DETAILED ACTION
This Office Action is in response to claims filed on 10/18/2024.
Claims 1-20 are pending.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 2, 5, 9-13, and 16-18 are rejected under 35 U.S.C. 103 as being unpatentable over Khemani et al. Pub. No. US 2017/0155573 A1 (hereinafter Khemani) in view of Herlocher et al. Pub. No. US 2017/0243013 A1 (hereinafter Herlocher).
With regard to claim 1, Khemani teaches a method for managing operation of a data processing system ([0023], FIG. 1 is block diagram illustrating an example of an HIS configured to switch host network traffic through a Baseboard Management Controller (BMC) according to some embodiments.), the method comprising:
making an identification, by a management controller of the data processing system, of an occurrence of a secure communication modification event for the data processing system ([0013], The host network path may be provided by a network device dedicated to the host processor, and the BMC may be configured to receive network configuration data from the network device via a sideband channel upon detection of a configuration change or upon request by the BMC. The BMC may be configured to take charge of the host network traffic after receiving a GPIO trigger from the FPGA); and
based on the identification:
performing, by the management controller, a communication management process based on a context of operation of hardware resources of the data processing system ([0038], Failover management system 200 may further include failover policy update interface 220 that can access the network traffic detection and control module 202 to update and set failover policy 208; [0040], During operation ,traffic analyzer and report module 204 may sample network traffic of first NIC 214, second NIC 216, and nth NIC 218 to detect one or more repeated patterns within the network traffic) and a schema that associates different contexts with different secure communication modalities to obtain at least one action ([0041], In this manner, when fault detector 210 detects a failover event of one or more of the NICs, failover control module 212 may access the failover policy 208 to automatically provide failover support and enable communication of specific network traffic detected in the failover policy 208.),
performing, by the management controller, the at least one action to modify an existing secure communication modality used by the hardware resources to obtain an updated secure communication modality ([0049], Moreover, an already existing standby or redundant MAC port (e.g., MAC 312) of BMC 128 may be used to conduct host failover traffic 307 between the network and host processor 102 via BMC 128 over PCIe bus 319, for example, in response to a determination by switching device 301 that host network path 305 has failed or is otherwise impaired.), and
providing, by the hardware resources, computer-implemented services using the updated secure communication modality ([0051], During failure of Host NIC/LOM1 303, MAC2 312 of BMC 128 takes charge host failover traffic 307 after receiving a GPIO trigger from switching device 301.).
However, Khemani does not explicitly teach the communication modality as secure communication modality.
Herlocher teaches secure communication modality ([0017], Embodiments of the invention are directed to systems, methods, and computer program products for securing Personally Identifiable Information (PII), such as payment information, protected health information and other sensitive information. Embodiments of the invention process this sensitive information using a secure modality for connection to computer systems that handle sensitive information.)
It would have been obvious to one of ordinary skill in the art at the time the invention was filed to apply the teachings of Herlocher with the teachings of Khemani in order to provide a method that teaches communication modalities comprising a secure communication modality. The motivation for applying Herlocher teaching with Khemani teaching is to provide a method that allows for the combination of known techniques that allows for information processing system communications governance of Khemani to implement data transmission over a secure modality of Herlocher and yield predictable results. Khemani and Herlocher are analogous art directed towards computer networking and communication arrangements. Therefore, it would have been obvious for one of ordinary skill in the art to combine Herlocher with Khemani to teach the claimed invention in order to provide and maintain secure communications in association with communication events.
With regard to claim 2, Khemani and Herlocher teach the method of claim 1,
Khemani further teaches wherein each of the different secure communication modalities utilizes a communication protocol of multiple communication protocols ([0048], In case of his NIC, BMC control (configuration path) is had over the I2C bus, and the data path is over RMII (NCSI). In case of LOM, BMC control (configuration path) is also over the I2C, and the data path is RMII (NCSI); [0067], Because BMC 128 peridocially obtains the configuration of NIC/LOM1 303 through I2C sideband channel 313, no configuration is needed during failover switching. BMC 128 may work as a virtual NIC for host processor 102, with ver minimal changes in host 102, for change of network path data from native PCIe path (305) to a virtual NIC PCIe path) and a set of parameters of multiple sets of parameters for the communication protocol ([0054], Configuration parameters of the NIC/LOM1 303 such as Link Speed, MTU, VLAN parameters, auto-negotiation, and DNS parameters are restored to the MAC 312 during failover.).
