Detailed Action
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-17 are pending in the application.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on August 7, 2025 is in compliance with the provisions of 37 CFR 1.97, and accordingly, the IDS has been considered by the examiner.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the conflicting claims are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on nonstatutory double patenting provided the reference application or patent either is shown to be commonly owned with the examined application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP § 2146 et seq. for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The filing of a terminal disclaimer by itself is not a complete reply to a nonstatutory double patenting (NSDP) rejection. A complete reply requires that the terminal disclaimer be accompanied by a reply requesting reconsideration of the prior Office action. Even where the NSDP rejection is provisional the reply must be complete. See MPEP § 804, subsection I.B.1. For a reply to a non-final Office action, see 37 CFR 1.111(a). For a reply to final Office action, see 37 CFR 1.113(c). A request for reconsideration while not provided for in 37 CFR 1.113(c) may be filed after final for consideration. See MPEP §§ 706.07(e) and 714.13.
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/patent/patents-forms. The actual filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to www.uspto.gov/patents/apply/applying-online/eterminal-disclaimer.
Claims 7-11 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-4 and 6 of U.S. Patent No. 12,388,786 (“Patent ‘786”).
Although the claims at issue are not identical, they are not patentably distinct from each other because the claims are anticipated by claims of Patent ’786.
Instant Application
Patent ‘786
7. A method, comprising:
receiving, from a provider configuration system of a network and at a domain name system (DNS) firewall system, a request to instantiate the DNS firewall system for an Internet circuit, wherein the request comprises customer information and an assigned Internet protocol (IP) address space for the Internet circuit;
1. A method, comprising:
receiving, from a provider configuration system of a network and at a domain name system (DNS) firewall system, a request to instantiate the DNS firewall system for an Internet circuit, wherein the request comprises customer information and an assigned Internet protocol (IP) address space for the Internet circuit;
automatically extracting the customer information and the assigned IP address space from the request;
automatically storing tenant data for the customer at the DNS firewall system, wherein the tenant data comprises at least the assigned IP address space;
automatically extracting the customer information and the assigned IP address space from the request;
automatically storing tenant data for the customer at the DNS firewall system, wherein the tenant data comprises at least the assigned IP address space;
receiving, by the DNS firewall system, a first DNS request from the assigned IP address space; and
processing, by the DNS firewall system, the first DNS request,
wherein the processing comprises:
receiving, by the DNS firewall system, a first DNS request from the assigned IP address space;
processing, by the DNS firewall system, the first DNS request,
wherein the processing comprises:
determining that the first DNS request includes a first domain that is in a first category;
determining whether the first category is permitted for the customer;
when the first category is permitted for the customer, causing the first DNS request to be resolved to a first IP address associated with the first domain; and
when the first category is not permitted for the customer, causing the first DNS request to be rejected.
determining that the first DNS request includes a first domain that is in a first category;
determining whether the first category is permitted for the customer;
when the first category is permitted for the customer, causing the first DNS request to be resolved to a first IP address associated with the first domain; and
when the first category is not permitted for the customer, causing the first DNS request to be rejected;
receiving, by the DNS firewall system, a second DNS request from the assigned IP address space;
determining, by the DNS firewall system, that the customer is not currently subscribed to the DNS firewall system for the Internet circuit; and forwarding, by the DNS firewall system, the second DNS request to a separate DNS system.
Claims 8-11 are unpatentable over claims 2-4 and 6 of Patent ‘786.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 5 and 16 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Regarding claim 5, there is insufficient antecedent basis for “the user information.”
Regarding claim 16, there is insufficient antecedent basis for “the user information.”
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1 and 12 are rejected under 35 U.S.C. 103 as being unpatentable over Cathrow et al. US Patent Publication No. 2017/0222978 (“Cathrow”) in view of Gundersen et al. US Patent Publication No. 2019/0058656 (“Gundersen”) and Lochhead et al. US Publication No. 2020/0396127 (“Lochhead”).
