DETAILED ACTION
This Office Action is in response to Applicant’s Application filed on July 17, 2025. Claims 1-43 are pending and presented for examination.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 7/22/2025 and 6/17/2026 have been considered by the examiner.
Specification
The disclosure is objected to because of the following informalities: the status of the Cross-Reference to Related Applications in paragraph 0001 needs to be updated.
Appropriate correction is required.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 1-43 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-35 and 69-76 of U.S. Patent No. 12,401,675. Although the claims at issue are not identical, they are not patentably distinct from each other because the subject matter claimed in the instant application is fully disclosed in U.S. Pat. No. 12,401,675 and would be covered by any patent granted since the U.S. Pat. No. 12,401,675 and the instant application are claiming common subject matter
Instant Application 19/272,038
1. A method for testing comprising:
(a) configuring a coordination agent in a production network, the production network
including at least one production service, the production network interfacing with an external network at a perimeter of the production network, the at least one production service
downstream from the external network, and a perimeter security system (PSS) for mitigating multiple threats upstream from the at least one production service;
(b) receiving, by the coordination agent, pre-attack notification information, the pre-
attack notification information including: one or more types of attacks to be launched against the at least one production service; and (c) collecting, by the coordination agent, operation data corresponding to traffic sent to
the at least one production service, the traffic which has at least partially traversed the perimeter security system (PSS) during an attack, where the attack is based on the one or more types of attacks of the received pre-attack notification information, and the collecting during the attack based on the one or more types of attacks of the received pre-attack notification information.
2. The method of claim 1, wherein the coordination agent includes at least one
emulated service for receiving a simulated attack associated with the pre-attack notification information, and/or for receiving pre-attack notification information or signaling.
3. The method of claim 1, wherein the traffic incldes packets.
4. The method of claim 1, wherein the traffic includes simulated attack traffic and/or
monitor traffic.
5. The method of claim 1, wherein the traffic includes legitimate traffic.
6. The method of claim 1, additionally comprising: monitoring response operation data of one or more monitors during the attack by a monitor controller, and, determining whether the response operation data is within a predetermined range.
7. The method of claim 6, wherein if the response operation data is determined to be
outside of the predetermined range, either altering or terminating the attack.
8. The method of claim 1, additionally comprising: monitoring coordination agent
operation data during the attack by a monitor controller or the coordination agent, and the
coordination agent is on a production server in the at least one production network.
9. The method of claim 8, wherein the monitor controller or the coordination agent
determines whether the coordination agent operation data is within a predetermined range.
10. The method of claim 9, wherein if the coordination agent operation data is
determined to be outside of the predetermined range, either altering or terminating the attack.
11. The method of claim 1, additionally comprising, the coordination agent sending
the collected operation data to a collection point which evaluates the operation of the perimeter security system (PSS).
12. The method of claim 11, wherein the collection point comprises a monitor
controller.
13. The method of claim 1, wherein the coordination agent collecting the operation
data includes receiving a copy of the traffic sent to the at least one production service from a mirror port, the traffic having at least partially traversed the perimeter security system (PSS) during the attack, the mirror port along the production network and/or the external network and in communication with the coordination agent.
14. The method of claim 1, wherein prior to a simulated attack, and the collecting by
the coordination agent, generating a baseline associated with one or more monitor responses for the at least one production service.
15. The method of claim 1, wherein prior to a simulated attack, and the collecting by
the coordination agent, generating a baseline associated with one or more coordination agent metrics for the at least one production service and/or the at least one production service hosting at least one production server.
16. The method of claim 1, wherein prior to the collecting by the coordination agent,
determining whether the at least one production service is of a predetermined stability to receive the attack.
17. The method of claim 1, wherein the pre-attack notification information includes
the time when the attack is launched, and one or more parameters of the attack.
18. The method of claim 1, wherein the coordination agent includes one or more
coordination agents, and configuring the one or more coordination agents on at least one
production server hosting the at least one production service, each of the one or more
coordination agents configured for: (i) receiving the pre-attack notification information; (ii) collecting the traffic received on the at least one production service and/or the at least one production server; or, (iii) collecting coordination agent operation data from the one or more coordination agents indicative of the operation of the at least one production server.
19. The method of claim 18, additionally comprising: monitoring the one or more
coordination agents for coordination agent operation data during the attack, and, determining whether the coordination agent operation data is within a predetermined range.
