Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This Office Action is in response to the amendment filed 8/11/2026 for application 18/926,165.
As per instant Amendment, claims 1, 3-15, 17, 18, 20, and 21 are currently pending. Claims 2, 16, and 19 have been canceled. Claims 1, 3, 15, 17, 18, 20, and 21 have been amended. Claims 1, 15, 18, and 21 are independent claims. Claims 1, 3-15, 17, 18, 20, and 21 have been examined. This Action is made FINAL.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 6/9/2026, 09/16/2026, and 09/29/2026 are in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement has been considered by the examiner.
Response to Arguments
The objection to the specification is removed in light of Applicant’s submission of a replacement abstract on August 11, 2026.
The objection to the claims is removed in light of Applicant’s amendment of claim 21.
The rejection of claim 18 under 35 U.S.C. 101 has been withdrawn in light of Applicant’s amendment of claim 18.
Applicants’ arguments in the instant Amendment, filed on 8/11/2026, with respect to limitations listed below, have been fully considered but they are not persuasive.
Applicant argues as follows: The rejections are respectfully traversed. With respect to claims 1, 15, 18, and 21, claim 1 recites, inter alia, "enforce a security policy on data plane traffic associated with the UE based on contextual information associated with the UE to provide secured data plane traffic using the security policy configured per user group and/or per user, comprising to: identify Remote Authentication Dial-In User Service (RADIUS) accounting messages, DIAMETER messages, and/or service provider (SP) Application Programming Interface (API) communication messages; and extract the contextual information from the RADIUS accounting messages, the DIAMETER messages, and/or the SP API communication messages, wherein the extracted contextual information includes a subscriber identity, and wherein the subscriber identity includes an International Mobile Subscriber Identity (IMSI)," and claims 15, 18, and 21 recite similar subject matter.
Examiner respectfully notes, regarding claim 1, Koenning discloses, paragraphs 0044 and 0065, a system, comprising: a processor configured to b disclosing memory, processor, traffic, policy; traffic management apparatus, processor, memory, software; paragraphs 0031 and 0038, receive traffic associated with a User Equipment (UE) from a mobile core network at a cloud network via a service provider network attach using an interconnect between the mobile core network and the cloud network by disclosing network traffic received; components can communicate with each other using the interconnect; paragraphs 0018, 0015,forward the data plane traffic from the cloud network to its original destination if allowed by the policy by disclosing forward all network traffic, data plane traffic distribution; policies to determine whether and how traffic is forwarded through the network; paragraph 0050, block or drop the data plane traffic from the cloud network if not allowed by the policy by disclosing implement policy, blocking packets, forwarding packets; paragraphs 0044, 0065, a memory coupled to the processor and configured to provide the processor with instructions by disclosing memory, processor, traffic, policy; traffic management apparatus, processor, memory, software.
Sood discloses, paragraphs 0034, 0048, 0049, receive traffic associated with a User Equipment (UE) from a mobile core network at a Secure Access Service Edge (SASE) cloud network via a service provider network attach using an interconnect between the mobile core network and the SASE cloud network by disclosing security policy, communication; data plane, cloud service, communication; Secure Access Service Edge; UE, policy; paragraphs 0034, 0048, 0049, enforce a security policy on data plane traffic associated with the UE based on contextual information associated with the UE to provide secured data plane traffic using the security policy configured per user group and/or per user by disclosing security policy, communication; data plane, cloud service, communication; Secure Access Service Edge; UE, policy; paragraphs 0034, 0048, 0049, forward the secured data plane traffic from the SASE cloud network to its original destination if allowed by the security policy by disclosing security policy, communication; data plane, cloud service, communication; Secure Access Service Edge; UE, policy; paragraphs 0034, 0048, 0049, block or drop the data plane traffic from the SASE cloud network if not allowed by the security policy by disclosing security policy, communication; data plane, cloud service, communication; Secure Access Service Edge; UE, policy..
Yadav discloses, paragraph 0101, identify Remote Authentication Dial-In User Service (RADIUS) accounting messages, DIAMVETER messages, and/or service provider (SP) Application Programming Interface (API) communication messages by disclosing RADIUS accounting messages, subscriber ID, IMSI; paragraphs 0053, 0063, 0067, extract the contextual information from the RADIUS accounting messages, the DIAMETER messages, and/or the SP API communication messages, wherein the extracted contextual information includes a subscriber identity, and wherein the subscriber identity includes an International Mobile Subscriber Identity (IMSI) by disclosing IP addresses, packet traffic, UE, IMSI, context; paragraphs 0044, 0067, 0101, forward the secured data plane traffic from the SASE cloud network to its original destination if allowed by the security policy, and block or drop the data plane traffic from the SASE cloud network if not allowed by the security policy, wherein the SASE cloud network includes a firewall as a service that is configured with a plurality of security policies based on the subscriber identity and an application identifier by disclosing firewall as a service, application endpoints, security, policies, secure access service edge (SASE), subscriber identifier.
