unique to the input port [79]- when the source IP of the data obtained from the monitoring unit is 1.1.1.1, the source port number is 53, the destination IP is 2.2.2.2 and the destination port number is 8080.
storing the one or more packets in an input queue of the input port corresponding to the flow identifier; [59]- In the flow table, a horizontal row is one entry and each entry may be expressed as the packet number and size of the data obtained by the monitoring unit for each flow information.
determining whether an amount of data associated with the data flow in the input queue triggers a flow control operation for the data flow [67]- The control unit as a component that controls an overall operation of the apparatus of detecting a distributed reflection denial of service attack inputs the flow information, and the packet number and size obtained by the monitoring unit in the flow table and detects the DRDoS attack by using the flow table
and in response to the amount of data in the input queue triggering the flow control operation: [80]- When the first entry having the same flow information is not present in the flow table, a new first entry is generated in the flow table(=triggering the flow control operation) by using the flow information of the obtained data and the packet number and size of the data(=the amount of data in the input queue) are input in the new first entry (S132).
generating, in a ; [81] For example, when the source IP of the data obtained from the monitoring unit is 1.5.5.5, the source port number is 53, the destination IP is 2.5.2.2 and the destination port number is 8080, the packet number is 20, the packet size is 300, and there is no first entry having the same flow information, the control unit generates (=generating )the new first entry in the flow table(=addressable memory).
Determining a process identifier of a source process generating the data flow executing on an end host coupled to the input port; Fig 3 and [103]- When the packet number item value of the first entry is larger than the predetermined fourth value T4, the control unit determines the host of the destination IP of the corresponding first entry as the victim (S341). [22]- The monitoring unit and the control unit may be provided in plural, and the plurality of respective control units may transmit and receive the stored flow table to and from each other and detect the DRDoS attack by further using the received flow table. Here Kim teaches stored packets that in [103] have the identification of packets mapped to packet flow.
Kim does not teach, generating, in a content-addressable memory (CAM) of the network device
Rajagopalan teaches generating, in a content-addressable memory (CAM) of the network device [38]- In particular, FIG. 4 illustrates a new manner in which to set up the CAM entries to provide packet or flow distribution across outgoing links, i.e., determine the outgoing links to direct flows, as a function of the incoming flow.
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of KIm, generating, in a content-addressable memory (CAM) of the network device as taught by Rajagopalan to add messaging to slow control.
Kim in view of Rajagopalan does not teach, generating a flow control message comprising the process identifier, an indicator of the source process, an indicator for controlling a data rate of the data flow from the source process, and a timer value indicating a duration for controlling the data rate; and sending, to the end host, the flow control message to the end host executing the source process of the data flow.
Lin teaches, generating a flow control message comprising the process identifier, an indicator of the source process, an indicator for controlling a data rate of the data flow from the source process, and a timer value indicating a duration for controlling the data rate; and sending, to the end host, the flow control message to the end host executing the source process of the data flow. [63]- about a triggering count of the abnormal flow entry and reports(=generating a flow control message) the triggering count to the controller, the controller directly determines, according to the triggering count, whether a malicious attack is initiated from a source host indicated by a source host identifier. [90]- after the destination host B is powered on, when receiving a packet-in message that carries a source host A identifier and a destination host B identifier and that is sent by the first switch, the controller can find the destination host B, and deliver a normal flow entry about the source host A and the destination host B to the first switch. [75]-After the OPENFLOW1.2 protocol, the controller may instruct, using a custom message, the switch to rearrange flow tables in the switch. In this case, the controller may instruct, using the custom message, the switch to adjust the wildcarded table including a source host identifier matching domain to be the last flow table( = message controlling flow)
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Kim in view of Rajagopalan, generating a flow control message comprising the identifying information of the source process and an indicator for controlling a data rate of the data flow from the source process; and sending, the flow control message to the end host executing the source process of the data flow as taught by Lin to add messaging to slow control.
Regarding claim 50, Kim does not teach, The non-transitory computer-readable storage medium of claim 48, wherein the method further comprises operating an Ethernet pause mechanism in conjunction with the flow control operation for the data flow.
Rajagopalan teaches, The non-transitory computer-readable storage medium of
claim 48, wherein the method further comprises operating an Ethernet pause mechanism in conjunction with the flow control operation for the data flow.[27]- The packet processor 330 executes these functions because it can do so at a significantly greater packet rate than a CPU (e.g., more than 50 million packets per second). [29]- The packet processor 330 then looks at the flow's Ethernet header (not shown) to make sure the packet headers are correct and to identify the flow's VLAN tag or identifier that identifies the VLAN with which the flow 309 is associated.
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Kim, The non-transitory computer-readable storage medium of claim 48, wherein the method further comprises operating an Ethernet pause mechanism in conjunction with the flow control operation for the data flow.as taught by Rajagopalan to add messaging to slow control.
