DETAILED ACTION
1. Claims 19-38 are pending in this examination.
Notice of Pre-AIA or AIA Status
2. The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
3. In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Response to Arguments
4.1. Applicant's arguments have been considered but are moot in view of the new ground(s) of rejection.
4.2. The objection of the specification is hereby withdrawn; since Applicants’ corrected the specification.
Claim Rejections - 35 USC § 103
5.1. The text of those sections of Title 35, U.S. Code not included in this action can be found in a prior Office action.
5.2. Claims 19-38 are rejected under 35 U.S.C. 103 as being unpatentable over Chinese Patent Application No. CN110830993A to LiHe et al (“LiHe”)(IDS) in view of WO Patent Application No. WO 2022/204042 to Talebi Fard et al (“Talebi Fard”), ) in view of Patent Application No. 20190116521 to Qiao et al (“Qiao”).
As per claim 19 and 22, LiHe discloses method applied to a terminal, the method (apparatus) comprising: receiving security endpoint information from a session management network element (page 34, FIG. 3, the user plane security policy is generated by the SMF (session management function) network element 105. In the method, the user plane security policy is generated by the UPF network element 103. As shown in FIG. 4, the method 200 includes: S207, The SMF network element 105 sends a second N4 message to the UPF network element 103. The UPF network element 103 receives the second N4 message sent by the SMF network element 105. The second N4 message includes a first user plane security policy; page 20 In S230, the terminal device can be directly notified whether the security protection must be activated. Optionally, the user plane security activation indication information is carried in an RRC connection reconfiguration (RRC connection reconfiguration) message. As shown in FIG. 1, after receiving the RRC reconfiguration message, the UE 101 determines that the third field indicates that the user plane security endpoint is in the UPF network element 103; the UE 101 determines that the user plane security is activated according to the fourth field, and generates a corresponding Key...).
Furthermore, LiHe disclose in page 27, For example, the second data packet may be protected by using Internet protocol security (IPsec).
LiHe does not explicitly disclose however in the same field of endeavor, Talebi Fard, discloses establishing an internet protocol security (IPsec) connection between the terminal and a security endpoint indicated by the security endpoint information, wherein the security endpoint is the first user plane network element ([0236] In an example, FIG. 21 may depict an example configuration procedure of a UE to a first network e.g., underlay network in accordance with embodiments of the present disclosure. In an example, as in FIG. 19, FIG. 20 and FIG. 21, the IPsec SA may be established between the UE and an N3IWF of the first network (e.g., overlay network) by using the common N3IWF key that was created in the UE and received by the N3IWF. The established IPsec SA may be referred to as the signaling IPsec SA. After the establishment of the signaling IPsec SA, the N3IWF may notify the AMF of the first network that the UE context (including AN security) was created by sending a NGAP initial context setup response message. The signaling IPsec SA may be configured to operate in tunnel mode and the N3IWF may assign to UE an inner IP address (e.g., the first IP address, IP_addr_overlay). If the N3IWF has received an indication that the UE supports MOBIKE, then the N3IWF may include a notify payload in the IKE_AUTH response message, indicating that MOBIKE may be supported. In an example, in response to receiving the first IP address, the UE may send a NAS message to the second network to configure the user plane nodes of the second network for routing of packets that correspond to the PDU session of the UE in the first network (e.g., the first PDU session). In an example, the NAS message may be a PDU session modification request message, a service request message, a PDU session establishment request message, and/or the like. In an example, the NAS message may be sent to the SMF of the second network. In an example, the NAS message may be sent to the AMF of the second network. The NAS message may be sent via an NG-RAN or a 3GPP access of the second network).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teaching of LiHe with the teaching of Talebi Fard by including the feature of IPsec connection, in order for LiHe’s system to providing crucial end-to-end security. IPsec connections in 5G provide crucial end-to-end security, enabling encrypted, authenticated, and high-integrity data transmission between the Radio Access Network (RAN) and the core network. Mandated for 5G, IPsec ensures subscriber confidentiality, defends against network attacks, and protects critical infrastructure, particularly for 5G backhaul.