Applicant argues as follows: As discussed during the interview, the applied references fail to teach or render obvious "enforce a security policy on data plane traffic associated with the UE based on contextual information associated with the UE to provide secured data plane traffic using the security policy configured per user group and/or per user, comprising to: identify Remote Authentication Dial-In User Service (RADIUS) accounting messages, DIAMETER messages, and/or service provider (SP) Application Programming Interface (API) communication messages; and extract the contextual information from the RADIUS accounting messages, the DIAMETER messages, and/or the SP API communication messages, wherein the extracted contextual information includes a subscriber identity, and wherein the subscriber identity includes an International Mobile Subscriber Identity (IMSI)," as recited in claim 1 and similarly recited in claims 15, 18, and 21.
Examiner respectfully notes that the Examiner Interview Summary Record files 7/22/2026 is as follows: Date of Interview: 20 July 2026 Issues Discussed: Proposed Amendment(s) Applicant's representative, Obert Chu, provided an overview of Applicant's invention. Proposed amendments were discussed. Examiner suggested that subject matter of dependent claims where a third or fourth prior art reference was cited by considered for incorporation into the independent claims. Furthermore, Examiner suggested that subject matter disclosed but not yet claimed may be incorporated into the independent claims to overcome the rejection and lead to allowability. The applicant agreed to consider further amendment that will be submitted for further examination.
The Examiner respectfully suggests that the claim be further amended and details in the specification be incorporated to distinguish the claimed invention over prior art of record. Should the Applicant desire an interview to further clarify the claim interpretation/rejections, please contact the Examiner at (571) 272 5368 to schedule an interview.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 1, 3-8, 12-15, 17, 18, 20, and 21 are rejected under 35 U.S.C. 103 as being unpatentable over Koenning (US20210258248), filed February 19, 2020, in view of Sood.(US20220329573), filed June 21, 2022, and Yadav (US20230100395), filed September 27, 2021
Regarding claim 1, Koenning disclose a system, comprising:
a processor configured to (Koenning, paragraph 0044, memory, processor, traffic, policy; paragraph 0065, traffic management apparatus, processor, memory, software);
receive traffic associated with a User Equipment (UE) from a mobile core network at a cloud network via a service provider network attach using an interconnect between the mobile core network and the cloud network (Koenning, paragraph 0031, network traffic received; paragraph 0038, components can communicate with each other using the interconnect);
forward the data plane traffic from the cloud network to its original destination if allowed by the policy (Koenning, paragraph 0018, forward all network traffic, data plane traffic distribution; paragraph 0015, policies to determine whether and how traffic is forwarded through the network);
block or drop the data plane traffic from the cloud network if not allowed by the policy (Koenning, paragraph 0050, implement policy, blocking packets, forwarding packets);
a memory coupled to the processor and configured to provide the processor with instructions (Koenning, paragraph 0044, memory, processor, traffic, policy; paragraph 0065, traffic management apparatus, processor, memory, software).
Koenning discloses receive traffic associated with a User Equipment (UE) from a mobile core network at a cloud network via a service provider network attach using an interconnect between the mobile core network and the cloud network; forward the at a plane traffic from the cloud network to its original destination if allowed by the policy; block or drop the data plane traffic from the cloud network if not allowed by the policy. but does not explicitly disclose receive traffic associated with a User Equipment (UE) from a mobile core network at a Secure Access Service Edge (SASE) cloud network via a service provider network attach using an interconnect between the mobile core network and the SASE cloud network; enforce a security policy on data plane traffic associated with the UE based on contextual information associated with the UE to provide secured data plane traffic using the security policy configured per user group and/or per user; forward the secured data plane traffic from the SASE cloud network to its original destination if allowed by the security policy; block or drop the data plane traffic from the SASE cloud network if not allowed by the security policy.
However, in an analogous art, Sood discloses receive traffic associated with a User Equipment (UE) from a mobile core network at a Secure Access Service Edge (SASE) cloud network via a service provider network attach using an interconnect between the mobile core network and the SASE cloud network (Sood, paragraph 0034, security policy, communication; paragraph 0048, data plane, cloud service, communication; Secure Access Service Edge; paragraph 0049, UE, policy);
enforce a security policy on data plane traffic associated with the UE based on contextual information associated with the UE to provide secured data plane traffic using the security policy configured per user group and/or per user (Sood, paragraph 0034, security policy, communication; paragraph 0048, data plane, cloud service, communication; Secure Access Service Edge; paragraph 0049, UE, policy);
forward the secured data plane traffic from the SASE cloud network to its original destination if allowed by the security policy (Sood, paragraph 0034, security policy, communication; paragraph 0048, data plane, cloud service, communication; Secure Access Service Edge; paragraph 0049, UE, policy);
block or drop the data plane traffic from the SASE cloud network if not allowed by the security policy (Sood, paragraph 0034, security policy, communication; paragraph 0048, data plane, cloud service, communication; Secure Access Service Edge; paragraph 0049, UE, policy)..