With regard to claim 5, Khemani and Herlocher teach the method of claim 1,
Khemani further teaches wherein the schema comprises policies for the data processing system ([0038], Failover management system 200 may further include failover policy update interface 220 that can access the network traffic detection and control module 202 to update and set failover policy 208), and each policy of the policies defines a secure communication modality of the different secure communication modalities with a corresponding context of the different contexts ([0040], During operation, traffic analyzer and report module may sample the network traffic of first NIC 214, second NIC 216, and nth NIC 218 to detect one or more repeated patterns within the network traffic; [0041], As such a user can select a failover option based on the network traffic and establish or et the failover policy 2078. In this manner, when fault detector 210 detects a failover event of one or more NICs, failover control module 212 may access the failover policy 20 and apply the policy and rules specified within the failover policy 208 to automatically provide failover support and enable communication of specific network traffic detected in the failover policy).
With regard to claim 9, Khameni and Herlocher the method of claim 1,
Khameni further teaches wherein the updated secure communication modality prevents communication previously provided by the existing secure communication modality ([0009], The host processor may be configured to use a PCIe endpoint instead of a dedicated network port after receiving another GPIO trigger from the FPGA; [0051], During failure of Host NIC/LOM1 303, MAC2 312 of BMC 128 takes charge host failover traffic 307 after receiving a GPIO trigger from switching device 301. This is routed to host processor 102 via PCIe bus 319.)
With regard to claim 10, Khemani and Herlocher teach the method of claim 1,
Khemani further teaches wherein the data processing system comprises a network module adapted to separately advertise network endpoints for the management controller and the hardware resources ([0046], BMC 128 includes dual core co-processor with I/O capabilities, as well as two MAC ports 311 and 312 coupled to two corresponding Reduced Gigabit Media-Independent Interface (RGMII) blocks 308 and 309, respectively. Ordinarily, both MACs 311 and 312 would be dedicated to BMC 128. Here, however, BMC network path 306 is provided via RGMII 308 and MAC1 311, and host failover path 307 is provided via RGMII 309 and MAC2 312), the network endpoints being usable by a remote system to address communications to the hardware resources and the management controller to facilitate the providing of the computer-implemented services ([0051], During failure of Host NIC/LOM1, MAC2 312 of BMC 128 takes charge host failover traffic 307 after receiving GPIO trigger from switching device 301. This is routed to host processor 102 via PCIe bus 319. Similarly another GPIO signal sent by switching device 301 to host processor triggers the switching of host network path 305 to host failover path 307 using PCIe endpoint 317; [0053], In general, an active/standby failover system allows a user to use a standby security appliance to take over the functionality of a failed unit.).
With regard to claim 11, Khemani and Herlocher teach the method of claim 10,
Khemani further teaches wherein an out-of-band communication channel that services the management controller runs through the network module ([0049], In operation … BMC network path 306 carries network packets to and from BMC 128.), an in-band communication channel that services the hardware resources also runs through the network module ([0045], Host NIC or LOM1 303 is coupled between switching device 301 and host processor 102, and it enables host network traffic 305 (e.g., packets, etc.) to flow between host processor 102 and a network; [0049], In operation, host network traffic 305 carries network packets to and from host processor 102.), and a sideband channel facilitates the updated secure communication modality ([0047], Host NIC/LOM1 303 is coupled to BMC 128 via Inter-Integrated Circuit (I.sup.2 C) bus or channel 313 to allow configuration information to be exchanged between NIC/LOM1 303 and MAC2 31, for example.).
With regard to claim 12, Khemani teaches a non-transitory machine-readable medium having instructions stored therein, which when executed by a processor, cause the processor to perform operations for managing operation of a data processing system ([0030], In some cases HIS 100 may be configured to access different types of computer-accessible media separate from memory 112. Generally speaking, a computer-accessible memory device may include any tangible, non-transitory storage media; [0032], In particular, any computer system and/or device may include combination of hardware or software cap), the operations comprising:
Claim 12 is a non-transitory machine-readable medium having similar limitations as claim 1. Thus claim 12 is rejected for the same rationale as applied to claim 1.