20. The method of claim 19, wherein if the coordination agent operation data is
determined to be outside of the predetermined range, either altering or terminating the attack.
21. The method of claim 20. wherein either altering or terminating the attack is
performed by a monitor controller and/or at least one of the one or more coordination agents.
22. The method of claim 1, additionally comprising: configuring one or more monitors along the external network, each of the one or more monitors configured for:
receiving the pre-attack notification information; and collecting monitor operation data based on the pre-attack notification information and the collecting during the attack, from one or more of:
the perimeter security system (PSS); or,
the at least one production service.
23. The method of claim 22, additionally comprising: monitoring, by a monitor
controller, the monitor operation data during the attack, and, determining whether the monitor operation data is within a predetermined range.
24. The method of claim 23, wherein if the monitor operation data is determined to be
outside of the predetermined range, either altering or terminating the attack.
25. The method of claim 1, additionally comprising: configuring one or more attack
simulators along the external network, each of the one or more attack simulators configured
for: receiving the pre-attack notification information; and collecting simulator operation data based on the pre-attack notification information and
the collecting of responses during the attack, from one or more of: the perimeter security system (PSS); or, the at least one production service.
26. The method of claim 1, wherein the attack is initiated by one or more simulators in
communication with a simulator controller.
27. The method of claim 26, wherein the simulator controller is in communication with
a monitor controller.
28. The method of claim 27, wherein the monitor controller is in communication with
the one or more simulators.
29. The method of claim 28, wherein if the simulator controller loses communication
with the monitor controller, the simulator controller initiates notification to the one or more simulators to terminate the attack.
30. The method of claim 1, wherein the attack is initiated by a simulator controller and
performed by one or more simulators.
31. The method of claim 30, wherein if any of the one or more simulators loses
communication with the simulator controller or a monitor controller, the simulator that has lost the communication terminates the attack.
32. The method of claim 1, wherein the perimeter security system (PSS) is within the
production network and at least partially in the external network.
33. The method of claim 25, wherein the perimeter security system (PSS), includes at
least two of the group of:
External Security Services (ESS) Module;
Distributed Denial of Service (DDoS) mitigation module;
Firewall;
Antivirus;
Anti-malware;
Sandbox protections;
Antispam;
Web Application Firewall (WAF); or
Intrusion Protection System (IPS).
34. The method of claim 1, additionally comprising: analyzing the operation data collected by a monitor controller and/or the coordination agent, the analyzing including:
identifying vulnerabilities in the components of the perimeter security system
(PSS); and sending commands from an Application Program Interface (API) controller towards the perimeter security system (PSS) for remediating at least one of the components of the perimeter security system (PSS) having the identified
vulnerabilities.
35. The method of claim 1, additionally comprising analyzing the operation data in the
traffic by processes including deep packet inspection (DPI).
36. A system for testing comprising:
a coordination agent configured for communicating with a network, the coordination agent comprising:
a receiver for receiving pre-attack notification information via the network, the
pre-attack notification information including: one or more types of attacks to be
launched; and
a collector for collecting operation data corresponding to traffic of an attack on
the network which has at least partially traversed a Perimeter Security System (PSS),
which was sent to a downstream target on the network, the traffic sent to the network
based on the pre-attack notification information, and the collecting is during the attack on the network based on the pre-attack notification information.
37. The system of claim 36, additionally comprising a Perimeter Security System (PSS) at least partially along the network to protect the downstream target.
38. The system of claim 37, wherein the perimeter security system (PSS) includes two
or more components selected from the group consisting of:
External Security Services (ESS) Module;
DDoS mitigation module;
Firewall;
Antivirus;
Anti-malware;
Sandbox protections;
Antispam;
Web Application Firewall (WAF); or
Intrusion Protection System (IPS).
39. The system of claim 36, wherein the coordination agent communicates with one or
more mirror ports which receive traffic having traversed one or more of the components of the
perimeter security system (PSS) along the network.
40. The system of claim 36, wherein the coordination agent or a monitor controller is
configured to determine, by monitoring the response of the downstream target, whether the operation data is out of a predetermined range, and, if the operation data is out of the
predetermined range, initiating a notification to one or more simulators to alter or terminate the attack.
41. The system of claim 36, wherein the downstream target comprises a production
service along the network downstream from the perimeter security system (PSS).