Regarding claim 51, Kim teaches The non-transitory computer-readable storage medium of claim 48, wherein the method further comprises including, in the flow control message, information indicating a protocol used by the data flow. [13]- and a control unit inputting the number and the sizes of packets of data obtained by the monitoring unit for a predetermined time as a first entry for each flow information in the flow table when at least one of the port number.
Regarding claim 54, Kim does not teach, The non-transitory computer-readable storage medium of claim 48, wherein the method further comprises selecting an address of the entry in the CAM as the flow identifier of the data flow.
Rajagopalan teaches, The non-transitory computer-readable storage medium of claim 48, wherein the method further comprises selecting an address of the entry in the CAM as the flow identifier of the data flow.[27]- builds a key 325 based on the contents of the flow 309, and (3) launches a CAM lookup with the key 325.
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Kim in view of Rajagopalan and Lin, The non-transitory computer-readable storage medium of claim 48, wherein the method further comprises selecting an address of the entry in the CAM as the flow identifier of the data flow as taught by Rajagopalan to add messaging to slow control.
Claim(s) 30,33, 40,43,49,53 are rejected under 35 U.S.C. 103 as being unpatentable over Kim et al. (US20170257386A1) in view of Rajagopalan et al. (US20070280258A1) in further view of Lin et al. (US20190281081A1) in further view of Callon et al. (US20110197274A1)
Regarding claim 30, Kim in view of Rajagopalan and Lin does not teach, The method of claim 29, further comprising including, in the flow control message, a credit value indicating an amount of data for the data flow to be sent from the source process to the input port based on throttling of the data flow at the end host for the flow control operation.
Callon teaches, The method of claim 29, further comprising including, in the flow control message, a credit value indicating an amount of data for the data flow to be sent from the source process to the input port based on throttling of the data flow at the end host for the flow control operation. [47] Otherwise, the ingress routers may be told to rate limit all packets which match the description of the attack packets. Also note that the ingress routers may also be told to count packets which match the description of the attack packets, which facilitates later analysis of the form and location of the attack. In this case the message describing the attack may be sent to all ingress routers (such as routers A, B, and C in FIG. 3).
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Kim in view of Rajagopalan and Lin,The method of claim 29, further comprising including, in the flow control message, a credit value indicating an amount of data for the data flow to be sent from the source process to the input port based on throttling of the data flow at the end host for the flow control operation as taught by Callon to add messaging to slow control.
Regarding claim 33, Kim in view of Rajagopalan and Lin does not teach, The method of claim 29, further comprising: discontinuing the flow control operation for the data flow based on the amount of data in the input queue; and sending, to the end host, a second flow control message indicating the discontinuation of the flow control operation.
Callon teaches, The method of claim 29, further comprising: discontinuing the flow control operation for the data flow based on the amount of data in the input queue; and sending, to the end host, a second flow control message indicating the discontinuation of the flow control operation.[111]- After an attack is detected, the firewall may set rate limits for various types of traffic (act 1020). [112]- In one implementation, the firewall may send the rate limit information along with the attack identification information.
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Kim in view of Rajagopalan and Lin, The method of claim 29, further comprising: discontinuing the flow control operation for the data flow based on the amount of data in the input queue; and sending, to the end host, a second flow control message indicating the discontinuation of the flow control operation as taught by Callon to add messaging to slow control.
Regarding claim 40, Kim in view of Rajagopalan and Lin does not teach, The network device of claim 39, wherein the instructions when executed by the processor cause the network device are further to include, in the flow control message, a credit value indicating an amount of data for the data flow to be sent from the source process to the input port based on throttling of the data flow at the end host for the flow control operation.
Callon teaches, The network device of claim 39, wherein the instructions when executed by the processor cause the network device are further to include, in the flow control message, a credit value indicating an amount of data for the data flow to be sent from the source process to the input port based on throttling of the data flow at the end host for the flow control operation. [47] Otherwise, the ingress routers may be told to rate limit all packets which match the description of the attack packets. Also note that the ingress routers may also be told to count packets which match the description of the attack packets, which facilitates later analysis of the form and location of the attack. In this case the message describing the attack may be sent to all ingress routers (such as routers A, B, and C in FIG. 3).
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Kim in view of Rajagopalan and Lin, The network device of claim 39, wherein the instructions when executed by the processor cause the network device are further to include, in the flow control message, a credit value indicating an amount of data for the data flow to be sent from the source process to the input port based on throttling of the data flow at the end host for the flow control operation as taught by Callon to add messaging to slow control.
