DETAILED ACTION
Claims 1-18 are examined and pending.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the claims at issue are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); and In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on a nonstatutory double patenting ground provided the reference application or patent either is shown to be commonly owned with this application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP §§ 706.02(l)(1) - 706.02(l)(3) for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/forms/. The filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to http://www.uspto.gov/patents/process/file/efs/guidance/eTD-info-I.jsp.
Claims 1-18 rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-18 of U.S. Patent No. 12,401,682. Although the claims at issue are not identical, they are not patentably distinct from each other because all the claimed limitations recited in the present application are transparently found in the Patent 12,401,682 with obvious wording variations. A comparison of the claims are shown below:
Pending Application 19/307806
Patent 12,401,682
1. A method for mitigating threats in a network, comprising: receiving, from a computing device, a first selection of a first threat mitigation system for protecting a target service; dynamically identifying available capacity of the threat mitigation system to deliver traffic to the target service; sending an indication of the available capacity to the computing device; receiving, from the computing device, a second selection of a desired capacity of the threat mitigation system; and automatically configuring, in response to the second selection, a first encapsulation tunnel for transmitting packets to the target service based on the desired capacity.
1. A method for mitigating threats in a network, comprising: receiving, from a computing device, a first selection of a first threat mitigation system for protecting a target service; dynamically identifying available capacity of the threat mitigation system to deliver traffic to the target service; sending an indication of the available capacity to the computing device; receiving, from the computing device, a second selection of a desired capacity of the threat mitigation system; and automatically configuring, in response to the second selection, a first encapsulation tunnel for transmitting packets to the target service based on the desired capacity, wherein identifying the available capacity comprises: automatically determining, from a plurality of scrubbing centers of the threat mitigation system, an optimal scrubbing center for the target service based on at least one of geographic proximity or latency between the plurality of scrubbing centers and the target service; and automatically determining existing routers in at least the optimal scrubbing center of the threat mitigation system, wherein the first router is one of the existing routers.
.
2. The method of claim 1, wherein the identifying the available capacity includes determining bandwidth of a network card in a first router of the first threat mitigation system.
2. The method of claim 1, wherein the identifying the available capacity includes determining bandwidth of a network card in a first router of the first threat mitigation system.
3. The method of claim 2, wherein the identifying the available capacity includes identifying a number of existing encapsulation tunnels configured on the network interface card.
3. The method of claim 2, wherein the identifying the available capacity includes identifying a number of existing encapsulation tunnels configured on the network interface card.
4. The method of claim 3, wherein the identifying the available capacity includes predicting usage of the existing encapsulation tunnels.
4. The method of claim 3, wherein the identifying the available capacity includes predicting usage of the existing encapsulation tunnels.
5. The method of claim 1, wherein the automatically configuring includes: configuring a router of the first threat mitigation system with an internet protocol (IP) address of a router at the target service; and transmitting a first signaling message to a router of the target service including an IP address of the router of the first threat mitigation system and instructions for configuring the first encapsulation tunnel at the router of the target service.
5. The method of claim 1, wherein the automatically configuring includes: configuring a router of the first threat mitigation system with an internet protocol (IP) address of a router at the target service; and transmitting a first signaling message to a router of the target service including an IP address of the router of the first threat mitigation system and instructions for configuring the first encapsulation tunnel at the router of the target service.
6. The method of claim 5 further comprising: identifying a second threat mitigation system; concurrently with the configuring of the router of the first threat mitigation system, configuring a router of the second threat mitigation system with an internet protocol (IP) address of the router at the target service; and transmitting, concurrently with the first signaling message, a second signaling message to the router at the target service including routing parameters of the router of the second threat mitigation system and instructions for configuring a second encapsulation tunnel at the router of the target service.