Regarding claim 1, Cathrow teaches a method comprising:
receiving, at a provider configuration system of a network, a request from a customer to provision a domain name system (DNS) firewall system for the Internet circuit, wherein the request includes customer information (para. [0016] users… can have the protection and privacy provided by the DNS firewall service. para. [0022] DNS firewall service can be configured to receive DNS requests from a user device associated with a customer, identify the user device based on the address of the user device (e.g., the IP address), identify which customer the user device is associated with. para. [0026],[0027] Internet network… can be one or more LANs that include one or more… wired and/or wireless connection);
automatically, based on receiving the request to provision the DNS firewall system for the Internet circuit, causing tenant data for the customer to be stored at the DNS firewall system, wherein the tenant data comprises at least assigned IP address space (para. [0022] DNS firewall service can be configured to receive DNS requests from a user device associated with a customer, identify the user device based on the address of the user device (e.g., the IP address), identify which customer the user device is associated with, apply the appropriate protections. para. [0044] determine whether address of the request is associated with a DNS firewall customer. maintain a database of IP addresses and/or IP address blocks associated with customers); and
causing DNS requests received from the assigned IP address space to be processed by the DNS firewall system (para. [0048] address of the request is associated with a DNS firewall customer. para. [0050] apply DNS firewall protections. block DNS requests for domain names).
Cathrow does not teach:
receiving, at a provider configuration system of a network, a request from a customer to provision an Internet circuit;
assigning an Internet protocol (IP) address space to the Internet circuit;
causing the Internet circuit to be provisioned using the customer information and the assigned IP address space.
Gundersen teaches receiving, at a provider configuration system of a network, a request from a customer to provision an Internet circuit; assigning an Internet protocol (IP) address to the Internet circuit; causing the Internet circuit to be provisioned using the customer information and the assigned IP address (para. [0018] self-service portal enables customers to review and modify existing network services and to order new network services. para. [0021] user through physical connection of the new equipment to a telecommunications network over which the new service is to be provided. para. [0041] generating the final specification may include generating customer network data including specific address and port assignments for the equipment used to provide the network service. corresponding customer network data may be stored in the database 226). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cathrow with Gundersen’s disclosure of requesting and provisioning an Internet Circuit with an IP address. One of ordinary skill in the art would have been motivated to do so for benefits of enabling a customer to conveniently order network services and provide the capability to provision of a network service to customers remotely over a network.
While Gundersen discloses assigning an IP address and provisioning an Internet Circuit using an IP address, Gundersen does not expressly teach provisioning an IP address space. Lochhead discloses a customer requesting IP connectivity and provisioning an IP address space (para. [0182] customer makes a request for IP connectivity, and a size of a subnet of the IP address space allocated to the customer is determined). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cathrow and Gundersen with Lochhead’s disclosure of providing IP address space such that the IP address space is assigned to the Internet Circuit as disclosed by Cathrow and Gundersen. One of ordinary skill in the art would have been motivated to do so because it would have been beneficial for a customer to further request an IP address space and provide use of the IP addresses for network components.
Regarding claim 12, Cathrow teaches a system, comprising:
at least one processor; and memory, operatively connected to the at least one processor and storing instructions that, when executed by the at least one processor, cause the system to perform a method, the method comprising:
receiving, at a provider configuration system of a network, a request from a customer to provision a domain name system (DNS) firewall system for the Internet circuit, wherein the request includes customer information (para. [0016] users… can have the protection and privacy provided by the DNS firewall service. para. [0022] DNS firewall service can be configured to receive DNS requests from a user device associated with a customer, identify the user device based on the address of the user device (e.g., the IP address), identify which customer the user device is associated with);
automatically, based on receiving the request to provision the DNS firewall system for the Internet circuit, causing tenant data for the customer to be stored at the DNS firewall system, wherein the tenant data comprises at least the assigned IP address space (para. [0022] DNS firewall service can be configured to receive DNS requests from a user device associated with a customer, identify the user device based on the address of the user device (e.g., the IP address), identify which customer the user device is associated with, apply the appropriate protections. para. [0044] determine whether address of the request is associated with a DNS firewall customer. maintain a database of IP addresses and/or IP address blocks associated with customers); and
causing DNS requests received from the assigned IP address space to be processed by the DNS firewall system (para. [0048] address of the request is associated with a DNS firewall customer. para. [0050] apply DNS firewall protections. Block DNS requests for domain names).