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of Sood with the system/ method/ computer program product/ system of Koenning to include enforce a security policy on data plane traffic associated with the UE based on contextual information associated with the UE to provide secured data plane traffic using the security policy configured per user group and/or per user. One would have been motivated to provide users with the benefits of facilitating service to service communications. (Sood: paragraph 0002).
Koenning and Sood disclose forward the secured data plane traffic from the SASE cloud network to its original destination if allowed by the security policy, and block or drop the data plane traffic from the SASE cloud network if not allowed by the security policy, but do not explicitly disclose identify Remote Authentication Dial-In User Service (RADIUS) accounting messages, DIAMVETER messages, and/or service provider (SP) Application Programming Interface (API) communication messages; and
extract the contextual information from the RADIUS accounting messages, the DIAMETER messages, and/or the SP API communication messages, wherein the extracted contextual information includes a subscriber identity, and wherein the subscriber identity includes an International Mobile Subscriber Identity (IMSI); and
forward the secured data plane traffic from the SASE cloud network to its original destination if allowed by the security policy, and block or drop the data plane traffic from the SASE cloud network if not allowed by the security policy, wherein the SASE cloud network includes a firewall as a service that is configured with a plurality of security policies based on the subscriber identity and an application identifier.
However, in an analogous art, Yadav discloses identify Remote Authentication Dial-In User Service (RADIUS) accounting messages, DIAMVETER messages, and/or service provider (SP) Application Programming Interface (API) communication messages (Yadav, paragraph 0101, RADIUS accounting messages, subscriber ID, IMSI);
extract the contextual information from the RADIUS accounting messages, the DIAMETER messages, and/or the SP API communication messages, wherein the extracted contextual information includes a subscriber identity, and wherein the subscriber identity includes an International Mobile Subscriber Identity (IMSI) ((Yadav, paragraph 0053, IP addresses, packet traffic, UE, paragraph 0063, IMSI, paragraph 0067, context).
forward the secured data plane traffic from the SASE cloud network to its original destination if allowed by the security policy, and block or drop the data plane traffic from the SASE cloud network if not allowed by the security policy, wherein the SASE cloud network includes a firewall as a service that is configured with a plurality of security policies based on the subscriber identity and an application identifier (Yadav, paragraph 0044, firewall as a service, application endpoints, paragraph 0067, security, policies, secure access service edge (SASE), paragraph 0101, subscriber identifier).
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of Yadav with the system/ method/ computer program product/ system of Koenning and Sood to include RADIUS messages and firewall as a service. One would have been motivated to provide users with the benefits of providing secure network connectivity (Yadav: paragraph 0017).
Regarding claim 3, Koenning, Sood, and Yadav disclose the system recited in claim 1. Koenning, Sood, and Yadav disclose wherein the firewall as a service that is configured with the plurality of security policies based on the subscriber identity, a unique device identifier, and the application identifier, wherein the unique device identifier includes an International Mobile Equipment Identifier (IMEI). (Sood, paragraph 0042, application identifier)(Yadav, paragraph 0044, Firewall-as-a-Service, paragraph 0054, International Mobile Subscriber Identity, International Mobile Equipment Identity, paragraph 0067, SASE policies may include context driven UE security, access policy, paragraph 0099, subscriber identity)
Regarding claim 4, Koenning, Sood, and Yadav disclose the system recited in claim 1. Koenning, Sood, and Yadav disclose wherein the mobile core network includes a 4G mobile core network, a 5G mobile core network, and/or 6G mobile core network (Sood, paragraph 0049, 5G/6G control plane functions, UE, mobile, paragraph 0065, interconnected, 4G, 5G, user; paragraph 0068, network, 4G, 5G).
Regarding claim 5, Koenning, Sood, and Yadav disclose the system recited in claim 1. Koenning, Sood, and Yadav disclose wherein the data plane traffic is secured from and to 4G, 5G, and/or 6G UE devices (Sood, paragraph 0049, 5G/6G control plane functions, UE, mobile, paragraph 0065, interconnected, 4G, 5G, user; paragraph 0068, network, 4G, 5G).
Regarding claim 6, Koenning, Sood, and Yadav disclose the system recited in claim 1. Koenning, Sood, and Yadav disclose wherein Internet access is secured from and to 4G, 5G, and/or 6G UE devices (Sood, paragraph 0049, 5G/6G control plane functions, UE, mobile, paragraph 0065, interconnected, 4G, 5G, user; paragraph 0068, network, 4G, 5G).
