DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Priority
Applicant has no priority data on file.
Information Disclosure statements
The information disclosure statements (IDS) were submitted and filed on 09/11/2024. The submission is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statements are being considered by the examiner.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Bahr et al (US 2012/0061458) in view of Balmakhtar et al (US 2024/0080323).
Regarding claim 1, Bahr et al discloses method (method, [0117], line 1), comprising:
receiving, by a device, secure connection data and load data associated with a secure connection established between a user equipment (UE) and a core network via an untrusted access network (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 (user equipment (UE)) on the network 160, [0102], lines 1-3);
Bahr et al does not specifically disclose concept of processing, by the device, the secure connection data and the load data, with a machine learning model, to generate analytics associated with the secure connection; and
providing, by the device, the analytics to one or more analytics consumers to cause the one or more analytics consumers to perform one or more actions based on the analytics.
However, Balmakhtar et al specifically teaches concept of processing, by the device, the secure connection data and the load data, with a machine learning model, to generate analytics associated with the secure connection (At block 203, method 200 comprises receiving, by the security analysis application 133 of the TLE 106, security data 143 (secure connection data) from multiple different sources 103. In an embodiment, the security data 143 may comprise data regarding traffic (load) related to a security threat occurring at one or more NEs in the network 100. In an embodiment, the one or more NEs may be UEs, NFs, switches, routers, bridges, logical elements, virtual machines, servers, databases, etc. in the network 100. At block 206, method 200 comprises determining, by the security analysis application 133 using the machine learning model 130, a security related event 149 indicating the security threat occurring at one or more NEs in the network 100 based on one or more SKPIs 146 and the security data 143, [0073], lines 1-4, [0074], lines 1-3); and
providing, by the device, the analytics to one or more analytics consumers to cause the one or more analytics consumers to perform one or more actions based on the analytics (At block 206, method 200 comprises determining, by the security analysis application 133 using the machine learning model 130, a security related event 149 indicating the security threat occurring at one or more NEs in the network 100 based on one or more SKPIs 146 and the security data 143. The SKPIs 146 may indicate a value describing a security metric related to the security threat occurring at the one or more NEs in the network 100. When the result of the decision block 212 is Yes, method 200 may continue with block 215. At block 215, method 200 comprises determining, using a remediation application 136 of the TLE 106, a remediation action 155 for the security related event 149 based on the threat impact level 152 and the one or more Nes. At block 218, method 200 comprises transmitting, by the remediation application 136 to a PDP 116, a first message 170 to comprising an indication of a change in a security posture of a current access authorized by the network 100, based on the remediation action 155 for the security related event 149, [0074], lines 1-3, [0076], lines 1-3, [0077], lines 1-3).
At the time the invention was filed, it would have been obvious for one of ordinary skill in the art to have modified system of Bahr et al with concept of processing, by the device, the secure connection data and the load data, with a machine learning model, to generate analytics associated with the secure connection; and providing, by the device, the analytics to one or more analytics consumers to cause the one or more analytics consumers to perform one or more actions based on the analytics of Balmakhtar et al. One of ordinary skill in the art would have been motivated to make this modification in order to improve network security, (Balmakhtar et al, [0004], line 1).
