DETAILED ACTION
This communication is responsive to Application No. 19/300,249 filed on August 14, 2025. Claims 1-40 are pending and are directed towards METHODS AND APPARATUSES FOR HANDLING END-TO-END ENCRYPTION.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statements (IDS) submitted on 12/12/2025, 02/11/2026, 03/19/2026 and 08/25/2026 were Acknowledge. The submission is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statements are being considered by the examiner.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claim(s) 1-7 and 21-27 are rejected under 35 U.S.C. 103 as being unpatentable over Sarker et al. WO 2021009553 A1 (hereinafter “Sarker”) in view of Haddad et al. US 2025/0203367 A1 (hereinafter “Haddad”)
As per claims 1 and 21, Sarker teaches one or more non-transitory computer-readable media storing processor-executable instructions that, when executed by at least one processor, cause the at least one processor to:
generate a frame that comprises a data packet encrypted based on an encryption key (A COPE packet may contain one or more frames of different types. The different frames may carry information either from the client to the COPE node, or from any COPE node on the path. The frames provide a structure to delimit the different information objects. Sarker, para [0045]) (the QUIC initial packet (202) is encrypted when it arrives at the COPE node 254, the discovery information that is generated by the COPE node 254 is encrypted prior to sending to the server node 256. QUIC Server: COPE Packet Reception. Sarker, para [0054]);
determine, based on Quality of Server (QoS) information associated with the data packet, a multipath connection with a proxy server (The User Plane Function (UPF) 106 supports handling of user plane traffic based on the rules received from the SMF; specifically, for this invention, packet inspection and different enforcement actions such as Quality of Service (QoS), charging, etc. Sarker, para [0036])( Equal Cost Multi Path (ECMP) (also known as Equal Cost Multi Pathing, multipath forwarding and IP multipath) may be used (e.g., typical implementations use as the criteria particular header fields to ensure that the packets of a particular packet flow are always forwarded on the same next hop to preserve packet flow ordering). For purposes of multipath forwarding, a packet flow is defined as a set of packets that share an ordering constraint. As an example, the set of packets in a particular TCP transfer sequence need to arrive in order, else the TCP logic will interpret the out of order delivery as congestion and slow the TCP transfer rate down. Sarker, para [0124]);
send, to the proxy server, a request to create an encrypted tunnel with an application server (the network device receives a first packet within a UDP datagram, where the first packet is an initial packet for establishing a QUIC session between a client network device and a server network device. The initial packet is within an IP packet, which includes a UDP datagram. In one embodiment, the initial packet is sourced from the client network device for the QUIC session, and the initial packet is a client’s initial packet containing a crypto frame with a TLS Client hello (e.g., a client hello frame CHELLO). In one embodiment, the initial packet is sourced from the server network device for the QUIC session, and wherein the initial packet contains a crypto frame with a TLS server hello (e.g., a server hello frame SHELLO). Sarker, para [0072]); and
send, to the proxy server, the frame using a path of the multipath connection, wherein the frame is to be forwarded to the application server over the encrypted tunnel based on the encryption key (The COPE nodes may encrypt the content of the COPE packet so that it is only decryptable by the client. For example, the encryption may be performed to generate protected data using the method/system disclosed in a co-pending international application, entitled“Method and System for Secured Information Exchange Between Intermediate and Endpoint Nodes in a Communications Network,” which is incorporated by reference herein in its entirety for all purposes. Sarker, para [0043]).
Sarker does not explicitly teach encryption key shared with a plurality of network nodes across a plurality of layers.
However, Haddad teaches encryption key shared with a plurality of network nodes across a plurality of layers (A pre-shared key computed via the GBA/AKMA platform is used to secure any communications between the end user device 701 and applications 703A-C authorized by the SASE entity 702. Haddad, para [0096])
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention, to modify the System of Sarker in view of Haddad. One would be motivated to do so, to enhance the security of the system by encrypting/decrypting the transmitted data packets using shared encryption key.
As per claims 2 and 22, Sarker and Haddad teach the one or more non-transitory computer-readable media of claims 1 and 21, wherein the plurality of network nodes comprises the proxy server and the application server (A proxy is an intermediary program/software (or hardware such as a network node implementing such intermediary program/software) acting as a server, a client, or a combination of the server or client for some functionalities as the proxy may create or simply relay requests on behalf of other entities. The proxy may be implemented on a path between a server and a client. Note that each of the client, server, and proxy may be implemented in one or more network nodes such as client nodes, server nodes, and intermediate (on-path) nodes, respectively. Each of a server or client node may be referred to as an endpoint node. Sarker, para [0032]).
