Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This office action is in response to the application filed on 02/27/2023. In which, claims 1-19 and 21 are pending and being considered, claims 1, 11 and 21 are independent, claims 1-19 and 21 are rejected.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 12/13/2024 is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Specification
The lengthy specification has not been checked to the extent necessary to determine the presence of all possible minor errors. Applicant’s cooperation is requested in correcting any errors of which applicant may become aware in the specification.
Claim Objections
Claim 1-2, 6 11-12, 16 and 21 are objected to because of the following informalities:
In regards to Claims 1, 11 and 21, the applicant recites the limitation “access control security policies” this is a typographical error as the limitation should read “the access control security policies”. Appropriate correction is required.
In regards to Claim 1-2, 11-12 and 21, the applicant recites the limitation “the access control security policy request” this is a typographical error as there is a lack of antecedent basis, the limitation should read that should read “access control security policy creation request” as previously recited in the claim. Appropriate correction is required.
In regards to Claims 1, 11 and 21, the applicant recites the limitation “the respective network function” this is a typographical error as there is a lack of antecedent basis. The limitation should read “the respective plurality of network functions” to recite consistency in the limitations. For prior art purposes Examiner will broadly and reasonably interpret in light of the specification that “the respective network function” is referring to the plurality of network functions previously recited. Appropriate correction is required.
In regards to Claim 6 and 16, the applicant recites the limitation “the new trust information”, this is a typographical error as there is a lack of antecedent basis, the limitation should read that should read “the new trust data” or “new trust information” when first reciting a new limitation. Appropriate correction is required.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claim 21 is/are rejected under 35 U.S.C. 101 because the claimed invention is directed to non-statutory subject matter.
In regards to Claim 21, claim 21 is rejected under U.S.C. 101 because the claims are directed to non-statutory subject matter. Claim 21 is directed to “a processor for wireless communication” and recites “comprising: at least one controller coupled with at least one memory and configured to cause the processor to:”. By using the phrase “one controller coupled with at least one memory”, it is not definitely recited that the controller comprises or includes a memory. The claimed limitation can be broadly and reasonably interpreted that the controller could be software per se. Furthermore the specification is silent on a controller including memory or hardware components. The Examiner respectfully suggests that the claim be amended to “at least one controller comprising with at least one memory” to definitely recite in the claims a controller that is hardware related to make the claim statutory under 35 USC 101.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1, 4, 8, 11, 14, 18 and 21 is/are rejected under 35 U.S.C. 103 as being unpatentable over Iwai et al. (U.S Pub. No. 20180132302, hereinafter referred to as “Iwai”) and Adam et al. (U.S Pub. No. 20180255101, hereinafter referred to as “Adam”) further in view of Miriyala et al. (U.S Pub. No. 20210306338, hereinafter referred to as “Miriyala”)
In regards to Claim 1, Iwai teaches an apparatus for wireless communication in a wireless network, the apparatus comprising: (Par. (0178); apparatus), (Par. (0163-0164); wireless network)
a processor; and (Par. (0180-0181); processor)
a memory coupled with the processor, the processor configured to: (Par. (0180-0181); processor with memory)
receive, from a first network function, a subscribe request for access control security policies; (Figure 22 label 200, 400, S801; receiving (subscriber server receiving request) from a first network function (mobility management node 200) a subscribe request for access control security policies (control policy request with subscriber ID to subscriber server), (Par. (0134); receiving (server acquiring) from a first network function (mobility management node 200) a subscriber request for access control security policies (subscriber information corresponding to control policy request)
transmit, in response to the subscribe request, a subscribe response to the first network function, the subscribe response indicating that a policy subscription has been initiated; (Par. (0134); transmit, in response to the subscribe request, a subscribe response to the first network function (subscriber server transmits a response with subscriber ID to mobility management node 200) the subscribe response indicating that a policy subscription has been initiated; (response corresponding to acquired state control policy)), (Figure 22 labels S802, S803, 200 , 400; transmit, in response to the subscribe request, a subscribe response (subscriber server transmits to mobility management node 200 a response) the subscribe response indicating that a policy subscription has been initiated (response followed by step of state control policy being performed))
transmit a response to the access control security policy request, the response including at least one of a list of access control security polices for the identified network function, the identified network function instance, the identified application function, the identified network slice, and validity information, (Par. (0134 and 0063); transmit a response to the access control security policy request (subscriber server transmits a response corresponding to control policy request) including at least one of a list of access control security polices for the identified network function (response includes subscriber ID to mobility management node 200 associated with mobile terminals)), (Figure 22 labels S802, S803, 200 , 400; transmit a response to the access control security policy request (subscriber server transmits to mobility management node 200 a response) including at least one of a list of access control security polices for the identified network function (response includes ID of subscriber of mobile terminal)), (Examiner note: By using the phrase “at least one of a list”, Examiner broadly and reasonably interprets in light of the specification that only at least one of the following “a list of access control security polices for the identified network function identified network function, the identified network function instance, the identified application function, the identified network slice, and validity information” must be applied to meet the claim)
Iwai does not explicitly teach generate access control security policies for a plurality of network functions based on trust data derived from monitoring the respective network functions; apply validity parameters to the generated access control security policies, the validity parameters indicating a time for which each access control security policy is valid; receive an access control security policy creation request including at least one of a network function ID, a network function instance ID, an application function ID and a network slice ID; and wherein the validity parameters are based on one or more of security monitoring data analytics validity, trust data analytics validity and local policy.
