DETAILED ACTION
Claims 1-20 have been examined and are pending.
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over US Pub. No. 2016/0212111 to Yang et al. (hereinafter “Yang”) and further in view of US Pub. No. 2013/0312094 to Zecheru (hereinafter “Zecheru”).
As to Claim 1, Yang discloses a computing system comprising processing circuitry and a storage device, wherein the processing circuitry has access to the storage device and is configured to:
collect information about interactions between user devices on a [private] network and a service provider computing system (Paragraph [0028] of Yang discloses the computer system receives a first request (operation 210) for information associated with a document (such as a web page), where the first request is associated with an authorized user authorized to access the information associated with the document);
enable a device [outside the private] network to request, based on the information about the interactions, data from the service provider computing system (Paragraph [0029] of Yang discloses the computer system provides a second request (operation 212) for the information associated with the document, where the second request includes credentials for an unauthorized user who lacks authorization to access the information associated with the document. Paragraph [0036] of Yang discloses the security technique may repeat or replay previous requests (such as the requests or traffic through targeted endpoints in a web page or website) with different identities to determine if the responses are other than null);
evaluate a response to the request to determine whether the response includes sensitive information (Paragraph [0036] of Yang discloses the security technique may repeat or replay previous requests (such as the requests or traffic through targeted endpoints in a web page or website) with different identities to determine if the responses are other than null); and
modify, based on the evaluation of the response, access by the user devices to the service provider computing system (Paragraph [0025] of Yang discloses After storing the response to the request from the unauthorized user, security engine 120 may analyze the response to the request from the unauthorized user based on a target pattern, and then may perform remedial action based on the analysis).
Yang does not explicitly disclose a private network and outside the private network.
However, Zecheru discloses this. Paragraph [0022] of Zecheru discloses communications interface 116 may be associated with a private network and/or one or more different IP address. Communications interface 116 may send or forward certain data packets (e.g., data packets identified as benign) toward an intended destination within a private or trusted network segment. Paragraph [0017] of Zecheru discloses an IP traffic simulator may surround an IPS, e.g., the IP traffic simulator may send packets to the IPS via a public network interface and receive the packets from the IPS via a private network interface.
It would have been obvious to one of ordinary skill in the art before the effective filing of the invention to combine the security screening system as disclosed by Yang, with implementing testing around a private network as disclosed by Zecheru. One of ordinary skill in the art would have been motivated to combine to apply a known technique to a known device ready for improvement to yield predictable results. Yang and Zecheru are directed toward security screen systems and as such it would be obvious to use the techniques of one in the other. Implementing the techniques of Zecheru in Yang would improve security.
As to Claim 2, Yang-Zecheru discloses the computing system of claim 1, wherein to enable the device outside the private network to request data, the processing circuitry is further configured to: output a signal to cause a separate collection computing system to request data (Paragraph [0017] of Zecheru discloses an IP traffic simulator may surround an IPS, e.g., the IP traffic simulator may send packets to the IPS via a public network interface and receive the packets from the IPS via a private network interface).
Examiner recites the same rationale to combine used for claim 1.
As to Claim 3, Yang-Zecheru discloses the computing system of claim 2, wherein to evaluate the response to the request, the processing circuitry is further configured to: determine that the separate collection computing system received the response from the service provider computing system (Paragraph [0017] of Zecheru discloses an IP traffic simulator may surround an IPS, e.g., the IP traffic simulator may send packets to the IPS via a public network interface and receive the packets from the IPS via a private network interface); and
determine that the response includes sensitive information (Paragraph [0025] of Yang discloses After storing the response to the request from the unauthorized user, security engine 120 may analyze the response to the request from the unauthorized user based on a target pattern, and then may perform remedial action based on the analysis).
Examiner recites the same rationale to combine used for claim 1.
As to Claim 4, Yang-Zecheru discloses the computing system of claim 3, wherein to modify access by the user devices, the processing circuitry is further configured to: block access to the service provider computing system (Paragraph [0025] of Yang discloses privileges in system 100 may be modified so that the information or content in the response is no longer provided in response to future requests from unauthorized users).
