DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Examiner Notes
All claims have been reviewed for compliance with 35 U.S.C. §101 (as set forth in MPEP 2106).
Response to Amendment
Applicant’s amendment filed 04 June 2025 amends claims 1-16. Claim 17 has been added. Applicant’s amendment has been fully considered and entered.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claim 7 is rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 7 recites the limitation "the information descriptive of the at least one trusted server" in lines 2-3. There is insufficient antecedent basis for this limitation in the claim.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-3, 5, 6, 8-13, 15, 16 are rejected under 35 U.S.C. 103 as being unpatentable over Tzakikario, U.S. Patent No. 7,620,733, in view of Mendiola, WO 2003/019445.
Referring to claim 1, Tzakikario discloses an anti-spoofing system wherein a client sending a DNS request to a DNS server 22 that is intercepted by a guard device 30 (Col. 3, lines 38-46: client reads on the claimed piece of equipment), which meets the limitation of transmitting, to at least one of the trusted servers, at least one request to activate a domain name resolution verification service. The guard device sends a DNS response to the source address that was included as part of the DNS request such that the DNS response includes a canonical domain name (Col. 3, lines 58-66) generated by the guard device (Col. 5, lines 32-34), which meets the limitation of receiving at least one response comprising at least one domain name generated by the trusted server for the at least one interface. The client sends a second DNS request to the DNS server that requests the IP address of the canonical domain name received in the DNS response (Col. 4. Lines 9-13), which meets the limitation of transmitting at least one request to resolve the at least one domain name. If the guard device does not receive a second DNS request from the client corresponding with the source address or if the second DNS request does not include the correct domain name information, the client is considered to have been spoofed (Col. 6, lines 1-9, 32-35), which meets the limitation of if no request to resolve the at least one domain name is received by the trusted server, or if at least one request to resolve the at least one domain name is received by the trusted server but comprises an anomaly, [receiving at least one notification requiring the piece of equipment to take an action].
Tzakikario does not disclose that the client subsequently receives a notification responsive to the spoof determination. Mendiola discloses a client receiving a notification message in response to the client failing to provide a response within a period of time or if the client response includes incorrect information (Page 25, line 25 – Page 26, line 2), which meets the limitation of receiving at least one notification requiring the piece of equipment to take an action. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention for the guard device to have sent a message to the client in response to the guard device not receiving a second DNS request from the client corresponding with the source address or if the second DNS request does not include the correct domain name information, in order to provide notification that the requested transaction was abandoned as suggested by Mendiola (Page 25, lines 25-29).
Referring to claim 2, Tzakikario discloses that the guard device sends a DNS response to the source address that was included as part of the DNS request such that the DNS response includes a canonical domain name (Col. 3, lines 58-66) generated by the guard device (Col. 5, lines 32-34), which meets the limitation of wherein the at least one response also comprises verification data generated by the trusted server for the at least one activation request. The client sends a second DNS request to the DNS server that requests the IP address of the canonical domain name received in the DNS response (Col. 4. Lines 9-13) such that the second DNS request includes an encoded version of the canonical domain name in the form of a cookie (Col. 5, lines 34-44), which meets the limitation of in that the at least one request to resolve the at least one domain name comprises a proof of integrity obtained from the verification data.
Referring to claim 3, Tzakikario discloses that the client sends a second DNS request to the DNS server that requests the IP address of the canonical domain name received in the DNS response such that the canonical domain name is only intended to be used in the current session (Col. 4. Lines 9-26: receiving the canonical domain name in the second DNS request represents an indication that another canonical domain name will need to be generated for the next DNS request), which meets the limitation of wherein the at least one request to resolve the at least one domain name comprises an indicator requiring generation, by the trusted server, of new verification data.
Referring to claim 5, Tzakikario discloses that the guard device sends a DNS response to the source address that was included as part of the DNS request such that the DNS response includes a canonical domain name (Col. 3, lines 58-66) generated by the guard device (Col. 5, lines 32-34) such that the client sends a second DNS request to the DNS server that requests the IP address of the canonical domain name received in the DNS response (Col. 4. Lines 9-13), which meets the limitation of wherein the at least one response also comprises a piece of recurrence information and in that the at least one request to resolve the at least one domain name is transmitted taking into account the piece of recurrence information.