Wherein Adam teaches generate access control security policies for a plurality of network functions based on trust data derived from monitoring the respective network functions; (Par. (0065); generate access control security policies for a plurality of network functions (generating the security policy for plurality of user accounts) based on trust data derived from monitoring the respective network functions (based on trust levels assigned to user accounts)), (Par. (0060-0061); based on trust data derived from monitoring the respective network functions; (level of trust permit to users/employees and their devices based on account data that is reviewed))
apply validity parameters to the generated access control security policies, the validity parameters indicating a time for which each access control security policy is valid; (Par. (0064-0065 and 0106); apply validity parameters to the generated access control security policies (interval and predetermined time associated with policy with designated time for permitted access)), (Par. (0064, 0105); indicating a time for which each access control security policy is valid (time limit and interval for permitted access based on policy))
wherein the validity parameters are based on one or more of security monitoring data analytics validity, trust data analytics validity and local policy. (Par. (0064-0065); wherein the validity parameters (interval and predetermined time associated with policy with designated time for permitted access) based on one or more of security monitoring data analytics and local policy (policy enforcement associated with predetermined time)), (Examiner Note: by using the phrase “based on one or more” followed by “and” Examiner broadly and reasonably interprets in light of the specification that the validity parameters are based on at least one of the following “security monitoring data analytics validity, trust data analytics validity or local policy”.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai to incorporate the teaching of Adam to utilize the above feature because of the analogous concept of access control policies and transmission of network data in a system, with the motivation of creating a level of trust to generate security policies and update the system to make administrators and enforcement more effective security based on time and threshold condition. (Adam Par. (0060-0061 and 0064))
Iwai and Adam do not explicitly teach receive an access control security policy creation request including at least one of a network function ID, a network function instance ID, an application function ID and a network slice ID; and
Wherein Miriyala teaches receive an access control security policy creation request including at least one of a network function ID, a network function instance ID, an application function ID and a network slice ID; and (Par. (0078); receive an access control security policy creation request (receiving request to create and access control policy) including at least one of a network function ID, an application function ID request to create access control policy with workflow identifier and user intent identifier corresponding to object)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai and Adam to incorporate the teaching of Miriyala to utilize the above feature because of the analogous concept of access control policies based on time, with the motivation of establishing role based access to allow administrators to identify proper access control policies based on determining identification to relegate appropriate roles in the system. (Miriyala Par. (0004-0006))
In regards to Claim 4, the combination of Iwai, Adam and Miriyala teach the apparatus of claim 1, Iwai further teaches wherein the first network function is a network repository function. (Par. (0062-0064 and 0072); the first network function (mobility management node 200) is a network repository function (policy management unit 204 of mobility management node 200 stores control policy for each terminal))
In regards to Claim 8, the combination of Iwai, Adam and Miriyala teach the apparatus of claim 1, Adam further teaches wherein the access control security policies include one or more of: (Par. (0062-0064); access control policy (generated security policy))
a trust data threshold for network service consumer authentication, (Par. (0044); for network service consumer authentication (authentication based on determining level of trust), (Par. (0104); a trust data threshold for network service consumer (threshold trust level that is based on policy meeting or exceeding level of trust))
a trust data threshold for network service consumer authorization,
a trust data threshold for network producer authentication,
a trust data threshold for network service discovery,
a trust data threshold for network registration,
a trust data threshold for network registration update,
a network function service consumer authentication lifetime,
a network function service consumer authorization lifetime, and
a network function service producer authentication lifetime. (Examiner Note: by using the phrase “include one or more of” Examiner broadly and reasonably interprets only one of the following to be included and mapped.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai and Miriyala to incorporate the teaching of Adam to utilize the above feature because of the analogous concept of access control policies and transmission of network data in a system, with the motivation of designated security policies based on a metric of trust to allow enforcement services to identify proper access to specific users. (Adam Par. (0060-0061))
In regards to Claim 11, Iwai teaches a method comprising: receiving, from a first network function, a subscribe request for access control security policies; (Figure 22 label 200, 400, S801; receiving (subscriber server receiving request) from a first network function (mobility management node 200) a subscribe request for access control security policies (control policy request with subscriber ID to subscriber server), (Par. (0134); receiving (server acquiring) from a first network function (mobility management node 200) a subscriber request for access control security policies (subscriber information corresponding to control policy request)
transmitting, in response to the subscribe request, a subscribe response to the first network function, the subscribe response indicating that a policy subscription has been initiated; (Par. (0134); transmit, in response to the subscribe request, a subscribe response to the first network function (subscriber server transmits a response with subscriber ID to mobility management node 200) the subscribe response indicating that a policy subscription has been initiated; (response corresponding to acquired state control policy)), (Figure 22 labels S802, S803, 200 , 400; transmit, in response to the subscribe request, a subscribe response (subscriber server transmits to mobility management node 200 a response) the subscribe response indicating that a policy subscription has been initiated (response followed by step of state control policy being performed))
transmitting a response to the access control security policy request, the response including at least one of a list of access control security polices for the identified network function, the identified network function instance, the identified application function, the identified network slice, and validity information, (Par. (0134 and 0063); transmit a response to the access control security policy request (subscriber server transmits a response corresponding to control policy request) including at least one of a list of access control security polices for the identified network function (response includes subscriber ID to mobility management node 200 associated with mobile terminals)), (Figure 22 labels S802, S803, 200 , 400; transmit a response to the access control security policy request (subscriber server transmits to mobility management node 200 a response) including at least one of a list of access control security polices for the identified network function (response includes ID of subscriber of mobile terminal)), (Examiner note: By using the phrase “at least one of a list”, Examiner broadly and reasonably interprets in light of the specification that only at least one of the following “a list of access control security polices for the identified network function identified network function, the identified network function instance, the identified application function, the identified network slice, and validity information” must be applied to meet the claim)
Iwai does not explicitly teach generating access control security policies for a plurality of network functions based on trust data derived from monitoring the respective network functions; applying validity parameters to the generated access control security policies; receiving an access control security policy creation request including at least one of a network function ID, a network function instance ID, an application function ID and a network slice ID; and wherein the validity parameters are based on one or more of security monitoring data analytics validity, trust data analytics validity and local policy.
