DETAILED ACTION
This action is responsive to continuation filed on July 17th, 2025.
Claims 1~20 are examined.
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 07/21/25 is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP §§ 706.02(l)(1) - 706.02(l)(3) for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
Claims 1~20 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1~20 of U.S Patent 12,368,750. Although the claims at issue are not identical, they are not patentably distinct from each other because the U.S Patent mentioned above fully anticipates claims 1~20 of the instant application. A subset of the claims for comparison is provided below:
Instant Application 19/272,653
U.S Patent 12,368,750
1. A method, comprising: receiving, at a traffic management system, a first stream of packets from a router on a first link and a second stream of packets from the router on a second link, wherein the first stream of packets comprises traffic from a first network element operatively connected to the router; determining flow information about the first stream, wherein the flow information indicates that the first network element has received at least one packet from the router that comprises a first source Internet protocol (IP) address and a first destination IP address, and wherein at least a first parameter of the first stream indicates that the first network element has sent a return packet to the source IP address; sending, by the traffic management system, a routing policy update, wherein the routing policy update causes at least a routing table at the router to be updated to require that all traffic received by the router having the first source IP address and the first destination IP address be routed to the first network element.
1. A method, comprising: receiving, at a traffic management system, a first stream of packets from a router on a first link and a second stream of packets from the router on a second link, wherein the first stream of packets comprises traffic from a first network element operatively connected to the router and the second stream of packets comprises traffic from a second network element operatively connected to the router; determining flow information about the first stream, wherein the flow information indicates that the first network element has received at least one packet from the router that comprises a first source Internet protocol (IP) address and a first destination IP address, and wherein at least a first parameter of the first stream indicates that the first network element has sent a return packet to the source IP address; sending, by the traffic management system, a routing policy update, wherein the routing policy update causes at least a routing table at the router to be updated to require that all traffic received by the router having the first source IP address and the first destination IP address be routed to the first network element.
2. The method of claim 1, wherein the routing policy update is applied for a determined period of time.
2. The method of claim 1, wherein the routing policy update is applied for a determined period of time.
3. The method of claim 2, wherein the determined period of time is based upon the flow information.
3. The method of claim 2, wherein the determined period of time is based upon the flow information.
4. The method of claim 1, further comprising: determining flow information about the second stream, wherein the flow information indicates that a second network element operatively connected to the router has received at least one packet from the router that comprises a second source Internet protocol (IP) address and a second destination IP address, and wherein at least a second parameter of the second stream indicates that the second network element has sent a return packet to the second source IP address; sending, by the traffic management system, a second routing policy update, wherein the second routing policy update causes at least a second routing table at the router to be updated to require that all traffic received by the router having the second source IP address and second destination IP address be routed to the second network element.
4. The method of claim 1, further comprising: determining flow information about the second stream, wherein the flow information indicates that the second network element has received at least one packet from the router that comprises a second source Internet protocol (IP) address and a second destination IP address, and wherein at least a second parameter of the second stream indicates that the second network element has sent a return packet to the second source IP address; sending, by the traffic management system, a second routing policy update, wherein the second routing policy update causes at least a second routing table at the router to be updated to require that all traffic received by the router having the second source IP address and second destination IP address be routed to the second network element.
5. The method of claim 1, wherein the first network element is a scrubber.
5. The method of claim 1, wherein the first network element is a scrubber.
6. The method of claim 5, wherein the first parameter of the first stream indicates that a challenge has been issued by the scrubber to the source IP address.
6. The method of claim 5, wherein the first parameter of the first stream indicates that a challenge has been issued by the scrubber to the source IP address.
7. The method of claim 1, further comprising: determining flow information about the second stream, wherein the flow information indicates that a second network element operatively connected to the router has received at least one packet from the router that comprises a second source Internet protocol (IP) address and a second destination IP address, and wherein at least a second parameter of the second stream indicates that the second network element has sent a return packet to the second source IP address; determining that a current routing policy exists for the second source IP address and the second destination IP address; and based on determining that the current routing policy exists, determining, by the traffic management system, not to send a second routing policy update.
7. The method of claim 1, further comprising: determining flow information about the second stream, wherein the flow information indicates that the second network element has received at least one packet from the router that comprises a second source Internet protocol (IP) address and a second destination IP address, and wherein at least a second parameter of the second stream indicates that the second network element has sent a return packet to the second source IP address; determining that a current routing policy exists for the second source IP address and the second destination IP address; and based on determining that the current routing policy exists, determining, by the traffic management system, not to send a second routing policy update.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1~5, 7~12, 14~18, and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Ballew (U.S 2023/0362192) in view of St. Pierre (U.S 2018/0091547).