Regarding claim 2, Bahr et al discloses method (method, [0117], line 1), wherein the secure connection data and the load data includes one or more of (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 on the network 160, [0102], lines 1-3):
subscriber data associated with the UE (The stationary devices 110 connect through wired or wireless connections to a network reachable by the mobile devices 120, [0030], lines 5-6),
network function data associated with the core network (The stationary devices 110 connect through wired or wireless connections to a network reachable by the mobile devices 120, [0030], lines 5-6),
events exposure data associated with the secure connection (communication between the mobile device 120 and of the stationary device 110 may be encrypted using any desired encryption technique. In one embodiment, a configurable passphrase may be hashed using a secure hashing algorithm such as SHA-1 to form two encryption keys, one for the mobile device 120 and one for the stationary device 110, which are shared between the two devices for use with a two-way encryption algorithm such as American Encryption Standard (AES)-128 using the keys generated from the passphrase, [0048], lines 1-5),
operations and management data associated with the core network (A system according to one embodiment manages dynamic connections between multiple mobile devices that include barcode scanners and multiple stationary devices, which may be computers, using barcodes displayed on the stationary devices. Although described in terms of multiple mobile devices and multiple stationary devices, the techniques described herein function equally as well with a single mobile device and a single stationary device. In one embodiment, the mobile device is a wireless telephone; in other embodiments, other types of mobile wireless devices may be used, [0020], lines 1-5),
drive test data associated with the core network (The mobile device 120 may be any type of mobile device that is capable of scanning a barcode 150 and using the scanned barcode to connect to a stationary device 110. In typical embodiments, the mobile device wirelessly communicates using a wireless access point 170 to a network 160 that is capable of reaching the stationary device 110, but in one embodiment, the mobile device 120 may use a wired connection to the network, [0036], lines 1-4),
quality of service flow data associated with the secure connection (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 on the network 160, [0102], lines 1-3),
traffic usage data associated with the secure connection (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 on the network 160, [0102], lines 1-3), or
historical data associated with the core network (scanning functionality of the mobile device 120 may be usable for scanning barcodes even when the mobile device 120 is not connected to a stationary device 110. In such an embodiment, the mobile device 120 may simply store barcodes scanned while unconnected, then after connection with the stationary device 110 is established, the stored barcodes may be uploaded to the stationary device 110, [0050], lines 1-4).
Regarding claim 3, Bahr et al discloses method (method, [0117], line 1), wherein the secure connection is an Internet protocol security tunnel provided between the UE and the core network (Stationary device 110 may be a computer, such as a desktop or laptop PC or any other type of device that can display a barcode and establish communications with other devices using predefined communications protocols, including Internet Protocol (IP). The linkage can be unambiguous, because one device is aimed at the other, and provides an inherent level of security because of the physical proximity required for the optical linkage, in addition to the security provided by encryption, challenge and response protocols, etc. Although described in terms of mobile and stationary devices, the embodiments described above may be implemented in any pair of devices, [0030], lines 1-3, [0101], lines 2-5).
Regarding claim 4, Bahr et al discloses method (method, [0117], line 1), wherein the untrusted access network is a Wi-Fi network (The stationary devices 110 connect through wired or wireless connections to a network reachable by the mobile devices 120, [0030], lines 5-6).
Regarding claim 5, Bahr et al discloses method (method, [0117], line 1), wherein receiving the secure connection data and the load data comprises (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 on the network 160, [0102], lines 1-3):
receiving the secure connection data and the load data from an evolved packet data gateway that established the secure connection between the UE and the core network (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 on the network 160, [0102], lines 1-3).
Regarding claim 6, Bahr et al discloses method (method, [0117], line 1), wherein the one or more actions include one or more of (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 on the network 160, [0102], lines 1-3):
providing access traffic steering (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 on the network 160, [0102], lines 1-3),
switching, and splitting for the secure connection (Upon a change in connection state, in one embodiment a notification balloon is displayed to show the change in connection state, [0087], lines 4-5),
providing mobility management for the UE (Stationary device 110 may be a computer, such as a desktop or laptop PC or any other type of device that can display a barcode and establish communications with other devices using predefined communications protocols, including Internet Protocol (IP). Although designated a stationary device, the devices 110 may themselves be movable, such as a laptop computer, and may include mobile devices such as the mobile device 120, so long as the devices 110 can display barcodes and accept connections from the mobile devices 120, [0030], lines 1-5),
generating a policy for the secure connection (lookup functionality may involve a database managed by a third device, a table maintained by the mobile device 120, or any other similar lookup functionality, [0040], lines 5-6),
selecting a user plane function of the core network to communicate with the secure connection (lookup functionality may involve a database managed by a third device, a table maintained by the mobile device 120, or any other similar lookup functionality, [0040], lines 5-6), or
modifying the secure connection (Upon a change in connection state, in one embodiment a notification balloon is displayed to show the change in connection state, [0087], lines 4-5).
Regarding claim 7, Bahr et al discloses method (method, [0117], line 1),
Bahr et al does not specifically disclose concept of wherein processing the secure connection data and the load data, with the machine learning model, to generate the analytics comprises:
classifying, with the machine learning model, types of traffic associated with the secure connection data and the load data; and
determining, with the machine learning model, load conditions for the types of traffic.