Cathrow does not teach:
receiving, at a provider configuration system of a network, a request from a customer to provision an Internet circuit;
assigning an Internet Protocol (IP) address space to the Internet circuit;
causing the Internet circuit to be provisioned using the customer information and the assigned IP address space;
Gundersen discloses receiving, at a provider configuration system of a network, a request from a customer to provision an Internet circuit; assigning an Internet protocol (IP) address to the Internet circuit; causing the Internet circuit to be provisioned using the customer information and the assigned IP address (para. [0018] self-service portal enables customers to review and modify existing network services and to order new network services. para. [0021] user through physical connection of the new equipment to a telecommunications network over which the new service is to be provided. para. [0041] generating the final specification may include generating customer network data including specific address and port assignments for the equipment used to provide the network service. corresponding customer network data may be stored in the database 226). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cathrow with Gundersen’s disclosure of requesting and provisioning an Internet Circuit with an IP address. One of ordinary skill in the art would have been motivated to do so for benefits of enabling a customer to conveniently order network services and provide the capability to provision of a network service to customers remotely over a network.
While Gundersen discloses assigning an IP address and provisioning an Internet Circuit using an IP address, Gundersen does not expressly teach provisioning an IP address space. Lochhead discloses a customer requesting IP connectivity and provisioning an IP address space (para. [0182] customer makes a request for IP connectivity, and a size of a subnet of the IP address space allocated to the customer is determined). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cathrow and Gundersen with Lochhead’s disclosure of providing IP address space. One of ordinary skill in the art would have been motivated to do so because it would have been beneficial for a customer to further request an IP address space and provide use of the IP addresses for network components.
Claims 2-4, 13-15 are rejected under 35 U.S.C. 103 as being unpatentable over Cathrow in view of Gundersen, Lochhead, and Enomoto et al. US Patent Publication No. 2008/0098472 (“Enomoto”).
Regarding claim 2, Cathrow does not teach the method of claim 1, wherein the DNS firewall system advertises at least a first IP address on the network, further comprising: automatically, based on receiving the request to provision the DNS firewall system for the Internet circuit, causing customer premises equipment to be programmed to direct the DNS requests to the first IP address.
Enomoto discloses a firewall system that advertises at least a first IP address on a network; and automatically, based on receiving the request to provision the firewall system, causing customer premises equipment to be programmed to direct the requests to the first IP address. (fig. 39. para. [0016] firewall 30… UPnP advertisement where address information on the firewall itself and information on access operational procedure are transmitted to a UPnP compatible device such as VPN-GW 220. para. [0017] VPN-GW 220 receives (a) an UPnP advertisement from the firewall 30). Cathrow discloses requesting to the provision the DNS firewall system. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cathrow and Gundersen with Enomoto’s disclosure such that the equipment is configured to send DNS requests to the DNS firewall system. One of ordinary skill in the art would have been motivated to do so for benefits of utilizing the network to configure a customer’s equipment to be communicate with the firewall.
Regarding claim 3, Cathrow does not teach the method of claim 2, wherein automatically causing customer premises equipment to be programmed to direct the DNS requests to the first IP address comprises remotely configuring the customer premises equipment.
Enomoto discloses automatically causing customer premises equipment to be programmed to direct the requests to the first IP address (fig. 39. para. [0016] firewall 30… UPnP advertisement where address information on the firewall itself and information on access operational procedure are transmitted to a UPnP compatible device such as VPN-GW 220. Para. [0017] VPN-GW 220 receives (a) an UPnP advertisement from the firewall 30). Gundersen discloses configuring customer premises equipment (para. [0010] initiating a first configuration operation for customer premise equipment (CPE) required. assigning a network address to the CPE based on stored customer network data). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cathrow and Gundersen with Enomoto’s disclosure such that the equipment is configured to send DNS requests to the DNS firewall system. One of ordinary skill in the art would have been motivated to do so for benefits of utilizing the network to configure a customer’s equipment to be communicate with the firewall.