Regarding Claim 1,
Ballew taught a method, comprising:
receiving, at a traffic management system, a first stream of packets from a router on a first link and a second stream of packets from the router on a second link, wherein the first stream of packets comprises traffic from a first network element operatively connected to the router and the second stream of packets comprises traffic from a second network element operatively connected to the router [¶54, Fig. 1, traffic information of incoming packets is received by the threat intelligence system 126. For example, traffic information may be collected according to the NetFlow protocol. Traffic information may include, for example, source IP address, destination IP address, timestamps, and/or the like. The traffic information may be obtained, for example, from the various servers 110 and/or routers 106 of the first AS 100];
determining flow information about the first stream, wherein the flow information indicates that the first network element has received at least one packet from the router that comprises a first source Internet protocol (IP) address and a first destination IP address [¶32, threat intelligence system 126 may analyze traffic information and identify threats to AS 100. In examples, the traffic information includes both router identifier information and an identification of the source of the traffic. The traffic information may be obtained from the various servers 110 and/or routers 106 of the first AS 100. In one example, the threat intelligence system 126 is configured to sample, at a given rate (e.g., one out of 100), packets received by the servers 110 and/or routers 106 to identify threats] and
sending, by the traffic management system, a routing policy update, wherein the routing policy update causes at least a routing table at the router to be updated to require that all traffic received by the router having the first source IP address and the first destination IP address be routed to the first network element [¶46, mitigation actions may comprise instituting on-demand scrubbers, routing to separate scrubbing centers, or other rules or components to mitigate effects of the identified threat(s). For example, the threat analyzer 202 may signal appropriate routers (e.g., router R5 106e), scrubbers, to apply one or more mitigation rules; ¶50, the threat intelligence system 126 may send a signal to one or more routers of the first AS 100 (e.g., router R5 106 e), to update their routing tables to direct traffic from the particular IP source address and/or particular AS to one or more scrubbing centers and/or other threat mitigation devices or services].
Ballew did not specifically teach wherein at least a first parameter (“flags/indicators”) of the first stream indicates that the first network element has sent a return packet to the source IP address.
St. Pierre taught wherein at least a first parameter (“flags/indicators”) of the first stream indicates that the first network element has sent a return packet to the source IP address [¶35, devices internal to the protected network 101 are configured to send, responsive to incoming requests, enhanced protocol messages with an agreed-upon flag (referred to hereinafter as the “status flag indicative of malicious characteristic of corresponding message requests” or simply “status flag”) to signal malicious characteristic of given source traffic (i.e., the received incoming requests). For example, if a web server, such as host 106c, is the protected element and the host 106c detects through its own internal logic that a source of an incoming request is malicious, the host 106c could reply with an enhanced protocol response message which includes special HTTP status code that indicates to the mitigation device 110 that the source address should be blacklisted].
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the invention was made, to combine, St. Pierre’s teaching of limitations with the teachings of Ballew, because the combination would allow service providers to reliably and cost-effectively mitigate DDoS attack [St. Pierre: ¶5].
Regarding Claim 2,
Ballew taught wherein the routing policy update is applied for a determined period of time [¶46, mitigation actions can be implemented for a preset period of time, until the condition causing the mitigation action to be taken has been remedied, or until an administrator of threat intelligence system 126 determines the threat mitigation action is no longer necessary, among other option].
Regarding Claim 3,
Ballew taught wherein the determined period of time is based upon the flow information [¶46, mitigation actions can be implemented for a preset period of time, until the condition causing the mitigation action to be taken has been remedied, or until an administrator of threat intelligence system 126 determines the threat mitigation action is no longer necessary, among other option.
Regarding Claim 4,
Ballew taught determining flow information about the second stream, wherein the flow information indicates that a second network element operatively connected to the router has received at least one packet from the router that comprises a second source Internet protocol (IP) address and a second destination IP address [¶32], and sending, by the traffic management system, a second routing policy update, wherein the second routing policy update causes at least a second routing table at the router to be updated to require that all traffic received by the router having the second source IP address and second destination IP address be routed to the second network element [¶46; ¶50].
Perre taught wherein at least a second parameter of the second stream indicates that the second network element has sent a return packet to the second source IP address [¶35]. The rationale to combine as discussed in claim 1, applies here as well.
Regarding Claim 5,
Ballew taught wherein the first network element is a scrubber [¶52, scrubber instituted on the router, or another device of AS 100].
Regarding Claim 7,
Ballew taught further comprising: determining flow information about the second stream, wherein the flow information indicates that a second network element operatively connected to the router has received at least one packet from the router that comprises a second source Internet protocol (IP) address and a second destination IP address [¶32], and
determining that a current routing policy exists for the second source IP address and the second destination IP address; and based on determining that the current routing policy exists, determining, by the traffic management system, not to send a second routing policy update [¶18, act 302, if a determination is made, per an existing filtering rule, that the packet received in act 300 is to be filtered, the packet may be filtered or ignored in act 312].
Perre taught wherein at least a second parameter of the second stream indicates that the second network element has sent a return packet to the second source IP address [¶35]. The rationale to combine as discussed in claim 1, applies here as well.
Regarding Claims 8~12, 14~18, and 20, the claims are similar in scope to claims 1~5 and 7 respectively and therefore, rejected under the same rationale.
Claims 6, 13, and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Ballew and St. Pierre in view of Hajduczenia (U.S 2019/0288984).
Regarding Claims 6, 13, and 19,
Ballew-St. Pierre-Hajduczenia taught wherein the first parameter of the first stream indicates that a challenge has been issued by the scrubber to the source IP address [¶51, DDoS attack mitigation actions which may be performed by the mitigation device may include presenting a challenge to the sender. In a challenge-based mechanism, the DDoS mitigation device automatically sends a challenge, such as some JavaScript, to the (alleged) sender/client of the incoming traffic identified as suspicious. If the client cannot run the JavaScript, it is assumed to be an attacker and is blacklisted].
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the invention was made, to combine, Hajduczenia’s teaching of limitations with the teachings of Ballew and St. Pierre, because the combination would allow preventing a customer enterprise network from being overloaded with data traffic, such as traffic attributable to a distributed denial-of-service (DDoS) attack [Hajduczenia: ¶5].
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to HEE SOO KIM whose telephone number is (571)270-3229. The examiner can normally be reached M-F 9AM-5PM.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Nicholas Taylor can be reached on (571) 272-3889. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/HEE SOO KIM/Primary Examiner, Art Unit 2443
Prosecution Insights