Wherein Adam teaches generating access control security policies for a plurality of network functions based on trust data derived from monitoring the respective network functions; (Par. (0065); generate access control security policies for a plurality of network functions (generating the security policy for plurality of user accounts) based on trust data derived from monitoring the respective network functions (based on trust levels assigned to user accounts)), (Par. (0060-0061); based on trust data derived from monitoring the respective network functions; (level of trust permit to users/employees and their devices based on account data that is reviewed))
applying validity parameters to the generated access control security policies; (Par. (0064-0065 and 0106); apply validity parameters to the generated access control security policies (interval and predetermined time associated with policy with designated time for permitted access)), (Par. (0064, 0105); indicating a time for which each access control security policy is valid (time limit and interval for permitted access based on policy))
wherein the validity parameters are based on one or more of security monitoring data analytics validity, trust data analytics validity and local policy. (Par. (0064-0065); wherein the validity parameters (interval and predetermined time associated with policy with designated time for permitted access) based on one or more of security monitoring data analytics and local policy (policy enforcement associated with predetermined time)), (Examiner Note: by using the phrase “based on one or more” followed by “and” Examiner broadly and reasonably interprets in light of the specification that the validity parameters are based on at least one of the following “security monitoring data analytics validity, trust data analytics validity or local policy”.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai to incorporate the teaching of Adam to utilize the above feature because of the analogous concept of access control policies and transmission of network data in a system, with the motivation of creating a level of trust to generate security policies and update the system to make administrators and enforcement more effective security based on time and threshold condition. (Adam Par. (0060-0061 and 0064))
Iwai and Adam do not explicitly teach receiving an access control security policy creation request including at least one of a network function ID, a network function instance ID, an application function ID and a network slice ID; and
Wherein Miriyala teaches receiving an access control security policy creation request including at least one of a network function ID, a network function instance ID, an application function ID and a network slice ID; and (Par. (0078); receive an access control security policy creation request (receiving request to create and access control policy) including at least one of a network function ID, an application function ID request to create access control policy with workflow identifier and user intent identifier corresponding to object)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai and Adam to incorporate the teaching of Miriyala to utilize the above feature because of the analogous concept of access control policies based on time, with the motivation of establishing role based access to allow administrators to identify proper access control policies based on determining identification to relegate appropriate roles in the system. (Miriyala Par. (0004-0006))
In regards to Claim 14, the combination of Iwai, Adam and Miriyala teach the method of claim 11, Iwai further teaches wherein the first network function is a network repository function. (Par. (0062-0064 and 0072); the first network function (mobility management node 200) is a network repository function (policy management unit 204 of mobility management node 200 stores control policy for each terminal))
In regards to Claim 18, the combination of Iwai, Adam and Miriyala teach the method of claim 11, Adam further teaches wherein the access control security policies include one or more of: (Par. (0062-0064); access control policy (generated security policy))
a trust data threshold for network service consumer authentication, (Par. (0044); for network service consumer authentication (authentication based on determining level of trust), (Par. (0104); a trust data threshold for network service consumer (threshold trust level that is based on policy meeting or exceeding level of trust))
a trust data threshold for network service consumer authorization,
a trust data threshold for network producer authentication,
a trust data threshold for network service discovery,
a trust data threshold for network registration,
a trust data threshold for network registration update,
a network function service consumer authentication lifetime,
a network function service consumer authorization lifetime, and
a network function service producer authentication lifetime. (Examiner Note: by using the phrase “include one or more of” Examiner broadly and reasonably interprets only one of the following to be included and mapped.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai and Miriyala to incorporate the teaching of Adam to utilize the above feature because of the analogous concept of access control policies and transmission of network data in a system, with the motivation of designated security policies based on a metric of trust to allow enforcement services to identify proper access to specific users. (Adam Par. (0060-0061))
In regards to Claim 21, Iwai teaches a processor for wireless communication, comprising: (Par. (0180-0181); processor), (Par. (0163-0164); wireless network)
at least one controller coupled with at least one memory and configured to cause the processor to: (Par. (0180-0181); processor with memory)
receive, from a first network function, a subscribe request for access control security policies; (Figure 22 label 200, 400, S801; receiving (subscriber server receiving request) from a first network function (mobility management node 200) a subscribe request for access control security policies (control policy request with subscriber ID to subscriber server), (Par. (0134); receiving (server acquiring) from a first network function (mobility management node 200) a subscriber request for access control security policies (subscriber information corresponding to control policy request)
transmit, in response to the subscribe request, a subscribe response to the first network function, the subscribe response indicating that a policy subscription has been initiated; (Par. (0134); transmit, in response to the subscribe request, a subscribe response to the first network function (subscriber server transmits a response with subscriber ID to mobility management node 200) the subscribe response indicating that a policy subscription has been initiated; (response corresponding to acquired state control policy)), (Figure 22 labels S802, S803, 200 , 400; transmit, in response to the subscribe request, a subscribe response (subscriber server transmits to mobility management node 200 a response) the subscribe response indicating that a policy subscription has been initiated (response followed by step of state control policy being performed))