Regarding claim 7, Koenning, Sood, and Yadav disclose the system recited in claim 1. Koenning, Sood, and Yadav disclose wherein enterprise data center access is secured from and to 4G, 5G, and/or 6G UE devices (Sood, paragraph 0049, 5G/6G control plane functions, UE, mobile, paragraph 0065, interconnected, 4G, 5G, user; paragraph 0068, network, 4G, 5G).
Regarding claim 8, Koenning, Sood, and Yadav disclose the system recited in claim 1. Koenning, Sood, and Yadav disclose wherein selection and the enforcement of the security policy is based on the contextual information associated with the UE and the data plane traffic correlated with the UE based on a UE Internet Protocol (IP) address (Koenning, paragraph 0031, network traffic flowing through the data plane) (Yadav, paragraph 0053, IP addresses, packet traffic, UE, paragraph 0067, context drive UE, paragraph 0068, enforces policies, paragraph 0044, policy enforcement, security checks).
Regarding claim 12, Koenning, Sood, and Yadav disclose the system recited in claim 1. Koenning, Sood, and Yadav disclose wherein each of a plurality of security policies is distinctly selected and enforced for each mobile service provider (MSP) enterprise tenant at the SASE cloud network, wherein per tenant security policy configuration and enforcement are provided by the SASE cloud network (Koenning, paragraph 0022, service provider, subscriber devices)(Sood, paragraph 0037, preferences, deploy those policies)(Yadav, paragraph 0064, tenants, enterprise, policies, paragraph 0044, SASE, security enforcement, cloud security).
Regarding claim 13, Koenning, Sood, and Yadav disclose the system recited in claim 1. Koenning, Sood, and Yadav disclose wherein the data plane traffic is encapsulated with meta information, including a subscriber identity and/or a unique device identifier (Koenning, paragraph 0045, subscriber, identifying information of the subscriber, policies; paragraph 0040, metadata associated with the subscriber).
Regarding claim 14, Koenning, Sood, and Yadav disclose the system recited in claim 1. Koenning, Sood, and Yadav disclose wherein the processor is further configured to: determine the security policy to apply at the SASE cloud network to the data plane traffic based on a subscriber identity and/or a unique device identifier. (Koenning, paragraph 0045, subscriber, identifying information of the subscriber, policies)
Regarding claim 15, Koenning discloses a method, comprising:
receiving traffic associated with a User Equipment (UE) from a mobile core network at a cloud network via a service provider network attach using an interconnect between the mobile core network and the cloud network (Koenning, paragraph 0031, network traffic received; paragraph 0038, components can communicate with each other using the interconnect);
forwarding the data plane traffic from the cloud network to its original destination if allowed by the policy (Koenning, paragraph 0018, forward all network traffic, data plane traffic distribution; paragraph 0015, policies to determine whether and how traffic is forwarded through the network);
block or drop the data plane traffic from the cloud network if not allowed by the policy (Koenning, paragraph 0050, implement policy, blocking packets, forwarding packets);
a memory coupled to the processor and configured to provide the processor with instructions (Koenning, paragraph 0044, memory, processor, traffic, policy; paragraph 0065, traffic management apparatus, processor, memory, software).
Koenning discloses receiving traffic associated with a User Equipment (UE) from a mobile core network at a cloud network via a service provider network attach using an interconnect between the mobile core network and the cloud network; forwarding the at a plane traffic from the cloud network to its original destination if allowed by the policy; block or drop the data plane traffic from the cloud network if not allowed by the policy. but does not explicitly disclose receiving traffic associated with a User Equipment (UE) from a mobile core network at a Secure Access Service Edge (SASE) cloud network via a service provider network attach using an interconnect between the mobile core network and the SASE cloud network; enforcing a security policy on data plane traffic associated with the UE based on contextual information associated with the UE to provide secured data plane traffic using the security policy configured per user group and/or per user; forwarding the secured data plane traffic from the SASE cloud network to its original destination if allowed by the security policy; block or drop the data plane traffic from the SASE cloud network if not allowed by the security policy.
However, in an analogous art, Sood discloses receiving traffic associated with a User Equipment (UE) from a mobile core network at a Secure Access Service Edge (SASE) cloud network via a service provider network attach using an interconnect between the mobile core network and the SASE cloud network (Sood, paragraph 0034, security policy, communication; paragraph 0048, data plane, cloud service, communication; Secure Access Service Edge; paragraph 0049, UE, policy);
enforcing a security policy on data plane traffic associated with the UE based on contextual information associated with the UE to provide secured data plane traffic using the security policy configured per user group and/or per user (Sood, paragraph 0034, security policy, communication; paragraph 0048, data plane, cloud service, communication; Secure Access Service Edge; paragraph 0049, UE, policy);
forwarding the secured data plane traffic from the SASE cloud network to its original destination if allowed by the security policy (Sood, paragraph 0034, security policy, communication; paragraph 0048, data plane, cloud service, communication; Secure Access Service Edge; paragraph 0049, UE, policy);
block or drop the data plane traffic from the SASE cloud network if not allowed by the security policy (Sood, paragraph 0034, security policy, communication; paragraph 0048, data plane, cloud service, communication; Secure Access Service Edge; paragraph 0049, UE, policy)..