Referring to claim 6, Tzakikario discloses that the DNS request includes the source address of the client (Col. 3, lines 58-66), which meets the limitation of wherein the at least one activation request comprises at least one contact address of the piece of equipment.
Referring to claim 8, Tzakikario does not disclose that the client subsequently receives a notification responsive to the spoof determination. Mendiola discloses a client receiving a notification message in response to the client failing to provide a response within a period of time or if the client response includes incorrect information (Page 25, line 25 – Page 26, line 2), which meets the limitation of wherein the piece of equipment executes at least one given action upon receipt of a notification requiring it to execute the at least one action, generating a local notification to inform a user of a modification of the domain name resolution configuration. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention for the guard device to have sent a message to the client in response to the guard device not receiving a second DNS request from the client corresponding with the source address or if the second DNS request does not include the correct domain name information, in order to provide notification that the requested transaction was abandoned as suggested by Mendiola (Page 25, lines 25-29).
Referring to claim 9, Tzakikario discloses an anti-spoofing system wherein a client sending a DNS request to a DNS server 22 that is intercepted by a guard device 30 (Col. 3, lines 38-46: guard device 30 reads on the claimed trusted domain name server; client reads on the claimed piece of equipment), which meets the limitation of receiving at least one request to activate a domain name resolution verification service from the piece of equipment. The guard device sends a DNS response to the source address that was included as part of the DNS request such that the DNS response includes a canonical domain name (Col. 3, lines 58-66) generated by the guard device (Col. 5, lines 32-34), which meets the limitation of transmitting at least one response comprising at least one domain name generated by the trusted server for the at least one interface. The client sends a second DNS request to the DNS server that requests the IP address of the canonical domain name received in the DNS response (Col. 4. Lines 9-13). If the guard device does not receive a second DNS request from the client corresponding with the source address or if the second DNS request does not include the correct domain name information, the client is considered to have been spoofed (Col. 6, lines 1-9, 32-35), which meets the limitation of if no request to resolve the at least one domain name is received by the trusted server, or if at least one request to resolve the at least one domain name is received by the trusted server but comprises an anomaly, [transmitting to the piece of equipment at least one notification requiring it to execute an action].
Tzakikario does not disclose that the client subsequently receives a notification responsive to the spoof determination. Mendiola discloses a client receiving a notification message in response to the client failing to provide a response within a period of time or if the client response includes incorrect information (Page 25, line 25 – Page 26, line 2), which meets the limitation of transmitting to the piece of equipment at least one notification requiring it to execute an action. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention for the guard device to have sent a message to the client in response to the guard device not receiving a second DNS request from the client corresponding with the source address or if the second DNS request does not include the correct domain name information, in order to provide notification that the requested transaction was abandoned as suggested by Mendiola (Page 25, lines 25-29).
Referring to claim 10, Tzakikario discloses that the guard device compares the source IP address from second DNS requests to the source IP address from the initial DNS request to detect spoofing (Col. 5, lines 44-46 & Col. 6, lines 15-31), which meets the limitation of wherein an anomaly is detected if the at least one request to resolve the at least one domain name and the at least one activation request do not come from the same piece of equipment.
Referring to claim 11, Tzakikario discloses that the guard device sends a DNS response to the source address that was included as part of the DNS request such that the DNS response includes a canonical domain name (Col. 3, lines 58-66) generated by the guard device (Col. 5, lines 32-34), which meets the limitation of wherein the at least one response also comprises verification data generated by the trusted server for the at least one activation request. The client sends a second DNS request to the DNS server that requests the IP address of the canonical domain name received in the DNS response (Col. 4. Lines 9-13) such that the second DNS request includes an encoded version of the canonical domain name in the form of a cookie (Col. 5, lines 34-44), which meets the limitation of in that the at least one request to resolve the at least one domain name comprises a proof of integrity obtained from the verification data. The guard device queries a local database 35 to retrieve information for comparison against the cookie information received in the second DNS request (Col. 6, lines 15-42 & Figure 1), which meets the limitation of and in that an anomaly is detected if the proof of integrity carried by the at least one request to resolve the at least one domain name is not consistent with a proof of integrity obtained locally from the verification data known to the trusted server.