transmit a response to the access control security policy request, the response including at least one of a list of access control security polices for the identified network function, the identified network function instance, the identified application function, the identified network slice, and validity information, (Par. (0134 and 0063); transmit a response to the access control security policy request (subscriber server transmits a response corresponding to control policy request) including at least one of a list of access control security polices for the identified network function (response includes subscriber ID to mobility management node 200 associated with mobile terminals)), (Figure 22 labels S802, S803, 200 , 400; transmit a response to the access control security policy request (subscriber server transmits to mobility management node 200 a response) including at least one of a list of access control security polices for the identified network function (response includes ID of subscriber of mobile terminal)), (Examiner note: By using the phrase “at least one of a list”, Examiner broadly and reasonably interprets in light of the specification that only at least one of the following “a list of access control security polices for the identified network function identified network function, the identified network function instance, the identified application function, the identified network slice, and validity information” must be applied to meet the claim)
Iwai does not explicitly teach generate access control security policies for a plurality of network functions based on trust data derived from monitoring the respective network functions; apply validity parameters to the generated access control security policies, the validity parameters indicating a time for which each access control security policy is valid; receive an access control security policy creation request including at least one of a network function ID, a network function instance ID, an application function ID and a network slice ID; and wherein the validity parameters are based on one or more of security monitoring data analytics validity, trust data analytics validity and local policy.
Wherein Adam teaches generate access control security policies for a plurality of network functions based on trust data derived from monitoring the respective network functions; (Par. (0065); generate access control security policies for a plurality of network functions (generating the security policy for plurality of user accounts) based on trust data derived from monitoring the respective network functions (based on trust levels assigned to user accounts)), (Par. (0060-0061); based on trust data derived from monitoring the respective network functions; (level of trust permit to users/employees and their devices based on account data that is reviewed))
apply validity parameters to the generated access control security policies, the validity parameters indicating a time for which each access control security policy is valid; (Par. (0064-0065 and 0106); apply validity parameters to the generated access control security policies (interval and predetermined time associated with policy with designated time for permitted access)), (Par. (0064, 0105); indicating a time for which each access control security policy is valid (time limit and interval for permitted access based on policy))
wherein the validity parameters are based on one or more of security monitoring data analytics validity, trust data analytics validity and local policy. (Par. (0064-0065); wherein the validity parameters (interval and predetermined time associated with policy with designated time for permitted access) based on one or more of security monitoring data analytics and local policy (policy enforcement associated with predetermined time)), (Examiner Note: by using the phrase “based on one or more” followed by “and” Examiner broadly and reasonably interprets in light of the specification that the validity parameters are based on at least one of the following “security monitoring data analytics validity, trust data analytics validity or local policy”.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai to incorporate the teaching of Adam to utilize the above feature because of the analogous concept of access control policies and transmission of network data in a system, with the motivation of creating a level of trust to generate security policies and update the system to make administrators and enforcement more effective security based on time and threshold condition. (Adam Par. (0060-0061 and 0064))
Iwai and Adam do not explicitly teach receive an access control security policy creation request including at least one of a network function ID, a network function instance ID, an application function ID and a network slice ID; and
Wherein Miriyala teaches receive an access control security policy creation request including at least one of a network function ID, a network function instance ID, an application function ID and a network slice ID; and (Par. (0078); receive an access control security policy creation request (receiving request to create and access control policy) including at least one of a network function ID, an application function ID request to create access control policy with workflow identifier and user intent identifier corresponding to object)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai and Adam to incorporate the teaching of Miriyala to utilize the above feature because of the analogous concept of access control policies based on time, with the motivation of establishing role based access to allow administrators to identify proper access control policies based on determining identification to relegate appropriate roles in the system. (Miriyala Par. (0004-0006))
Claim(s) 2-3 and 12-13 is/are rejected under 35 U.S.C. 103 as being unpatentable over Iwai et al. (U.S Pub. No. 20180132302, hereinafter referred to as “Iwai”), Adam et al. (U.S Pub. No. 20180255101, hereinafter referred to as “Adam”), Miriyala et al. (U.S Pub. No. 20210306338, hereinafter referred to as “Miriyala”) and Sidhu et al. (U.S Pub. No. 20170083898 , hereinafter referred to as “Sidhu”) further in view of Jakobsson et al. (U.S Pub. No. 20200053111, hereinafter referred to as “Jakobsson”)
In regards to Claim 2, the combination of Iwai, Adam and Miriyala do not explicitly teach transmit a trust evaluation request to a second network function, the trust evaluation request including at least one of a trust data analytics indication, the network function ID, the network function instance ID, the application function ID, and the network slice ID; and receive, from the first network function, a response to the trust evaluation request, the response including trust data associated with the identified network function, the identified network function instance, the identified application function, and the identified network slice.