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of Sood with the system/ method/ computer program product/ system of Koenning to include enforcing a security policy on data plane traffic associated with the UE based on contextual information associated with the UE to provide secured data plane traffic using the security policy configured per user group and/or per user. One would have been motivated to provide users with the benefits of facilitating service to service communications. (Sood: paragraph 0002).
Koenning and Sood do not explicitly disclose identifying Remote Authentication Dial-In User Service (RADIUS) accounting messages, DIAMETER messages, and/or service provider (SP) Application Programming Interface (API) communication messages; and
extracting the contextual information from the RADIUS accounting messages, the DIAMETER messages, and/or the SP API communication messages, wherein the extracted contextual information includes a subscriber identity, and wherein the subscriber identity includes an International Mobile Subscriber Identity (IMSI);and
wherein the SASE cloud network includes a firewall as a service that is configured with a plurality of security policies based on the subscriber identity and an application identifier.
However, in an analogous art, Yadav discloses identifying Remote Authentication Dial-In User Service (RADIUS) accounting messages, DIAMETER messages, and/or service provider (SP) Application Programming Interface (API) communication messages (Yadav, paragraph 0101, RADIUS accounting messages, subscriber ID, IMSI);
extracting the contextual information from the RADIUS accounting messages, the DIAMETER messages, and/or the SP API communication messages, wherein the extracted contextual information includes a subscriber identity, and wherein the subscriber identity includes an International Mobile Subscriber Identity (IMSI ) ((Yadav, paragraph 0053, IP addresses, packet traffic, UE, paragraph 0063, IMSI, paragraph 0067, context);
wherein the SASE cloud network includes a firewall as a service that is configured with a plurality of security policies based on the subscriber identity and an application identifier (Yadav, paragraph 0044, firewall as a service, application endpoints, paragraph 0067, security, policies, secure access service edge (SASE), paragraph 0101, subscriber identifier).
Regarding claim 17, Koenning and Sood disclose the method recited in claim 15.
Koenning, Sood, and Yadav do not explicitly disclose wherein the firewall as a service that is configured with the plurality of security policies based on the subscriber identity, a unique device identifier, and the application identifier, wherein the unique device identifier includes an International Mobile Equipment Identifier (IMEI). (Sood, paragraph 0042, application identifier)(Yadav, paragraph 0044, Firewall-as-a-Service, paragraph 0054, International Mobile Subscriber Identity, International Mobile Equipment Identity, paragraph 0067, SASE policies may include context driven UE security, access policy, paragraph 0099, subscriber identity).
Regarding claim 18, Koenning discloses a computer program product, the computer program product being embodied in a tangible computer readable storage medium and comprising computer instructions for: (Koenning, paragraph 0044, memory, processor, traffic, policy; paragraph 0065, traffic management apparatus, processor, memory, software);
receiving traffic associated with a User Equipment (UE) from a mobile core network at a cloud network via a service provider network attach using an interconnect between the mobile core network and the cloud network (Koenning, paragraph 0031, network traffic received; paragraph 0038, components can communicate with each other using the interconnect);
forwarding the data plane traffic from the cloud network to its original destination if allowed by the policy (Koenning, paragraph 0018, forward all network traffic, data plane traffic distribution; paragraph 0015, policies to determine whether and how traffic is forwarded through the network);
block or drop the data plane traffic from the cloud network if not allowed by the policy (Koenning, paragraph 0050, implement policy, blocking packets, forwarding packets);
a memory coupled to the processor and configured to provide the processor with instructions (Koenning, paragraph 0044, memory, processor, traffic, policy; paragraph 0065, traffic management apparatus, processor, memory, software).
Koenning discloses receiving traffic associated with a User Equipment (UE) from a mobile core network at a cloud network via a service provider network attach using an interconnect between the mobile core network and the cloud network; forwarding the at a plane traffic from the cloud network to its original destination if allowed by the policy; block or drop the data plane traffic from the cloud network if not allowed by the policy. but does not explicitly disclose receiving traffic associated with a User Equipment (UE) from a mobile core network at a Secure Access Service Edge (SASE) cloud network via a service provider network attach using an interconnect between the mobile core network and the SASE cloud network; enforcing a security policy on data plane traffic associated with the UE based on contextual information associated with the UE to provide secured data plane traffic using the security policy configured per user group and/or per user; forwarding the secured data plane traffic from the SASE cloud network to its original destination if allowed by the security policy; block or drop the data plane traffic from the SASE cloud network if not allowed by the security policy.