Regarding claim 4, Cathrow in view of Gundersen, Lochhead, and Enomoto teach the method of claim 3, wherein remotely configuring the customer premises equipment is performed in response to receiving notification that the customer premises equipment has been installed at the customer (Gundersen: para. [0010] initiating a first configuration operation for customer premise equipment (CPE) required. assigning a network address to the CPE based on stored customer network data. para. [0054] CPE has been connected as indicated in the installation wizard…, initiate a CPE connection and update routine… in which connectivity of the CPE is verified and any necessary software/firmware updates are applied to the CPE).
Regarding claim 13, Cathrow does not teach the system of claim 12, wherein the DNS firewall system advertises at least a first IP address on the network, wherein the method further comprises: automatically, based on receiving the request to provision the DNS firewall system for the Internet circuit, causing customer premises equipment to be programmed to direct the DNS requests to the first IP address.
Enomoto discloses a firewall system that advertises at least a first IP address on a network; and automatically, based on receiving a request to provision the firewall system, causing customer premises equipment to be programmed to direct the requests to the first IP address. (fig. 39. para. [0016] firewall 30… UPnP advertisement where address information on the firewall itself and information on access operational procedure are transmitted to a UPnP compatible device such as VPN-GW 220. para. [0017] VPN-GW 220 receives (a) an UPnP advertisement from the firewall 30). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cathrow and Gundersen with Enomoto’s disclosure such that the equipment is configured to send DNS requests to the DNS firewall system. One of ordinary skill in the art would have been motivated to do so for benefits of utilizing the network to configure a customer’s equipment to be communicate with the firewall.
Regarding claim 14, Cathrow does not teach the system of claim 13, wherein automatically causing customer premises equipment to be programmed to direct the DNS requests to the first IP address comprises remotely configuring the customer premises equipment.
Enomoto discloses automatically causing customer premises equipment to be programmed to direct the requests to the first IP address (fig. 39. para. [0016] firewall 30… UPnP advertisement where address information on the firewall itself and information on access operational procedure are transmitted to a UPnP compatible device such as VPN-GW 220. para. [0017] VPN-GW 220 receives (a) an UPnP advertisement from the firewall 30). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cathrow and Gundersen with Enomoto’s disclosure such that the equipment is configured to send DNS requests to the DNS firewall system. One of ordinary skill in the art would have been motivated to do so for benefits of utilizing the network to configure a customer’s equipment to be communicate with the firewall.
Regarding claim 15, Cathrow in view of Gundersen, Lochhead, and Enomoto teach the system of claim 14, wherein remotely configuring the customer premises equipment is performed in response to receiving notification that the customer premises equipment has been installed at the customer and comprises at least one of: automatically sending instructions to configure the customer premises equipment; or automatically sending an executable script to configure the customer premises equipment, wherein the executable script is specific to the customer premises equipment (Gundersen: para. [0010] initiating a first configuration operation for customer premise equipment (CPE) required. assigning a network address to the CPE based on stored customer network data. para. [0054] CPE has been connected as indicated in the installation wizard…, initiate a CPE connection and update routine… in which connectivity of the CPE is verified and any necessary software/firmware updates are applied to the CPE).
Claims 5 and 16 are rejected under 35 U.S.C. 103 as being unpatentable over Cathrow in view of Gundersen, Lochhead, and Sella US Patent Publication No. 2017/0264686 (“Sella”).
Regarding claim 5, Cathrow does not teach the method of claim 1, further comprising at least one of: providing, by the provider configuration system, programmatic access to an ordering system via an application programming interface (API) by exposing the API to permit programmatic ordering of the Internet circuit, providing the user information, and requesting that the DNS firewall system be provisioned for the Internet circuit; or causing, by the provider configuration system, a user interface to be presented, wherein the user interface provides user selectable options for the customer to order the Internet circuit, provide the user information, and to request that the DNS firewall system be provisioned for the Internet circuit.