Wherein Sidhu teaches transmit a trust evaluation request to a second network function, (Par. (0006); transmitting and receiving trust evaluation request (confidence level request) to a second network function (request sent to mobile device)), (Par. (0024-0025); second network function (plurality of mobile devices))
the trust evaluation request including at least one of a trust data analytics indication, the network function ID, the network function instance ID, the application function ID, and the network slice ID; and (Par. (0006); the trust evaluation request including at least one of a trust data analytics indication (confidence level request including validity of device, location, fingerprint data etc.) the network function ID (confidence level request includes account profile and identifier of user of mobile device)), (Examiner Note: By using the phrase “including at least one” Examiner broadly and reasonably in light of the specification interprets the limitation to only include one or the following to meet the claimed limitation)
receive, from the first network function, a response to the trust evaluation request, the response including trust data associated with the identified network function, (Par. (0006-0007); receiving a response from the first network function (server) corresponding to the trust evaluation request (confidence level request) that includes trust data associated with the identified network function includes (confidence level and data))
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai, Adam and Miriyala to incorporate the teaching of Sidhu to utilize the above feature because of the analogous concept of access control policies based on trust data and metrics, with the motivation of authentication of a plurality of devices using trust data and confidence metrics to identify proper recipients. (Sidhu Par. (0003-0006))
Iwai, Adam, Miriyala and Sidhu do not explicitly teach the identified network function instance, the identified application function, and the identified network slice.
Wherein Jakobsson teaches the identified network function instance, the identified application function, and the identified network slice. (Par. (0102); sending an identified network function instance (sending response with code of artifact corresponding to request)), (Par. (0197); receiving response with the identified application function (request and response with artifacts), (Par. (0065, 0126) receiving response with the identified network slice (portions of artifacts), (Par. (0164 and 0227-0229); a response to the trust evaluation request (request corresponding to confidence scores))
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai, Adam, Miriyala and Sidhu to incorporate the teaching of Jakobsson to utilize the above feature because of the analogous concept of access control policies based on trust data and metrics, with the motivation of detecting possible compromise and threats of attacks targeted to fraud by improving software artifacts with identifying information to help authentication become more effective and securely protect the transmission of data. (Jakobsson Par. (0015-0018))
In regards to Claim 3, the combination of Iwai, Adam and Miriyala teach the apparatus of claim 1, Adam further teaches wherein the second network function is a trust evaluation function. (Par. (0054 and 0066); the second network function (plurality of client devices)), (Par. (0035 and 0044); the second network function (client device of plurality of client devices includes policy enforcement service 108) is a trust evaluation function (policy enforcement service 108 that is apart of client device determines levels of trust ))
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai, Miriyala, Sidhu and Jakobsson, to incorporate the teaching of Adam to utilize the above feature because of the analogous concept of access control policies and transmission of network data in a system, with the motivation of designated security policies based on a metric of trust to allow enforcement services to identify proper access to specific users. (Adam Par. (0060-0061))
In regards to Claim 12, the combination of Iwai, Adam and Miriyala do not explicitly teach transmitting a trust evaluation request to a second network function, the trust evaluation request including at least one of a trust data analytics indication, the network function ID, the network function instance ID, the application function ID, and the network slice ID; and receiving, from the first network function, a response to the trust evaluation request, the response including trust data associated with the identified network function, the identified network function instance, the identified application function, and the identified network slice.
Wherein Sidhu teaches transmitting a trust evaluation request to a second network function, (Par. (0006); transmitting and receiving trust evaluation request (confidence level request) to a second network function (request sent to mobile device)), (Par. (0024-0025); second network function (plurality of mobile devices))
the trust evaluation request including at least one of a trust data analytics indication, the network function ID, the network function instance ID, the application function ID, and the network slice ID; and (Par. (0006); the trust evaluation request including at least one of a trust data analytics indication (confidence level request including validity of device, location, fingerprint data etc.) the network function ID (confidence level request includes account profile and identifier of user of mobile device)) (Examiner Note: By using the phrase “including at least one” Examiner broadly and reasonably in light of the specification interprets the limitation to only include one or the following to meet the claimed limitation)
receiving, from the first network function, a response to the trust evaluation request, the response including trust data associated with the identified network function, (Par. (0006-0007); receiving a response from the first network function (server) corresponding to the trust evaluation request (confidence level request) that includes trust data associated with the identified network function includes (confidence level and data))
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai, Adam and Miriyala to incorporate the teaching of Sidhu to utilize the above feature because of the analogous concept of access control policies based on trust data and metrics, with the motivation of authentication of a plurality of devices using trust data and confidence metrics to identify proper recipients. (Sidhu Par. (0003-0006))
Iwai, Adam, Miriyala and Sidhu do not explicitly teach the identified network function instance, the identified application function, and the identified network slice.
