DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Arguments
Applicant’s arguments, with respect to the rejection(s) of claim(s) 1 and 11 under the combination of prior arts have been fully considered and are persuasive. Therefore, the rejection has been withdrawn. However, upon further consideration, a new ground(s) of rejection is made in view of Arango (US pg. no. 20180343227).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-4, 7, 11-14, and 17 is/are rejected under 35 U.S.C. 103 as being unpatentable over Chung (US pat. No. 11863528), further in view of Zheng (US pg. no. 20250301053), further in view of Arango (US pg. no. 20180343227).
Regarding claim 1. Chung discloses a computer-implemented method for managing data traffic (fig. 8 traffic forwarding method), the method comprising:
receiving, by a computer executing a load-balancer program (fig. 2 service provider comprising load balancer 212 and reverse proxy 214), client data traffic comprising one or more data packets that originated at a client device (col. 8, lines 66-67 and col.9 lines 1-15 discloses the reverse proxy 314 of 2 service provider receives the network packet 324 (client traffic) and first obtains the domain name associated with the packet 324);
determining, by the computer, a destination domain hosting one or more webservices (fig. 2, 210 resources. What is hosted by resources corresponds to webservice) requested by the client data traffic according to header data of the one or more data packets (col. 8, lines 66-67 and col.9 lines 1-15 discloses the reverse proxy 314 receives the network packet 324 and first obtains the domain name (destination domain) associated with the packet 324);
querying, by the computer, a mapping database (fig. 2 discloses DNS server 220) using the destination domain to identify a set of ingress host cells (fig. 2, 220 resources corresponds to ingress host cell) assigned to the destination domain (col. 7 34-67 and col. 8 1-15 discloses proxy server receives a network packet…the reverse proxy 214 may submit the domain name of the network packet and/or the FQDN associated with the destination IP address to the DNS server 220 to identify the IP address of the corresponding resource 210A, 210B, or 210C… the DNS server 220 may include a routing table (mapping data) in which the domain name of the network packet or any other FQDN associated with resources 210A, 210B, or 210C can be routed to the appropriate resource IP address. Once the domain name of the resource 210A, 210B, or 210C (plurality of ingress host cells) is identified, the reverse proxy 214 may submit the FQDN to the DNS server so that the IP address of the resource domain is determined. As a result of the resource domain being determined, the reverse proxy 214 forwards the network packet to one or more corresponding resources 210A/B/C, which in turn processes any application data within the network packet and generates a response); and
routing, by the computer, the one or more data packets of the data traffic to at least one node of the destination domain via an ingress host of the set of ingress host cells assigned to the destination domain according to the mapping data (col. 7 34-67 and col. 8 1-15 discloses proxy server receives a network packet…the reverse proxy 214 may submit the domain name of the network packet and/or the FQDN associated with the destination IP address to the DNS server 220 to identify the IP address of the corresponding resource 210A, 210B, or 210C… the DNS server 220 may include a routing table (mapping data) in which the domain name of the network packet or any other FQDN associated with resources 210A, 210B, or 210C can be routed to the appropriate resource IP address. Once the domain name of the resource 210A, 210B, or 210C (plurality of ingress host cells) is identified, the reverse proxy 214 may submit the FQDN to the DNS server so that the IP address of the resource domain is determined. As a result of the resource domain being determined, the reverse proxy 214 forwards the network packet to one or more corresponding resources 210A/B/C, which in turn processes any application data within the network packet and generates a response).
But, Chung does not explicitly disclose:
the mapping database containing mapping data indicating a plurality of mappings between a plurality of domains to a plurality of sets of ingress host cells;
However, in the same field of endeavor, Zheng discloses the mapping database containing mapping data indicating a plurality of mappings between a plurality of domains to a plurality of sets of ingress host cells ([0036] discloses the DNS is a distributed database that maps a domain name and an IP address (belonging to host cells) to each other, which can make it more convenient for people to access the Internet).
Therefore, it would have been obvious to a person having ordinary skill in the art at the time of the invention was effectively filed to combine the teaching of Chung with Zheng. The modification would allow effective record accessing when record is not available in local cache for efficient resolving of domain names and traffic forwarding.
But, the combination does not explicitly disclose:
querying, by the computer, a mapping database using the destination domain to identify a set of ingress host cells assigned to the destination domain, the mapping database containing mapping data indicating a plurality of mappings between a plurality of domains to a plurality of sets of ingress host cells that define one or more traffic entry points for routing traffic to nodes of respective domains.