Gundersen discloses providing, by a provider configuration system, programmatic access to an ordering system via an application programming interface (API) by exposing the API to permit programmatic ordering of the Internet circuit, providing the user information; or causing, by the provider configuration system, a user interface to be presented, wherein the user interface provides user selectable options for the customer to order the Internet circuit, provide the user information (para. [0037] APIs may include a site design API 216 for facilitating design of a branch of the customer network for providing a new service. para. [0027] self-service portal 118 allows an authorized user of the customer network 106 to manage services of the customer network 106. ordering one or more new services). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cathrow with Gundersen’s disclosure. One of ordinary skill in the art would have been motivated to do so for benefits of providing a self-service portal to allow users to conveniently order services and enable provisioning of a network service remotely over a network.
Sella disclose providing, by a provider configuration system, programmatic access to an ordering system via an application programming interface (API) by exposing the API to requesting that a firewall system be provisioned for the Internet circuit; or causing, by the provider configuration system, a user interface to be presented, wherein the user interface provides user selectable options to request that the firewall system be provisioned for the Internet circuit (para. [0029] service call module 126 generates and transmits API calls to provision a network service. para. [0030] client portal module 128 may receive a command from client 110a to include firewall. provides a graphical user interface for clients to provision configuration and services settings). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cathrow and Gundersen with Sella’s disclosure. One of ordinary skill in the art would have been motivated to do so because it would have been beneficial to enable a user to remotely initiate services including a firewall and provide a graphical user-interface to provision configuration and services setting.
Regarding claim 16, Cathrow does not teach the system of claim 12, wherein the method further comprises at least one of: providing, by the provider configuration system, programmatic access to an ordering system via an application programming interface (API) by exposing the API to permit programmatic ordering of the Internet circuit, providing the user information, and requesting that the DNS firewall system be provisioned for the Internet circuit; or causing, by the provider configuration system, a user interface to be presented, wherein the user interface provides user selectable options for the customer to order the Internet circuit, provide the user information, and to request that the DNS firewall system be provisioned for the Internet circuit.
Gundersen discloses providing, by a provider configuration system, programmatic access to an ordering system via an application programming interface (API) by exposing the API to permit programmatic ordering of the Internet circuit, providing the user information; or causing, by the provider configuration system, a user interface to be presented, wherein the user interface provides user selectable options for the customer to order the Internet circuit, provide the user information (para. [0037] APIs may include a site design API 216 for facilitating design of a branch of the customer network for providing a new service. para. [0027] self-service portal 118 allows an authorized user of the customer network 106 to manage services of the customer network 106. ordering one or more new services). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cathrow with Gundersen’s disclosure. One of ordinary skill in the art would have been motivated to do so for benefits of providing a self-service portal to allow users to conveniently order services and enable provisioning of a network service remotely over a network.
Sella disclose providing, by a provider configuration system, programmatic access to an ordering system via an application programming interface (API) by exposing the API to requesting that a firewall system be provisioned for the Internet circuit; or causing, by the provider configuration system, a user interface to be presented, wherein the user interface provides user selectable options to request that the firewall system be provisioned for the Internet circuit (para. [0029] service call module 126 generates and transmits API calls to provision a network service. para. [0030] client portal module 128 may receive a command from client 110a to include firewall. provides a graphical user interface for clients to provision configuration and services settings). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cathrow and Gundersen with Sella’s disclosure. One of ordinary skill in the art would have been motivated to do so because it would have been beneficial to enable a user to remotely initiate services including a firewall and provide a graphical user-interface to provision configuration and services setting.
Claims 6 and 17 are rejected under 35 U.S.C. 103 as being unpatentable over Cathrow in view of Gundersen, Lochhead, Enomoto, and Maino et al. US Patent Publication No. 2017/0054758 (“Maino”).
Regarding claim 6, Cathrow in view of Gundersen, Lochhead, and Enomoto teach the method of claim 2, wherein the assigned IP address space comprises at least a first IP address and a second IP address, and wherein the method further comprises: assigning the second IP address to the customer premises equipment (Gundersen: claim 1. assigning a network address to the CPE. Lochhead: para. [0182] size of a subnet of the IP address space allocated to the customer is determined). Cathrow, Gundersen, and Lochhead do not teach assigning the first IP address to an edge router.