Wherein Jakobsson teaches the identified network function instance, the identified application function, and the identified network slice. (Par. (0102); sending an identified network function instance (sending response with code of artifact corresponding to request)), (Par. (0197); receiving response with the identified application function (request and response with artifacts), (Par. (0065, 0126) receiving response with the identified network slice (portions of artifacts), (Par. (0164 and 0227-0229); a response to the trust evaluation request (request corresponding to confidence scores))
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai, Adam, Miriyala and Sidhu to incorporate the teaching of Jakobsson to utilize the above feature because of the analogous concept of access control policies based on trust data and metrics, with the motivation of detecting possible compromise and threats of attacks targeted to fraud by improving software artifacts with identifying information to help authentication become more effective and securely protect the transmission of data. (Jakobsson Par. (0015-0018))
In regards to Claim 13, the combination of Iwai, Adam and Miriyala teach the method of claim 11, Adam further teaches wherein the second network function is a trust evaluation function. (Par. (0054 and 0066); the second network function (plurality of client devices)), (Par. (0035 and 0044); the second network function (client device of plurality of client devices includes policy enforcement service 108) is a trust evaluation function (policy enforcement service 108 that is apart of client device determines levels of trust ))
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai, Miriyala, Sidhu and Jakobsson to incorporate the teaching of Adam to utilize the above feature because of the analogous concept of access control policies and transmission of network data in a system, with the motivation of designated security policies based on a metric of trust to allow enforcement services to identify proper access to specific users. (Adam Par. (0060-0061))
Claim(s) 5 and 15 is/are rejected under 35 U.S.C. 103 as being unpatentable over Iwai et al. (U.S Pub. No. 20180132302, hereinafter referred to as “Iwai”), Adam et al. (U.S Pub. No. 20180255101, hereinafter referred to as “Adam”), and Miriyala et al. (U.S Pub. No. 20210306338, hereinafter referred to as “Miriyala”) further in view of Boodaei et al. (U.S Pub. No. 20200134165 , hereinafter referred to as “Boodaei”)
In regards to Claim 5, the combination of Iwai, Adam and Miriyala do not explicitly teach before initiating the policy subscription, compare a trust level of the first network function to a threshold value, wherein the policy subscription is only initiated when the trust level of the first network function exceeds the threshold value.
Wherein Boodaei teaches before initiating the policy subscription, compare a trust level of the first network function to a threshold value, (Par. (0009,0022, 0041); actions on policy are initiated after risk scores are compared)
wherein the policy subscription is only initiated when the trust level of the first network function exceeds the threshold value. (Par. (0009 and 0022); initiating actions of security policy when risk scores exceed threshold values))
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai, Adam and Miriyala to incorporate the teaching of Boodaei to utilize the above feature because of the analogous concept of access policies based on trust data and metrics, with the motivation of preventing malicious parties and exploitations by having risk scores attributed to data to enhance authentication before a security policy is enacted. (Boodaei Par. (0002-0004))
In regards to Claim 15, the combination of Iwai, Adam and Miriyala do not explicitly before initiating the policy subscription, comparing a trust level of the first network function to a threshold value, wherein the policy subscription is only initiated when the trust level of the first network function exceeds the threshold value.
Wherein Boodaei teaches before initiating the policy subscription, comparing a trust level of the first network function to a threshold value, (Par. (0009,0022, 0041); actions on policy are initiated after risk scores are compared)
wherein the policy subscription is only initiated when the trust level of the first network function exceeds the threshold value. (Par. (0009 and 0022); initiating actions of security policy when risk scores exceed threshold values))
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai, Adam and Miriyala to incorporate the teaching of Boodaei to utilize the above feature because of the analogous concept of access policies based on trust data and metrics, with the motivation of preventing malicious parties and exploitations by having risk scores attributed to data to enhance authentication before a security policy is enacted. (Boodaei Par. (0002-0004))
Claim(s) 6 and 16 is/are rejected under 35 U.S.C. 103 as being unpatentable over Iwai et al. (U.S Pub. No. 20180132302, hereinafter referred to as “Iwai”), Adam et al. (U.S Pub. No. 20180255101, hereinafter referred to as “Adam”), and Miriyala et al. (U.S Pub. No. 20210306338, hereinafter referred to as “Miriyala”) further in view of Dubois et al. (U.S Pub. No. 20200329072, hereinafter referred to as “Dubois”)
In regards to Claim 6, the combination of Iwai, Adam and Miriyala do not explicitly teach receive new trust data from the second network function; and transmit an access control security policy request trigger message to the first network function in response to the new trust information.