However, in an analogous art, Sood discloses receiving traffic associated with a User Equipment (UE) from a mobile core network at a Secure Access Service Edge (SASE) cloud network via a service provider network attach using an interconnect between the mobile core network and the SASE cloud network (Sood, paragraph 0034, security policy, communication; paragraph 0048, data plane, cloud service, communication; Secure Access Service Edge; paragraph 0049, UE, policy);
enforcing a security policy on data plane traffic associated with the UE based on contextual information associated with the UE to provide secured data plane traffic using the security policy configured per user group and/or per user (Sood, paragraph 0034, security policy, communication; paragraph 0048, data plane, cloud service, communication; Secure Access Service Edge; paragraph 0049, UE, policy);
forwarding the secured data plane traffic from the SASE cloud network to its original destination if allowed by the security policy (Sood, paragraph 0034, security policy, communication; paragraph 0048, data plane, cloud service, communication; Secure Access Service Edge; paragraph 0049, UE, policy);
block or drop the data plane traffic from the SASE cloud network if not allowed by the security policy (Sood, paragraph 0034, security policy, communication; paragraph 0048, data plane, cloud service, communication; Secure Access Service Edge; paragraph 0049, UE, policy)..
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of Sood with the system/ method/ computer program product/ system of Koenning to include enforcing a security policy on data plane traffic associated with the UE based on contextual information associated with the UE to provide secured data plane traffic using the security policy configured per user group and/or per user. One would have been motivated to provide users with the benefits of facilitating service to service communications. (Sood: paragraph 0002).
Koenning and Sood do not explicitly disclose identifying Remote Authentication Dial-In User Service (RADIUS) accounting messages, DIAMETER messages, and/or service provider (SP) Application Programming Interface (API) communication messages;
extracting the contextual information from the RADIUS accounting messages, the DIAMETER messages, and/or the SP API communication messages, wherein the extracted contextual information includes a subscriber identity, and wherein the subscriber identity includes an International Mobile Subscriber Identity (IMSI);
wherein the SASE cloud network includes a firewall as a service that is configured with a plurality of security policies based on the subscriber identity and an application identifier .
However, in an analogous art, Yadav discloses identifying Remote Authentication Dial-In User Service (RADIUS) accounting messages, DIAMETER messages, and/or service provider (SP) Application Programming Interface (API) communication messages (Yadav, paragraph 0101, RADIUS accounting messages, subscriber ID, IMSI);
extracting the contextual information from the RADIUS accounting messages, the DIAMETER messages, and/or the SP API communication messages, wherein the extracted contextual information includes a subscriber identity, and wherein the subscriber identity includes an International Mobile Subscriber Identity (IMSI) ((Yadav, paragraph 0053, IP addresses, packet traffic, UE, paragraph 0063, IMSI, paragraph 0067, context);
wherein the SASE cloud network includes a firewall as a service that is configured with a plurality of security policies based on the subscriber identity and an application identifier (Yadav, paragraph 0044, firewall as a service, application endpoints, paragraph 0067, security, policies, secure access service edge (SASE), paragraph 0101, subscriber identifier).
Regarding claim 20, Koenning and Sood disclose the computer program product recited in claim 18. Koenning, Sood, and Yadav do not explicitly disclose wherein the firewall as a service that is configured with the plurality of security policies based on the subscriber identity, a unique device identifier, and the application identifier, wherein the unique device identifier includes an International Mobile Equipment Identifier (IMEI). (Sood, paragraph 0042, application identifier)(Yadav, paragraph 0044, Firewall-as-a-Service, paragraph 0054, International Mobile Subscriber Identity, International Mobile Equipment Identity, paragraph 0067, SASE policies may include context driven UE security, access policy, paragraph 0099, subscriber identity).