Referring to claim 12, Tzakikario discloses that if the guard device does not receive a second DNS request from the client corresponding with the source address or if the second DNS request does not include the correct domain name information, the client is considered to have been spoofed (Col. 6, lines 1-9, 32-35), which meets the limitation of and in that an anomaly is detected if no request to resolve the at least one domain name is received by the trusted server. Tzakikario discloses that the guard device sends a DNS response to the source address that was included as part of the DNS request such that the DNS response includes a canonical domain name (Col. 3, lines 58-66) generated by the guard device (Col. 5, lines 32-34) such that the client sends a second DNS request to the DNS server that requests the IP address of the canonical domain name received in the DNS response (Col. 4. Lines 9-13) and the guard device compares the cookie information received in the second DNS request to information stored in a local database (Col. 6, lines 15-42 & Figure 1), which meets the limitation of wherein the at least one response also comprises a piece of recurrence information of the at least one request to resolve the at least one domain name and if the at least one request to resolve the at least one domain name is not consistent with the piece of recurrence information.
Referring to claim 13, Tzakikario does not disclose that the client subsequently receives a notification responsive to the spoof determination. Mendiola discloses a client receiving a notification message in response to the client failing to provide a response within a period of time or if the client response includes incorrect information (Page 25, line 25 – Page 26, line 2), which meets the limitation of wherein the at least one action notification is transmitting to at least one contact address of the piece of equipment carried by the activation request or to the address used by the piece of equipment to transmit the activation request. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention for the guard device to have sent a message to the client in response to the guard device not receiving a second DNS request from the client corresponding with the source address or if the second DNS request does not include the correct domain name information, in order to provide notification that the requested transaction was abandoned as suggested by Mendiola (Page 25, lines 25-29).
Referring to claim 15, Tzakikario discloses an anti-spoofing system wherein a client sending a DNS request to a DNS server 22 that is intercepted by a guard device 30 (Col. 3, lines 38-46: client reads on the claimed piece of equipment), which meets the limitation of a piece of equipment configured with at least one trusted domain name server associated with at least one network interface via which the piece of equipment is capable of communicating, wherein the piece of equipment is configured to transmit, to at least one of the trusted servers, at least one request to activate a domain name resolution verification service. The guard device sends a DNS response to the source address that was included as part of the DNS request such that the DNS response includes a canonical domain name (Col. 3, lines 58-66) generated by the guard device (Col. 5, lines 32-34), which meets the limitation of receive at least one response comprising at least one domain name generated by the trusted server for the at least one interface. The client sends a second DNS request to the DNS server that requests the IP address of the canonical domain name received in the DNS response (Col. 4. Lines 9-13), which meets the limitation of transmit at least one request to resolve the at least one domain name. If the guard device does not receive a second DNS request from the client corresponding with the source address or if the second DNS request does not include the correct domain name information, the client is considered to have been spoofed (Col. 6, lines 1-9, 32-35), which meets the limitation of if no request to resolve the at least one domain name is received by the trusted server, or if at least one request to resolve the at least one domain name is received by the trusted server but comprises an anomaly, [receive at least one notification requiring the piece of equipment to take an action].
Tzakikario does not disclose that the client subsequently receives a notification responsive to the spoof determination. Mendiola discloses a client receiving a notification message in response to the client failing to provide a response within a period of time or if the client response includes incorrect information (Page 25, line 25 – Page 26, line 2), which meets the limitation of receive at least one notification requiring the piece of equipment to take an action. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention for the guard device to have sent a message to the client in response to the guard device not receiving a second DNS request from the client corresponding with the source address or if the second DNS request does not include the correct domain name information, in order to provide notification that the requested transaction was abandoned as suggested by Mendiola (Page 25, lines 25-29).