As to Claim 5, Yang-Zecheru discloses the computing system of claim 1, wherein to collect information about interactions, the processing circuitry is further configured to: collect information about the interactions using logged information (Paragraph [0024] of Yang discloses if the response is other than null, security engine 120 may selectively store or log the response in storage system 122 (or the response body to the replay request)).
As to Claim 6, Yang-Zecheru discloses the computing system of claim 1, wherein to collect information about interactions, the processing circuitry is further configured to: identify a network path associated with a data object accessed by at least one of the user devices at the service provider computing system (Paragraph [0028] of Yang discloses the computer system receives a first request (operation 210) for information associated with a document (such as a web page), where the first request is associated with an authorized user authorized to access the information associated with the document).
As to Claim 7, Yang-Zecheru discloses the computing system of claim 6, wherein to enable the device outside the private network to request data, the processing circuitry is further configured to: provide access to information about the network path (Paragraph [0029] of Yang discloses the computer system provides a second request (operation 212) for the information associated with the document, where the second request includes credentials for an unauthorized user who lacks authorization to access the information associated with the document).
As to Claim 8, Yang-Zecheru discloses the computing system of claim 1, wherein the service provider computing system is a first service provider computing system, wherein the information about interactions is information about a first set of interactions, wherein the response is a first response, and wherein the processing circuitry is further configured to:
collect information about a second set of interactions between user devices on the private network and a second service provider computing system (Paragraph [0028] of Yang discloses the computer system receives a first request (operation 210) for information associated with a document (such as a web page), where the first request is associated with an authorized user authorized to access the information associated with the document);
enable the device outside the private network to request, based on the information about the second set of interactions, data from the second service provider computing system (Paragraph [0029] of Yang discloses the computer system provides a second request (operation 212) for the information associated with the document, where the second request includes credentials for an unauthorized user who lacks authorization to access the information associated with the document. Paragraph [0036] of Yang discloses the security technique may repeat or replay previous requests (such as the requests or traffic through targeted endpoints in a web page or website) with different identities to determine if the responses are other than null);
evaluate a second response to determine whether the second response includes sensitive information (Paragraph [0036] of Yang discloses the security technique may repeat or replay previous requests (such as the requests or traffic through targeted endpoints in a web page or website) with different identities to determine if the responses are other than null); and
modify, based on the evaluation of the second response, access by the user devices to the second service provider computing system (Paragraph [0025] of Yang discloses After storing the response to the request from the unauthorized user, security engine 120 may analyze the response to the request from the unauthorized user based on a target pattern, and then may perform remedial action based on the analysis).
As to Claim 9, Yang-Zecheru discloses the computing system of claim 1, wherein to modify access, the processing circuitry is further configured to: configure a cloud access security broker to restrict access by the user devices to the service provider computing system (Paragraph [0025] of Yang discloses privileges in system 100 may be modified so that the information or content in the response is no longer provided in response to future requests from unauthorized users).
As to Claim 10, Yang discloses a method comprising:
collecting, by a computing system, information about interactions between user devices on a [private] network and a service provider computing system (Paragraph [0028] of Yang discloses the computer system receives a first request (operation 210) for information associated with a document (such as a web page), where the first request is associated with an authorized user authorized to access the information associated with the document);
enabling, by the computing system, a device [outside the private] network to request, based on the information about the interactions, data from the service provider computing system (Paragraph [0029] of Yang discloses the computer system provides a second request (operation 212) for the information associated with the document, where the second request includes credentials for an unauthorized user who lacks authorization to access the information associated with the document. Paragraph [0036] of Yang discloses the security technique may repeat or replay previous requests (such as the requests or traffic through targeted endpoints in a web page or website) with different identities to determine if the responses are other than null);
evaluating, by the computing system, a response to the request to determine whether the response includes sensitive information (Paragraph [0036] of Yang discloses the security technique may repeat or replay previous requests (such as the requests or traffic through targeted endpoints in a web page or website) with different identities to determine if the responses are other than null); and
modifying, based on the evaluation of the response, access by the user devices to the service provider computing system (Paragraph [0025] of Yang discloses After storing the response to the request from the unauthorized user, security engine 120 may analyze the response to the request from the unauthorized user based on a target pattern, and then may perform remedial action based on the analysis).