Maino discloses assigning an IP address to an edge router (para. [0040] authorizes the CPE to be attached to the VPN and provides initial or “day-0” configuration information for the CPE and network devices in network underlay 104, such as address allocations for edge routers 41). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cathrow, Gundersen, and Lochhead with Maino’s disclosure of assigning an IP address to an edge router. One of ordinary skill in the art would have been motivated to do so in order to have configured the devices over a network and enabled connection to the network.
Regarding claim 17, Cathrow in view of Gundersen, Lochhead, and Enomoto teach the system of claim 13, wherein the assigned IP address space comprises at least a first IP address and a second IP address, and wherein the method further comprises: assigning the second IP address to the customer premises equipment (Gundersen: claim 1. assigning a network address to the CPE. Lochhead: para. [0182] size of a subnet of the IP address space allocated to the customer is determined). Cathrow, Gundersen, and Lochhead do not teach assigning the first IP address to an edge router.
Maino discloses assigning an IP address to an edge router (para. [0040] authorizes the CPE to be attached to the VPN and provides initial or “day-0” configuration information for the CPE and network devices in network underlay 104, such as address allocations for edge routers 41). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cathrow, Gundersen, and Lochhead with Maino’s disclosure of assigning an IP address to an edge router. One of ordinary skill in the art would have been motivated to do so in order to have configured the devices over a network and enabled connection to the network.
Claims 7 is rejected under 35 U.S.C. 103 as being unpatentable over Cathrow et al. US Patent Publication No. 2017/0222978 (“Cathrow”) in view of Gundersen et al. US Patent Publication No. 2019/0058656 (“Gundersen”), Lochhead et al. US Publication No. 2020/0396127 (“Lochhead”), and Xie US Patent Publication No. 2016/0294877 (“Xie”).
Regarding claim 7, Cathrow teaches a method, comprising:
receiving, from a provider configuration system of a network and at a domain name system (DNS) firewall system, a request to instantiate the DNS firewall system for an Internet circuit, wherein the request comprises customer information (para. [0016] users… can have the protection and privacy provided by the DNS firewall service. para. [0022] DNS firewall service can be configured to receive DNS requests from a user device associated with a customer, identify the user device based on the address of the user device (e.g., the IP address), identify which customer the user device is associated with);
automatically extracting the customer information and the assigned IP address space from the request (para. [0022] DNS firewall service can be configured to receive DNS requests from a user device associated with a customer, identify the user device based on the address of the user device (e.g., the IP address), identify which customer the user device is associated with, apply the appropriate protections. para. [0044] determine whether address of the request is associated with a DNS firewall customer. maintain a database of IP addresses and/or IP address blocks associated with customers);
automatically storing tenant data for the customer at the DNS firewall system, wherein the tenant data comprises at least the assigned IP address space (para. [0022] DNS firewall service can be configured to receive DNS requests from a user device associated with a customer, identify the user device based on the address of the user device (e.g., the IP address), identify which customer the user device is associated with, apply the appropriate protections. para. [0044] determine whether address of the request is associated with a DNS firewall customer. maintain a database of IP addresses and/or IP address blocks associated with customers);
receiving, by the DNS firewall system, a first DNS request from the assigned IP address space (para. [0048] address of the request is associated with a DNS firewall customer. para. [0050] apply DNS firewall protections); and
processing, by the DNS firewall system, the first DNS request, wherein the processing comprises:
determining that the first DNS request includes a first domain that is in a first category (para. [0048] address of the request is associated with a DNS firewall customer. para. [0050] list of domain names… associated with cyber threat);
when the first category is not permitted for the customer, causing the first DNS request to be rejected (para. [0048] address of the request is associated with a DNS firewall customer. para. [0051] apply DNS firewall protections. block DNS requests for domain names).