Referring to claim 16, Tzakikario discloses an anti-spoofing system wherein a client sending a DNS request to a DNS server 22 that is intercepted by a guard device 30 (Col. 3, lines 38-46: guard device 30 reads on the claimed trusted domain name server; client reads on the claimed piece of equipment), which meets the limitation of a trusted domain name server configured in a piece of equipment and associated with at least one network interface via which the piece of equipment is capable of communicating, wherein the trusted domain name server is configured to receive at least one request to activate a domain name resolution verification service from the piece of equipment. The guard device sends a DNS response to the source address that was included as part of the DNS request such that the DNS response includes a canonical domain name (Col. 3, lines 58-66) generated by the guard device (Col. 5, lines 32-34), which meets the limitation of transmit at least one response comprising at least one domain name generated by the trusted server for the at least one interface. The client sends a second DNS request to the DNS server that requests the IP address of the canonical domain name received in the DNS response (Col. 4. Lines 9-13). If the guard device does not receive a second DNS request from the client corresponding with the source address or if the second DNS request does not include the correct domain name information, the client is considered to have been spoofed (Col. 6, lines 1-9, 32-35), which meets the limitation of if no request to resolve the at least one domain name is received by the trusted server, or if at least one request to resolve the at least one domain name is received by the trusted server but comprises an anomaly, [transmit to the piece of equipment at least one notification requiring it to execute an action].
Tzakikario does not disclose that the client subsequently receives a notification responsive to the spoof determination. Mendiola discloses a client receiving a notification message in response to the client failing to provide a response within a period of time or if the client response includes incorrect information (Page 25, line 25 – Page 26, line 2), which meets the limitation of transmit to the piece of equipment at least one notification requiring it to execute an action. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention for the guard device to have sent a message to the client in response to the guard device not receiving a second DNS request from the client corresponding with the source address or if the second DNS request does not include the correct domain name information, in order to provide notification that the requested transaction was abandoned as suggested by Mendiola (Page 25, lines 25-29).
Claim 4 is rejected under 35 U.S.C. 103 as being unpatentable over Tzakikario, U.S. Patent No. 7,620,733, in view of Mendiola, WO 2003/019445, and further in view of Weiss, U.S. Publication No. 2021/0120069. Referring to claim 4, Tzakikario does not specify that the DNS requests are encrypted. Weiss the encryption of DNS requests ([0041]), which meets the limitation of wherein the at request to resolve the at least one domain name are encrypted. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention for the DNS requests of Tzakikario to have been encrypted in order to protect the devices from third-party tracking as suggested by Weiss ([0041]).
Claim 7 is rejected under 35 U.S.C. 103 as being unpatentable over Tzakikario, U.S. Patent No. 7,620,733, in view of Mendiola, WO 2003/019445, and further in view of Rissmeyer, U.S. Patent No. 7,363,356. Referring to claim 7,
Tzakikario that the client sends DNS requests to a DNS server using the address of the DNS server (Col. 3, lines 42-44). Tzakikario does not specify that the address of the DNS server is stored at the client in a protected manner.
Rissmeyer discloses that storage of DNS addresses in secure storage (Col. 6, lines 5-28), which meets the limitation of wherein the information descriptive of the at least one trusted server is stored in a registry maintained by the piece of equipment and whose access is protected.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention for the DNS server addresses to have been stored in protected storage in the client devices in order to ensure that the stored addresses are valid as suggested by Rissmeyer (Col. 1, lines 55-67).
Claims 14, 17 are rejected under 35 U.S.C. 103 as being unpatentable over Tzakikario, U.S. Patent No. 7,620,733, in view of Mendiola, WO 2003/019445, and further in view of Patil, U.S. Publication No. 2021/0044678. Referring to claims 14, 17, Tzakikario does not disclose that the DNS requests include an EDNS field. Patil discloses the use of EDNS fields in DNS requests and DNS responses ([0051] & [0053]), which meets the limitation of wherein the activation and/or resolution requests use an option according to EDNS mechanism to exchange information between the piece of equipment and the trusted server. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention for the DNS requests and DNS responses of Tzakikario to have included EDNS fields in order to allow for the determination of QUIC support as suggested by Patil ([0051]).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to BENJAMIN E LANIER whose telephone number is (571)272-3805. The examiner can normally be reached M-Th: 5:30-4:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Alexander Lagor can be reached at 5712705143. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/BENJAMIN E LANIER/Primary Examiner, Art Unit 2437