42. The system of claim 41, wherein the production service is hosted by one or more
production servers.
43. The system of claim 36, wherein at least one emulated service is deployed on the
coordination agent, the emulated service configured for receiving a simulated attack associated with the pre-attack notification information for receiving pre-attack notification information, and/or, for receiving and sending signaling associated with the pre-attack notification
information.
U.S. Pat. No. 12,401,675
1. A method for testing comprising: (a) configuring a coordination device in communication with a production network, the production network including at least one production service, the production network interfacing with an external network at a perimeter of the production network, the at least one production service downstream from the external network, and a perimeter security system (PSS) for mitigating multiple threats upstream from the at least one production service; (b) receiving, by the coordination device, pre-attack notification information, the pre-attack notification information including: one or more types of attacks to be launched against the at least one production service; and (c) collecting, by the coordination device, operation data corresponding to the traffic sent to the at least one production service, the traffic which has at least partially traversed the perimeter security system (PSS) during an attack, where the attack is based on the one or more types of attacks of the received pre-attack notification information, and the collecting during the attack based on the one or more types of attacks of the received pre-attack notification information.
2. The method of claim 1, wherein the coordination device includes at least one emulated service for receiving a simulated attack associated with the pre-attack notification information, and/or for receiving pre-attack notification information or signaling.
3. The method of claim 1, wherein the traffic includes packets.
4. The method of claim 1, wherein the traffic includes simulated attack traffic and/or monitor traffic.
5. The method of claim 1, wherein the traffic includes legitimate traffic.
6. The method of claim 1, additionally comprising: monitoring response operation data of one or more monitors during the attack by a monitor controller, and, determining whether the response operation data is within a predetermined range.
7. The method of claim 6, wherein if the response operation data is determined to be outside of the predetermined range, either altering or terminating the attack.
8. The method of claim 1, additionally comprising: monitoring coordination agent operation data during the attack by a monitor controller or the coordination device, and a coordination agent is on a production server and/or the coordination device.
9. The method of claim 8, wherein the monitor controller or the coordination device determines whether the coordination agent operation data is within a predetermined range.
10. The method of claim 9, wherein if the coordination agent operation data is determined to be outside of the predetermined range, either altering or terminating the attack.
11. The method of claim 1, additionally comprising, the coordination device sending the collected operation data to a collection point which evaluates the operation of the perimeter security system (PSS).
12. The method of claim 11, wherein the collection point comprises a monitor controller.
13. The method of claim 1, wherein the coordination device collecting the operation data includes receiving a copy of the traffic sent to the at least one production service from a mirror port, the traffic having at least partially traversed the perimeter security system (PSS) during the attack, the mirror port along the production network and/or the external network and in communication with the coordination device.
14. The method of claim 1, wherein prior to a simulated attack, and the collecting by the coordination device, generating a baseline associated with one or more monitor responses for the at least one production service.
15. The method of claim 1, wherein prior to a simulated attack, and the collecting by the coordination device, generating a baseline associated with one or more coordination agent metrics for the at least one production service and/or the at least one production service hosting at least one production server.
16. The method of claim 1, wherein prior to the collecting by the coordination device, determining whether the at least one production service is of a predetermined stability to receive the attack.
17. The method of claim 1, wherein the pre-attack notification information includes the time when the attack is launched, and one or more parameters of the attack.
18. The method of claim 1, additionally comprising: configuring one or more coordination agents on at least one production server hosting the at least one production service, each of the one or more coordination agents configured for: (i) receiving the pre-attack notification information; (ii) collecting the traffic received on the at least one production service and/or the at least one production server; or, (iii) collecting coordination agent operation data from the one or more coordination agents indicative of the operation of the at least one production server.
19. The method of claim 18, additionally comprising: monitoring the one or more coordination agents for coordination agent operation data during the attack, and, determining whether the coordination agent operation data is within a predetermined range.
20. The method of claim 19, wherein if the coordination agent operation data is determined to be outside of the predetermined range, either altering or terminating the attack.
21. The method of claim 20, wherein either altering or terminating the attack is performed by a monitor controller and/or the coordination device.
22. The method of claim 1, additionally comprising: configuring one or more monitors along the external network, each of the one or more monitors configured for: receiving the pre-attack notification information; and collecting monitor operation data based on the pre-attack notification information and the collecting during the attack, from one or more of: the perimeter security system (PSS); or, the at least one production service.