Wherein Dubois teaches receive new trust data from the second network function; and (Par. (0040-0042 and 0059); receiving new trust data (receiving threat intelligence information that contains confidence and risk scores) from the second network function (plurality of computing devices transmitting to security system the trust data (threat intelligence information))
transmit an access control security policy request trigger message to the first network function in response to the new trust information. (Par. (0007-0008, 0059 and 0074); transmitting based on new trust information (risk/ confidence scores detected associated with threat and risk) a trigger corresponding to security policy))
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai, Adam and Miriyala to incorporate the teaching of Dubois to utilize the above feature because of the analogous concept of access policies based on trust data and metrics, with the motivation of establishing security policies to quickly adapt based on changing environments and attacks, by implementing policies based on new trust data the security services of the network are more enhanced and not outdated and triggered data can alert more users. (Dubois Par. (0004-0007))
In regards to Claim 16, the combination of Iwai, Adam and Miriyala do not explicitly teach receiving new trust data from the second network function; and transmitting an access control security policy request trigger message to the first network function in response to the new trust information.
Wherein Dubois teaches receiving new trust data from the second network function; and (Par. (0040-0042 and 0059); receiving new trust data (receiving threat intelligence information that contains confidence and risk scores) from the second network function (plurality of computing devices transmitting to security system the trust data (threat intelligence information))
transmitting an access control security policy request trigger message to the first network function in response to the new trust information. (Par. (0007-0008, 0059 and 0074); transmitting based on new trust information (risk/ confidence scores detected associated with threat and risk) a trigger corresponding to security policy))
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai, Adam and Miriyala to incorporate the teaching of Dubois to utilize the above feature because of the analogous concept of access policies based on trust data and metrics, with the motivation of establishing security policies to quickly adapt based on changing environments and attacks, by implementing policies based on new trust data the security services of the network are more enhanced and not outdated and triggered data can alert more users. (Dubois Par. (0004-0007))
Claim(s) 7 and 17 is/are rejected under 35 U.S.C. 103 as being unpatentable over Iwai et al. (U.S Pub. No. 20180132302, hereinafter referred to as “Iwai”), Adam et al. (U.S Pub. No. 20180255101, hereinafter referred to as “Adam”), and Miriyala et al. (U.S Pub. No. 20210306338, hereinafter referred to as “Miriyala”) further in view of Sajjan et al. (U.S Pub. No. 20230022184, hereinafter referred to as “Sajjan”)
In regards to Claim 7, the combination of Iwai, Adam and Miriyala do not explicitly teach wherein the access control security policies include one or more of: a network slice restriction list of network slices that can be offered as services, a network slice forbidden list of network slices that cannot be offered as services, a network service consumer restriction information list comprising one or more network function or application function permitted to consume a service after authentication and authorization, and a network service consumer forbidden list comprising one or more network function or application function forbidden from consuming a service.
Wherein Sajjan teaches wherein the access control security policies include one or more of: (Par. (0031); access policy)
a network slice restriction list of network slices that can be offered as services, (Par. (0031-0033); access policy corresponding to list of primary network slices that are restricted and granting restricted access to other network slices)
a network slice forbidden list of network slices that cannot be offered as services,
a network service consumer restriction information list comprising one or more network function or application function permitted to consume a service after authentication and authorization, and
a network service consumer forbidden list comprising one or more network function or application function forbidden from consuming a service. (Examiner Note: by using the phrase “include one or more of” Examiner broadly and reasonably interprets only one of the following to be included and mapped.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai, Adam and Miriyala to incorporate the teaching of Sajjan to utilize the above feature because of the analogous concept of access policies controls and network device authentication, with the motivation of enhancing subscription policies in nodes and using network slices to manage access as well as having restriction list to regulate times of access. (Sajjan Par. (0028-0029 and 0031-0032))
In regards to Claim 17, the combination of Iwai, Adam and Miriyala do not explicitly teach wherein the access control security policies include one or more of: a network slice restriction list of network slices that can be offered as services, a network slice forbidden list of network slices that cannot be offered as services, a network service consumer restriction information list comprising one or more network function or application function permitted to consume a service after authentication and authorization, and a network service consumer forbidden list comprising one or more network function or application function forbidden from consuming a service.
Wherein Sajjan teaches wherein the access control security policies include one or more of: (Par. (0031); access policy)
a network slice restriction list of network slices that can be offered as services, (Par. (0031-0033); access policy corresponding to list of primary network slices that are restricted and granting restricted access to other network slices)
a network slice forbidden list of network slices that cannot be offered as services,
a network service consumer restriction information list comprising one or more network function or application function permitted to consume a service after authentication and authorization, and
a network service consumer forbidden list comprising one or more network function or application function forbidden from consuming a service. (Examiner Note: by using the phrase “include one or more of” Examiner broadly and reasonably interprets only one of the following to be included and mapped.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai, Adam and Miriyala to incorporate the teaching of Sajjan to utilize the above feature because of the analogous concept of access policies controls and network device authentication, with the motivation of enhancing subscription policies in nodes and using network slices to manage access as well as having restriction list to regulate times of access. (Sajjan Par. (0028-0029 and 0031-0032))
Claim(s) 9 and 19 is/are rejected under 35 U.S.C. 103 as being unpatentable over Iwai et al. (U.S Pub. No. 20180132302, hereinafter referred to as “Iwai”), Adam et al. (U.S Pub. No. 20180255101, hereinafter referred to as “Adam”), and Miriyala et al. (U.S Pub. No. 20210306338, hereinafter referred to as “Miriyala”) further in view of Ayyalasomayajula et al. (U.S Pub. No. 20130263287, hereinafter referred to as “Ayyalasomayajula”)
In regards to Claim 9, the combination of Iwai, Adam and Miriyala do not explicitly teach wherein the access control security policies include one or more of: a service operations restriction list comprising service names that can be offered as network function service producers, and a service operations forbidden list comprising service names that are not allowed to be offered as NF service producers.