However, in the same field of endeavor, Arango discloses querying, by the computer ([0030] ITR) , a mapping database using the destination domain to identify a set of ingress host cells assigned to the destination domain ([0030] discloses The ITR then queries the mapping server to identify an RLOC for 10.2.0.1/32. The mapping server queries its mapping database and finds that the 10.2/16 subnetwork is serviced by a particular ETR with an associated RLOC), the mapping database containing mapping data indicating a plurality of mappings between a plurality of domains to a plurality of sets of ingress host cells (fig. 4 endpoint pool 412-2) that define one or more traffic entry points for routing traffic to nodes of respective domains([0013] By way of example, an endpoint at EID 10.1.0.1/32 may want to communicate with an endpoint at 10.2.0.1/32. The endpoint at 10.1.0.1/32 sends a network packet out to the ITR servicing the 10.1/16 subnetwork with a destination IP address of 10.2.0.1. The ITR then queries the mapping server to identify an RLOC for 10.2.0.1/32. The mapping server queries its mapping database and finds that the 10.2/16 subnetwork is serviced by a particular ETR with an associated RLOC. The mapping server then responds to the ITR with the RLOC for the ETR servicing the 10.2/16 subnetwork.
[0014] The ITR servicing the 10.1/16 network encapsulates the EID header with a LISP header and RLOC header for the specific destination node around the regular TCP/IP header, in this case 10.2.0.1/32. The ITR then routes the packet to the ETR servicing the 10.2/16 subnetwork. [0015] When the ETR servicing 10.2/16 receives the encapsulated LISP packet, it decapsulates the packet and forwards it to the appropriate EID, in this case 10.2.0.1/32).
Arango further discloses what Chung discloses that is routing, by the computer, the one or more data packets of the data traffic to at least one node of the destination domain via an ingress host of the set of ingress host cells assigned to the destination domain according to the mapping data ([0013] By way of example, an endpoint at EID 10.1.0.1/32 may want to communicate with an endpoint at 10.2.0.1/32. The endpoint at 10.1.0.1/32 sends a network packet out to the ITR servicing the 10.1/16 subnetwork with a destination IP address of 10.2.0.1. The ITR then queries the mapping server to identify an RLOC for 10.2.0.1/32. The mapping server queries its mapping database and finds that the 10.2/16 subnetwork is serviced by a particular ETR with an associated RLOC. The mapping server then responds to the ITR with the RLOC for the ETR servicing the 10.2/16 subnetwork. [0014] The ITR servicing the 10.1/16 network encapsulates the EID header with a LISP header and RLOC header for the specific destination node around the regular TCP/IP header, in this case 10.2.0.1/32. The ITR then routes the packet to the ETR servicing the 10.2/16 subnetwork. [0015] When the ETR servicing 10.2/16 receives the encapsulated LISP packet, it decapsulates the packet and forwards it to the appropriate EID, in this case 10.2.0.1/32).
Therefore, it would have been obvious to a person having ordinary skill in the art at the time of the invention was effectively filed to combine the teaching of the combination with Arango. The modification would allow effective information mapping retrieval. The modification would allow mapping destinations to effectively forward traffic to mapped endpoints. The modification would allow effective network communication using a mapping data base to resolve target ID.
Regarding claim 2.The combination discloses the method according to claim 1.
Chung further discloses, wherein each ingress host of each ingress host cell routes the data traffic to the destination domain (col. 4 59-64 discloses resources 110A/B/C or 210A/B/C may be virtual machine images or instances which receive the network packets, performs any tasks as requested in the network packets. Example of resources 110A/B/C (ingress host cell) may include, but are not limited to, compute resources (virtual computer systems). Host of the VMs 110A/B/C or 210A/B/C corresponds to ingress host; col. 7 34-67 and col. 8 1-15 discloses proxy server receives a network packet…the reverse proxy 214 may submit the domain name of the network packet and/or the FQDN associated with the destination IP address to the DNS server 220 to identify the IP address of the corresponding resource 210A, 210B, or 210C… the DNS server 220 may include a routing table (mapping data) in which the domain name of the network packet or any other FQDN associated with resources 210A, 210B, or 210C can be routed to the appropriate resource IP address. Once the domain name of the resource 210A, 210B, or 210C (plurality of ingress host cells) is identified, the reverse proxy 214 may submit the FQDN to the DNS server so that the IP address of the resource domain is determined. As a result of the resource domain being determined, the reverse proxy 214 forwards the network packet to one or more corresponding resources 210A/B/C, which in turn processes any application data within the network packet and generates a response. Host of the VMs 110A/B/C or 210A/B/C corresponds to ingress host. The host forwarding packet destined to the VMs hosted corresponds to routing),.