Regarding claim 43, Kim in view of Rajagopalan and Lin does not teach The network device of claim 39, wherein the instructions when executed by the processor cause the network device are further to: discontinue the flow control operation for the data flow based on the threshold; and send, to the end host, a second flow control message indicating the discontinuation of the flow control operation.
Callon teaches, The network device of claim 39, wherein the instructions when executed by the processor cause the network device are further to: discontinue the flow control operation for the data flow based on the threshold; and send, to the end host, a second flow control message indicating the discontinuation of the flow control operation.[111]- After an attack is detected, the firewall may set rate limits for various types of traffic (act 1020). [112]- In one implementation, the firewall may send the rate limit information along with the attack identification information.
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Kim in view of Rajagopalan and Lin, The network device of claim 39, wherein the instructions when executed by the processor cause the network device are further to: discontinue the flow control operation for the data flow based on the threshold; and send, to the end host, a second flow control message indicating the discontinuation of the flow control operation as taught by Callon to add messaging to slow control.
Regarding claim 52, Kim in view of Rajagopalan and Lin does not teach, The non-transitory computer-readable storage medium of
claim 48, wherein the method further comprises:discontinuing the flow control operation for the data flow based on the amount of data in the input queue; andsending, to the end host, a second flow control message indicating the discontinuation of the flow control operation
Callon teaches The non-transitory computer-readable storage medium of
claim 48, wherein the method further comprises:discontinuing the flow control operation for the data flow based on the amount of data in the input queue; andsending, to the end host, a second flow control message indicating the discontinuation of the flow control operation.[111]- After an attack is detected, the firewall may set rate limits for various types of traffic (act 1020). [112]- In one implementation, the firewall may send the rate limit information along with the attack identification information.
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Kim in view of Rajagopalan and Lin, The non-transitory computer-readable storage medium of
claim 48, wherein the method further comprises: discontinuing the flow control operation for the data flow based on the amount of data in the input queue; and sending, to the end host, a second flow control message indicating the discontinuation of the flow control operation as taught by Callon to add messaging to slow control.
Regarding claim 53, Kim in view of Rajagopalan and Lin does not teach The non-transitory computer-readable storage medium of claim 52, wherein triggering the flow control operation is in response to the amount of data in the input queue exceeding a threshold; and wherein discontinuing of the flow control operation is in response to the amount of data in the input queue being below the threshold
Callon teaches, The non-transitory computer-readable storage medium of
claim 52, wherein triggering the flow control operation is in response to the amount of data in the input queue exceeding a threshold; and wherein discontinuing of the flow control operation is in response to the amount of data in the input queue being below the threshold.[111]- After an attack is detected, the firewall may set rate limits for various types of traffic (act 1020). [112]- In one implementation, the firewall may send the rate limit information along with the attack identification information.
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Kim in view of Rajagopalan and Lin The non-transitory computer-readable storage medium of claim 52, wherein triggering the flow control operation is in response to the amount of data in the input queue exceeding a threshold; andwherein discontinuing of the flow control operation is in response to the amount of data in the input queue being below the threshold as taught by Callon to add messaging to slow control.
Regarding claim 49, Kim in view of Rajagopalan and Lin does not teach, The non-transitory computer-readable storage medium of claim 48, wherein the method further comprises including, in the flow control message, a credit value indicating an amount of data for the data flow to be sent from the source process to the input port based on throttling of the data flow at the end host for the flow control operation.
Callon teaches, The non-transitory computer-readable storage medium of claim 48, wherein the method further comprises including, in the flow control message, a credit value indicating an amount of data for the data flow to be sent from the source process to the input port based on throttling of the data flow at the end host for the flow control operation.. [47] Otherwise, the ingress routers may be told to rate limit all packets which match the description of the attack packets. Also note that the ingress routers may also be told to count packets which match the description of the attack packets, which facilitates later analysis of the form and location of the attack. In this case the message describing the attack may be sent to all ingress routers (such as routers A, B, and C in FIG. 3).
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Kim in view of Rajagopalan and Lin, The non-transitory computer-readable storage medium of claim 48, wherein the method further comprises including, in the flow control message,a credit value indicating an amount of data for the data flow to be sent from the sourceprocess to the input port based on throttling of the data flow at the end host for the flow control operation as taught by callon to add messaging to slow control.
Regarding claim 53, Kim in view of Rajagopalan and Lin does not teach The non-transitory computer-readable storage medium of
claim 52, wherein triggering the flow control operation is in response to the amount of data in the input queue exceeding a threshold; and wherein discontinuing of the flow control operation is in response to the amount of data in the input queue being below the threshold.
Callon teaches, The non-transitory computer-readable storage medium of claim 52, wherein triggering the flow control operation is in response to the amount of data in the input queue exceeding a threshold; andwherein discontinuing of the flow control operation is in response to the amount of data in the input queue being below the threshold.[111]- After an attack is detected, the firewall may set rate limits for various types of traffic (act 1020). [112]- In one implementation, the firewall may send the rate limit information along with the attack identification information.