23. The method of claim 22, additionally comprising: monitoring, by a monitor controller, the monitor operation data during the attack, and, determining whether the monitor operation data is within a predetermined range.
24. The method of claim 23, wherein if the monitor operation data is determined to be outside of the predetermined range, either altering or terminating the attack.
25. The method of claim 1, additionally comprising: configuring one or more attack simulators along the external network, each of the one or more attack simulators configured for: receiving the pre-attack notification information; and collecting simulator operation data based on the pre-attack notification information and the collecting of responses during the attack, from one or more of: the perimeter security system (PSS); or, the at least one production service.
26. The method of claim 1, wherein the attack is initiated by one or more simulators in communication with a simulator controller.
27. The method of claim 26, wherein the simulator controller is in communication with a monitor controller.
28. The method of claim 27, wherein the monitor controller is in communication with the one or more simulators.
29. The method of claim 28, wherein if the simulator controller loses communication with the monitor controller, the simulator controller initiates notification to the one or more simulators to terminate the attack.
30. The method of claim 1, wherein the attack is initiated by a simulator controller and performed by one or more simulators.
31. The method of claim 30, wherein if any of the one or more simulators loses communication with the simulator controller or a monitor controller, the simulator that has lost the communication terminates the attack.
32. The method of claim 1, wherein the perimeter security system (PSS) is within the production network and at least partially in the external network.
33. The method of claim 25, wherein the perimeter security system (PSS), includes at least two of the group of: External Security Services (ESS) Module; Distributed Denial of Service (DDoS) mitigation module; Firewall; Antivirus; Anti-malware; Sandbox protections; Antispam; Web Application Firewall (WAF); or Intrusion Protection System (IPS).
34. The method of claim 1, additionally comprising: analyzing the operation data collected by a monitor controller and/or the coordination device, the analyzing including: identifying vulnerabilities in the components of the perimeter security system (PSS); and sending commands from an Application Program Interface (API) controller towards the perimeter security system (PSS) for remediating at least one of the components of the perimeter security system (PSS) having the identified vulnerabilities.
35. The method of claim 1, additionally comprising analyzing the operation data in the traffic by processes including deep packet inspection (DPI).
69. A system for testing comprising: a coordination device configured for communicating with a network, the coordination device including: a receiver for receiving pre-attack notification information via the network, the pre-attack notification information including: one or more types of attacks to be launched; and a collector for collecting operation data corresponding to traffic of an attack on the network which has at least partially traversed a Perimeter Security System (PSS), which was sent to a downstream target on the network, the traffic sent to the network based on the pre-attack notification information, and the collecting is during the attack on the network based on the pre-attack notification information.
70. The system of claim 69, additionally comprising a Perimeter Security System (PSS) at least partially along the network to protect the downstream target.
71. The system of claim 70, wherein the perimeter security system (PSS) includes two or more components selected from the group consisting of: External Security Services (ESS) Module; DDoS mitigation module; Firewall; Antivirus; Anti-malware; Sandbox protections; Antispam; Web Application Firewall (WAF); or Intrusion Protection System (IPS).
72. The system of claim 71, wherein the coordination device communicates with one or more mirror ports which receive traffic having traversed one or more of the components of the perimeter security system (PSS) along the network.
73. The system of claim 69, wherein the coordination device or a monitor controller is configured to determine, by monitoring the response of the downstream target, whether the operation data is out of a predetermined range, and, if the operation data is out of the predetermined range, initiating a notification to one or more simulators to alter or terminate the attack.
74. The system of claim 69, wherein the downstream target comprises a production service along the network downstream from the perimeter security system (PSS).
75. The system of claim 74, wherein the production service is hosted by one or more production servers.
76. The system of claim 69, wherein at least one emulated service is deployed on the coordination device, the emulated service configured for receiving a simulated attack associated with the pre-attack notification information for receiving pre-attack notification information, and/or, for receiving and sending signaling associated with the pre-attack notification information.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to LASHONDA T JACOBS-BURTON whose telephone number is (571)272-4004. The examiner can normally be reached M-F 8:30 am - 5:00 pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ario Etienne can be reached at 571-272-4001. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/LASHONDA JACOBS-BURTON/Primary Examiner, Art Unit 2457
ljb
August 29, 2026
Prosecution Insights