Regarding claim 3.The method according to claim 1.
Chung further disclose, further comprising establishing, by the computer, a transport-layer connection for the client device to the ingress host of the sets of ingress host cells according to the mapping data (col. 16, 5-15 discloses in an embodiment, a system utilizes at least one network (such as network 204 of FIG. 2) that would be familiar to those skilled in the art for supporting communications using any of a variety of commercially-available protocols, such as Transmission Control Protocol/Internet Protocol (“TCP/IP”) (transport layer connection); (56) The system 900, in an embodiment, is a distributed and/or virtual computing system utilizing several computer systems and components that are interconnected via communication links (e.g., transmission control protocol (TCP) connections and/or transport layer security (TLS)).
Regarding claim 4.The method according to claim 1.
Chung further discloses, further comprising updating, by the computer, one or more header fields of at least one data packet of the client data traffic for routing the client data traffic to the ingress host and to the destination domain (col. 13, 31-36 After the resource IP address is identified, the reverse proxy may transform the destination IP address to the resource IP address (updating header) then attach the new IP address to the packet (step 812). At step 814, the reverse proxy forwards the packet to the resource IP address. The process 800 terminates thereafter).
Regarding claim 7.The combination discloses method according to claim 1.
Chung further discloses, further comprising: assigning, by the computer, the one or more webservices of the destination domain to at least one ingress cell during an onboarding process updating, by the computer, the mapping database to indicate that the one or more webservices are mapped to the at least one ingress cell (fig. 2 discloses service provider 208, resources 210, and DNS server 220; col. 4 59-64 discloses resources 110A/B/C or 210A/B/C may be virtual machine images or instances which receive the network packets, performs any tasks as requested in the network packets. Example of resources 110A/B/C (ingress host cell) may include, but are not limited to, compute resources (virtual computer systems). Host of the VMs 110A/B/C or 210A/B/C corresponds to ingress host. It is known system that when new resource or VM or a host of the VM/resource is added, its information is updated in the DNS 220 for correctly resolve domain name associated with the added component);
Regarding claim 11. The combination discloses a system for managing data traffic.
Chung inherently discloses , the system comprising: a mapping database comprising non-transitory machine-readable storage media, configured to store mapping data indicating a plurality of mappings between a plurality of domains to a plurality of sets of ingress host cells (col. 7 34-67 and col. 8 1-15 discloses proxy server receives a network packet…the reverse proxy 214 may submit the domain name of the network packet and/or the FQDN associated with the destination IP address to the DNS server 220 to identify the IP address of the corresponding resource 210A, 210B, or 210C… the DNS server 220 may include a routing table (mapping data) in which the domain name of the network packet or any other FQDN associated with resources 210A, 210B, or 210C can be routed to the appropriate resource IP address. Once the domain name of the resource 210A, 210B, or 210C (plurality of ingress host cells) is identified, the reverse proxy 214 may submit the FQDN to the DNS server so that the IP address of the resource domain is determined. As a result of the resource domain being determined, the reverse proxy 214 forwards the network packet to one or more corresponding resources 210A/B/C, which in turn processes any application data within the network packet and generates a response);
Chung discloses a computing device comprising at least one processor and a load-balancer program, the computing device configured to ((fig. 2 service provider comprising load balancer 212 and reverse proxy 214);
Zheng discloses, the system comprising: a mapping database comprising non-transitory machine-readable storage media, configured to store mapping data indicating a plurality of mappings between a plurality of domains to a plurality of sets of ingress host cells ([0036] discloses the DNS is a distributed database that maps a domain name and an IP address (belonging to host cells) to each other, which can make it more convenient for people to access the Internet).
All other limitations of claim 11 are similar with the limitations of claim 1 above and is rejected on the same basis.
Regarding claim 12.The combination discloses system according to claim 11.
All other limitations of claim 12 are similar with the limitations of claim 2 above and are rejected on the same basis.
Regarding claim 13.The combination discloses system according to claim 11.
All other limitations of claim 13 are similar with the limitations of claim 3 above and are rejected on the same basis.
Regarding claim 14.The combination discloses system according to claim 11.
All other limitations of claim 14 are similar with the limitations of claim 4 above and are rejected on the same basis.
Regarding claim 17.The combination discloses system according to claim 11.
All other limitations of claim 17 are similar with the limitations of claim 7 above and are rejected on the same basis.
Claim(s) 5-6 and 15-16 is/are rejected under 35 U.S.C. 103 as being unpatentable over the combination of Chung (US pat. No. 11863528), Zheng (US pg. no. 20250301053), and Arango (US pg. no. 20180343227), further in view of Allie (US pat. No. 11528212).