Yang does not explicitly disclose a private network and outside the private network.
However, Zecheru discloses this. Paragraph [0022] of Zecheru discloses communications interface 116 may be associated with a private network and/or one or more different IP address. Communications interface 116 may send or forward certain data packets (e.g., data packets identified as benign) toward an intended destination within a private or trusted network segment. Paragraph [0017] of Zecheru discloses an IP traffic simulator may surround an IPS, e.g., the IP traffic simulator may send packets to the IPS via a public network interface and receive the packets from the IPS via a private network interface.
Examiner recites the same rationale to combine used for claim 1.
As to Claim 11, Yang-Zecheru discloses the method of claim 10, wherein enabling the device outside the private network to request data includes: outputting a signal to cause a separate collection computing system to request data (Paragraph [0017] of Zecheru discloses an IP traffic simulator may surround an IPS, e.g., the IP traffic simulator may send packets to the IPS via a public network interface and receive the packets from the IPS via a private network interface).
Examiner recites the same rationale to combine used for claim 1.
As to Claim 12, Yang-Zecheru discloses the method of claim 11, wherein evaluating the response to the request includes: determining that the separate collection computing system received the response from the service provider computing system (Paragraph [0017] of Zecheru discloses an IP traffic simulator may surround an IPS, e.g., the IP traffic simulator may send packets to the IPS via a public network interface and receive the packets from the IPS via a private network interface); and
determining that the response includes sensitive information (Paragraph [0025] of Yang discloses After storing the response to the request from the unauthorized user, security engine 120 may analyze the response to the request from the unauthorized user based on a target pattern, and then may perform remedial action based on the analysis).
Examiner recites the same rationale to combine used for claim 1.
As to Claim 13, Yang-Zecheru discloses the method of claim 12, wherein modifying access by the user devices includes: blocking access to the service provider computing system (Paragraph [0025] of Yang discloses privileges in system 100 may be modified so that the information or content in the response is no longer provided in response to future requests from unauthorized users).
As to Claim 14, Yang-Zecheru discloses the method of claim 10, wherein collecting information about interactions includes: collecting information about the interactions using logged information (Paragraph [0024] of Yang discloses if the response is other than null, security engine 120 may selectively store or log the response in storage system 122 (or the response body to the replay request)).
As to Claim 15, Yang-Zecheru discloses the method of claim 10, wherein collecting information about interactions includes: identifying a network path associated with a data object accessed by at least one of the user devices at the service provider computing system (Paragraph [0028] of Yang discloses the computer system receives a first request (operation 210) for information associated with a document (such as a web page), where the first request is associated with an authorized user authorized to access the information associated with the document).
As to Claim 16, Yang-Zecheru discloses the method of claim 15, wherein enabling the device outside the private network to request data includes: providing access to information about the network path (Paragraph [0029] of Yang discloses the computer system provides a second request (operation 212) for the information associated with the document, where the second request includes credentials for an unauthorized user who lacks authorization to access the information associated with the document).