However, Balmakhtar et al specifically teaches concept of wherein processing the secure connection data and the load data, with the machine learning model, to generate the analytics comprises (The TLE may employ one or more artificial intelligence models (e.g., machine learning models, deep learning models, neural networking models, etc.) to use the security data received from the sources and make additional inferences. The artificial intelligence models may be based on historical security data and the corresponding accurately predicted historical threats. In an embodiment, the TLE may determine, using the machine learning model, security key performance indicators (SKPIs), security related events, a security event class, and one or more threat impact levels associated with each of the determined events, [0024], lines 1-6):
classifying, with the machine learning model, types of traffic associated with the secure connection data and the load data (In an embodiment, the TLE may determine, using the machine learning model, security key performance indicators (SKPIs), security related events, a security event class, and one or more threat impact levels associated with each of the determined events. An SKPI may indicate a value based on a related security metric or a threat (e.g., traffic exceeding thresholds, unidentified devices, number of intrusion attempts, user plane and control plane mismatch, etc.), [0024], lines 4-7); and
determining, with the machine learning model, load conditions for the types of traffic (At block 203, method 200 comprises receiving, by the security analysis application 133 of the TLE 106, security data 143 (secure connection data) from multiple different sources 103. In an embodiment, the security data 143 may comprise data regarding traffic (load) related to a security threat occurring at one or more NEs in the network 100. In an embodiment, the one or more NEs may be UEs, NFs, switches, routers, bridges, logical elements, virtual machines, servers, databases, etc. in the network 100. At block 206, method 200 comprises determining, by the security analysis application 133 using the machine learning model 130, a security related event 149 indicating the security threat occurring at one or more NEs in the network 100 based on one or more SKPIs 146 and the security data 143, [0073], lines 1-4, [0074], lines 1-3).
At the time the invention was filed, it would have been obvious for one of ordinary skill in the art to have modified system of Bahr et al with concept of of wherein processing the secure connection data and the load data, with the machine learning model, to generate the analytics comprises: classifying, with the machine learning model, types of traffic associated with the secure connection data and the load data; and determining, with the machine learning model, load conditions for the types of traffic of Balmakhtar et al. One of ordinary skill in the art would have been motivated to make this modification in order to improve network security, (Balmakhtar et al, [0004], line 1).
Regarding claim 8, Bahr et al discloses device (fig. 1, item 120, mobile device), comprising (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 on the network 160, [0102], lines 1-3):
one or more processors (fig. 6, item 382, processor) configured to:
receive secure connection data and load data associated with a secure connection established between a user equipment (UE) and a core network via an untrusted access network (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 on the network 160, [0102], lines 1-3),
wherein the secure connection is an Internet protocol security tunnel provided between the UE and the core network (Stationary device 110 may be a computer, such as a desktop or laptop PC or any other type of device that can display a barcode and establish communications with other devices using predefined communications protocols, including Internet Protocol (IP). The linkage can be unambiguous, because one device is aimed at the other, and provides an inherent level of security because of the physical proximity required for the optical linkage, in addition to the security provided by encryption, challenge and response protocols, etc. Although described in terms of mobile and stationary devices, the embodiments described above may be implemented in any pair of devices, [0030], lines 1-3, [0101], lines 2-5);
Bahr et al does not specifically disclose concept of process the secure connection data and the load data to generate analytics associated with the secure connection; and
provide the analytics to one or more analytics consumers to cause the one or more analytics consumers to perform one or more actions based on the analytics.