6. The method of claim 5 further comprising: identifying a second threat mitigation system; concurrently with the configuring of the router of the first threat mitigation system, configuring a router of the second threat mitigation system with an internet protocol (IP) address of the router at the target service; and transmitting, concurrently with the first signaling message, a second signaling message to the router at the target service including routing parameters of the router of the second threat mitigation system and instructions for configuring a second encapsulation tunnel at the router of the target service.
7. The method of claim 1 further comprising: receiving, by the first threat mitigation system, instructions for packet filtering from a threat intelligence service; receiving, at the first threat mitigation system, a network packet directed to the target service; determining, by the first threat mitigation system, whether to forward the network packet based on the instructions; in response to a determination to forward the network packet based on the instructions, transmitting the packet via the first encapsulation tunnel to the target service.
7. The method of claim 1 further comprising: receiving, by the first threat mitigation system, instructions for packet filtering from a threat intelligence service; receiving, at the first threat mitigation system, a network packet directed to the target service; determining, by the first threat mitigation system, whether to forward the network packet based on the instructions; in response to a determination to forward the network packet based on the instructions, transmitting the packet via the first encapsulation tunnel to the target service.
8. The method of claim 1 further comprising: wherein the available capacity comprises multiple available bandwidths, and wherein the second selection comprises one of the multiple available bandwidths.
8. The method of claim 1 further comprising: wherein the available capacity comprises multiple available bandwidths, and wherein the second selection comprises one of the multiple available bandwidths.
9. A method for mitigating threats in a network, comprising: causing display of a plurality of scrubbing centers of a threat mitigation system; receiving, from a computing device, a first selection of a particular scrubbing center of the plurality of scrubbing centers for protecting a target service; dynamically calculating available capacity of at least the particular scrubbing center to deliver traffic to the target service; causing display of one or more bandwidth options for an encapsulation tunnel originating from the particular scrubbing center, wherein the one or more bandwidth options is at or below the available capacity; receiving, from the computing device, a second selection of a desired bandwidth for the particular scrubbing center; automatically configuring, in response to the second selection, a first encapsulation tunnel with the desired bandwidth for transmitting packets to the target service; receiving, by the first scrubbing center a network packet directed to the target service; determining, by the first scrubbing center, whether to forward the network packet to the target service; and in response to determining to forward the network packet to the target service, transmitting the packet to the target service via the encapsulation tunnel.
9. A method for mitigating threats in a network, comprising: causing display of a plurality of scrubbing centers of a threat mitigation system; receiving, from a computing device, a first selection of a particular scrubbing center of the plurality of scrubbing centers for protecting a target service; dynamically calculating available capacity of at least the particular scrubbing center to deliver traffic to the target service; causing display of one or more bandwidth options for an encapsulation tunnel originating from the particular scrubbing center, wherein the one or more bandwidth options is at or below the available capacity; receiving, from the computing device, a second selection of a desired bandwidth for the particular scrubbing center; automatically configuring, in response to the second selection, a first encapsulation tunnel with the desired bandwidth for transmitting packets to the target service; receiving, by the first scrubbing center a network packet directed to the target service; determining, by the first scrubbing center, whether to forward the network packet to the target service; and in response to determining to forward the network packet to the target service, transmitting the packet to the target service via the encapsulation tunnel, wherein calculating the available capacity comprises: automatically determining, from a plurality of scrubbing centers of the threat mitigation system, an optimal scrubbing center for the target service based on at least one of geographic proximity or latency between the plurality of scrubbing centers and the target service; and determining existing routers in at least the optimal scrubbing center of the threat mitigation system, wherein the first router is one of the existing routers.
10. The method of claim 9, wherein dynamically calculating available capacity comprises determining bandwidth of a network card in a first router of the particular scrubbing center.
10. The method of claim 9, wherein dynamically calculating available capacity comprises determining bandwidth of a network card in a first router of the particular scrubbing center.
11. The method of claim 10, wherein dynamically calculating available capacity comprises identifying a number of existing encapsulation tunnels configured on the network interface card.