As per claims 3 and 23, Sarker and Haddad teach the one or more non-transitory computer-readable media of claims 1 and 21, wherein the plurality of layers comprises a Quick User Datagram Protocol (UDP) Internet Connections (QUIC) protocol layer, an Internet Protocol (IP) layer, and a UDP layer (QUIC is a general-purpose transport layer network protocol. While it may be referred to as the acronym for Quick User Datagram Protocol (UDP) Internet Connections, some organizations (e.g., Internet Engineering Task Force, IETF) refer to QUIC as the name of the protocol without treating it as an acronym. QUIC may be viewed as similar to Transmission Control Protocol (TCP) + enhancement such as Transport Layer Security (TLS) and/or Hypertext Transfer Protocol 2.0 (HTTP/2 or HTTP/2.0) but implemented on top of UDP. QUIC is therefore a UDP based stream-multiplexed and secure transport protocol with integrity protected header and encrypted payload. Yet unlike the traditional transport protocol stack with TCP (Transmission Control Protocol), which resides in the operating system kernel, QUIC can easily be implemented in the application layer. Sarker, para [0030])( (e.g., layer 2 (L2, data link layer) and/or layer 3 (L3, network layer) services) over an underlay network (e.g., an L3 network, such as an Internet Protocol (IP) network that uses tunnels (e.g., generic routing encapsulation (GRE), layer 2 tunneling protocol (L2TP), IPSec) to create the overlay network) Sarker, para [0103]).
As per claims 4 and 24, Sarker and Haddad teach the one or more non-transitory computer-readable media of claims 1 and 21, wherein the frame comprises an Internet Protocol (IP) header, a User Datagram Protocol (UDP) header, a Quick UDP Internet Connections (QUIC) header, and the data packet encapsulated within a QUIC datagram (The second packet may be included as a part of the UDP payload, a UDP option, or IPv6 Header. Sarker, para [0073]) (IP header information includes source IP address, destination IP address, source port, destination port (where“source port” and“destination port” refer herein to protocol ports, as opposed to physical ports of a ND), transport protocol (e.g., user datagram protocol (UDP), Transmission Control Protocol (TCP), and differentiated services code point (DSCP) values. Sarker, para [0100]) (The connection may use QUIC outer and inner headers at reference 234. The QUIC outer refers to a QUIC connection that is established between an endpoint and a COPE node, e.g., between the client node 252 and the COPE node 254; and it encapsulates the“inner” end-to-end connection at reference 236 between the client node 252 and the server node 256. Sarker, para [0061]).
As per claims 5 and 25, Sarker and Haddad teach the one or more non-transitory computer-readable media of claims 1 and 21, wherein the request further comprises a method field being set to CONNECT and a protocol field being set to CONNECT-UDP or CONNECT-IP.1 (a subsequent QUIC packet could also be an UDP datagram that only contains a COPE packet but using the IP+UDP 5-tuple and Destination Connection ID (DCID) / Source Connection ID (SCID) from the QUIC connection triggering the inclusion of the COPE packet. Sarker, para [0053]).
As per claims 6 and 26, Sarker and Haddad teach the one or more non-transitory computer-readable media of claims 1 and 21, wherein the instructions, when executed by at least one processor, further cause the at least one processor to: receive, from the proxy server, configuration information to establish the multipath connection with the proxy server, wherein the configuration information comprises an Internet Protocol (IP) address of the proxy server, a port number for the proxy server, and a proxy type (different packets may be routed over different paths, and thus be delivered out of order. Where a reliable virtual circuit is established with TCP on top of the underlying unreliable and connectionless IP protocol, the virtual circuit is identified by the source and destination network socket address pair, i.e., the sender and receiver IP address and port number. Sarker, para [0128])( A Layer 3 (L3) Link Aggregation (LAG) link is a link directly connecting two NDs with multiple IP-addressed link paths (each link path is assigned a different IP address), and a load distribution decision across these different link paths is performed at the ND forwarding plane; in which case, a load distribution decision is made between the link paths. Sarker, para [0125]).