LiHe and Talebi Fard do not explicitly disclose however in the same field of endeavor, Qiao discloses an N1 session management (SM) container, the security endpoint information comprising an address of a first user plane network element ([0154], [0158]-[0159], also see [0234]).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teaching of LiHe with the teaching of Talebi Fard/Qiao by including the feature of N1 session, in order for LiHe’s system to securein the data transmission between UE and UPF, protecting user data from eavesdropping. A radio access network receives from an access and mobility management function, a first message comprising an Ethernet packet filter set for a wireless device. The Ethernet packet filter set comprises: source medium access control address; and a destination medium access control address. The radio access network determines, based on the Ethernet packet filter set, Ethernet header configuration parameters for the wireless device, wherein the Ethernet header configuration parameters comprise: a header compression index indicating the source medium access control address and the destination medium access control address; and Ethernet header profile configuration information element(s) comprising a profile identifier. The radio access network sends to the wireless device, second message(s) comprising the Ethernet header configuration parameters. The radio access network sends to the wireless device, Ethernet packet(s) comprising packet header(s) compressed based on the header compression index and the profile identifier (Qiao, abstract).
As per claim 25, LiHe discloses a method, comprising: sending, by the session management network element, the user plane security rule to the first user plane network element (receiving, by the first user plane network element, the user plane security rule from the session management network element (page 34 S207. The SMF network element 105 sends a second N4 message to the UPF network element 103. The UPF network element 103 receives the second N4 message sent by the SMF network element 105. The second N4 message includes a first user plane security policy. It should be understood that the first user plane security policy in S207 may be the user plane security policy determined by SMF network element 105 in S206 in FIG. 4).
determining, by a session management network element, a user plane security rule (page 34, FIG. 4 shows still another schematic flowchart of the data processing method 200 provided by the embodiment of the present application. Compared with FIG. 3, the user plane security policy is generated by the SMF network element 105. In the method, the user plane security policy is generated by the UPF network element 103. As shown in FIG. 4, the method 200 includes: S207. The SMF network element 105 sends a second N4 message to the UPF network element 103. The UPF network element 103 receives the second N4 message sent by the SMF network element 105. The second N4 message includes a first user plane security policy. [page 27, For example, the second data packet may be protected by using Internet protocol security (IPsec));
LiHe does not explicitly disclose however in the same field of endeavor, Talebi Fard, discloses the user plane security rule is used to establish an internet protocol security (IPsec) connection between a first user plane network element and a terminal; establishing, by the first user plane network element, the IPsec connection between the first user plane network element and the terminal according to the user plane security rule ([0236] In an example, FIG. 21 may depict an example configuration procedure of a UE to a first network e.g., underlay network in accordance with embodiments of the present disclosure. In an example, as in FIG. 19, FIG. 20 and FIG. 21, the IPsec SA may be established between the UE and an N3IWF of the first network (e.g., overlay network) by using the common N3IWF key that was created in the UE and received by the N3IWF. The established IPsec SA may be referred to as the signaling IPsec SA. After the establishment of the signaling IPsec SA, the N3IWF may notify the AMF of the first network that the UE context (including AN security) was created by sending a NGAP initial context setup response message. The signaling IPsec SA may be configured to operate in tunnel mode and the N3IWF may assign to UE an inner IP address (e.g., the first IP address, IP_addr_overlay). If the N3IWF has received an indication that the UE supports MOBIKE, then the N3IWF may include a notify payload in the IKE_AUTH response message, indicating that MOBIKE may be supported. In an example, in response to receiving the first IP address, the UE may send a NAS message to the second network to configure the user plane nodes of the second network for routing of packets that correspond to the PDU session of the UE in the first network (e.g., the first PDU session). In an example, the NAS message may be a PDU session modification request message, a service request message, a PDU session establishment request message, and/or the like. In an example, the NAS message may be sent to the SMF of the second network. In an example, the NAS message may be sent to the AMF of the second network. The NAS message may be sent via an NG-RAN or a 3GPP access of the second network, [0293], the mapping may be based on an element of the first message. In an example, the configuration message may comprise at least one of a packet detection rule (PDR), a forwarding action rule, a buffering rule, a reporting rule, a service data flow (SDF) parameter comprising a SPI associated with an IPsec SA (or IPsec child SA) of the IPsec tunnel).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teaching of LiHe with the teaching of Talebi Fard by including the feature of IPsec connection, in order for LiHe’s system to providing crucial end-to-end security. IPsec connections in 5G provide crucial end-to-end security, enabling encrypted, authenticated, and high-integrity data transmission between the Radio Access Network (RAN) and the core network. Mandated for 5G, IPsec ensures subscriber confidentiality, defends against network attacks, and protects critical infrastructure, particularly for 5G backhaul.