Cathrow does not teach:
an assigned Internet protocol (IP) address space for the Internet circuit
determining whether the first category is permitted for the customer;
when the first category is permitted for the customer, causing the first DNS request to be resolved to a first IP address associated with the first domain; and
Gundersen discloses receiving, at a provider configuration system of a network, a request from a customer to provision an Internet circuit; assigning an Internet protocol (IP) address to the Internet circuit; causing the Internet circuit to be provisioned using the customer information and the assigned IP address (para. [0018] self-service portal enables customers to review and modify existing network services and to order new network services. para. [0021] user through physical connection of the new equipment to a telecommunications network over which the new service is to be provided. para. [0041] generating the final specification may include generating customer network data including specific address and port assignments for the equipment used to provide the network service. corresponding customer network data may be stored in the database 226). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cathrow with Gundersen’s disclosure of requesting and provisioning an Internet Circuit with an IP address. One of ordinary skill in the art would have been motivated to do so for benefits of enabling a customer to conveniently order network services and provide the capability to provision of a network service to customers remotely over a network.
While Gundersen discloses assigning an IP address and provisioning an Internet Circuit using an IP address, Gundersen does not expressly teach provisioning an IP address space. Lochhead discloses a customer requesting IP connectivity and provisioning an IP address space (para. [0182] customer makes a request for IP connectivity, and a size of a subnet of the IP address space allocated to the customer is determined). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cathrow and Gundersen with Lochhead’s disclosure of providing IP address space such that the IP address space is assigned to the Internet Circuit as disclosed by Cathrow and Gundersen. One of ordinary skill in the art would have been motivated to do so because it would have been beneficial for a customer to further request an IP address space and provide use of the IP addresses for network components.
Xie teaches determining that a first DNS request includes a first domain that is in a first category (para. [0016] factors such as the determined category and/or the user or client initiating the DNS request); determining whether the first category is permitted for the customer (para. [0016] factors such as the determined category and/or the user or client initiating the DNS request, various actions may be performed by security appliance 20); when the first category is permitted for the customer, causing the first DNS request to be resolved to a first IP address associated with the first domain (para. [0016] request for a domain name categorized as a news service may be routed to the DNS server); and when the first category is not permitted for the customer, causing the first DNS request to be rejected (para. [0016] request for a domain name categorized as a social networking site from a user who does not have permission to access such a site may be blocked and not routed to the DNS server. error or access denied message may be sent to the requesting client). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cathrow and Gundersen with Xie’s disclosure of utilizing categories to determine whether to permit or reject DNS requests. One of ordinary skill in the art would have been motivated to do so for benefits of further defining and controlling domains that are accessible to customers.
Claims 8-11 are rejected under 35 U.S.C. 103 as being unpatentable over Cathrow in view of Gundersen, Lochhead, Xie, and Neystadt et al. US Patent Publication No. 2024/0163253 (“Neystadt”).
Regarding claim 8, Cathrow in view of Gundersen, Lochhead, and Enomoto teach the method of claim 7, further comprising reporting, by the DNS firewall system, filtering information to a threat intelligence system.
Neystadt teaches reporting, by a firewall system, filtering information to a threat intelligence system (para. [0034] inspection component 104 performs the security inspection and blocks, passes, or proxies client communications to the desired destination. para. [0047] component 106 collects logs from components 102 and 104. analyzes the logs to determine… situations and/or domains that should be the trigger for adjustments). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cathrow and Gundersen with Neystadt’s disclosure of reporting filtering information to a threat intelligence system. One of ordinary skill in the art would have been motivated to do so for benefits of evaluating domains for risk and providing an updated, accurate lists of domains based on threat intelligence (para. [0025],[0119]).
Regarding claim 9, Cathrow in view of Gundersen, Lochhead, and Enomoto teach the method of claim 8, wherein the filtering information comprises information regarding any domains that the customer has included on at least one of an access-allowed list or an access-denied list.
Neystadt teaches filtering information comprises information regarding any domains that the customer has included on at least one of an access-allowed list or an access-denied list (para. [0047] component 106 collects logs from components 102 and 104. analyzes the logs to determine… situations and/or domains that should be the trigger for adjustments. para. [0048] can filter the results and/or verify them to minimize false positives and/or false negatives. updates the requesting routing component 102 with a new configuration (e.g., new domain lists for [High Risk Domains], [Risky Domains], [Whitelist], [Low Risk Domains]). Cathrow discloses domains included on at least one of an access-allowed list or an access-denied list. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cathrow and Gundersen with Neystadt’s disclosure of reporting the filtering information including the domains that the customer has included as disclosed by Cathrow. One of ordinary skill in the art would have been motivated to do so for benefits of evaluating domains for risk and providing an updated, accurate lists of domains based on threat intelligence (para. [0025],[0119]).