As per claims 7 and 27, Sarker and Haddad teach the one or more non-transitory computer-readable media of claims 1 and 21, wherein the proxy server is a network node performing one or more User Plane Functions (UPFs) (The User Plane Function (UPF) 106 supports handling of user plane traffic based on the rules received from the SMF; specifically, for this invention, packet inspection and different enforcement actions such as Quality of Service (QoS), charging, etc. Sarker, para [0036])( A COPE node may be implemented in a network device containing the QUIC proxy and/or performance enhancement features/functions, and it is an intermediate/on- path node (referred to as a COPE node for it implementing the COPE functions) between the client and server. Sarker, para [0042]).
Claim(s) 8-14 and 28-34 are rejected under 35 U.S.C. 103 as being unpatentable over Sarker et al. WO 2021009553 A1 (hereinafter “Sarker”) in view of Haddad et al. US 2025/0203367 A1 (hereinafter “Haddad”)
As per claims 8 and 28, Sarker teaches one or more non-transitory computer-readable media storing processor-executable instructions that, when executed by at least one processor, cause the at least one processor to:
determine, based on Quality of Server (QoS) information associated with a data packet, a multipath connection with a user device (The User Plane Function (UPF) 106 supports handling of user plane traffic based on the rules received from the SMF; specifically, for this invention, packet inspection and different enforcement actions such as Quality of Service (QoS), charging, etc. Sarker, para [0036])( Equal Cost Multi Path (ECMP) (also known as Equal Cost Multi Pathing, multipath forwarding and IP multipath) may be used (e.g., typical implementations use as the criteria particular header fields to ensure that the packets of a particular packet flow are always forwarded on the same next hop to preserve packet flow ordering). For purposes of multipath forwarding, a packet flow is defined as a set of packets that share an ordering constraint. As an example, the set of packets in a particular TCP transfer sequence need to arrive in order, else the TCP logic will interpret the out of order delivery as congestion and slow the TCP transfer rate down. Sarker, para [0124]);
receive, from the user device, a request to create an encrypted tunnel with an application server (the network device receives a first packet within a UDP datagram, where the first packet is an initial packet for establishing a QUIC session between a client network device and a server network device. The initial packet is within an IP packet, which includes a UDP datagram. In one embodiment, the initial packet is sourced from the client network device for the QUIC session, and the initial packet is a client’s initial packet containing a crypto frame with a TLS Client hello (e.g., a client hello frame CHELLO). In one embodiment, the initial packet is sourced from the server network device for the QUIC session, and wherein the initial packet contains a crypto frame with a TLS server hello (e.g., a server hello frame SHELLO). Sarker, para [0072]);
receive, from the user device, using a path of the multipath connection, a frame comprising the data packet, wherein the data packet is encrypted based on an encryption key (The endpoint and COPE node will agree on the feature usage. The encryption of the COPE packets may use the existing encryption algorithms known in the art. For example, the encryption can use so-called hybrid encryption algorithm (e.g., Elliptic Curve Integrated Encryption Scheme (ECIES)) consisting of a key encapsulation mechanism and a data encapsulation mechanism) or other symmetric/asymmetric encryption algorithms. Sarker, para [0070]); and
send, to the application server, the frame over the encrypted tunnel based on the encryption key (The COPE nodes may encrypt the content of the COPE packet so that it is only decryptable by the client. For example, the encryption may be performed to generate protected data using the method/system disclosed in a co-pending international application, entitled“Method and System for Secured Information Exchange Between Intermediate and Endpoint Nodes in a Communications Network,” which is incorporated by reference herein in its entirety for all purposes. Sarker, para [0043]).
Sarker does not explicitly teach encryption key shared with a plurality of network nodes across a plurality of layers.
However, Haddad teaches encryption key shared with a plurality of network nodes across a plurality of layers (A pre-shared key computed via the GBA/AKMA platform is used to secure any communications between the end user device 701 and applications 703A-C authorized by the SASE entity 702. Haddad, para [0096])
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention, to modify the System of Sarker in view of Haddad. One would be motivated to do so, to enhance the security of the system by encrypting/decrypting the transmitted data packets using shared encryption key.
As per claims 9 and 29. Sarker and Haddad teach the one or more non-transitory computer-readable media of claims 8 and 28, wherein the plurality of network nodes comprises the user device and the application server (Client node, Cope Node and Server Node. Sarker Fig. 2 and related paragraphs).
