Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This action is responsive to the amendment filed 08/26/2026 to the Application filed on 07/24/2024
Claims 1, 4-22 are pending in this case. Claims 1, 15, and 19 are independent
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 5-10, and 15-16 are rejected under 35 U.S.C. 103 as being unpatentable over Subramanian et al, U. S. Patent Publication No. 20150312761, published on 2015-10-29 (hereinafter Subramanian) in view of Ou et al, U. S. Patent Publication No. 20200220858, published on 2020-07-09 (hereinafter Ou) in further view of Dao et al, U. S. Patent Publication No. 20180199398, published on 2018-07-12 (hereinafter Dao).
As for independent claim 1, Subramanian discloses a method and a system for preventing unauthorized access of a communications network, the system comprising: a network storage device; a network device comprising one or more processors; and a non-transitory computer-readable medium comprising executable instructions that, when executed, cause the network device to perform operations, wherein the operations comprise:
(Subramanian paragraphs [0004], [0005] and [0037] discloses a network storage device (SPR) and a network device (called a network interface) with the disclosed structure, “a network interface; a memory device; and a processor in communication with the memory device and the network interface… The subscriber profile repository (SPR) 148 may be a device that stores information related to subscribers to the subscriber network 100. Thus, SPR 148 may include a machine-readable storage medium such as read-only memory (ROM), random-access memory (RAM), magnetic disk storage media, optical storage media, flash-memory devices, and/or similar storage media. The SPR 148 may be a component of one of the PCRBs 144, 146 or may constitute an independent node within EPC 130 or session control device 140. Data stored by the SPR 148 may include subscriber information such as identifiers for each subscriber (e.g. IMSI and MSISDN identifiers), identifiers for devices associated with the subscriber (e.g., IMEI identifiers), bandwidth limits, charging parameters, subscriber priority, and other custom data.”; “Various embodiments described herein relate to a non-transitory machine-readable medium encoded with instructions for performing authentication”, [0004])
retrieving, based on the subscriber identifier in the bearer request, the PEI stored for the authorized UE; comparing, the PEI retrieved
(Subramanian paragraph [0043] discloses retrieving a subscriber record, and comparing the identity provided to the list, the authentication being denied if the equipment identifier is not in the list of known devices associated with the subscriber, “If the equipment identifier is not recorded in the retrieved subscriber record, the session control device denies authentication and, consequently, access to the service network.”)
Subramanian does not appear to disclose a system and method wherein the operations comprise: receiving, at a first time, a physical entity identifier (PEI) of an authorized user equipment (UE) and a subscriber identifier of the authorized UE, and storing both of the PEI of the authorized UE and the subscriber identifier of the authorized UE on the network storage device and the bearer request comprising the PEI of the suspect UE and the subscriber identifier of the authorized UE.
However Ou does disclose a system and method wherein the operations comprise: receiving, at a first time, a physical entity identifier (PEI) of an authorized user equipment (UE) and a subscriber identifier of the authorized UE, and storing both of the PEI of the authorized UE and the subscriber identifier of the authorized UE on the network storage device and the bearer request comprising the PEI of the suspect UE and the subscriber identifier of the authorized UE.
(Ou paragraph [0009] discloses a server receiving from a user device an access request (which according the applicant specification [00049] is equivalent to a bearer request), including an international mobile equipment identity (IMEI) and an international mobile subscriber identity (IMSI) which is stored in a database, “One or more aspects of the disclosure may also provide a method of receiving, by a server and from a user device, a request to access a network. The user device may be associated with a subscriber identity. The server may send, to the user device, a request for one or more identities associated with the user device. The server may receive, from the user device, a first identity associated with the user device. The server may receive, from the user device, a second identity associated with a user network identity. The server may retrieve, from a database associated with the server, identities that have been registered to the database. Based on a determination, by the server, that the first identity and the second identity correspond to the registered identities, the server may send, to the user device, a confirmation for accessing the network. The first identity may comprise an international mobile equipment identity. The second identity may comprise an international mobile subscriber identity. The receiving the request to access the network may be based on a determination that a local password associated with the user device has been verified. The server may receive, from the user device, the identities. The server may register the identities to the database. The server may store the identities in a key store configured to store cryptographic keys or certificates. Before retrieving the identities that have been registered to the database, the server may determine that one or more of the identities have been registered to the database.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to combine the network manager of Ou, adding the step of storing the identities to the session establishment protocol, to the network manager of Subramanian in order to reduce the threat of identity theft.
Neither Ou nor Subramanian appear to disclose a system and method wherein the network device comprises a Unified Data Management (UDM) function, wherein the network storage device comprises a Unified Data Repository (UDR), and wherein the operations comprise: after service has been established for the authorized UE, receiving, by the UDM function from a Session Management Function (SMF), a bearer request initiated by a suspect UE to establish a new data session with the communications network, and transmitting an indication of the rejection to the SMF.