However, Balmakhtar et al specifically teaches concept of process the secure connection data and the load data to generate analytics associated with the secure connection (At block 203, method 200 comprises receiving, by the security analysis application 133 of the TLE 106, security data 143 (secure connection data) from multiple different sources 103. In an embodiment, the security data 143 may comprise data regarding traffic (load) related to a security threat occurring at one or more NEs in the network 100. In an embodiment, the one or more NEs may be UEs, NFs, switches, routers, bridges, logical elements, virtual machines, servers, databases, etc. in the network 100. At block 206, method 200 comprises determining, by the security analysis application 133 using the machine learning model 130, a security related event 149 indicating the security threat occurring at one or more NEs in the network 100 based on one or more SKPIs 146 and the security data 143, [0073], lines 1-4, [0074], lines 1-3); and
provide the analytics to one or more analytics consumers to cause the one or more analytics consumers to perform one or more actions based on the analytics (At block 206, method 200 comprises determining, by the security analysis application 133 using the machine learning model 130, a security related event 149 indicating the security threat occurring at one or more NEs in the network 100 based on one or more SKPIs 146 and the security data 143. The SKPIs 146 may indicate a value describing a security metric related to the security threat occurring at the one or more NEs in the network 100. When the result of the decision block 212 is Yes, method 200 may continue with block 215. At block 215, method 200 comprises determining, using a remediation application 136 of the TLE 106, a remediation action 155 for the security related event 149 based on the threat impact level 152 and the one or more Nes. At block 218, method 200 comprises transmitting, by the remediation application 136 to a PDP 116, a first message 170 to comprising an indication of a change in a security posture of a current access authorized by the network 100, based on the remediation action 155 for the security related event 149, [0074], lines 1-3, [0076], lines 1-3, [0077], lines 1-3)..
At the time the invention was filed, it would have been obvious for one of ordinary skill in the art to have modified system of Bahr et al with concept of process the secure connection data and the load data to generate analytics associated with the secure connection; and provide the analytics to one or more analytics consumers to cause the one or more analytics consumers to perform one or more actions based on the analytics of Balmakhtar et al. One of ordinary skill in the art would have been motivated to make this modification in order to improve network security, (Balmakhtar et al, [0004], line 1)
Regarding claim 9, Bahr et al discloses device (fig. 1, item 120, mobile device), wherein the one or more processors (fig. 6, item 382, processor), to receive the secure connection data and the load data, are configured to (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 on the network 160, [0102], lines 1-3):
establish a connection with an evolved packet data gateway (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 on the network 160, [0102], lines 1-3).; and
receive the secure connection data and the load data from the evolved packet data gateway via the connection (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 on the network 160, [0102], lines 1-3).
Regarding claim 10, Bahr et al discloses device (fig. 1, item 120, mobile device),
Bahr et al does not specifically disclose concept of wherein the one or more analytics consumers include one or more of a network exposure function of the core network, a policy control function of the core network, an application function of the core network, or an operations and management system associated with the core network.
However, Balmakhtar et al specifically teaches concept of wherein the one or more analytics consumers include one or more of a network exposure function of the core network, a policy control function of the core network, an application function of the core network, or an operations and management system associated with the core network (At block 203, method 200 comprises receiving, by the security analysis application 133 of the TLE 106, security data 143 (secure connection data) from multiple different sources 103. In an embodiment, the security data 143 may comprise data regarding traffic (load) related to a security threat occurring at one or more NEs in the network 100. In an embodiment, the one or more NEs may be UEs, NFs, switches, routers, bridges, logical elements, virtual machines, servers, databases, etc. in the network 100. At block 206, method 200 comprises determining, by the security analysis application 133 using the machine learning model 130, a security related event 149 indicating the security threat occurring at one or more NEs in the network 100 based on one or more SKPIs 146 and the security data 143, [0073], lines 1-4, [0074], lines 1-3)
At the time the invention was filed, it would have been obvious for one of ordinary skill in the art to have modified system of Bahr et al with concept of wherein the one or more analytics consumers include one or more of a network exposure function of the core network, a policy control function of the core network, an application function of the core network, or an operations and management system associated with the core network of Balmakhtar et al. One of ordinary skill in the art would have been motivated to make this modification in order to improve network security, (Balmakhtar et al, [0004], line 1).
Regarding claim 11, Bahr et al discloses device (fig. 1, item 120, mobile device), wherein the one or more actions include determining one or more access networks for switching or splitting traffic of the UE (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 on the network 160, [0102], lines 1-3).
Regarding claim 12, Bahr et al discloses device (fig. 1, item 120, mobile device), wherein the one or more processors (fig. 6, item 382, processor) are further configured to:
cause an update to be provided to the UE (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 on the network 160, [0102], lines 1-3).,
wherein the update causes the UE to switch or split the traffic based on the one or more access networks (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 on the network 160, [0102], lines 1-3).
Regarding claim 13, Bahr et al discloses device (fig. 1, item 120, mobile device), wherein the one or more processors (fig. 6, item 382, processor) are further configured to:
Bahr et al does not specifically disclose concept of train a machine learning model with historical secure connection data, historical load data, and historical analytics,
wherein the machine learning model is utilized to generate the analytics associated with the secure connection.