12. The method of claim 11, wherein dynamically calculating available capacity comprises includes predicting usage of the existing encapsulation tunnels.
11. The method of claim 10, wherein dynamically calculating available capacity comprises identifying a number of existing encapsulation tunnels configured on the network interface card.
12. The method of claim 11, wherein dynamically calculating available capacity comprises includes predicting usage of the existing encapsulation tunnels.
13. A system for mitigating threats in a network, comprising: at least one processor; and memory, operatively connected to the at least one processor and storing instructions that, when executed by the at least one processor, cause the system to perform a method, the method comprising: receiving, from a computing device, a first selection of a first threat mitigation system for protecting a target service; dynamically identifying available capacity of the threat mitigation system to deliver traffic to the target service; sending an indication of the available capacity to the computing device; receiving, from the computing device, a second selection of a desired capacity of the first threat mitigation system; and automatically configuring, in response to the second selection, a first encapsulation tunnel for transmitting packets to the target service based on the desired capacity.
13. A system for mitigating threats in a network, comprising: at least one processor; and memory, operatively connected to the at least one processor and storing instructions that, when executed by the at least one processor, cause the system to perform a method, the method comprising: receiving, from a computing device, a first selection of a first threat mitigation system for protecting a target service; dynamically identifying available capacity of the threat mitigation system to deliver traffic to the target service; sending an indication of the available capacity to the computing device; receiving, from the computing device, a second selection of a desired capacity of the first threat mitigation system; and automatically configuring, in response to the second selection, a first encapsulation tunnel for transmitting packets to the target service based on the desired capacity, wherein identifying the available capacity comprises: automatically determining, from a plurality of scrubbing centers of the threat mitigation system, an optimal scrubbing center for the target service based on at least one of geographic proximity or latency between the plurality of scrubbing centers and the target service; and automatically determining existing routers in at least the optimal scrubbing center of the threat mitigation system, wherein the first router is one of the existing routers.
14. The system of claim 13, wherein the identifying the available capacity includes determining bandwidth of a network card in a first router of the first threat mitigation system, identifying a number of existing encapsulation tunnels configured on the network interface card, and predicting usage of the existing encapsulation tunnels.
14. The system of claim 13, wherein the identifying the available capacity includes determining bandwidth of a network card in a first router of the first threat mitigation system, identifying a number of existing encapsulation tunnels configured on the network interface card, and predicting usage of the existing encapsulation tunnels.
15. The system of claim 13, wherein the automatically configuring includes: configuring a router of the first threat mitigation system with an internet protocol (IP) address of a router at the target service; and transmitting a first signaling message to a router of the target service including an IP address of the router of the first threat mitigation system and instructions for configuring the first encapsulation tunnel at the router of the target service.
15. The system of claim 13, wherein the automatically configuring includes: configuring a router of the first threat mitigation system with an internet protocol (IP) address of a router at the target service; and transmitting a first signaling message to a router of the target service including an IP address of the router of the first threat mitigation system and instructions for configuring the first encapsulation tunnel at the router of the target service.
16. The system of claim 15, wherein the method further comprises: identifying a second threat mitigation system; concurrently with the configuring of the router of the first threat mitigation system, configuring a router of the second threat mitigation system with an internet protocol (IP) address of the router at the target service; and transmitting, concurrently with the first signaling message, a second signaling message to the router at the target service including routing parameters of the router of the second threat mitigation system and instructions for configuring a second encapsulation tunnel at the router of the target service.
16. The system of claim 15, wherein the method further comprises: identifying a second threat mitigation system; concurrently with the configuring of the router of the first threat mitigation system, configuring a router of the second threat mitigation system with an internet protocol (IP) address of the router at the target service; and transmitting, concurrently with the first signaling message, a second signaling message to the router at the target service including routing parameters of the router of the second threat mitigation system and instructions for configuring a second encapsulation tunnel at the router of the target service.