LiHe and Talebi Fard do not explicitly disclose however in the same field of endeavor, Qiao discloses sending, by the session management network element, security endpoint information in an N1 SM container to the terminal, the security endpoint information comprising an address of the first user plane network element ([0154], [0158]-[0159], also see [0234])
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teaching of LiHe with the teaching of Talebi Fard/Qiao by including the feature of N1 session, in order for LiHe’s system to securein the data transmission between UE and UPF, protecting user data from eavesdropping. A radio access network receives from an access and mobility management function, a first message comprising an Ethernet packet filter set for a wireless device. The Ethernet packet filter set comprises: source medium access control address; and a destination medium access control address. The radio access network determines, based on the Ethernet packet filter set, Ethernet header configuration parameters for the wireless device, wherein the Ethernet header configuration parameters comprise: a header compression index indicating the source medium access control address and the destination medium access control address; and Ethernet header profile configuration information element(s) comprising a profile identifier. The radio access network sends to the wireless device, second message(s) comprising the Ethernet header configuration parameters. The radio access network sends to the wireless device, Ethernet packet(s) comprising packet header(s) compressed based on the header compression index and the profile identifier (Qiao, abstract).
As per claim 20, the combination of LiHe, Talebi Fard and Qiao discloses the method according to claim 19, wherein establishing the IPsec connection to the security endpoint indicated by the security endpoint information comprises: sending a security association (SA) establishment request message to the security endpoint, wherein the SA establishment request message comprises a SA parameter of the terminal; and receiving a SA establishment response message from the security endpoint, wherein the SA establishment response message comprises a SA parameter of the first user plane network element (Talebi Fard, [0240] The configuration parameter may comprise the first IP address (associated with the first PDU session in the overlay network, or the inner IP address). The SMF may configure the UPF to forward packets that have destination address as the first IP address to an interface for the second PDU session. The configuration parameter may indicate that the first IP address may be mapped to the second PDU session of the UE in the second network. The configuration parameter may indicate that one or more rules, such as packet detection rules, forwarding action rules, buffering rules, and/or the like of the second PDU session may apply to packets with destination address as the first IP address. In an example, the configuration parameter may be a mapping information between the first IP address and the second IP address [0243] In an example, FIG. 23 may depict an example registration and PDU session establishment procedure of a UE to the first network in accordance with embodiments of the present disclosure. In an example, as described in example embodiments of the present disclosure in FIG. 19, FIG. 20, and FIG. 21, one or more IPsec security associations IPsec SA or IPsec child security associations
IPsec child SA may be established between the UE and the N3IWF of the first network. In an example, the IPsec tunnel, the IPsec SA, or an IPsec child SA wherein the UE is a receiving entity may be assigned or allocated an SPI. In an example, the SPI may be a value which is used (together with the destination IP address) to identify the security association of the receiving party e.g., the UE.). The motivation regarding the obviousness of claim 19 is also applied to claim 20.
As per claim 21, the combination of LiHe, Talebi Fard and Qiao discloses the method according to claim 19, further comprising: sending security capability information of the terminal to a mobility management network element, wherein the security capability information of the terminal indicates that the terminal supports establishment of an IPsec connection to a core network function (Talebi Fard, [0142], [0212]). The motivation regarding the obviousness of claim 19 is also applied to claim 21.
Claim 23, is rejected for similar reasons as stated above, and claim 20.
Claim 24, is rejected for similar reasons as stated above, and claim 21.
As per claim 26, the combination of LiHe, Talebi Fard and Qiao discloses the method according to claim 25, further comprising: receiving, by the terminal, security endpoint information from the session management network element (LiHe, page 34, FIG. 3, the user plane security policy is generated by the SMF (session management function) network element 105. In the method, the user plane security policy is generated by the UPF network element 103. As shown in FIG. 4, the method 200 includes: S207, The SMF network element 105 sends a second N4 message to the UPF network element 103. The UPF network element 103 receives the second N4 message sent by the SMF network element 105. The second N4 message includes a first user plane security policy; page 20 In S230, the terminal device can be directly notified whether the security protection must be activated. Optionally, the user plane security activation indication information is carried in an RRC connection reconfiguration (RRC connection reconfiguration) message. As shown in FIG. 1, after receiving the RRC reconfiguration message, the UE 101 determines that the third field indicates that the user plane security endpoint is in the UPF network element 103; the UE 101 determines that the user plane security is activated according to the fourth field, and generates a corresponding Key...).