With regard to claim 13, it is a non-transitory machine-readable medium having similar limitations as claim 2. Thus, claim 13 is rejected for the same rationale as applied to claim 2.
With regard to claim 16, it is a non-transitory machine-readable medium having similar limitations as claim 5. Thus, claim 16 is rejected for the same rationale as applied to claim 5.
With regard to claim 17, Khemani teaches a data processing system ([0005], Embodiments of systems and methods for switching host network traffic through a Baseboard Management Controller (BMC) are described herein. In an illustrative, non limitation embodiment, an Information Handling System), comprising:
a processor ([0005], an Information Handling System (IHS) may include a host processor); and
a memory coupled to the processor to store instructions, which when executed by the processor, cause operations to be performed ([0005], And a memory coupled to the host processor, the memory having program instructions stored thereon that, upon execution, cause the IHS to: determine that a network path dedicated to the host processor has failed; and route host network traffic to and from the host processor through a network failover path provided by the BMC.), the operations comprising:
Claim 17 is a data processing system having similar limitations as claim 1. Thus, claim 17 is rejected for the same rationale as applied to claim 1.
With regard to claim 18, it is a data processing system having similar limitations as claim 2. Thus claim 18 is rejected for the same rationale as applied to claim 2.
Claims 3, 14, and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Khemani and Herlocher as applied to claim 1 above, and further in view of Gopal et al. Pub. No. US 2021/0303739 A1 (hereinafter Gopal) in view of Rothman et al. Pub. No. US 2010/0169949 A1 (hereinafter Rothman).
With regard to claim 3, Khemani and Herlocher teaches the method of claim 1,
Khemani further teaches wherein the context of operation of the hardware resources is based on at least:
a location of the data processing system;
a time of the occurrence of the secure communication modification event;
a security status of the hardware resources; and
a network connection status of the data processing system ([0044], A switching device including a Field Programmable Gate Array (FPGA) may be used, for example, for monitoring failover situations and for switching host network traffic from a dedicated controller and/or port to BMC 128’s controller or port. In case CPU 102’s Ethernet Controller fails (e.g., due to wrong configuration, firmware corruption, fault in MAC/PHY layer, or NO link status for uplink/downlink, etc.), BMC 128 may provide the redundant network data path).
However, Khemani does not explicitly teach hardware resource operating context including attributes of data processing system location, event occurrence time, and security status of the hardware resources
Herlocher further teaches a security status of the hardware resources ([0036], The OLTP system 12 may monitor the status of the secure communication session, control access to the session, and relay selected information about the session state and context securely to multiple parties involved in the collaboration.)
It would have been obvious to one of ordinary skill in the art at the time the invention was filed to apply the teachings of Herlocher with the teachings of Khemani in order to provide a method that teaches operation context including hardware resource security status. The motivation for applying Herlocher teaching with Khemani teaching is to provide a method that allows for global communication governance in association with a particular secure state (Herlocher, [0056]). Khemani and Herlocher are analogous art directed towards network and communication arrangements. Therefore, it would have been obvious for one of ordinary skill in the art to combine Herlocher with Khemani to teach the claimed invention in order to provide system operation context.
However, Kehmani and Herlocher do not explicitly teach hardware resource operating context including event occurrence time.
Gopal teaches a time of the occurrence of the secure communication modification event ([0026], The current system and method provide a security management framework to restrict a user or software interaction with the information handling system. In particular, the current system and method may provide the ability to programmatically restrict the system interaction events at the hardware and/or firmware level based on a user initiation, a timer and/or an entrance and an exit event. For example, the current system and method may enhance the security of the information handling system to ensure that the resources of information handling system are not available during a prescribed time.)
It would have been obvious to one of ordinary skill in the art at the time the invention was filed to apply the teachings of Gopal with the teachings of Khemani and Herlocher in order to provide a method that teaches operation context including event occurrence time. The motivation for applying Gopal teaching with Khemani and Herlocher teaching is to provide a method that allows for time information to be detected, such that enables modality policy to specify time-gated resource availability (Gopal, [0026]). Khemani and Herlocher and Gopal are analogous art directed towards network and communication arrangements. Therefore, it would have been obvious for one of ordinary skill in the art to combine Gopal with Khemani and Herlocher to teach the claimed invention in order to provide time-based operation context.