However, Balmakhtar et al specifically teaches concept of train a machine learning model with historical secure connection data, historical load data, and historical analytics (The TLE may employ one or more artificial intelligence models (e.g., machine learning models, deep learning models, neural networking models, etc.) to use the security data received from the sources and make additional inferences. The artificial intelligence models may be based on historical security data and the corresponding accurately predicted historical threats. In an embodiment, the TLE may determine, using the machine learning model, security key performance indicators (SKPIs), security related events, a security event class, and one or more threat impact levels associated with each of the determined events, [0024], lines 1-6),
wherein the machine learning model is utilized to generate the analytics associated with the secure connection (At block 203, method 200 comprises receiving, by the security analysis application 133 of the TLE 106, security data 143 (secure connection data) from multiple different sources 103. In an embodiment, the security data 143 may comprise data regarding traffic (load) related to a security threat occurring at one or more NEs in the network 100. In an embodiment, the one or more NEs may be UEs, NFs, switches, routers, bridges, logical elements, virtual machines, servers, databases, etc. in the network 100. At block 206, method 200 comprises determining, by the security analysis application 133 using the machine learning model 130, a security related event 149 indicating the security threat occurring at one or more NEs in the network 100 based on one or more SKPIs 146 and the security data 143, [0073], lines 1-4, [0074], lines 1-3).
At the time the invention was filed, it would have been obvious for one of ordinary skill in the art to have modified system of Bahr et al with concept of train a machine learning model with historical secure connection data, historical load data, and historical analytics, wherein the machine learning model is utilized to generate the analytics associated with the secure connection of Balmakhtar et al. One of ordinary skill in the art would have been motivated to make this modification in order to improve network security, (Balmakhtar et al, [0004], line 1)
Regarding claim 14, Bahr et al discloses device (fig. 1, item 120, mobile device), wherein the one or more processors (fig. 6, item 382, processor) are further configured to:
provide, to a network device that established the secure connection between the UE and the core network, updated traffic management settings based on the analytics (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 on the network 160, [0102], lines 1-3).
Regarding claim 15, Bahr et al discloses non-transitory computer-readable medium storing a set of instructions, the set of instructions comprising (non-transitory computer-readable medium storage 384 may be used to store programs which are loaded into RAM 388 when such programs are selected for execution, [0109], lines 1-9):
one or more instructions that, when executed by one or more processors (fig. 6, item 382, processor) of a device (fig. 1, item 120, mobile device), cause the device (fig. 1, item 120, mobile device) to:
receive secure connection data and load data associated with a secure connection established between a user equipment (UE) and a core network via an untrusted access network (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 on the network 160, [0102], lines 1-3);
Bahr et al does not specifically disclose concept of process the secure connection data and the load data, with a machine learning model, to generate analytics associated with the secure connection; and
provide the analytics to one or more analytics consumers to cause the one or more analytics consumers to perform one or more actions based on the analytics,
wherein the one or more analytics consumers include one or more of a network exposure function of the core network, a policy control function of the core network, an application function of the core network, or an operations and management system associated with the core network.
However, Balmakhtar et al specifically teaches concept of process the secure connection data and the load data, with a machine learning model, to generate analytics associated with the secure connection (At block 203, method 200 comprises receiving, by the security analysis application 133 of the TLE 106, security data 143 (secure connection data) from multiple different sources 103. In an embodiment, the security data 143 may comprise data regarding traffic (load) related to a security threat occurring at one or more NEs in the network 100. In an embodiment, the one or more NEs may be UEs, NFs, switches, routers, bridges, logical elements, virtual machines, servers, databases, etc. in the network 100. At block 206, method 200 comprises determining, by the security analysis application 133 using the machine learning model 130, a security related event 149 indicating the security threat occurring at one or more NEs in the network 100 based on one or more SKPIs 146 and the security data 143, [0073], lines 1-4, [0074], lines 1-3); and
provide the analytics to one or more analytics consumers to cause the one or more analytics consumers to perform one or more actions based on the analytics (At block 206, method 200 comprises determining, by the security analysis application 133 using the machine learning model 130, a security related event 149 indicating the security threat occurring at one or more NEs in the network 100 based on one or more SKPIs 146 and the security data 143. The SKPIs 146 may indicate a value describing a security metric related to the security threat occurring at the one or more NEs in the network 100. When the result of the decision block 212 is Yes, method 200 may continue with block 215. At block 215, method 200 comprises determining, using a remediation application 136 of the TLE 106, a remediation action 155 for the security related event 149 based on the threat impact level 152 and the one or more Nes. At block 218, method 200 comprises transmitting, by the remediation application 136 to a PDP 116, a first message 170 to comprising an indication of a change in a security posture of a current access authorized by the network 100, based on the remediation action 155 for the security related event 149, [0074], lines 1-3, [0076], lines 1-3, [0077], lines 1-3).