As per claims 10 and 30. Sarker and Haddad teach the one or more non-transitory computer-readable media of claims 8 and 28, wherein the plurality of layers comprises a Quick User Datagram Protocol (UDP) Internet Connections (QUIC) protocol layer, an Internet Protocol (IP) layer, and a UDP layer (QUIC is a general-purpose transport layer network protocol. While it may be referred to as the acronym for Quick User Datagram Protocol (UDP) Internet Connections, some organizations (e.g., Internet Engineering Task Force, IETF) refer to QUIC as the name of the protocol without treating it as an acronym. QUIC may be viewed as similar to Transmission Control Protocol (TCP) + enhancement such as Transport Layer Security (TLS) and/or Hypertext Transfer Protocol 2.0 (HTTP/2 or HTTP/2.0) but implemented on top of UDP. QUIC is therefore a UDP based stream-multiplexed and secure transport protocol with integrity protected header and encrypted payload. Yet unlike the traditional transport protocol stack with TCP (Transmission Control Protocol), which resides in the operating system kernel, QUIC can easily be implemented in the application layer. Sarker, para [0030])( (e.g., layer 2 (L2, data link layer) and/or layer 3 (L3, network layer) services) over an underlay network (e.g., an L3 network, such as an Internet Protocol (IP) network that uses tunnels (e.g., generic routing encapsulation (GRE), layer 2 tunneling protocol (L2TP), IPSec) to create the overlay network) Sarker, para [0103]).
As per claims 11 and 31. Sarker and Haddad teach the one or more non-transitory computer-readable media of claims 8 and 28 wherein the frame comprises an Internet Protocol (IP) header, a User Datagram Protocol (UDP) header, a Quick UDP Internet Connections (QUIC) header, and the data packet encapsulated within a QUIC datagram (The second packet may be included as a part of the UDP payload, a UDP option, or IPv6 Header. Sarker, para [0073]) (IP header information includes source IP address, destination IP address, source port, destination port (where“source port” and“destination port” refer herein to protocol ports, as opposed to physical ports of a ND), transport protocol (e.g., user datagram protocol (UDP), Transmission Control Protocol (TCP), and differentiated services code point (DSCP) values. Sarker, para [0100]) (The connection may use QUIC outer and inner headers at reference 234. The QUIC outer refers to a QUIC connection that is established between an endpoint and a COPE node, e.g., between the client node 252 and the COPE node 254; and it encapsulates the“inner” end-to-end connection at reference 236 between the client node 252 and the server node 256. Sarker, para [0061]).
As per claims 12 and 32. Sarker and Haddad teach the one or more non-transitory computer-readable media of claims 8 and 28 wherein the request further comprises a method field being set to CONNECT and a protocol field being set to CONNECT-UDP or CONNECT-IP (a subsequent QUIC packet could also be an UDP datagram that only contains a COPE packet but using the IP+UDP 5-tuple and Destination Connection ID (DCID) / Source Connection ID (SCID) from the QUIC connection triggering the inclusion of the COPE packet. Sarker, para [0053]).
As per claims 13 and 33. Sarker and Haddad teach the one or more non-transitory computer-readable media of claims 8 and 28, wherein the instructions, when executed by at least one processor, further cause the at least one processor to:send, to the user device, configuration information for the multipath connection with the user device, wherein the configuration information comprises an Internet Protocol (IP) address of a proxy server, a port number for the proxy server, and a proxy type (different packets may be routed over different paths, and thus be delivered out of order. Where a reliable virtual circuit is established with TCP on top of the underlying unreliable and connectionless IP protocol, the virtual circuit is identified by the source and destination network socket address pair, i.e., the sender and receiver IP address and port number. Sarker, para [0128])( A Layer 3 (L3) Link Aggregation (LAG) link is a link directly connecting two NDs with multiple IP-addressed link paths (each link path is assigned a different IP address), and a load distribution decision across these different link paths is performed at the ND forwarding plane; in which case, a load distribution decision is made between the link paths. Sarker, para [0125]).