Regarding claim 10, Cathrow in view of Gundersen, Lochhead, and Enomoto teach the method of claim 8, further comprising receiving, from the threat intelligence system, a list of known malicious domains, wherein the first category comprises the list of known malicious domains and wherein the DNS firewall system automatically prohibits the first category from being permitted for the customer.
Neystadt teaches receiving, from the threat intelligence system, a list of known malicious domains, wherein the first category comprises the list of known malicious domains and wherein the firewall system automatically prohibits the first category from being permitted for the customer (para. [0034] inspection component 104 performs the security inspection and blocks, passes, or proxies client communications to the desired destination. para. [0048] updates the requesting routing component 102 with a new configuration (e.g., new domain lists for [High Risk Domains], [Risky Domains]. para. [0054] threat intelligence component 206a is used to generate a configuration comprising list of domains which are a threat). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have modified Cathrow and Gundersen with Neystadt’s disclosure. One of ordinary skill in the art would have been motivated to do so for benefits of evaluating domains for risk and providing an updated, accurate lists of domains based on threat intelligence (para. [0025],[0119]).
Regarding claim 11, Cathrow in view of Gundersen, Lochhead, and Enomoto teach the method of claim 8. Cathrow teaches the method further comprising: receiving, by the DNS firewall system, a second DNS request from the assigned IP address space, determining based on the tenant data whether the customer is currently subscribed to the DNS firewall system for the Internet circuit (para. [0022] DNS firewall service can be configured to receive DNS requests from a user device associated with a customer, identify the user device based on the address of the user device (e.g., the IP address). para. [0044] determine whether address of the request is associated with a DNS firewall customer. maintain a database of IP addresses and/or IP address blocks associated with customers);
when the customer is currently subscribed to the DNS firewall system for the Internet circuit, processing, by the DNS firewall system, the second DNS request (para. [0048] determines that the address of the request is associated with a DNS firewall customer, resolve the domain name by searching for a record associated with the domain name); and
when the customer is not currently subscribed to the DNS firewall system for the Internet circuit, discarding the second DNS request (Note. This is an optional, alternative language that is not required by the claim. Furthermore, the claim cannot be practiced with a customer as both currently subscribed and not currently subscribed).
Examiner’s Note
The following prior art made of record and not relied upon is considered pertinent to applicant’s disclosure.
Atkinson et al. US Patent No. 10,116,698 (col. 7, lines 43-47. customer 102 executes the firewall configuration code or component 216 to process a set of network address ranges included in the network firewall configuration information to form a prioritized list of network address ranges that will be used to configure network firewalls).
Tucker et al. US Publication No. 2024/0194033 (para. [0062] network 15 could be any packet data network offering a communications interface or exchange between any two nodes in system 100. network connections 11 may include, but are not limited to, wired and/or wireless mediums which may be provisioned with routers and firewalls. [0065] access the internet).
Wang et al. US Patent Publication No. 2017/0250951 discloses receiving a request from a customer to provision a firewall system; assigning an IP address space and causing tenant data to be stored at a firewall system (para. [0015] generate a request for dynamically configuring firewalls and/or firewall policies. dynamic controller 102 may transmit instructions that may be processed and/or executed to generate, or otherwise display, a Portal for defining the firewall policies and/or configuring firewalls. para. [0018] if the firewall policy involves a subnet, the firewall policy may include configurations for router that defines an Address, network ID, subnet ID, subnet mask. para. [0023] input for a firewall policy that relates to one or more ports, communication protocols, or services, among other alternatives that describe how network traffic may be managed. such input may include one or more source IP addresses, destination IP addresses).
Conclusion
A shortened statutory period for reply to this Office action is set to expire THREE MONTHS from the mailing date of this action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Joshua Joo whose telephone number is (571)272-3966. The examiner can normally be reached Monday-Friday 7am-3pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Oscar Louie can be reached at 571-270-1684. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/JOSHUA JOO/Primary Examiner, Art Unit 2445
Prosecution Insights