wherein the one or more analytics consumers include one or more of a network exposure function of the core network, a policy control function of the core network, an application function of the core network, or an operations and management system associated with the core network (At block 206, method 200 comprises determining, by the security analysis application 133 using the machine learning model 130, a security related event 149 indicating the security threat occurring at one or more NEs in the network 100 based on one or more SKPIs 146 and the security data 143. The SKPIs 146 may indicate a value describing a security metric related to the security threat occurring at the one or more NEs in the network 100. When the result of the decision block 212 is Yes, method 200 may continue with block 215. At block 215, method 200 comprises determining, using a remediation application 136 of the TLE 106, a remediation action 155 for the security related event 149 based on the threat impact level 152 and the one or more Nes. At block 218, method 200 comprises transmitting, by the remediation application 136 to a PDP 116, a first message 170 to comprising an indication of a change in a security posture of a current access authorized by the network 100, based on the remediation action 155 for the security related event 149, [0074], lines 1-3, [0076], lines 1-3, [0077], lines 1-3).
At the time the invention was filed, it would have been obvious for one of ordinary skill in the art to have modified system of Bahr et al with concept of process the secure connection data and the load data, with a machine learning model, to generate analytics associated with the secure connection; and provide the analytics to one or more analytics consumers to cause the one or more analytics consumers to perform one or more actions based on the analytics, wherein the one or more analytics consumers include one or more of a network exposure function of the core network, a policy control function of the core network, an application function of the core network, or an operations and management system associated with the core network of Balmakhtar et al. One of ordinary skill in the art would have been motivated to make this modification in order to improve network security, (Balmakhtar et al, [0004], line 1).
Regarding claim 16, Bahr et al discloses non-transitory computer-readable medium (non-transitory computer-readable medium storage 384 may be used to store programs which are loaded into RAM 388 when such programs are selected for execution, [0109], lines 1-9), wherein the one or more instructions, that cause the device to receive the secure connection data and the load data, cause the device to (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 on the network 160, [0102], lines 1-3):
receive the secure connection data and the load data from an evolved packet data gateway that established the secure connection between the UE and the core network (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 on the network 160, [0102], lines 1-3).
Regarding claim 17, Bahr et al discloses non-transitory computer-readable medium (non-transitory computer-readable medium storage 384 may be used to store programs which are loaded into RAM 388 when such programs are selected for execution, [0109], lines 1-9), wherein the one or more instructions, that cause the device (fig. 1, item 120, mobile device) to process the secure connection data and the load data, with the machine learning model, to (non-transitory computer-readable medium storage 384 may be used to store programs which are loaded into RAM 388 when such programs are selected for execution, [0109], lines 1-9)
Bahr et al does not specifically disclose concept of generate the analytics, cause the device to:
classify, with the machine learning model, types of traffic associated with the secure connection data and the load data; and
determine, with the machine learning model, load conditions for the types of traffic.