Regarding claim 21, Koenning discloses a system, comprising:
a processor configured to: (Koenning, paragraph 0044, memory, processor, traffic, policy; paragraph 0065, traffic management apparatus, processor, memory, software);
receive mobile network service provider configuration settings for a plurality of mobile network attributes for a mobile core network in a portal for a cloud network (Koenning, paragraph 0031, network traffic received);
activate an interconnect between the mobile core network and the cloud network (Koenning, paragraph 0058, interconnect various computing systems);
route data plane traffic from the mobile core network and a RADIUS message to a load balancing endpoint for the cloud network (Koenning, paragraph 0018, RADIUS server, data plane traffic distribution; paragraph 0023, cloud-based computing environment; paragraph 0026, load balancing; paragraph 0063, load balancing network traffic);
process a RADIUS start message and populate synchronization data with a mobile user identity and IP mapping for the cloud network (Koenning, paragraph 0018, RADIUS server, data plane traffic distribution);
process the data plane traffic using a processing node (SPN) in the cloud network and applying the configured security policy for the tenant (Koenning, paragraph 0018, data plane traffic distribution);
perform an action on the data plane traffic based on a verdict after applying the configured policy for the tenant (Koenning, paragraph 0018, data plane traffic, processing nodes);
forward the secured data plane traffic from the SASE cloud network to its original destination if allowed by the security policy (Koenning, paragraph 0018, forward all network traffic, data plane traffic distribution; paragraph 0015, policies to determine whether and how traffic is forwarded through the network);
block or drop the data plane traffic from the SASE cloud network if not allowed by the security policy (Koenning, paragraph 0050, implement policy, blocking packets, forwarding packets);
a memory coupled to the processor and configured to provide the processor with instructions (Koenning, paragraph 0044, memory, processor, traffic, policy; paragraph 0065, traffic management apparatus, processor, memory, software).
Koenning discloses receive mobile network service provider configuration settings for a plurality of mobile network attributes for a mobile core network in a portal for a cloud network; activate an interconnect between the mobile core network and the cloud network; route data plane traffic from the mobile core network and a RADIUS message to a load balancing endpoint for the cloud network; process a RADIUS start message and populate synchronization data with a mobile user identity and IP mapping for the cloud network; process the data plane traffic using a processing node (SPN) in the cloud network and applying the configured security policy for the tenant, does not explicitly disclose receive mobile network service provider configuration settings for a plurality of mobile network attributes for a mobile core network in a portal for a Secure Access Service Edge (SASE) cloud network; receive a security policy configured per user group and/or per user for a tenant for the SASE cloud network; activate an interconnect between the mobile core network and the SASE cloud network; route data plane traffic from the mobile core network and a Remote Authentication Dial-In User Service (RADIUS) message to a load balancing endpoint for the SASE cloud network; process a RADIUS start message and populate synchronization data with a mobile user identity and IP mapping for the SASE cloud network; process the data plane traffic using a security processing node (SPN) in the SASE cloud network and applying the configured security policy for the tenant..
However, in an analogous art, Sood discloses receive mobile network service provider configuration settings for a plurality of mobile network attributes for a mobile core network in a portal for a Secure Access Service Edge (SASE) cloud network (Sood, paragraph 0034, security policy, communication; paragraph 0048, data plane, cloud service, communication; Secure Access Service Edge; paragraph 0049, UE, policy);
receive a security policy configured per user group and/or per user for a tenant for the SASE cloud network (Sood, paragraph 0034, security policy, communication; paragraph 0048, data plane, cloud service, communication; Secure Access Service Edge; paragraph 0049, UE, policy);
activate an interconnect between the mobile core network and the SASE cloud network (Sood, paragraph 0034, security policy, communication; paragraph 0048, data plane, cloud service, communication; Secure Access Service Edge; paragraph 0049, UE, policy);
route data plane traffic from the mobile core network and a Remote Authentication Dial-In User Service (RADIUS) message to a load balancing endpoint for the SASE cloud network (Sood, paragraph 0034, security policy, communication; paragraph 0048, data plane, cloud service, communication; Secure Access Service Edge; paragraph 0049, UE, policy);
process a RADIUS start message and populate synchronization data with a mobile user identity and IP mapping for the SASE cloud network (Sood, paragraph 0034, security policy, communication; paragraph 0048, data plane, cloud service, communication; Secure Access Service Edge; paragraph 0049, UE, policy);
process the data plane traffic using a security processing node (SPN) in the SASE cloud network and applying the configured security policy for the tenant (Sood, paragraph 0034, security policy, communication; paragraph 0048, data plane, cloud service, communication; Secure Access Service Edge; paragraph 0049, UE, policy);
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of Sood with the system/ method/ computer program product/ system of Koenning to include receive a security policy configured per user group and/or per user for a tenant for the SASE cloud network. One would have been motivated to provide users with the benefits of facilitating service to service communications. (Sood: paragraph 0002).
Koenning and Sood disclose forwarding the data plane traffic from the cloud network to its original destination if allowed by the policy; block or drop the data plane traffic from the cloud network if not allowed by the policy, but do not explicitly disclose extract contextual information from the RADIUS start message, wherein the extracted contextual information includes a subscriber identity, and wherein the subscriber identity includes an International Mobile Subscriber Identity (IMSI): and
forward the secured data plane traffic from the SASE cloud network to its original destination if allowed by the security policy, and block or drop the data plane traffic from the SASE cloud network if not allowed by the security policy, wherein the SASE cloud network includes a firewall as a service that is configured with a plurality of security policies based on the subscriber identity and an application identifier.