17. The system of claim 13, wherein the method further comprises: receiving, by the first threat mitigation system, instructions for packet filtering from a threat intelligence service; receiving, at the first threat mitigation system, a network packet directed to the target service; determining, by the first threat mitigation system, whether to forward the network packet based on the instructions; in response to a determination to forward the network packet based on the instructions, transmitting the packet via the first encapsulation tunnel to the target service.
17. The system of claim 13, wherein the method further comprises: receiving, by the first threat mitigation system, instructions for packet filtering from a threat intelligence service; receiving, at the first threat mitigation system, a network packet directed to the target service; determining, by the first threat mitigation system, whether to forward the network packet based on the instructions; in response to a determination to forward the network packet based on the instructions, transmitting the packet via the first encapsulation tunnel to the target service.
18. The system of claim 13, wherein the method further comprises: wherein the available capacity comprises multiple available bandwidths, and wherein the second selection comprises one of the multiple available bandwidths.
18. The system of claim 13, wherein the method further comprises: wherein the available capacity comprises multiple available bandwidths, and wherein the second selection comprises one of the multiple available bandwidths.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Smith (U.S. 2021/0084067 A1, hereinafter “Smith”) in view of Smith et al. (U.S. 2016/0241590 A1).
As to claims 1, 9, 13, Smith discloses a method for mitigating threats in a network, comprising:
receiving, from a computing device (controller or orchestrator device), a first selection of a first threat mitigation system for protecting a target service (para.[0015]; discloses a controller or orchestrator device or system associated with the scrubbing architecture to control which scrubber of the scrubbing architecture is tasked with scrubbing packets);
dynamically identifying available capacity of the threat mitigation system to deliver traffic to the target service (para.[0015]; discloses dynamically shift scrubbing services based on information received of a potential DDoS attack);
sending an indication of the available capacity to the computing device (para.[0023]; discloses the large scrubbers 206-210 and the small scrubbers 212-222 may provide the same scrubbing service to traffic received at the scrubber. The designations of “large” and “small” may therefore refer to other aspects of the scrubbing devices);
However Smith does not explicitly disclose receiving, from the computing device, a second selection of a desired capacity; and automatically configuring, in response to the second selection, a first encapsulation tunnel for transmitting packets to the target service based on the desired capacity.
In an analogous art, Smith et al. discloses receiving, from the computing device, a second selection of a desired capacity (para.[0035]; discloses upon arriving at one of the data scrubbers a server is selected using load balancing technique);
and automatically configuring, in response to the second selection, a first encapsulation tunnel for transmitting packets to the target service based on the desired capacity (para.[0035]; discloses transmits the traffic through the MPLS tunnel 125 (or other tunnel), which encapsulates IP addresses of the traffic and prevents normal routing of the filtered traffic (which might cause the traffic to be routed back to the data scrubbers 110,).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Smith by incorporating the function to select a target server using encapsulated MPLS tunnel as taught by Smith et al. in order to help block undesirable traffic such traffic part of DDoS attack. (see Smith et al., para. [0023])
As to claim 2, Smith-Smith et al. discloses the method of claim 1, wherein the identifying the available capacity includes determining bandwidth of a network card in a first router of the first threat mitigation system (Smith, para. [0018]; discloses the scrubbers have large bandwidth and small bandwidth that are linked to a network card connected to the scrubber) .
As to claim 3, Smith-Smith et al. discloses the method of claim 2, wherein the identifying the available capacity includes identifying a number of existing encapsulation tunnels configured on the network interface card (Smith et al. para.[0034]; discloses a DS router (e.g., 115a) receiving traffic from an data scrubber (e.g., 110a) can implement load balancing among the servers 105 by selecting different tunnels (e.g., 125a, 125b, 125c) or different static routes (e.g., 150a, 150b, 150c) in any desired fashion (e.g., round robin, etc.) when routing traffic to the servers).