As to Claim 17, Yang-Zecheru discloses the method of claim 10, wherein the service provider computing system is a first service provider computing system, wherein the information about interactions is information about a first set of interactions, wherein the response is a first response, and wherein the method further comprises:
collecting, by the computing system, information about a second set of interactions between user devices on the private network and a second service provider computing system (Paragraph [0028] of Yang discloses the computer system receives a first request (operation 210) for information associated with a document (such as a web page), where the first request is associated with an authorized user authorized to access the information associated with the document);
enabling, by the computing system, the device outside the private network to request, based on the information about the second set of interactions, data from the second service provider computing system (Paragraph [0029] of Yang discloses the computer system provides a second request (operation 212) for the information associated with the document, where the second request includes credentials for an unauthorized user who lacks authorization to access the information associated with the document. Paragraph [0036] of Yang discloses the security technique may repeat or replay previous requests (such as the requests or traffic through targeted endpoints in a web page or website) with different identities to determine if the responses are other than null);
evaluating, by the computing system, a second response to determine whether the second response includes sensitive information (Paragraph [0036] of Yang discloses the security technique may repeat or replay previous requests (such as the requests or traffic through targeted endpoints in a web page or website) with different identities to determine if the responses are other than null); and
modifying, by the computing system and based on the evaluation of the second response, access by the user devices to the second service provider computing system (Paragraph [0025] of Yang discloses After storing the response to the request from the unauthorized user, security engine 120 may analyze the response to the request from the unauthorized user based on a target pattern, and then may perform remedial action based on the analysis) (Paragraph [0025] of Yang discloses After storing the response to the request from the unauthorized user, security engine 120 may analyze the response to the request from the unauthorized user based on a target pattern, and then may perform remedial action based on the analysis).
As to Claim 18, Yang-Zecheru discloses the method of claim 10, wherein modifying access includes: configuring a cloud access security broker to restrict access by the user devices to the service provider computing system (Paragraph [0025] of Yang discloses privileges in system 100 may be modified so that the information or content in the response is no longer provided in response to future requests from unauthorized users).
As to Claim 19, Yang discloses Non-transitory computer-readable storage media comprising instructions that, when executed, configure processing circuitry of a computing system to:
collect information about interactions between user devices on a [private] network and a service provider computing system (Paragraph [0028] of Yang discloses the computer system receives a first request (operation 210) for information associated with a document (such as a web page), where the first request is associated with an authorized user authorized to access the information associated with the document);
enable a device [outside the private] network to request, based on the information about the interactions, data from the service provider computing system (Paragraph [0029] of Yang discloses the computer system provides a second request (operation 212) for the information associated with the document, where the second request includes credentials for an unauthorized user who lacks authorization to access the information associated with the document. Paragraph [0036] of Yang discloses the security technique may repeat or replay previous requests (such as the requests or traffic through targeted endpoints in a web page or website) with different identities to determine if the responses are other than null);
evaluate a response to the request to determine whether the response includes sensitive information (Paragraph [0036] of Yang discloses the security technique may repeat or replay previous requests (such as the requests or traffic through targeted endpoints in a web page or website) with different identities to determine if the responses are other than null); and
modify, based on the evaluation of the response, access by the user devices to the service provider computing system (Paragraph [0025] of Yang discloses After storing the response to the request from the unauthorized user, security engine 120 may analyze the response to the request from the unauthorized user based on a target pattern, and then may perform remedial action based on the analysis).
Yang does not explicitly disclose a private network and outside the private network.
However, Zecheru discloses this. Paragraph [0022] of Zecheru discloses communications interface 116 may be associated with a private network and/or one or more different IP address. Communications interface 116 may send or forward certain data packets (e.g., data packets identified as benign) toward an intended destination within a private or trusted network segment. Paragraph [0017] of Zecheru discloses an IP traffic simulator may surround an IPS, e.g., the IP traffic simulator may send packets to the IPS via a public network interface and receive the packets from the IPS via a private network interface.
Examiner recites the same rationale to combine used for claim 1.
As to Claim 20, Yang-Zecheru discloses the non-transitory computer-readable media of claim 19, wherein the instructions that cause the processing circuitry to enable a device outside the private network to request data further include instructions that, when executed, further cause the processing circuitry to: output a signal to cause a separate collection computing system to request data (Paragraph [0017] of Zecheru discloses an IP traffic simulator may surround an IPS, e.g., the IP traffic simulator may send packets to the IPS via a public network interface and receive the packets from the IPS via a private network interface).
Examiner recites the same rationale to combine used for claim 1.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Kevin S Mai whose telephone number is (571)270-5001. The examiner can normally be reached Monday to Friday 9AM to 5PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Philip Chea can be reached at 5712723951. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/KEVIN S MAI/Primary Examiner, Art Unit 2499
Prosecution Insights