However, Dao does disclose a system and method wherein the network device comprises a Unified Data Management (UDM) function, wherein the network storage device comprises a Unified Data Repository (UDR),
(Dao discloses a UDM and a user data repository (an equivalent to unified data repository), and figure 3, shows the UDM, UDR, SMF, and AMF communicating with each other during the process, “A Unified Data Management Function (UDM) 216 can present a service based Nudm interface to communicate with other network functions, and can provide data storage facilities to other network functions. Unified data storage can allow for a consolidated view of network information that can be used to ensure that the most relevant information can be made available to different network functions from a single resource….The UDM 216 may employ an interface, such as Nudr to connect to a User Data Repository (UDR) 234. The PCF 222 may be associated with the UDM 216 because it may be involved with requesting and providing subscription policy information to the UDR 234, but it should be understood that typically the PCF 222 and the UDM 216 are independent functions.” [0122], “A Network Exposure Function (NEF) 230 can be deployed in the network to allow servers, functions and other entities such as those outside a trusted domain to have exposure to services and capabilities within the network. In one such example, an NEF 230 can act much like a proxy between an application server outside the illustrated network and network functions such as the Policy Control Function (PCF) 222, the SMF 220, the UDM 216, and the AMF 218, so that the external application server can provide information that may be of use in the setup of the parameters associated with a data session. The NEF 230 can communicate with other network functions through a service based Nnef network interface. The NEF 230 may also have an interface to non-3GPP functions.” [0119])
and wherein the operations comprise: after service has been established for the authorized UE, receiving, by the UDM function from a Session Management Function (SMF), a bearer request initiated by a suspect UE to establish a new data session with the communications network;
(Dao discloses a UE sending a re-attach request (as such it is a second request subsequent to the initial attach request and it is a bearer request since it is a request to establish a new session), “The method of re-attaching (375) comprises the UE 202 sending an attach request (380) to the AN 204. The attach request includes the SM-NSSAI, the Temp UE ID and the MM parameters. The AN 204 forwards the attach request to the AMF 218.” [0128], “Session management states describe the UP connectivity for a PDU session between the UE 202 and the SMF 220. For an established PDU session, there may be at least two session management states for a PDU session: an active state (e.g., Session-ACTIVE) and an idle state (e.g., Session-IDLE). In this description, “Session-ACTIVE” may be used to denote an active state and “Session-IDLE” is used to denote an idle state. Since the PDU session state is related to data transmission activities (UL and DL) of the user, the session state may alternatively be called a session connection state.” [0129])
(Dao paragraph [0169] discloses an SMF sending a UDM a UE context update request (equivalent to session establishment request), “The SMF 220 may send to the UDM 216 (or the UDM 216 may receive from the SMF 220) a SMF-UDM UE context update request (966) message. The message (966) may include identifiers to identify the UE 202 (such as temp ID, IMSI, GUTI), and the UE context or new values of parameters of the UE context that have changed.”)
and transmitting an indication of the rejection to the SMF.
(Dao paragraph [0166] discloses sending a message to an SMF including an error code when a session request is rejected, “Next, the UPF 212 may send a UPF session setup response message (750) to the SMF 220. The SMF 220 may store all UE-related information in a SM UE context profile, including the Session-State parameter….As noted above, if the session request is reject, the session creation response may include an error code. This error code may be ‘Un-authorized Service Request’, ‘Network Resources Outage’, ‘Not Enough Credit for Charging’, or another error code.”)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to combine the network manager of Dao, adding a UDM, UDR, SMF and AMF, which perform various steps in the process, to the network manager of Ou and Subramanian as an obvious to try variation in order to ensure that the most relevant information can be made available to different network functions.
As for claim 5, the limitations of the parent claim 1 have been discussed. Ou discloses a system and method wherein the receiving at the first time comprises receiving,
(Ou discloses receiving the two identifiers during a registration process, “The first identity may comprise an international mobile equipment identity. The second identity may comprise an international mobile subscriber identity. The receiving the request to access the network may be based on a determination that a local password associated with the user device has been verified. The server may receive, from the user device, the identities. The server may register the identities to the database.” [0009])
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to combine the network manager of Ou, adding the step of storing the identities to the session establishment protocol, to the network manager of Subramanian in order to reduce the threat of identity theft.
Neither Ou nor Subramanian appear to disclose a system and method wherein receiving, by the UDM function from an Access and Mobility Management Function (AMF).
However Dao does disclose a system and method wherein receiving, by the UDM function from an Access and Mobility Management Function (AMF).
(Dao paragraph [0169] discloses an SMF sending a UDM a UE context update request (equivalent to session establishment request), “The SMF 220 may send to the UDM 216 (or the UDM 216 may receive from the SMF 220) a SMF-UDM UE context update request (966) message. The message (966) may include identifiers to identify the UE 202 (such as temp ID, IMSI, GUTI), and the UE context or new values of parameters of the UE context that have changed.”)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to combine the network manager of Dao, adding a UDM, UDR, SMF and AMF, which perform various steps in the process, to the network manager of Ou and Subramanian as an obvious to try variation in order to ensure that the most relevant information can be made available to different network functions.
As for claim 6, the limitations of the parent claim 5 have been discussed. Subramanian discloses a system and method wherein the operations further comprise, after the storing, transmitting,
(Subramanian discloses “In step 735, the session control device determines that the request is authentic and proceeds to perform additional processing of the session establishment request. For example, the session control device may proceed to establish, reject, or counteroffer the requested session. The method 700 then proceeds to end in step 540.” [0073])
Subramanian does not appear to disclose a system and method wherein the storing at the first time comprises storing, by the UDM function, the PEI of the authorized UE in association with the subscriber identifier of the authorized UE in the UDR.
However Ou does disclose a system and method wherein the storing at the first time comprises storing,
(Ou discloses receiving the two identifiers during a registration process, “The first identity may comprise an international mobile equipment identity. The second identity may comprise an international mobile subscriber identity. The receiving the request to access the network may be based on a determination that a local password associated with the user device has been verified. The server may receive, from the user device, the identities. The server may register the identities to the database. The server may store the identities in a key store configured to store cryptographic keys or certificates.” [0009])
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to combine the network manager of Ou, adding the step of storing the identities to the session establishment protocol, to the network manager of Subramanian in order to reduce the threat of identity theft.