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Kim in view of Rajagopalan and Lin, The non-transitory computer-readable storage medium of claim 52, wherein triggering the flow control operation is in response to the amount of data in the input queue exceeding a threshold; and wherein discontinuing of the flow control operation is in response to the amount of data in the input queue being below the threshold as taught by Callon to add messaging to slow control.
Claim(s) 36,45,55 are rejected under 35 U.S.C. 103 as being unpatentable over Kim et al. (US20170257386A1) in view of Rajagopalan et al. (US20070280258A1) in further view of Lin et al. (US20190281081A1) in further view of DeCusatis et al. (US20090238068A1)
Regarding claim 36, , Kim in view of Rajagopalan and Lin does not teach, The method of claim 29, wherein the indicator includes an Organizationally Unique Identifier (OUI) extended Ether_Type field of an Ethernet frame recognizable by a network interface controller (NIC) of the end host
DeCusatis teaches,The method of claim 29, wherein the indicator includes an Organizationally Unique Identifier (OUI) extended Ether_Type field of an Ethernet frame recognizable by a network interface controller (NIC) of the end host.[27]- If a node fault is present, a fault message with a node ID (unique identifier) of the faulty node is generated in 805. [18]- If the data network 100 is operated according to existing Ethernet protocols, the source transmitter 102 may, for example, send data packets to the destination receiver 104(=Ethernet frame recognizable by a network interface controller (NIC) of the end host) in a data flow via the first node 106.
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Kim in view of Rajagopalan and Lin in view of Matthews, The network device of claim 39, wherein the indicator includes an Organizationally Unique Identifier (OUI) extended EtherType field of an Ethernet frame recognized by a network interface controller (NIC) of the end host as taught by DeCusatis to add messaging to slow control.
Regarding claim 45, , Kim in view of Rajagopalan and Lin does not teach, The network device of claim 39, wherein the indicator includes an Organizationally Unique Identifier (OUI) extended EtherType field of an Ethernet frame recognized by a network interface controller (NIC) of the end host.
DeCusatis teaches, The network device of claim 39, wherein the indicator includes an Organizationally Unique Identifier (OUI) extended EtherType field of an Ethernet frame recognized by a network interface controller (NIC) of the end host.[27]- If a node fault is present, a fault message with a node ID (unique identifier) of the faulty node is generated in 805. [18]- If the data network 100 is operated according to existing Ethernet protocols, the source transmitter 102 may, for example, send data packets to the destination receiver 104(=Ethernet frame recognizable by a network interface controller (NIC) of the end host) in a data flow via the first node 106.
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Kim in view of Rajagopalan and Lin in view of Matthews, The network device of claim 39, wherein the indicator includes an Organizationally Unique Identifier (OUI) extended EtherType field of an Ethernet frame recognized by a network interface controller (NIC) of the end host.
as taught by DeCusatis to add messaging to slow control.
Regarding claim 55, Kim in view of Rajagopalan and Lin does not teach, The non-transitory computer-readable storage medium of The non-transitory computer-readable storage medium of wherein the indicator includes an Organizationally Unique Identifier (OUI) extended EtherType field of an Ethernet frame recognizable by a network interface controller (NIC) of the end host.
DeCusatis teaches, The non-transitory computer-readable storage medium of The non-transitory computer-readable storage medium of wherein the indicator includes an Organizationally Unique Identifier (OUI) extended EtherType field of an Ethernet frame recognizable by a network interface controller (NIC) of the end host..[27]- If a node fault is present, a fault message with a node ID (unique identifier) of the faulty node is generated in 805. [18]- If the data network 100 is operated according to existing Ethernet protocols, the source transmitter 102 may, for example, send data packets to the destination receiver 104(=Ethernet frame recognizable by a network interface controller (NIC) of the end host) in a data flow via the first node 106.
It would have been obvious to a person having an ordinary skill in the art before the effective filing date of the claimed invention to modify the system of Kim in view of Rajagopalan and Lin, The non-transitory computer-readable storage medium of The non-transitory computer-readable storage medium of wherein the indicator includes an Organizationally Unique Identifier (OUI) extended EtherType field of an Ethernet frame recognizable by a network interface controller (NIC) of the end host..
as taught by DeCusatis to add messaging to slow control.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Anindita Sen whose telephone number is (571)-272-2390. The examiner can normally be reached 7:30am-5:30pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Joseph Avellino can be reached on (571)-272-3905. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ANINDITA SEN/Examiner, Art Unit 2478
/JOSEPH E AVELLINO/Supervisory Patent Examiner, Art Unit 2478
Prosecution Insights