Furthermore, LiHe disclose in page 27, For example, the second data packet may be protected by using Internet protocol security (IPsec).
LiHe does not explicitly disclose however in the same field of endeavor, Talebi Fard, discloses establishing, by the terminal, an IPsec connection between the terminal and a security endpoint indicated by the security endpoint information, wherein the security endpoint is the first user plane network element ([0236] In an example,
FIG. 21 may depict an example configuration procedure of a UE to a first network e.g., underlay network in accordance with embodiments of the present disclosure. In an example, as in FIG. 19, FIG. 20 and FIG. 21, the IPsec SA may be established between the UE and an N3IWF of the first network (e.g., overlay network) by using the common N3IWF key that was created in the UE and received by the N3IWF. The established IPsec SA may be referred to as the signaling IPsec SA. After the establishment of the signaling IPsec SA, the N3IWF may notify the AMF of the first network that the UE context (including AN security) was created by sending a NGAP initial context setup response message. The signaling IPsec SA may be configured to operate in tunnel mode and the N3IWF may assign to UE an inner IP address (e.g., the first IP address, IP_addr_overlay). If the N3IWF has received an indication that the UE supports MOBIKE, then the N3IWF may include a notify payload in the IKE_AUTH response message, indicating that MOBIKE may be supported. In an example, in response to receiving the first IP address, the UE may send a NAS message to the second network to configure the user plane nodes of the second network for routing of packets that correspond to the PDU session of the UE in the first network (e.g., the first PDU session). In an example, the NAS message may be a PDU session modification request message, a service request message, a PDU session establishment request message, and/or the like. In an example, the NAS message may be sent to the SMF of the second network. In an example, the NAS message may be sent to the AMF of the second network. The NAS message may be sent via an NG-RAN or a 3GPP access of the second network). The motivation regarding the obviousness of claim 25 is also applied to claim 26.
As per claim 27, the combination of LiHe, Talebi Fard and Qiao discloses the method according to claim 25, wherein an access network device on the IPsec connection does not enable user plane security protection of the terminal (LiHe, page 16, S210. The control plane function network element sends a user plane security policy to the access network device, and the access network device receives the user plane security policy sent by the control plane function network element, and the user plane security policy is used to indicate the user plane security termination).
As per claim 28, the combination of LiHe and Talebi Fard discloses the method according to claim 27, further comprising: sending, by the session management network element, a user plane security policy to the access network device, wherein the user plane security policy indicates the access network device not to enable user plane encryption and integrity protection of the terminal (LiHe, page 16).
As per claim 29, the combination of LiHe, Talebi Fard and Qiao discloses the method according to claim 25, wherein determining the user plane security rule comprises: determining, by the session management network element, the user plane security rule based on security indication information and a user plane security policy of the terminal (LiHe, Pages 28 -29, S201. “The UE 101 sends a non-access stratum (NAS) message to the AN device 102, and the AN device 102 receives the NAS message sent by the UE 101….. The SMF network element 105 obtains user plane security endpoint location information of the UE 101, and determines a first user plane security policy according to the user plane security endpoint location information. (1)The NAS message includes the security endpoint preference information of the UE 101, and the SMF network element 105 may obtain it from the message forwarded by the AMF network element 104; the security endpoint preference information sent by the UE 101 may indicate the security endpoint location preferred by the UE 101. For example, the security termination point may be bit information, 0 represents the security termination point on the AN device102, and 1 represents the security termination point on the UPF network element 103 ... ").
As per claim 30, the combination of LiHe, Talebi Fard and Qiao discloses the method according to claim 29, wherein determining the user plane security rule based on the security indication information and the user plane security policy of the terminal comprises: determining, by the session management network element, the user plane security rule in response to the security indication information indicating to use the IPsec connection to protect user plane data and the user plane security policy of the terminal being that user plane security protection is determined to be enabled (LiHe, Pages 28 -29).
As per claim 31, the combination of LiHe, Talebi Fard and Qiao discloses the method according to claim 29, wherein the security indication information is end to end (E2E) security indication information (Talebi Fard, [0207]). The motivation regarding the obviousness of claim 25 is also applied to claim 31.