Neither Ou nor Subramanian appear to disclose a system and method comprising transmitting, by the UDM function to the AMF and storing, by the UDM function in the UDR.
However Dao does disclose a system and method comprising transmitting, by the UDM function to the AMF and storing, by the UDM function in the UDR.
(Dao discloses a UDM and a user data repository (an equivalent to unified data repository), and figure 3, shows the UDM, UDR, SMF, and AMF communicating with each other during the process, “A Unified Data Management Function (UDM) 216 can present a service based Nudm interface to communicate with other network functions, and can provide data storage facilities to other network functions. Unified data storage can allow for a consolidated view of network information that can be used to ensure that the most relevant information can be made available to different network functions from a single resource….The UDM 216 may employ an interface, such as Nudr to connect to a User Data Repository (UDR) 234. The PCF 222 may be associated with the UDM 216 because it may be involved with requesting and providing subscription policy information to the UDR 234, but it should be understood that typically the PCF 222 and the UDM 216 are independent functions.” [0122], “A Network Exposure Function (NEF) 230 can be deployed in the network to allow servers, functions and other entities such as those outside a trusted domain to have exposure to services and capabilities within the network. In one such example, an NEF 230 can act much like a proxy between an application server outside the illustrated network and network functions such as the Policy Control Function (PCF) 222, the SMF 220, the UDM 216, and the AMF 218, so that the external application server can provide information that may be of use in the setup of the parameters associated with a data session. The NEF 230 can communicate with other network functions through a service based Nnef network interface. The NEF 230 may also have an interface to non-3GPP functions.” [0119])
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to combine the network manager of Dao, adding a UDM, UDR, SMF and AMF, which perform various steps in the process, to the network manager of Ou and Subramanian as an obvious to try variation in order to ensure that the most relevant information can be made available to different network functions.
As for claim 7, the limitations of the parent claim 1 have been discussed. Subramanian discloses a system and method wherein an authentication procedure is performed during an attachment of the authorized UE to the communications network prior to the first time.
(Subramanian paragraph [0042] discloses authentication occurring when the UE attaches to the network environment, “According to some embodiments, upon the user equipment 110 attaching to the network environment 100 and requesting authentication”)
As for claim 8, the limitations of the parent claim 7 have been discussed. Subramanian discloses a system and method wherein the authentication procedure comprises verifying that the PEI of the authorized UE is associated with the subscriber identifier of the authorized UE.
(Subramanian paragraph [0043] discloses part of the authentication involving matching the equipment identification being compared to an existing list of ones, “the session control device 140 additionally or alternatively verifies that a reported equipment identifier is associated with the identified subscriber in the associated subscription profile record.”)
As for claim 9, the limitations of the parent claim 1 have been discussed. Ou discloses a system and method wherein the bearer request to establish the new data session comprises a bearer setup request.
(Ou paragraph [0009] discloses a server receiving from a user device an access request (which according the applicant specification [00049] is equivalent to a bearer request), including an international mobile equipment identity (IMEI) and an international mobile subscriber identity (IMSI) which is stored in a database, “One or more aspects of the disclosure may also provide a method of receiving, by a server and from a user device, a request to access a network.”)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to combine the network manager of Ou, adding the use of a bearer setup request with the network manager of Subramanian in order to have a system that works in a more diverse set of situations.
As for claim 10, the limitations of the parent claim 1 have been discussed. Dao discloses a system and method wherein the indication of the rejection comprises a 403 Forbidden error code or an Unauthorized Device Access error code.
(Dao paragraph [0166] discloses sending a message to an SMF including an unauthorized device access (called Un-authorized Service Request) error code when a session request is rejected, “Next, the UPF 212 may send a UPF session setup response message (750) to the SMF 220. The SMF 220 may store all UE-related information in a SM UE context profile, including the Session-State parameter….As noted above, if the session request is reject, the session creation response may include an error code. This error code may be ‘Un-authorized Service Request’, ‘Network Resources Outage’, ‘Not Enough Credit for Charging’, or another error code.”)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to combine the network manager of Dao, adding an error handling step, to the network manager of Ou and Subramanian to ensure that the most relevant information can be made available to different network functions from a single resource.
As for independent claim 15, Subramanian discloses a system and method comprising retrieving,
(Subramanian paragraph [0043] discloses retrieving a subscriber record, and comparing the identity provided to the list, the authentication being denied if the equipment identifier is not in the list of known devices associated with the subscriber, “If the equipment identifier is not recorded in the retrieved subscriber record, the session control device denies authentication and, consequently, access to the service network.”)
Subramanian does not appear to disclose a system and method comprising storing, by a Unified Data Management (UDM) function, a Physical Entity Identifier (PEI) of an authorized user equipment (UE) and a subscriber identifier of the authorized UE as associated data in a Unified Data Repository (UDR).