Wherein Ayyalasomayajula teaches wherein the access control security policies include one or more of: a service operations restriction list comprising service names that can be offered as network function service producers, and (Par. (0096); policy with list of restricted applications with names in policy list), (Par. (0027, 0031-0034; that can be offered as network function service producers, (names corresponding to service in system and admin, admin service, management service etc. for devices))
a service operations forbidden list comprising service names that are not allowed to be offered as NF service producers. (Examiner Note: by using the phrase “include one or more of” Examiner broadly and reasonably interprets only one of the following to be included and mapped.), (Examiner Note: Examiner broadly and reasonably interprets in light of the specification “NF service producers” to be “network function service producers)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai, Adam and Miriyala to incorporate the teaching of Ayyalasomayajula to utilize the above feature because of the analogous concept of access policies controls and network device authentication, with the motivation of implementing security protection and privacy of data transmitted for devices without sensitive information and access issues to carriers of devices as well as to regulate access and control. (Ayyalasomayajula Par. (0005-0008))
In regards to Claim 19, the combination of Iwai, Adam and Miriyala do not explicitly teach wherein the access control security policies include one or more of: a service operations restriction list comprising service names that can be offered as network function service producers, and a service operations forbidden list comprising service names that are not allowed to be offered as NF service producers.
Wherein Ayyalasomayajula teaches wherein the access control security policies include one or more of: a service operations restriction list comprising service names that can be offered as network function service producers, and (Par. (0096); policy with list of restricted applications with names in policy list), (Par. (0027, 0031-0034; that can be offered as network function service producers, (names corresponding to service in system and admin, admin service, management service etc. for devices)),
a service operations forbidden list comprising service names that are not allowed to be offered as NF service producers. (Examiner Note: by using the phrase “include one or more of” Examiner broadly and reasonably interprets only one of the following to be included and mapped.), (Examiner Note: Examiner broadly and reasonably interprets in light of the specification “NF service producers” to be “network function service producers)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai, Adam and Miriyala to incorporate the teaching of Ayyalasomayajula to utilize the above feature because of the analogous concept of access policies controls and network device authentication, with the motivation of implementing security protection and privacy of data transmitted for devices without sensitive information and access issues to carriers of devices as well as to regulate access and control. (Ayyalasomayajula Par. (0005-0008))
Claim(s) 10 is/are rejected under 35 U.S.C. 103 as being unpatentable over Iwai et al. (U.S Pub. No. 20180132302, hereinafter referred to as “Iwai”), Adam et al. (U.S Pub. No. 20180255101, hereinafter referred to as “Adam”), and Miriyala et al. (U.S Pub. No. 20210306338, hereinafter referred to as “Miriyala”) further in view of Lochan et al. (U.S Pub. No. 20180145938, hereinafter referred to as “Lochan”)
In regards to Claim 10, the combination of Iwai, Adam and Miriyala do not explicitly teach wherein the access control security policies include one or more of: permitted UE context sharing, forbidden UE context sharing, restricted authentication lifetime, re-authentication periodicity, immediate connection termination recommendations, and least privilege authorizations.
Wherein Lochan teaches wherein the access control security policies include one or more of: (Par. (0026); sharing policy)
permitted UE context sharing, (Par. (0026) permitted sharing of context data between first and second computing device based on permitted sharing policy)
forbidden UE context sharing,
restricted authentication lifetime,
re-authentication periodicity,
immediate connection termination recommendations, and
least privilege authorizations. (Examiner Note: by using the phrase “include one or more of” Examiner broadly and reasonably interprets only one of the following to be included and mapped.)
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Iwai, Adam and Miriyala to incorporate the teaching of Lochan to utilize the above feature because of the analogous concept of access policies controls of devices within a network, with the motivation of implementing a sharing policy and context data of devices to allow devices transmitting data to be aware of authenticated peer to peer communication. (Lochan Par. (0026 and 0077))
Relevant Prior Art
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Kunz; Andreas (U.S Pub. No. 20230262460) “NETWORK FUNCTION REALLOCATION WITH SECURITY CONTEXT”. Considered this reference because it addressed similar inventors and concept of access policies of mobile devices.
Abdelsamie; Maher A (U.S Pub. No. 20250260565) “Methods And Systems For Privacy-Preserving Location Verification”. Considered this application because it relates to triggering alerts before policy subscription is enacted with trust data.
Chen; Xiaobao (U.S Pub. No. 20230021843) “PROVIDING CYBERSECURITY SERVICES BY A NETWORK AND AUTOMATED PROVISIONING THEREOF”. Considered this application because it addressed security policies for a plurality of devices based on identifiers and various trust data.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to HASSAN A HUSSEIN whose telephone number is (571)272-3554. The examiner can normally be reached on 7:30am-5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Eleni Shiferaw can be reached on (571)272-3867. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see https://ppair-my.uspto.gov/pair/PrivatePair. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/HASSAN A HUSSEIN/ Examiner, Art Unit 2497