Regarding claim 5.The combination discloses method according to claim 1.
But, the combination does not explicitly disclose: further comprising determining, by the computer, health check information for each ingress host cell assigned to the destination domain using the mapping database.
However, in the same field of endeavor, Allie discloses, further comprising determining, by the computer, health check information for each ingress host cell assigned to the destination domain using the mapping database (col. 7, 6-39 discloses resolver 210 (computer) may communicate with data server 218 to obtain from endpoint data 238 the relevant endpoints 240 that are associated with service 222 (ingress host)…Each of the endpoints 240 (associated with corresponding service) may have a health indicator that indicates a state of health of the endpoint (as determined by health checker 214). Resolver 210 may check each of the health indicators of endpoints 240; col. 8 16-23 (48) The health checker 214 may perform health checking for each of the services named in service configuration 232. For a given name, the health checker may query the data server 218 to pull all the discovered endpoints associated with that name. The health checker may then perform the actions on those discovered endpoints. Based on the result of the health check test, the health checker may store the health status of each of the endpoints in endpoint data 238);
Therefore, it would have been obvious to a person having ordinary skill in the art at the time of the invention was effectively filed to combine the teaching of the combination with Allie. The modification would allow effective health checking system that checks health of services to identify failed services and to avoid sending traffic to failed target that would contribute to the overall traffic and congestion in the network.
Regarding claim 6.The combination discloses method according to claim 5.
Allie further discloses, further comprising: querying, by the computer, a cell manager program that polls each instance of the ingress host cells associated with the destination domain (col. 7, 6-39 discloses resolver 210 (computer) may communicate with data server 218 to obtain from endpoint data 238 (obtain by querying) the relevant endpoints 240 that are associated with service 222 (ingress host)…Each of the endpoints 240 (associated with corresponding service) may have a health indicator that indicates a state of health of the endpoint (as determined by health checker 214). Resolver 210 may check each of the health indicators of endpoints 240; col. 8 16-23 (48) The health checker 214 (cell manager) may perform health checking for each of the services named in service configuration 232. For a given name, the health checker may query the data server 218 to pull all the discovered endpoints associated with that name. The health checker may then perform the actions on those discovered endpoints. Based on the result of the health check test, the health checker may store the health status of each of the endpoints in endpoint data 238); and
receiving, by the computer, the health check information from the cell manager program (col. 7, 6-39 discloses resolver 210 (computer) may communicate with data server 218 to obtain from endpoint data 238 the relevant endpoints 240 that are associated with service 222 (ingress host)…Each of the endpoints 240 (associated with corresponding service) may have a health indicator that indicates a state of health of the endpoint (as determined by health checker 214). Resolver 210 may check each of the health indicators of endpoints 240; col. 8 16-23 (48) The health checker 214 may perform health checking for each of the services named in service configuration 232. For a given name, the health checker may query the data server 218 to pull all the discovered endpoints associated with that name. The health checker may then perform the actions on those discovered endpoints. Based on the result of the health check test, the health checker may store the health status of each of the endpoints in endpoint data 238).
Regarding claim 15.The combination discloses system according to claim 11.
All other limitations of claim 15 are similar with the limitations of claim 5 above and are rejected on the same basis.
Regarding claim 16.The combination discloses system according to claim 15.
All other limitations of claim 16 are similar with the limitations of claim 6 above and are rejected on the same basis.
Claim(s) 8 and 18 is/are rejected under 35 U.S.C. 103 as being unpatentable over the combination of Chung (US pat. No. 11863528), Zheng (US pg. no. 20250301053), and Arango (US pg. no. 20180343227), further in view of Rozner (US pg. no. 20210160237).
Regarding claim 8.The combination discloses method according to claim 1.
But, the combination does not explicitly disclose:
further comprising determining, by the computer, a service name indicator (SNI) in the header data of at least one data packet of the client data traffic, the SNI indicating the destination domain of the client data traffic.
However, in the same field of endeavor, Rozner discloses further comprising determining, by the computer, a service name indicator (SNI) in the header data of at least one data packet of the client data traffic, the SNI indicating the destination domain of the client data traffic ([0126] discloses . The CN 405 then intercepts the request coming from the application 410 according to the proxy protocol and returns the response through the same proxy connection. In another such instances, the application 410 on the client computer is configured to use a DNS server that points at least some of the requested domains to the computer executing the CN 405. The CN 405 receives a DNS request and determines a requested domain from the header provided with the DNS request, such as Server Name Indicator (SNI) header for HTTPS request or HOST header for HTTP requests).