However Ou discloses a system and method comprising storing,
(Ou paragraph [0009] discloses a server receiving from a user device an access request (which according the applicant specification [00049] is equivalent to a bearer request), including an international mobile equipment identity (IMEI) and an international mobile subscriber identity (IMSI) which is stored in a database, “One or more aspects of the disclosure may also provide a method of receiving, by a server and from a user device, a request to access a network. The user device may be associated with a subscriber identity. The server may send, to the user device, a request for one or more identities associated with the user device. The server may receive, from the user device, a first identity associated with the user device. The server may receive, from the user device, a second identity associated with a user network identity. The server may retrieve, from a database associated with the server, identities that have been registered to the database. Based on a determination, by the server, that the first identity and the second identity correspond to the registered identities, the server may send, to the user device, a confirmation for accessing the network. The first identity may comprise an international mobile equipment identity. The second identity may comprise an international mobile subscriber identity. The receiving the request to access the network may be based on a determination that a local password associated with the user device has been verified. The server may receive, from the user device, the identities. The server may register the identities to the database. The server may store the identities in a key store configured to store cryptographic keys or certificates. Before retrieving the identities that have been registered to the database, the server may determine that one or more of the identities have been registered to the database.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to combine the network manager of Ou, adding the step of storing the identities to the session establishment protocol, to the network manager of Subramanian in order to reduce the threat of identity theft.
Neither Subramanian nor Ou appear to disclose a system and method comprising after service has been established for the authorized UE, receiving, by the UDM function from a Session Management Function (SMF), a bearer request initiated by a suspect UE, the bearer request comprising the PEI of the suspect UE and the subscriber identifier of the authorized UE; transmitting an indication of the rejection to the SMF; and the UDM and UDR performing certain steps.
However Dao does disclose a system and method comprising after service has been established for the authorized UE, receiving, by the UDM function from a Session Management Function (SMF), a bearer request initiated by a suspect UE, the bearer request comprising the PEI of the suspect UE and the subscriber identifier of the authorized UE;
(Dao discloses a UE sending a re-attach request (as such it is a second request subsequent to the initial attach request and it is a bearer request since it is a request to establish a new session), “The method of re-attaching (375) comprises the UE 202 sending an attach request (380) to the AN 204. The attach request includes the SM-NSSAI, the Temp UE ID and the MM parameters. The AN 204 forwards the attach request to the AMF 218.” [0128], “Session management states describe the UP connectivity for a PDU session between the UE 202 and the SMF 220. For an established PDU session, there may be at least two session management states for a PDU session: an active state (e.g., Session-ACTIVE) and an idle state (e.g., Session-IDLE). In this description, “Session-ACTIVE” may be used to denote an active state and “Session-IDLE” is used to denote an idle state. Since the PDU session state is related to data transmission activities (UL and DL) of the user, the session state may alternatively be called a session connection state.” [0129])
(Dao paragraph [0169] discloses an SMF sending a UDM a UE context update request (equivalent to session establishment request), “The SMF 220 may send to the UDM 216 (or the UDM 216 may receive from the SMF 220) a SMF-UDM UE context update request (966) message. The message (966) may include identifiers to identify the UE 202 (such as temp ID, IMSI, GUTI), and the UE context or new values of parameters of the UE context that have changed.”)
transmitting an indication of the rejection to the SMF;
(Dao paragraph [0166] discloses sending a message to an SMF including an error code when a session request is rejected, “Next, the UPF 212 may send a UPF session setup response message (750) to the SMF 220. The SMF 220 may store all UE-related information in a SM UE context profile, including the Session-State parameter….As noted above, if the session request is reject, the session creation response may include an error code. This error code may be ‘Un-authorized Service Request’, ‘Network Resources Outage’, ‘Not Enough Credit for Charging’, or another error code.”)
and the UDM and UDR performing certain steps.
(Dao discloses a UDM and a user data repository (an equivalent to unified data repository), and figure 3, shows the UDM, UDR, SMF, and AMF communicating with each other during the process, “A Unified Data Management Function (UDM) 216 can present a service based Nudm interface to communicate with other network functions, and can provide data storage facilities to other network functions. Unified data storage can allow for a consolidated view of network information that can be used to ensure that the most relevant information can be made available to different network functions from a single resource….The UDM 216 may employ an interface, such as Nudr to connect to a User Data Repository (UDR) 234. The PCF 222 may be associated with the UDM 216 because it may be involved with requesting and providing subscription policy information to the UDR 234, but it should be understood that typically the PCF 222 and the UDM 216 are independent functions.” [0122], “A Network Exposure Function (NEF) 230 can be deployed in the network to allow servers, functions and other entities such as those outside a trusted domain to have exposure to services and capabilities within the network. In one such example, an NEF 230 can act much like a proxy between an application server outside the illustrated network and network functions such as the Policy Control Function (PCF) 222, the SMF 220, the UDM 216, and the AMF 218, so that the external application server can provide information that may be of use in the setup of the parameters associated with a data session. The NEF 230 can communicate with other network functions through a service based Nnef network interface. The NEF 230 may also have an interface to non-3GPP functions.” [0119])
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to combine the network manager of Dao, adding a UDM, UDR, SMF and AMF, which perform various steps in the process, to the network manager of Ou and Subramanian as an obvious to try variation in order to ensure that the most relevant information can be made available to different network functions.
As for claim 16, the limitations of the parent claim 15 have been discussed. Claim 16 is directed to a method for implementing the system for claim 6 and is rejected alongside the same rationale.
Claim 4 is rejected under 35 U.S.C. 103 as being unpatentable over Subramanian in view of Ou in further view of Dao in further view of Yang et al, U. S. Patent Publication No. 20210092603, published on 2021-03-25 (hereinafter Yang).
As for claim 4, the limitations of the parent claim 1 have been discussed. Yang discloses a system and method wherein the subscriber identifier is one of a subscription concealed identifier (SUCI), a subscription permanent identifier (SUPI), or a globally routable user agent public identity (GPSI).