As to claim 4, Smith-Smith et al. discloses the method of claim 3, wherein the identifying the available capacity includes predicting usage of the existing encapsulation tunnels (Smith et al., para.[0043]; discloses a DS router could use a round robin (or other load balancing) algorithm to select tunnels and/or unicast IP addresses on which to transmit injected, filtered traffic, in order to provide load balancing on the servers while still providing for anycast data scrubbers and anycast servers).
As to claim 5, Smith-Smith et al. discloses the method of claim 1, wherein the automatically configuring includes: configuring a router of the first threat mitigation system with an internet protocol (IP) address of a router at the target service; and transmitting a first signaling message to a router of the target service including an IP address of the router of the first threat mitigation system (Smith, para. [0043]; discloses the orchestrator 122 may distribute the scrubbing profile associated with the attacked IP addresses to the small scrubber 212 or other tier of the scrubbing architecture 120. As above, the small scrubber 212 may again announce, in a BGP session or other address announcement, the IP addresses of the destination device 110 to receive the traffic intended for the destination device) and instructions for configuring the first encapsulation tunnel at the router of the target service (Smith et al., para.[0035]; discloses transmits the traffic through the MPLS tunnel 125 (or other tunnel), which encapsulates IP addresses of the traffic and prevents normal routing of the filtered traffic (which might cause the traffic to be routed back to the data scrubbers 110,).
As to claim 6, Smith-Smith et al. discloses the method of claim 6 further comprising: identifying a second threat mitigation system; concurrently with the configuring of the router of the first threat mitigation system, configuring a router of the second threat mitigation system with an internet protocol (IP) address of the router at the target service; and transmitting, concurrently with the first signaling message, a second signaling message to the router at the target service including routing parameters of the router of the second threat mitigation system and instructions for configuring a second encapsulation tunnel at the router of the target service (Smith, para. [0043]; discloses orchestrator distributing to the small scrubber 212 may again announce, in a BGP session or other address announcement to other tiers of the scrubbing architecture, the IP addresses of the destination device 110 to receive the traffic intended for the destination device).
As to claim 7, Smith-Smith et al. discloses the method of claim 1 further comprising: receiving, by the first threat mitigation system, instructions for packet filtering from a threat intelligence service; receiving, at the first threat mitigation system, a network packet directed to the target service; determining, by the first threat mitigation system, whether to forward the network packet based on the instructions; in response to a determination to forward the network packet based on the instructions, transmitting the packet via the first encapsulation tunnel to the target service (Smith, para.[0029]; discloses the scrubbing devices of the architecture 102 analyze communication packets to determine if such packets may be potentially malicious to a destination device, such as by being part of a DDOS attack, and remove or reroute such packets before reaching the destination device 110. As explained in more detail below, the scrubbing controller 316 and/or the orchestrator 122 may control the operation of the scrubbing devices of the architecture 120, such as configuring the scrubbing devices with scrubbing profiles that instructs the scrubbing devices on the scrubbing services to apply to received packets. The incoming stream of communication packets for the destination device 110 that is scrubbed in the scrubbing architecture 120 may then be transmitted to the clean router 304 which provides the cleaned stream of packets to the VPN 322 over connection ).
As to claim 8, Smith-Smith et al. discloses the method of claim 1 further comprising: wherein the available capacity comprises multiple available bandwidths, and wherein the second selection comprises one of the multiple available bandwidths (Smith, para. [0040]; discloses the scrubbing architecture 120 may include other tiers that correspond to other threshold values such that traffic for the destination device 110 may be transferred to a tier based on the threshold value associated with the tier. In this manner the traffic for the destination device 110 may move up the tiers of the architecture 120 to scrubbing devices with larger and larger input bandwidths to accommodate larger and larger incoming attacks. Further, in one instance, the large scrubbers 206-210 (or any other scrubber of the architecture 120) may be geographically located near known originations of DDOS attacks).
