Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This is in response to the original filing of 03/06/2025. Claims 1-20 are pending and have been considered below.
Priority
Acknowledgment is made of no claims of foreign priority.
Drawings
The drawings filed on 03/06/2025 are accepted.
Specification
The specification filed on 03/06/2025 is accepted.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claims 11 and 11 are rejected under 35 U.S.C. 102(a)1 as being anticipated by Kompella et al U.S. 2018/0367413 A1.
Claims 1 and 11: Kompella et al teaches a computer network, a method comprising:
a plurality of hierarchically interconnected nodes that include virtual machines, physical bare metal hosts and container namespaces (Kompella et al teaches cisco ACI which supports VMs, Bare metal and containers under a unified fabric at [0035], [0046],[0048], [0050]-[0052], [0117], Fig.1A-B, the Network Environment 100 can include a Fabric 120 which can represent the physical layer or infrastructure (e.g., underlay) of the Network Environment 100. Fabric 120 can include Spines 102 and Leafs 104 which can be interconnected for routing or switching traffic in the Fabric 120.), wherein the plurality of hierarchically interconnected nodes implement applications across a virtual network domain, a physical network domain and a container network domain (Kompella et al teaches ACI similarly spans virtual, physical, and container domains at [0031], the network assurance approaches herein can be implemented in various types of networks, including a private network, such as a local area network (LAN); an enterprise network; a standalone or traditional network, such as a data center network; a network including a physical or underlay layer and a logical or overlay layer, such as a virtual extensible LAN (VXLAN) or software-defined network (SDN) (e.g., Application Centric Infrastructure (ACI) or VMware NSX networks [0062] A bridge domain can be a set of logical ports that share the same flooding or broadcast characteristics. Like a virtual LAN (VLAN), bridge domains can span multiple devices.);; and
a single controller configured to provide unified policy application to the plurality of hierarchically interconnected nodes across the virtual network domain, the physical network domain and the container network domain ( Kompella et al teaches ACI APIC provides a single policy controller for all node types at [0038] teaches Network policies and rules can be driven by one or more Controllers 116, and/or implemented or enforced by one or more devices, such as Leafs 104. Leafs 104 can connect other elements to the Fabric 120. For example, Leafs 104 can connect Servers 106, Hypervisors 108, Virtual Machines (VMs) 110, Applications 112, Network Device 114, etc., with Fabric 120. Such elements can reside in one or more logical or virtual layers or networks, such as an overlay network. [0043] ACI can provide an application-centric or policy-based solution through scalable distributed enforcement. [0047] Controllers 116 can provide centralized access to fabric information, application configuration, resource configuration, application-level configuration modeling for a software-defined network (SDN) infrastructure, integration with management systems or servers, etc. Controllers 116 can form a control plane that interfaces with an application plane via northbound APIs and a data plane via southbound APIs.)).
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 2-10 and 12-20 are rejected under 35 U.S.C. 103 as being unpatentable over Kompella et al U.S. 2018/0367413 A1 in view of Baabdallah U.S. 2015/0288662 A1.
Claims 2 and 12: Kompella et al teaches
wherein the plurality of hierarchically interconnected nodes support network traffic across the virtual network domain, the physical network domain and the container network domain ([0002], [0017], The servers of the data center 100 are interconnected with a network that includes leaf switches 160 and 165, spine switches 170 and 175, and leaf switches 180 and 185. The leaf switches aggregate traffic from server nodes and connect to the core of the network. In FIG. 1, leaf switches 160 and 165 aggregate traffic from bare-metal servers 120 and 125, while leaf switches 180 and 185 aggregate traffic from virtual servers 140 and 145. Spine switches 170 and 175 aggregate traffic from all the leaf switches. The network is split into two or more subnetworks, such as by network address. The subnetwork can be as small as one IP address, such as to protect a single workload).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the disclosure of Bella Kompella et al with the additional features of Baabdallah in order to provide the ability to centralize the management of network security policies for both physical and virtual firewalls, as suggested by Baabdallah abstract.
Claims 3 and 13: the combination teaches
wherein the hierarchically interconnected nodes in the virtual network domain include hypervisor hosts each running a plurality of virtual machines (VMs)( Kompella et al teaches NSX rely on hypervisors running multiple VMs.at {0031], [0038] VMs 110 can be virtual machines hosted by Hypervisors 108 or virtual machine managers running on Servers 106. VMs 110 can include workloads running on a guest operating system on a respective server. Hypervisors 108 can provide a layer of software, firmware, and/or hardware that creates, manages, and/or runs the VMs 110. Hypervisors 108 can allow VMs 110 to share hardware resources on Servers 106, and the hardware resources on Servers 106 to appear as multiple, separate hardware platforms. Moreover, Hypervisors 108 on Servers 106 can host one or more VMs 110.).