(Yang paragraph [0031] discloses using a SUCI or SUPI in a network environment using a UE, “a user equipment (UE), and wireless network entities by encrypting a subscription permanent identifier (SUPI) to form a subscription concealed identifier (SUCI) using a one-time ephemeral asymmetric key, generated by the UE, and network provided keys. Encryption of the SUPI to form the SUCI can mitigate snooping and can be based on ephemeral asymmetric key pairs generated by the UE and by additional keys (including combinations of symmetric and/or asymmetric keys) generated by a wireless network entity.”)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to combine the network manager of Yang, adding the use of a SUCI or SUPI with the network manager of Ou, Dao, and Subramanian in order to have more secure communication and personal information protection.
Claims 11-12, and 17 are rejected under 35 U.S.C. 103 as being unpatentable over Subramanian in view of Ou in further view of Dao in further view of Saxena et al, U. S. Patent Publication No. 20220078696, published on 2022-03-10 (hereinafter Saxena).
As for claim 11, the limitations of the parent claim 10 have been discussed. Dao discloses a system and method wherein the system further comprises the SMF, and wherein the SMF is configured, to use a key performance indicator (KPI) that tracks rejected bearer requests.
(Dao paragraph [0258] discloses the SMF having a list of rejected session establishment requests (called QoS), which according to paragraph [00051] of applicant’s specification is a type of KPI, “Next, the (R)AN 204 may send (N2 message) an N3 (R)AN Information (4712) to the SMF 220 via the AMF 218. The message (4712) may include the PDU session ID(s), a RAT type, a list of accepted QoS flows and a list of rejected QoS flows for the corresponding activated PDU session, and (R)AN N3 tunnel information ((R)AN IP address and tunnel ID).”)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to combine the network manager of Dao, adding an error handling step, to the network manager of Ou and Subramanian to ensure that the most relevant information can be made available to different network functions from a single resource.
Neither Subramanian no Dao appear to disclose a system and method configured to in response to receiving the indication of the rejection, to update session-management records and log the rejected bearer request for security auditing.
However Saxena does disclose a system and method configured to in response to receiving the indication of the rejection, to update session-management records and log the rejected bearer request for security auditing.
(Saxena discloses notifying a database (EIR) to update its records to record the rejection in response to the rejection, “upon identifying a mismatch of a PEI/IMEI-to-SUPI/IMSI mapping, e.g., between the SUPI/PEI received from/presented by a UE and the PEI/IMEI-to-SUPI/IMSI maintained by local EIR database 304, E-AMF 302 may inform E-5G-EIR NF 306 of the mismatch so that E-5G-EIR NF 306 can apply the change (if warranted) and propagate the change to local EIR database 304.” [0051])
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to combine the network manager of Saxena, adding an error handling step, to the network manager of Dao, Ou, and Subramanian to further ensure unauthorized access to a network.
As for claim 12, the limitations of the parent claim 1 have been discussed. Dao discloses Saxena discloses a system and method wherein the operations further comprise, in response to rejecting the bearer request, transmitting, by the UDM function to an Equipment Identity Register (EIR) through an interface between the UDM function and the EIR, a notification identifying the PEI of the suspect UE and indicating that the bearer request was rejected as an unauthorized-access attempt based on the PEIs being different.
(Saxen discloses and AMF (which according to figure 2a acts as an interface for UDM) sending to an EIR to update its records to record the rejection in response to the rejection, “FIG. 2A illustrates an example representation of certain 5G system Network Functions (NFs), although not all NFs/elements are necessarily illustrated. For example, other examples of NFs that may be part of a 5G system, may include, but are not limited to, a session management function (SMF), a unified data management (UDM), a uniform data repository (UDR), etc. It should be understood that NFs in the 5G core network may discover other NFs through the NF repository function (NRF), while structured or standard data may be stored in a UDR, which is accessible by other NFs, e.g., the UDM. As noted above, the AMF, e.g., AMF 202, may receive connection and session-related information from UEs across N1/N2 reference point interfaces (between UE and AMF/between RAN and AMF)” [0033], “upon identifying a mismatch of a PEI/IMEI-to-SUPI/IMSI mapping, e.g., between the SUPI/PEI received from/presented by a UE and the PEI/IMEI-to-SUPI/IMSI maintained by local EIR database 304, E-AMF 302 may inform E-5G-EIR NF 306 of the mismatch so that E-5G-EIR NF 306 can apply the change (if warranted) and propagate the change to local EIR database 304.” [0051], “Although various embodiments described herein refer to a localized EIR database as providing PEI/IMEI-to-SUPI/IMSI mapping information, per-slice allowlists, denylists, etc., such a repository, in some examples, may be a localized version of an EIR database, or in some examples may be a new slice control NF and associated data store.” [0055])
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to combine the network manager of Saxena, adding an error handling step, to the network manager of Dao, Ou, and Subramanian to further ensure unauthorized access to a network.
As for claim 17, the limitations of the parent claim 15 have been discussed. Claim 17 is directed to a method for implementing the system for claim 12 and is rejected alongside the same rationale.
Claims 13-14, and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Subramanian in view of Ou in further view of Dao in further view of Saxena in further view of Di Girolamo et al, U. S. Patent Publication No. 11445435, published on 2022-09-13 (hereinafter Di Girolamo).