Therefore, it would have been obvious in the art at the time of the invention was effectively filed to combine the teaching of the combination with Rozner. The modification would allow effective resolving of end services IP address using SNI information to effectively forward service request to the right service end point.
Regarding claim 18.The combination discloses system according to claim 11.
All other limitations of claim 18 are similar with the limitations of claim 8 above and are rejected on the same basis.
Claim(s) 9 and 19 is/are rejected under 35 U.S.C. 103 as being unpatentable over the combination of Chung (US pat. No. 11863528), Zheng (US pg. no. 20250301053), and Arango (US pg. no. 20180343227), further in view of Bennett (US pg. no. 20070258437).
Regarding claim 9.The combination discloses method according to claim 1.
But, the combination does not explicitly disclose, wherein the set of ingress host cells assigned to the destination domain includes a set of quarantine ingress cells, and wherein the computer routes the client data traffic to the set of quarantine ingress cells in response to the computer determining that the client data traffic satisfies one or more quarantine thresholds.
However, in the same field of endeavor Bennett, discloses wherein the set of ingress host cells assigned to the destination domain (fig. 1 server clusters 151) includes a set of quarantine ingress cells ([0029] discloses quarantine service functionality (quarantine ingress cells) may be contained within one or more of server cluster), and wherein the computer routes the client data traffic to the set of quarantine ingress cells in response to the computer determining that the client data traffic satisfies one or more quarantine thresholds ([0035] sending, by a browser on a client device 153, a UDP packet to a domain name server (DNS) 141. Within the UDP packet, a notorious server, e.g., a server within a server cluster 151 might be identified by domain name…However, when a UDP packet that identifies a notorious server's domain name is received (threshold met) by one of the intermediate packet pathway nodes 109, a template targeting such domain name matches and a quarantine service function is triggered; [0029] discloses an intermediate packet pathway node detects routing attempts of packets that are related to a known source of: a) malware; b) illegal content; or 3) illegal distribution. Upon detecting any such packets (threshold met), the intermediate packet pathway nodes 109 invoke quarantine service function (quarantine cells). Quarantine service functionality may be contained within one or more of server cluster).
Therefore, it would have been obvious to a person having ordinary skill in the art ate the time of the invention was effectively filed to combine the teaching of the combination with Bennett. The modification would allow isolating malware traffic from the normal traffic processing to insure a more secured network communication.
Regarding claim 19.The combination discloses the system according to claim 11.
All other limitations of claim 19 are similar with the limitations of claim 9 above and are rejected on the same basis.
Claim(s) 10 and 20 is/are rejected under 35 U.S.C. 103 as being unpatentable over the combination of Chung (US pat. No. 11863528), Zheng (US pg. no. 20250301053), and Arango (US pg. no. 20180343227), further in view of Volkovich (US pg. no. 20240184857).
Regarding claim 10.The combination discloses the method according to claim 9.
But, the combination does not explicitly disclose:
further comprising obtaining, by the computer, packet telemetry data for the client data traffic using the header data of the one or more data packets of the client data traffic.
However, in the same field of endeavor Volkovich discloses further comprising obtaining, by the computer, packet telemetry data for the client data traffic using the header data of the one or more data packets of the client data traffic ([0111] Similarly, the instructions of data traffic monitor 208 may cause system 200 to analyze packet headers, to capture telemetry data with respect to the monitored data traffic flow samples. For example, the instructions of data traffic monitor 208 may cause system 200 to extract header information by analyzing the headers of included packets. Example features in the telemetry data may include, but are not limited to, Transport Layer Security (TLS) information (e.g., from a TLS handshake), such as the cipher suite offered, User Agent information, destination hostname, TLS extensions, etc., HTTP information (e.g., URI, etc.), Domain Name System (DNS) information).
Therefore, it would have been obvious toa person having ordinary skill in the art ate the time of the invention was effectively filed to combine the teaching of the combination with Volkovich. The modification would allow a dynamic system that can be dynamically adapted based on telemetry data captured. The modification would allow adaptive DNS based system to would adapt to conditions in the network.
Regarding claim 20.The combination discloses the system according to claim 19.
All other limitations of claim 20 are similar with the limitations of claim 10 above and are rejected on the same basis.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
-US 20160065531
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MESSERET F. GEBRE whose telephone number is (571)272-8272. The examiner can normally be reached 9:00 am-5:30PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Oscar Louie can be reached at 5712701684. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MESSERET F GEBRE/Primary Examiner, Art Unit 2445
Prosecution Insights