However, the combination does not explicitly teach hardware resource operating context including data processing system location
Rothman teaches a location of the data processing system ([0015], By using platform-based heuristics (e.g., intrusion detection without password confirmation, locality-based operation, etc.) the platform 101 may alter its behavior to automatically launch alternate boot paths to prevent the use of the platform … The heuristics may include detection of the network 109; location from a positioning source 107)
It would have been obvious to one of ordinary skill in the art at the time the invention was filed to apply the teachings of Rothman with the teachings of Khemani, Herlocher, and Gopal in order to provide a method that teaches operation context including system location. The motivation for applying Rothman teaching with Khemani, Herlocher, and Gopal teaching is to provide a method that allows for range information to be detected, such that enables modality policy to specify platform range (Rothman, [0009]). Khemani, Herlocher, and Gopal and Rothman are analogous art directed towards network and communication arrangements. Therefore, it would have been obvious for one of ordinary skill in the art to combine Rothman with Khemani, Herlocher, and Gopal to teach the claimed invention in order to provide location-based operation context.
With regard to claim 14, it is non-transitory machine-readable medium having similar limitations as claim 3. Thus, claim 14 is rejected for the same rationale as applied to claim 3.
With regard to claim 19, it is a data processing system having similar limitations as claim 3. Thus claim 19 is rejected for the same rationale as applied to claim 3.
Claims 4, 15, and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Khemani in view of Herlocher in view of Gopal in view of Rothman as applied to claim 3 above, and further in view of Smith et al. Pub. No. US 2012/0017271 A1 (hereinafter Smith).
With regard to claim 4, Khemani and Herlocher teaches the method of claim 3,
Herlocher further teaches wherein the context of operation of the hardware resources is further based on:
information regarding whether the data processing system is lost and/or stolen;
ownership information for the data processing system ([0022], The OLTP system 12 may thereby enable collection of sensitive information from one part (e.g., the customer) with the assistance of another party (e.g., the agent) without exposing the sensitive information to the assisting party; [0040], The context database 58 may store a session context for each secure communication session. This session content may be stored, for example, a session context record. The profile database 60 may store customer profile information, such as preferences for customer who have previously participated in secure communication session); and
information regarding the data processing system provided by another system ([0021], The OLTP system 12 may be configured to selectively provide information and/or attributes of the information to collaborating systems as needed by controlling what information is shared with each collaborating system. For example, the customer may provide sensitive payment information (e.g., credit card or bank account data through the customer system 14, and have that information processed by OLTP system 12).
However, the combination does not explicitly teach hardware resource operation context including information regarding whether the data processing system is lost and/or stolen
Smith teaches information regarding whether the data processing system is lost and/or stolen ([0027], In one embodiment, authenticated server 160 also includes anti-theft service 160. Anti-theft service 160 is used in conjunction with an enterprise server component (not shown) of domain controller 170 to prevent theft of data from storage devices on platform 100 in the event that platform 100 is stolen. Anti-theft service 160 enables platform resources to be disabled and/or locked if platform 100 is reported stolen.)
It would have been obvious to one of ordinary skill in the art at the time the invention was filed to apply the teachings of Smith with the teachings of Khemani, Herlocher, Gopal, and Rothman in order to provide a method that teaches theft detection operation context. The motivation for applying Smith teaching with Khemani, Herlocher, Gopal, and Rothman teaching is to provide a method that allows for theft detection, such that enables modality policies to globally disable platform resources uniformly (Smith, [0027]-[0030]). Khemani, Herlocher, Gopal, and Rothman and Smith are analogous art directed towards network and communication arrangements. Therefore, it would have been obvious for one of ordinary skill in the art to combine Smith with Khemani, Herlocher, Gopal, and Rothman to teach the claimed invention in order to provide operation context including theft detection.
With regard to claim 15, it is a non-transitory machine-readable medium having similar limitations as claim 4. Thus, claim 15 is rejected for the same rationale as applied to claim 4.
With regard to claim 20, it is a data processing system having similar limitations as claim 4. Thus claim 20 is rejected for the same rationale as applied to claim 4.
Claim 6 is rejected under 35 U.S.C. 103 as being unpatentable over Khemani in view of Herlocher as applied to claim 5 above, and further in view of Gopal et al. Pub. No. US 2021/0303739 A1 (hereinafter Gopal).