As for claim 13, the limitations of the parent claim 1 have been discussed. Saxena discloses a system and method wherein the system further comprises the SMF, an Equipment Identity Register (EIR), and an interface configured for direct communication between the SMF and the EIR, and wherein the SMF is configured, in response to receiving the indication of the rejection from the UDM function, to transmit directly through the interface to the EIR a notification identifying the PEI of the suspect UE
(Saxen discloses an SMF (a function of an AMF) and an EIR which is sent a message notifying of a mismatch of PEI, “FIG. 2A illustrates an example representation of certain 5G system Network Functions (NFs), although not all NFs/elements are necessarily illustrated. For example, other examples of NFs that may be part of a 5G system, may include, but are not limited to, a session management function (SMF), a unified data management (UDM), a uniform data repository (UDR), etc. It should be understood that NFs in the 5G core network may discover other NFs through the NF repository function (NRF), while structured or standard data may be stored in a UDR, which is accessible by other NFs, e.g., the UDM. As noted above, the AMF, e.g., AMF 202, may receive connection and session-related information from UEs across N1/N2 reference point interfaces (between UE and AMF/between RAN and AMF)” [0033], “upon identifying a mismatch of a PEI/IMEI-to-SUPI/IMSI mapping, e.g., between the SUPI/PEI received from/presented by a UE and the PEI/IMEI-to-SUPI/IMSI maintained by local EIR database 304, E-AMF 302 may inform E-5G-EIR NF 306 of the mismatch so that E-5G-EIR NF 306 can apply the change (if warranted) and propagate the change to local EIR database 304.” [0051], “Although various embodiments described herein refer to a localized EIR database as providing PEI/IMEI-to-SUPI/IMSI mapping information, per-slice allowlists, denylists, etc., such a repository, in some examples, may be a localized version of an EIR database, or in some examples may be a new slice control NF and associated data store.” [0055])
Saxena does not appear to disclose a system and method comprising instructing the EIR to place the PEI of the suspect UE on a gray list or a black list.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to combine the network manager of Saxena, adding an error handling step, to the network manager of Dao, Ou, and Subramanian to further ensure unauthorized access to a network.
Neither Saxena nor Subramanian appear to disclose a system and method comprising instructing the EIR to place the PEI of the suspect UE on a gray list or a black list.
However, Di Girolamo does disclose a system and method comprising instructing the EIR to place the PEI of the suspect UE on a gray list or a black list.
(Di Girolamo discloses sending a message to an EIR to add it to a black list, “These devices are effectively decommissioned, and all core network context related to these devices (such as operator subscription profile information) should be deleted from the cellular network, and these devices should be added to the list of blacklisted devices maintained in the EIR/5G-EIR and central EIR/5G-EIR. These devices are said to be “off-boarded” from the cellular system.” Col 19, Lines 58-64)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to combine the network manager of Di Girolamo, adding an error handling step, to the network manager of Saxena, Dao, Ou, and Subramanian to further ensure unauthorized access to a network.
As for claim 14, the limitations of the parent claim 13 have been discussed. Claim 14 is directed to a method for implementing the system for claim 6 and is rejected alongside the same rationale.
As for claim 18, the limitations of the parent claim 15 have been discussed. Claim 15 is directed to a method for implementing the system for claim 13 and is rejected alongside the same rationale.
Claim 19 is rejected under 35 U.S.C. 103 as being unpatentable over Subramanian in view of Dao.
As for independent claim 19, Subramanian discloses a method and a system comprising a non-transitory computer-readable medium comprising executable instructions that, when executed, cause a network device comprising one or more processors to perform operations for preventing unauthorized
access of a communications network
(Subramanian paragraphs [0004], [0005] and [0037] discloses a network storage device (SPR) and a network device (called a network interface) with the disclosed structure, “a network interface; a memory device; and a processor in communication with the memory device and the network interface… The subscriber profile repository (SPR) 148 may be a device that stores information related to subscribers to the subscriber network 100. Thus, SPR 148 may include a machine-readable storage medium such as read-only memory (ROM), random-access memory (RAM), magnetic disk storage media, optical storage media, flash-memory devices, and/or similar storage media. The SPR 148 may be a component of one of the PCRBs 144, 146 or may constitute an independent node within EPC 130 or session control device 140. Data stored by the SPR 148 may include subscriber information such as identifiers for each subscriber (e.g. IMSI and MSISDN identifiers), identifiers for devices associated with the subscriber (e.g., IMEI identifiers), bandwidth limits, charging parameters, subscriber priority, and other custom data.”; “Various embodiments described herein relate to a non-transitory machine-readable medium encoded with instructions for performing authentication”, [0004])
and wherein the operations comprise: during a period of time in which service is maintained to the authorized UE
(Subramanian paragraphs [0038] and [0039] disclose a network providing a service to a UE given a designated length of time, “The packet data network 150 may be any network for providing data communications between user equipment 110 and other devices connected to packet data network 150, such as application functions (not shown). The packet data network 150 may further provide, for example, phone or Internet service to various user devices in communication with the packet data network 150. As shown, the environment also includes a web portal server 160 accessible by an end user device 170 for performing functions such as account inquiries and updates by an end user. For example, a subscriber, wishing to inquire as to the current month's bill for service”)
retrieving,
(Subramanian paragraph [0043] discloses retrieving a subscriber record, and comparing the identity provided to the list, the authentication being denied if the equipment identifier is not in the list of known devices associated with the subscriber, “If the equipment identifier is not recorded in the retrieved subscriber record, the session control device denies authentication and, consequently, access to the service network.”)