As per claims 14 and 34. Sarker and Haddad teach the one or more non-transitory computer-readable media of claims 13 and 33 wherein the proxy server is a network node performing one or more User Plane Functions (UPFs) (The User Plane Function (UPF) 106 supports handling of user plane traffic based on the rules received from the SMF; specifically, for this invention, packet inspection and different enforcement actions such as Quality of Service (QoS), charging, etc. Sarker, para [0036])( A COPE node may be implemented in a network device containing the QUIC proxy and/or performance enhancement features/functions, and it is an intermediate/on- path node (referred to as a COPE node for it implementing the COPE functions) between the client and server. Sarker, para [0042]).
Claim(s) 15-20 and 35-40 are rejected under 35 U.S.C. 103 as being unpatentable over Haddad et al. US 2025/0203367 A1 (hereinafter “Haddad”) in view of Dutta US 2022/0191139 A1 (hereinafter “Dutta”).
As per claims 15 and 35, Haddad teaches One or more non-transitory computer-readable media storing processor-executable instructions that, when executed by at least one processor, cause the at least one processor to:
receiving, from a proxy server, a request to create an encrypted tunnel with a user device via the proxy server, wherein the encrypted tunnel is based on an encryption key shared with a plurality of network nodes across a plurality of layers (in an operation 909, the SASE entity 903 may forward the “app session establishment request” message to App (A) 904. Upon receiving an “app session establishment request” message from the SASE entity 903, the App (A) 904 may query about the associated session key by sending the “AKMA AFKey Request” message to the AAnF (or by sending a similar request to the BSF for GBA) in an operation of 910. Haddad, para [0112] and Fig. 9)( After the transmission of the “AKMA AFKey Response” (or transmission of similar response if the GBA platform is used), in an operation 913, secure end-to-end communication may be established between the UE 901 and App (A) 904 by using the pre-shared session key computed by the GBA/AKMA platform 902. Haddad, para [0114])( offer both VPN capabilities and granular control over end-to-end encryption between a user equipment (UE) and corporate IT services. Haddad, para [0115])( the embodiments of the present disclosure integrate SASE features (crypto-tables, artificial intelligence (AI), firewall, proxy, etc.) in the enhanced UPF and allow pushing such node closer to the IT services running on premise and/or in public cloud. In addition, VPN encryption granularity can be coordinated by the SASE on a per application, per user device, and/or per user basis. Haddad, para [0116]);
receiving, from the proxy server, a frame over the encrypted tunnel, wherein the frame comprises a data packet encrypted based on the encryption key shared with the plurality of network nodes across the plurality of layers (A pre-shared key computed via the GBA/AKMA platform is used to secure any communications between the end user device 701 and applications 703A-C authorized by the SASE entity 702. Haddad, para [0096]); and
Haddad does not explicitly teach decoding, based on the encryption key, the data packet.
However, Dutta teaches decoding, based on the encryption key, the data packet (The encapsulation represented by the data link header 205, the IP header 210, and the GRE header 215 causes user packets to be sent through the GRE tunnels. When the tunnel's receiving endpoint receives a packet, it decapsulates the user packet by removing the IP header 210 and the GRE header 215. The packet is then processed by the appropriate user application based on the Protocol Type specified in GRE header 215. Dutta, para [0088]).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention, to modify the System of Haddad in view of Dutta. One would be motivated to do so, to enhance the security of the system by encrypting/decrypting the transmitted data packets.
As per claims 16 and 36, Haddad and Dutta teach the one or more non-transitory computer-readable media of claims 15 and 35, wherein the plurality of network nodes comprises the user device and the proxy server. ( the embodiments of the present disclosure integrate SASE features (crypto-tables, artificial intelligence (AI), firewall, proxy, etc.) in the enhanced UPF and allow pushing such node closer to the IT services running on premise and/or in public cloud. In addition, VPN encryption granularity can be coordinated by the SASE on a per application, per user device, and/or per user basis. Haddad, para [0116]).
As per claims 17 and 37, Haddad and Dutta teach the one or more non-transitory computer-readable media of claims 15 and 35. Haddad does not explicitly teach wherein the plurality of layers comprises a Quick User Datagram Protocol (UDP) Internet Connections (QUIC) protocol layer, an Internet Protocol (IP) layer, and a UDP layer.