However, Balmakhtar et al specifically teaches concept of generate the analytics, cause the device to (The TLE may employ one or more artificial intelligence models (e.g., machine learning models, deep learning models, neural networking models, etc.) to use the security data received from the sources and make additional inferences. The artificial intelligence models may be based on historical security data and the corresponding accurately predicted historical threats. In an embodiment, the TLE may determine, using the machine learning model, security key performance indicators (SKPIs), security related events, a security event class, and one or more threat impact levels associated with each of the determined events, [0024], lines 1-6):
classify, with the machine learning model, types of traffic associated with the secure connection data and the load data (In an embodiment, the TLE may determine, using the machine learning model, security key performance indicators (SKPIs), security related events, a security event class, and one or more threat impact levels associated with each of the determined events. An SKPI may indicate a value based on a related security metric or a threat (e.g., traffic exceeding thresholds, unidentified devices, number of intrusion attempts, user plane and control plane mismatch, etc.), [0024], lines 4-7); and
determine, with the machine learning model, load conditions for the types of traffic (At block 203, method 200 comprises receiving, by the security analysis application 133 of the TLE 106, security data 143 (secure connection data) from multiple different sources 103. In an embodiment, the security data 143 may comprise data regarding traffic (load) related to a security threat occurring at one or more NEs in the network 100. In an embodiment, the one or more NEs may be UEs, NFs, switches, routers, bridges, logical elements, virtual machines, servers, databases, etc. in the network 100. At block 206, method 200 comprises determining, by the security analysis application 133 using the machine learning model 130, a security related event 149 indicating the security threat occurring at one or more NEs in the network 100 based on one or more SKPIs 146 and the security data 143, [0073], lines 1-4, [0074], lines 1-3).
At the time the invention was filed, it would have been obvious for one of ordinary skill in the art to have modified system of Bahr et al with concept of generate the analytics, cause the device to: classify, with the machine learning model, types of traffic associated with the secure connection data and the load data; and determine, with the machine learning model, load conditions for the types of traffic of Balmakhtar et al. One of ordinary skill in the art would have been motivated to make this modification in order to improve network security, (Balmakhtar et al, [0004], line 1).
Regarding claim 18, Bahr et al discloses non-transitory computer-readable medium, wherein the one or more instructions, that cause the device (fig. 1, item 120, mobile device) to receive the secure connection data and the load data, cause the device to (non-transitory computer-readable medium storage 384 may be used to store programs which are loaded into RAM 388 when such programs are selected for execution, [0109], lines 1-9):
establish a connection with an evolved packet data gateway (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 on the network 160, [0102], lines 1-3); and
receive the secure connection data and the load data from the evolved packet data gateway via the connection (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 on the network 160, [0102], lines 1-3)..
Regarding claim 19, Bahr et al discloses non-transitory computer-readable medium, wherein the one or more instructions further cause the device to (non-transitory computer-readable medium storage 384 may be used to store programs which are loaded into RAM 388 when such programs are selected for execution, [0109], lines 1-9):
Bahr et al does not specifically disclose concept of train the machine learning model based on the secure connection data, the load data, and the analytics.
However, Balmakhtar et al specifically teaches concept of train the machine learning model based on the secure connection data, the load data, and the analytics (The TLE may employ one or more artificial intelligence models (e.g., machine learning models, deep learning models, neural networking models, etc.) to use the security data received from the sources and make additional inferences. The artificial intelligence models may be based on historical security data and the corresponding accurately predicted historical threats. In an embodiment, the TLE may determine, using the machine learning model, security key performance indicators (SKPIs), security related events, a security event class, and one or more threat impact levels associated with each of the determined events, [0024], lines 1-6).
At the time the invention was filed, it would have been obvious for one of ordinary skill in the art to have modified system of Bahr et al with concept of train the machine learning model based on the secure connection data, the load data, and the analytics of Balmakhtar et al. One of ordinary skill in the art would have been motivated to make this modification in order to improve network security, (Balmakhtar et al, [0004], line 1).
Regarding claim 20, Bahr et al discloses non-transitory computer-readable medium, wherein the one or more instructions further cause the device to (non-transitory computer-readable medium storage 384 may be used to store programs which are loaded into RAM 388 when such programs are selected for execution, [0109], lines 1-9):
provide, to a network device that established the secure connection between the UE and the core network, updated traffic management settings based on the analytics (In one embodiment, web certificates or other security data used by the mobile device 120 for connection (secure connection data) to the network 160 or for connection with the stationary device 110 may be scanned (received) using the above technique to load the certificates (load data) or other security data into the mobile device 120 to allow use of the mobile device 120 on the network 160, [0102], lines 1-3).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to FRANTZ BATAILLE whose telephone number is (571)270-7286. The examiner can normally be reached Monday-Friday 9:00 AM-5:00 PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Akwasi Sarpong can be reached on 571-270-3438. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/FRANTZ BATAILLE/ Primary Examiner, Art Unit 2681
Prosecution Insights