As per claim 32, the combination of LiHe, Talebi Fard and Qiao discloses the method according to claim 25, wherein determining the user plane security rule comprises: determining, by the session management network element, the user plane security rule based on a radio access technology type of the terminal (Talebi Fard, [0240], [0125]-[0126], also see [0072]-[0073]). The motivation regarding the obviousness of claim 25 is also applied to claim 32.
As per claim 33, the combination of LiHe, Talebi Fard and Qiao discloses the method according to claim 32, wherein determining the user plane security rule based on the radio access technology type of the terminal comprises: determining, by the session management network element, the user plane security rule in response to the radio access technology type being a new radio satellite access type (Talebi Fard, [0240], [0125]-[0126], also see [0072]-[0073], [0051]). The motivation regarding the obviousness of claim 25 is also applied to claim 33.
As per claim 34, the combination of LiHe, Talebi Fard and Qiao discloses the method according to claim 25, wherein determining the user plane security rule comprises: determining, by the session management network element, the user plane security rule based on a radio access technology type of the terminal and a user plane security policy of the terminal (Talebi Fard, [0240], [0125]-[0126], also see [0072]-[0073]). The motivation regarding the obviousness of claim 25 is also applied to claim 34.
As per claim 35 the combination of LiHe, Talebi Fard and Qiao discloses the method according to claim 34, wherein determining the user plane security rule based on the radio access technology type of the terminal and the user plane security policy of the terminal comprises: determining, by the session management network element, the user plane security rule in response to the radio access technology type being a satellite access type and the user plane security policy of the terminal being that user plane security protection is determined to be enabled (Talebi Fard, [0240], [0125]-[0126], also see [0072]-[0073]). The motivation regarding the obviousness of claim 25 is also applied to claim 35.
As per claim 36, the combination of LiHe, Talebi Fard and Qiao discloses the method according to claim 25, wherein determining the user plane security rule comprises: determining, by the session management network element, the user plane security rule based on security indication information, wherein the security indication information indicates to use the IPsec connection to protect user plane data (Talebi Fard, [0280], [0240], also see [0207]). The motivation regarding the obviousness of claim 25 is also applied to claim 36.
As per claim 37, the combination of LiHe, Talebi Fard and Qiao discloses the method according to claim 19, wherein an access network device on the IPsec connection does not enable user plane security protection of the terminal (LiHe, page 16, also see page 17, fig. 2 and associated texts).
As per claim 38, the combination of LiHe, Talebi Fard and Qiao discloses the method according to claim 37, wherein a user plane security policy received by the access network device indicates the access (LiHe, page 28, also see page 34, fig. 3 and associated texts).
6.1. The prior art made of record and not relied upon is considered pertinent to applicant's disclosure as the prior art discloses many of the claim features (See PTO-form 892).
6.2. a). US Patent Application No. 10812980 issued to Zhu et al., described herein are a communication method, a security node network element, and a terminal. The method includes receiving, by a security node network element, a first data packet carrying first user plane data or first control signaling from a terminal, the first data packet is transmitted via a first security connection or a second security connection, the first security connection is used to transmit the first data packet carrying the first user plane data, and the second security connection is used to transmit the first data packet carrying the first control signaling; and sending the first control signaling to a control plane (CP) function entity if the first data packet is transmitted via the second security connection.
b). US Patent Application No. 20240397464 to Salkintzis et al., discloses apparatuses, methods, and systems are disclosed for registering with a mobile communication network (“MCN”) through another MCN. A network entity in a first MCN may include at least one processor coupled with at least one memory and configured to cause the network entity to receive a first request message including an indication that the data connection is to facilitate a UE to register with a second MCN; select a gateway function in the second MCN; initiate an access procedure with the gateway function; relay authentication messages between the gateway function and the UE; establish the data connection in the first MCN in response to a successful completion of the access procedure; and transmit an accept message indicating that the data connection with the first MCN is successfully established, where the registration of the UE with the second MCN is completed via the established data connection.
Conclusion
7. Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to HARUNUR RASHID whose telephone number is (571)270-7195. The examiner can normally be reached 9 AM to 5PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Eleni A. Shiferaw can be reached at (571) 272-3867. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
HARUNUR . RASHID
Primary Examiner
Art Unit 2497
/HARUNUR RASHID/Primary Examiner, Art Unit 2497
Prosecution Insights