Subramanian does not appear to disclose a system and method wherein the network device comprises a Unified Data Management (UDM) function, wherein the network storage device comprises a Unified Data Repository (UDR), and wherein the operations comprise: after service has been established for the authorized UE, receiving, by the UDM function from a Session Management Function (SMF), a bearer request initiated by a suspect UE to establish a new data session with the communications network, and transmitting an indication of the rejection to the SMF.
However, Dao does disclose a system and method wherein the network device comprises a Unified Data Management (UDM) function,
(Dao discloses a UDM and a user data repository (an equivalent to unified data repository), and figure 3, shows the UDM, UDR, SMF, and AMF communicating with each other during the process, “A Unified Data Management Function (UDM) 216 can present a service based Nudm interface to communicate with other network functions, and can provide data storage facilities to other network functions. Unified data storage can allow for a consolidated view of network information that can be used to ensure that the most relevant information can be made available to different network functions from a single resource….The UDM 216 may employ an interface, such as Nudr to connect to a User Data Repository (UDR) 234. The PCF 222 may be associated with the UDM 216 because it may be involved with requesting and providing subscription policy information to the UDR 234, but it should be understood that typically the PCF 222 and the UDM 216 are independent functions.” [0122], “A Network Exposure Function (NEF) 230 can be deployed in the network to allow servers, functions and other entities such as those outside a trusted domain to have exposure to services and capabilities within the network. In one such example, an NEF 230 can act much like a proxy between an application server outside the illustrated network and network functions such as the Policy Control Function (PCF) 222, the SMF 220, the UDM 216, and the AMF 218, so that the external application server can provide information that may be of use in the setup of the parameters associated with a data session. The NEF 230 can communicate with other network functions through a service based Nnef network interface. The NEF 230 may also have an interface to non-3GPP functions.” [0119])
and wherein the operations comprise: after service has been established for the authorized UE, receiving, by the UDM function from a Session Management Function (SMF), a bearer request initiated by a suspect UE to establish a new data session with the communications network;
(Dao discloses a UE sending a re-attach request (as such it is a second request subsequent to the initial attach request and it is a bearer request since it is a request to establish a new session), “The method of re-attaching (375) comprises the UE 202 sending an attach request (380) to the AN 204. The attach request includes the SM-NSSAI, the Temp UE ID and the MM parameters. The AN 204 forwards the attach request to the AMF 218.” [0128], “Session management states describe the UP connectivity for a PDU session between the UE 202 and the SMF 220. For an established PDU session, there may be at least two session management states for a PDU session: an active state (e.g., Session-ACTIVE) and an idle state (e.g., Session-IDLE). In this description, “Session-ACTIVE” may be used to denote an active state and “Session-IDLE” is used to denote an idle state. Since the PDU session state is related to data transmission activities (UL and DL) of the user, the session state may alternatively be called a session connection state.” [0129])
(Dao paragraph [0169] discloses an SMF sending a UDM a UE context update request (equivalent to session establishment request), “The SMF 220 may send to the UDM 216 (or the UDM 216 may receive from the SMF 220) a SMF-UDM UE context update request (966) message. The message (966) may include identifiers to identify the UE 202 (such as temp ID, IMSI, GUTI), and the UE context or new values of parameters of the UE context that have changed.”)
and transmitting an indication of the rejection to the SMF.
(Dao paragraph [0166] discloses sending a message to an SMF including an error code when a session request is rejected, “Next, the UPF 212 may send a UPF session setup response message (750) to the SMF 220. The SMF 220 may store all UE-related information in a SM UE context profile, including the Session-State parameter….As noted above, if the session request is reject, the session creation response may include an error code. This error code may be ‘Un-authorized Service Request’, ‘Network Resources Outage’, ‘Not Enough Credit for Charging’, or another error code.”)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to combine the network manager of Dao, adding a UDM, UDR, SMF and AMF, which perform various steps in the process, to the network manager of Subramanian as an obvious to try variation in order to ensure that the most relevant information can be made available to different network functions.
Claim 20 is rejected under 35 U.S.C. 103 as being unpatentable over Subramanian in view of Dao in further view of Saxena.
As for claim 20, the limitations of the parent claim 19 have been discussed. Claim 20 is directed to a system with substantially similar subject matter as the system for claim 12 and is rejected alongside the same rationale.
Claim 21 is rejected under 35 U.S.C. 103 as being unpatentable over Subramanian in view of Dao in further view of Ou.
As for claim 21, the limitations of the parent claim 19 have been discussed. Subramanian discloses a system and method comprising transmitting, by the UDM function to the AMF, a confirmation that allows the AMF to proceed with establishing service for the authorized UE.
(Subramanian discloses “In step 735, the session control device determines that the request is authentic and proceeds to perform additional processing of the session establishment request. For example, the session control device may proceed to establish, reject, or counteroffer the requested session. The method 700 then proceeds to end in step 540.” [0073])
Subramanian does not appear to disclose a system and method comprising receiving, by the UDM function from an Access and Mobility Management Function (AMF), the PEI of the authorized UE and the subscriber identifier of the authorized UE; storing, by the UDM function, the PEI of the authorized UE in association with the subscriber identifier of the authorized UE in the UDR.