With regard to claim 6, Khemani and Herlocher teaches the method of claim 5,
Gopal further teaches wherein each of the policies are keyed to different secure communication modification events for the data processing system ([0036], Each of policies 265(1)-265(N) may be generated to manage features and/or limit access to the device, such as by modifying the feature settings of the device. As such, each one of policies 265(1)-265(N) may include custom feature settings of configuration information; [0041], the method monitors the information handling system for an assertion such as an event to enter the non-interactive mode. The assertion may be associated with a policy (Examiner notes: Assertion event associated with a particular policy) to limit user or software interaction with the information handling system. The policy may include modification to configuration settings of a component or device of the information handling system).
It would have been obvious to one of ordinary skill in the art at the time the invention was filed to apply the teachings of Gopal with the teachings of Khemani and Herlocher in order to provide a method that teaches policy organization associated with secure communication events. The motivation for applying Gopal teaching with Khemani and Herlocher teaching is to provide a method that allows for policy arrangement maintaining appropriate restrictions in association with a particular event (Gopal, [0034]). Khemani and Herlocher and Gopal are analogous art directed towards network and communication arrangements. Therefore, it would have been obvious for one of ordinary skill in the art to combine Gopal with Khemani and Herlocher to teach the claimed invention in order to provide multi-policy communication arrangements.
Claims 7 and 8 are rejected under 35 U.S.C. 103 as being unpatentable over Khemani in view of Herlocher as applied to claim 1 above, and further in view of Butcher et al. Pub. No. US 2016/0323148 A1 (hereinafter Butcher).
With regard to claim 7, Khemani and Herlocher teach the method of claim 1,
Butcher further teaches wherein the at least one action modifies a quantity of memory of the hardware resources reserved for the existing secure communication modality ([0043], As further shown, between power states 704 and 706 system BIOS may allocate receive and transmit buffer memory address/es for management controller 298 in main memory in main memory).
It would have been obvious to one of ordinary skill in the art at the time the invention was filed to apply the teachings of Butcher with the teachings of Khemani and Herlocher in order to provide a method that teaches memory management with respect to secure communication. The motivation for applying Butcher teaching with Khemani and Herlocher teaching is to provide a method that allows for high speed data paths between network and management controller absent high-speed physical connections between associated components (Butcher, [0009]). Khemani and Herlocher and Butcher are analogous art directed towards network and communication arrangements. Therefore, it would have been obvious for one of ordinary skill in the art to combine Butcher with Khemani and Herlocher to teach the claimed invention in order to provide memory allocation modification associated with secure communication modalities.
With regard to claim 8, Khemani and Herlocher teach the method of claim 1,
Butcher further teaches wherein the at least one action migrates a region of memory of the hardware resources reserved for the existing secure communication modality ([0031], incoming network packets are received across network interface 292 by network controller 260, filtered by network controller 260 based on the MAC address of management controller 298, and then packets 502 destined for management controller 298 are transferred via direct memory access (DMA) from the PCIe device across DDR 250 to receive buffer allocated for management controller 298 in main memory 215 … such a receive buffer area may be allocated by system executing on host processing device 207 in an area of main memory 215).
It would have been obvious to one of ordinary skill in the art at the time the invention was filed to apply the teachings of Butcher with the teachings of Khemani and Herlocher in order to provide a method that teaches memory migration with respect to secure communications. The motivation for applying Butcher teaching with Khemani and Herlocher teaching is to provide a method that allows for memory allocation within a region not reported to an operating system, such that allows for security of high speed data paths (Butcher, [0031]). Khemani and Herlocher and Butcher are analogous art directed towards network and communication arrangements. Therefore, it would have been obvious for one of ordinary skill in the art to combine Butcher with Khemani and Herlocher to teach the claimed invention in order to provide memory region migration associated with secure communication modalities.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to IVAN A CASTANEDA whose telephone number is (571)272-0465. The examiner can normally be reached Monday-Friday 9:30AM-5:30PM EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Aimee Li can be reached at (571) 272-4169. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/I.A.C./Examiner, Art Unit 2195
/Aimee Li/Supervisory Patent Examiner, Art Unit 2195
Prosecution Insights