Claims 4 and 14: the combination teaches
wherein each of the hypervisor hosts include a hypervisor bridge element configured to forward portions of the network traffic to the plurality of VMs (Kompella et al teaches at [0089], [0040] VMs 110 can be virtual machines hosted by Hypervisors 108 or virtual machine managers running on Servers 106. VMs 110 can include workloads running on a guest operating system on a respective server. ).
Claims 5 and 15: the combination teaches
wherein the hypervisor bridge element applies an access control list (ACL) or firewall rules (Kompella et al teaches at [0065], [0068], [0076], A filter can thus function similar to an ACL or Firewall rule. In some examples, a filter can be implemented in a packet (e.g., TCP/IP) header field, such as L3 protocol type, L4 (Layer 4) ports, and so on, which is used to allow inbound or outbound communications between endpoints or EPGs, for example).
Claims 6 and 16: The computer network of claim 4,
wherein the hypervisor bridge element utilizes hardware accelerated filtering (Kompella et al teaches [0065] As used herein, the term “Filter” can refer to a parameter or configuration for permitting communications. For example, in a whitelist model where all communications are blocked by default, a communication must be given explicit permission to prevent such communication from being blocked. A filter can define permission(s) for one or more communications or packets. A filter can thus function similar to an ACL or Firewall rule. In some examples, a filter can be implemented in a packet (e.g., TCP/IP) header field, such as L3 protocol type, L4 (Layer 4) ports, and so on, which is used to permit inbound or outbound communications between endpoints or EPGs, for example. Also see [0182]-[0186).
Claims 7 and 17: the combination teaches
wherein the hierarchically interconnected nodes in the virtual network domain include bare metal hosts (Kompella et al teaches [0050], [0046], Non-limiting examples of “hosts” can include virtual switches or routers, such as distributed virtual switches (DVS), application virtual switches (AVS), vector packet processing (VPP) switches; VCENTER and NSX MANAGERS; bare metal physical hosts; HYPER-V hosts; VMs; DOCKER Containers; ).
Claims 8 and 18: the combination teaches
wherein the network traffic can be sent to the bare metal hosts via an access mode without utilizing a virtual local area network tag ([0046] Returning now to FIG. 1A, Network Environment 100 can deploy different hosts via Leafs 104, Servers 106, Hypervisors 108, VMs 110, Applications 112, and Controllers 116, such as VMWARE ESXi hosts, WINDOWS HYPER-V hosts, bare metal physical hosts, etc. Network Environment 100 may interoperate with a variety of Hypervisors 108, Servers 106 (e.g., physical and/or virtual servers), SDN orchestration platforms, etc. Network Environment 100 may implement a declarative model to allow its integration with application design and holistic network policy.).
Claims 9 and 19: the combination teaches
wherein the hierarchically interconnected nodes in the virtual network domain include container hosts (Kompella et al teaches [0050] Further, as referenced herein, the term “hosts” can refer to Servers 106 (e.g., physical or logical), Hypervisors 108, VMs 110, containers (e.g., Applications 112), etc., and can run or include any type of server or application solution. )
Claims 10 and 20: the combination teaches
wherein each of the container hosts includes a container bridge element configured to forward, based on an access control list, portions of the network traffic to a network namespace (Kompella et al teaches [0046] Returning now to FIG. 1A, Network Environment 100 can deploy different hosts via Leafs 104, Servers 106, Hypervisors 108, VMs 110, Applications 112, and Controllers 116, such as VMWARE ESXi hosts, WINDOWS HYPER-V hosts, bare metal physical hosts, etc. Network Environment 100 may interoperate with a variety of Hypervisors 108, Servers 106 (e.g., physical and/or virtual servers), SDN orchestration platforms, etc. Network Environment 100 may implement a declarative model to allow its integration with application design and holistic network policy.).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Dixit et al U.S. 2021/0144069 A1 teaches shim layer for extracting and prioritizing underlying rules for modeling network intents.
.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to FATOUMATA TRAORE whose telephone number is (571)270-1685. The examiner can normally be reached 6:30-3:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, SHEWAYE GELAGAY can be reached at 5712724219. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
Friday, June 12, 2026
/FATOUMATA TRAORE/Primary Examiner, Art Unit 2436
Prosecution Insights