However, Ou does disclose a system and method comprising receiving,
(Ou paragraph [0009] discloses a server receiving from a user device an access request (which according the applicant specification [00049] is equivalent to a bearer request), including an international mobile equipment identity (IMEI) and an international mobile subscriber identity (IMSI) which is stored in a database, “One or more aspects of the disclosure may also provide a method of receiving, by a server and from a user device, a request to access a network. The user device may be associated with a subscriber identity. The server may send, to the user device, a request for one or more identities associated with the user device. The server may receive, from the user device, a first identity associated with the user device. The server may receive, from the user device, a second identity associated with a user network identity. The server may retrieve, from a database associated with the server, identities that have been registered to the database. Based on a determination, by the server, that the first identity and the second identity correspond to the registered identities, the server may send, to the user device, a confirmation for accessing the network. The first identity may comprise an international mobile equipment identity. The second identity may comprise an international mobile subscriber identity. The receiving the request to access the network may be based on a determination that a local password associated with the user device has been verified. The server may receive, from the user device, the identities. The server may register the identities to the database. The server may store the identities in a key store configured to store cryptographic keys or certificates. Before retrieving the identities that have been registered to the database, the server may determine that one or more of the identities have been registered to the database.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to combine the network manager of Ou, adding the step of storing the identities to the session establishment protocol, to the network manager of Subramanian in order to reduce the threat of identity theft.
Neither Ou nor Subramanian appear to disclose a system and method wherein the network device performs certain steps by a UDM, UDR, and AMF.
However, Dao does disclose a system and method wherein the network device performs certain steps by a UDM, UDR, and AMF.
(Dao discloses a UDM and a user data repository (an equivalent to unified data repository), and figure 3, shows the UDM, UDR, SMF, and AMF communicating with each other during the process, “A Unified Data Management Function (UDM) 216 can present a service based Nudm interface to communicate with other network functions, and can provide data storage facilities to other network functions. Unified data storage can allow for a consolidated view of network information that can be used to ensure that the most relevant information can be made available to different network functions from a single resource….The UDM 216 may employ an interface, such as Nudr to connect to a User Data Repository (UDR) 234. The PCF 222 may be associated with the UDM 216 because it may be involved with requesting and providing subscription policy information to the UDR 234, but it should be understood that typically the PCF 222 and the UDM 216 are independent functions.” [0122], “A Network Exposure Function (NEF) 230 can be deployed in the network to allow servers, functions and other entities such as those outside a trusted domain to have exposure to services and capabilities within the network. In one such example, an NEF 230 can act much like a proxy between an application server outside the illustrated network and network functions such as the Policy Control Function (PCF) 222, the SMF 220, the UDM 216, and the AMF 218, so that the external application server can provide information that may be of use in the setup of the parameters associated with a data session. The NEF 230 can communicate with other network functions through a service based Nnef network interface. The NEF 230 may also have an interface to non-3GPP functions.” [0119])
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to combine the network manager of Dao, adding a UDM, UDR, SMF and AMF, which perform various steps in the process, to the network manager of Ou and Subramanian as an obvious to try variation in order to ensure that the most relevant information can be made available to different network functions.
Claim 22 is rejected under 35 U.S.C. 103 as being unpatentable over Subramanian in view of Dao in further view of Saxena in further view of Di Girolamo.
As for claim 22, the limitations of the parent claim 19 have been discussed. Claim 22 is directed to a system with substantially similar subject matter as the system for claim 13 and is rejected alongside the same rationale.
Response to Arguments
In response to arguments to claim 1, applicant argues that Subramanian and Ou do not teach “the claimed SMF-to-UDM communication, UDM-to-UDR retrieval and comparison, or UDM-to-SMF rejection indication.” (see pages 2-3).
However, Dao does disclose the aforementioned functions and modules, and in combination with Subramanian and Ou teach all of the claimed steps. It would be obvious to try for one of ordinary skill in the art to have the functions and modules of Dao, of which there are finite quantity, do the steps disclosed in Dao, Subramanian, and Ou with a reasonable expectation of success since they are all computer modules or functions for managing a network.
In response to arguments to claim 15, applicant argues that Subramanian and Ou do not teach “ ’storing, by a Unified Data Management (UDM) function’ the recited identifiers ‘as associated data in a Unified Data Repository (UDR),’ receiving the claimed bearer request from an SMF, or transmitting an indication of rejection from the UDM function to the SMF.” and “the missing allocation and exchange among the SMF, UDM function, and UDR.” (see pages 5-6).
However, Dao does disclose the aforementioned functions and modules, and in combination with Subramanian and Ou teach all of the claimed steps. It would be obvious to try for one of ordinary skill in the art to have the functions and modules of Dao, of which there are finite quantity, do the steps disclosed in Dao, Subramanian, and Ou with a reasonable expectation of success since they are all computer modules or functions for managing a network.
In response to arguments to claim 15, applicant argues that Subramanian and Ou do not “disclose ‘receiving, by the UDM function from a Session Management Function (SMF)’ the claimed bearer request, ‘retrieving, by the UDM function from a Unified Data Repository (UDR)’ the stored PEI, or ‘transmitting an indication of the rejection to the SMF’ within the temporal relationship recited in claim 19.”
However, Dao does disclose the aforementioned functions and modules, and in combination with Subramanian and Ou teach all of the claimed steps. It would be obvious to try for one of ordinary skill in the art to have the functions and modules of Dao, of which there are finite quantity, do the steps disclosed in Dao, Subramanian, and Ou with a reasonable expectation of success since they are all computer modules or functions for managing a network.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JOHN C LAWRENCE whose telephone number is (571)272-9833. The examiner can normally be reached Monday-Friday 7:30am-5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeanette Parker can be reached at (571) 270-3647. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/JOHN CALEB LAWRENCE/ Examiner, Art Unit 2646
/KATHY W WANG-HURST/ Supervisory Patent Examiner, Art Unit 2644
Prosecution Insights