However, in an analogous art, Yadav discloses extract contextual information from the RADIUS start message, wherein the extracted contextual information includes a subscriber identity, and wherein the subscriber identity includes an International Mobile Subscriber Identity (IMSI) ((Yadav, paragraph 0053, IP addresses, packet traffic, UE, paragraph 0063, IMSI, paragraph 0067, context): and
forward the secured data plane traffic from the SASE cloud network to its original destination if allowed by the security policy, and block or drop the data plane traffic from the SASE cloud network if not allowed by the security policy, wherein the SASE cloud network includes a firewall as a service that is configured with a plurality of security policies based on the subscriber identity and an application identifier (Yadav, paragraph 0044, firewall as a service, application endpoints, paragraph 0067, security, policies, secure access service edge (SASE), paragraph 0101, subscriber identifier).
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of Sood with the system/ method/ computer program product/ system of Koenning to include RADIUS messages and firewall as a service. One would have been motivated to provide users with the benefits of providing secure network connectivity (Yadav: paragraph 0017).
Claims 9-11 are rejected under 35 U.S.C. 103 as being unpatentable over Koenning (US20210258248), filed February 19, 2020, in view of Sood.(US20220329573), filed June 21, 2022, and Yadav (US20230100395), filed September 27, 2021, and further in view of Jungck (US20100103837), filed November 12, 2009
Regarding claim 9, Koenning, Sood, and Yadav disclose the system recited in claim 1.
Koenning, Sood, and Yadav do not explicitly disclose wherein a firewall as a service (FWaaS) associated with the SASE is configured to perform Uniform Resource Link (URL) filtering for the data plane traffic.
However, in an analogous art, Jungck discloses wherein a firewall as a service (FWaaS) associated with the SASE is configured to perform Uniform Resource Link (URL) filtering for the data plane traffic (Jungck, paragraph 0184, firewall service, denial of service, intrusion detection, intrusion prevention, URL filtering service).
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of Jungck with the system/ method/ computer program product/ system of Koenning, Sood, and Yadav to include wherein a firewall as a service (FWaaS) associated with the SASE is configured to perform Uniform Resource Link (URL) filtering for the data plane traffic. One would have been motivated to provide users with the benefits of more efficiently delivering content and services from providers to users and providing additional network throughput, reliability, security and fault tolerance (Jungck: paragraph 0007).
Regarding claim 10, Koenning, Sood, and Yadav disclose the system recited in claim 1.
Koenning, Sood, and Yadav do not explicitly disclose wherein a firewall as a service (FWaaS) associated with the SASE is configured to perform application Denial of Service (DoS) detection for the data plane traffic.
However, in an analogous art, Jungck discloses wherein a firewall as a service (FWaaS) associated with the SASE is configured to perform application Denial of Service (DoS) detection for the data plane traffic (Jungck, paragraph 0184, firewall service, denial of service, intrusion detection, intrusion prevention, URL filtering service).
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of Jungck with the system/ method/ computer program product/ system of Koenning, Sood, and Yadav to include wherein a firewall as a service (FWaaS) associated with the SASE is configured to perform application Denial of Service (DoS) detection for the data plane traffic. One would have been motivated to provide users with the benefits of more efficiently delivering content and services from providers to users and providing additional network throughput, reliability, security and fault tolerance (Jungck: paragraph 0007).
Regarding claim 11, Koenning, Sood, and Yadav disclose the system recited in claim 1.
Koenning, Sood, and Yadav do not explicitly disclose wherein a firewall as a service (FWaaS) associated with the SASE is configured to perform application Denial of Service (DoS) prevention for the data plane traffic.
However, in an analogous art, Jungck discloses wherein a firewall as a service (FWaaS) associated with the SASE is configured to perform application Denial of Service (DoS) prevention for the data plane traffic (Jungck, paragraph 0184, firewall service, denial of service, intrusion detection, intrusion prevention, URL filtering service).
Therefore, it would have been obvious to a person of ordinary skill in the art, before the effective filing date of the claimed invention to combine the teachings of Jungck with the system/ method/ computer program product/ system of Koenning, Sood, and Yadav to include wherein a firewall as a service (FWaaS) associated with the SASE is configured to perform application Denial of Service (DoS) prevention for the data plane traffic. One would have been motivated to provide users with the benefits of more efficiently delivering content and services from providers to users and providing additional network throughput, reliability, security and fault tolerance (Jungck: paragraph 0007).
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to WALTER J MALINOWSKI whose telephone number is (571)272-5368. The examiner can normally be reached 8-6:30 MTWH.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, LUU PHAM can be reached at 5712705002. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/W.J.M/Examiner, Art Unit 2439
/LUU T PHAM/Supervisory Patent Examiner, Art Unit 2439