However, Dutta teaches wherein the plurality of layers comprises a Quick User Datagram Protocol (UDP) Internet Connections (QUIC) protocol layer, an Internet Protocol (IP) layer, and a UDP layer (QUIC (Quick UDP Internet Connections) is used as the reliable transport layer for tunneling of GRE packets. QUIC is a computer networking communications protocol which operates at the transport layer and serves a role similar to TCP and SCTP. Dutta, para [0463]) (IP layers 1460, 1465 in the routers 1405, 1410 are configured to encapsulate payloads in IP headers for transmission over the IP network 1415 and de-encapsulate packets received over the IP network 1415. Dutta, para [0162]).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention, to modify the System of Haddad in view of Dutta. One would be motivated to do so, to enhance the efficiency of the system by establishing multiplexed sub-connections between two endpoints of the tunnel.
.
As per claims 18 and 38, Haddad and Dutta teach the one or more non-transitory computer-readable media of claims 15 and 35. Haddad does not explicitly teach wherein the frame comprises an Internet Protocol (IP) header, a User Datagram Protocol (UDP) header, a Quick UDP Internet Connections (QUIC) header, and the data packet encapsulated within a QUIC datagram.
However, Dutta teaches wherein the frame comprises an Internet Protocol (IP) header, a User Datagram Protocol (UDP) header, a Quick UDP Internet Connections (QUIC) header, and the data packet encapsulated within a QUIC datagram (An IP header 210 contains an IPv4 or an IPv6 datagram header. The source and destination addresses are set to addresses of the source and destination routers of the underlay IP tunnel, respectively. Dutta, para [0085]) (the UDP Header 4103 and the QUIC Header 4104 belongs to the reliable delivery layer, because QUIC runs atop UDP.. Dutta, para [0471]), and the data packet encapsulated within a QUIC datagram (FIG. 58 is a block diagram of a packet including 5800 used for a GRE-in-QUIC encapsulation format according to some embodiments. Dutta, Fig. 58 para [0469]-[0473]).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention, to modify the System of Haddad in view of Dutta. One would be motivated to do so, to enhance the efficiency of the system by establishing multiplexed sub-connections between two endpoints of the tunnel.
As per claims 19 and 39, Haddad and Dutta teach the one or more non-transitory computer-readable media of claims 15 and 35. Haddad does not explicitly teach wherein the request further comprises a method field being set to CONNECT and a protocol field being set to CONNECT-UDP or CONNECT- IP.
However, Dutta teaches wherein the request further comprises a method field being set to CONNECT and a protocol field being set to CONNECT-UDP or CONNECT- IP (generates a TCP connect request [TCP] from the local port at the local IP address to port number GRE (6638) at the remote IP address. If the TCP connect request is rejected, then the router should act to limit unnecessary repetition attempts to establish the connection. Dutta, para [0284])( generates a QUIC connect request with Connection ID from one of the local IP addresses to the remote IP address. The QUIC connection request is a QUIC packet that carries data for cryptographic handshake and MLPN. The QUIC connection request is sent over a UDP packet. In the UDP packet, the local port number is set to any random value and destination port number is set to 80 or 443 or to a value administratively chosen for the entire network, to identify QUIC as the user protocol. Dutta, para [0571])( A data link header 505 is the link layer header that is used to reach the immediate next-hop in the IP network. For example, for an Ethernet link from a router to the IP next-hop, this header is an Ethernet Header. Dutta, para [0094]).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention, to modify the System of Haddad in view of Dutta. One would be motivated to do so, to enhance the efficiency of the system by establishing connections between two endpoints of the tunnel using different protocols.
As per claims 20 and 40, Haddad and Dutta teach the one or more non-transitory computer-readable media of claims 15 and 35,wherein the proxy server is a network node performing one or more User Plane Functions (UPFs) (FIG. 8 illustrates an example communication diagram of a user equipment (UE) 801 communicating via enhanced user plane function (E-UPF) 803 with enterprise application entities 806A-B using GBA/AKMA based VPNs between the end user device 801 and the enterprise application entities 806A-B. The enhanced user plane function (E-UPF) 803 may include a secure access secure edge (SASE) entity 804. Haddad, para [0100] and Fig. 8)
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to KHALID M ALMAGHAYREH whose telephone number is (571)272-0179. The examiner can normally be reached Monday - Thursday 8AM-5PM EST & Friday variable.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, RUPAL D./HARIA can be reached at (571)272-3880. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
Respectfully Submitted
/KHALID M ALMAGHAYREH/ Primary Examiner, Art Unit 2492
Prosecution Insights