As to claim 9, Smith discloses a method for mitigating threats in a network, comprising:
causing display of a plurality of scrubbing centers of a threat mitigation system;
receiving, from a computing device, a first selection of a particular scrubbing center of the plurality of scrubbing centers for protecting a target service (para.[0015]; discloses a controller or orchestrator device or system associated with the scrubbing architecture to control which scrubber of the scrubbing architecture is tasked with scrubbing packets);
dynamically calculating available capacity of at least the particular scrubbing center to deliver traffic to the target service (para.[0015]; discloses dynamically shift scrubbing services based on information received of a potential DDoS attack);
causing display of one or more bandwidth options for an encapsulation tunnel originating from the particular scrubbing center, wherein the one or more bandwidth options is at or below the available capacity (para. [0024]; discloses each tier of the scrubbing architecture may include scrubbing devices that differ in some aspect from scrubbers of other tiers in the architecture . For example, a first tier may include scrubbers with 600 gigabytes per second (Gbps) of bandwidth, a second tier may include scrubbers with 250 Gbps of bandwidth, and a third tier may include scrubbers with 100 Gbps of bandwidth. );
receiving, by the first scrubbing center a network packet directed to the target service; (para.[0029]; discloses the scrubbing devices of the architecture 102 analyze communication packets to determine if such packets may be potentially malicious to a destination device, such as by being part of a DDOS attack, and remove or reroute such packets before reaching the destination device 110. As explained in more detail below, the scrubbing controller 316 and/or the orchestrator 122 may control the operation of the scrubbing devices of the architecture 120, such as configuring the scrubbing devices with scrubbing profiles that instructs the scrubbing devices on the scrubbing services to apply to received packets.)
determining, by the first scrubbing center, whether to forward the network packet to the target service; and in response to determining to forward the network packet to the target service, transmitting the packet to the target service via the encapsulation tunnel.(para. [0029]; discloses The incoming stream of communication packets for the destination device 110 that is scrubbed in the scrubbing architecture 120 may then be transmitted to the clean router 304 which provides the cleaned stream of packets to the VPN 322 over connection ).
However Smith does not explicitly disclose receiving, from the computing device, a second selection of a desired bandwidth for the particular scrubbing center; automatically configuring, in response to the second selection, a first encapsulation tunnel with the desired bandwidth for transmitting packets to the target service.
In an analogous art, Smith et al. discloses receiving, from the computing device, a second selection of a desired bandwidth for the particular scrubbing center (para.[0035]; discloses upon arriving at one of the data scrubbers a server is selected using load balancing technique); and
automatically configuring, in response to the second selection, a first encapsulation tunnel with the desired bandwidth for transmitting packets to the target service (para.[0035]; discloses transmits the traffic through the MPLS tunnel 125 (or other tunnel), which encapsulates IP addresses of the traffic and prevents normal routing of the filtered traffic (which might cause the traffic to be routed back to the data scrubbers 110,).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Smith by incorporating the function to select a target server using encapsulated MPLS tunnel as taught by Smith et al. in order to help block undesirable traffic such traffic part of DDoS attack. (see Smith et al., para. [0023])
As to claim 10, Smith-Smith et al. discloses the method of claim 10, wherein dynamically calculating available capacity comprises determining bandwidth of a network card in a first router of the particular scrubbing center (Smith, para. [0018]; discloses the scrubbers have large bandwidth and small bandwidth that are linked to a network card connected to the scrubber) .
As to claim 11, Smith-Smith et al. discloses the method of claim 10, wherein dynamically calculating available capacity comprises identifying a number of existing encapsulation tunnels configured on the network interface card (Smith et al. para.[0034]; discloses a DS router (e.g., 115a) receiving traffic from an data scrubber (e.g., 110a) can implement load balancing among the servers 105 by selecting different tunnels (e.g., 125a, 125b, 125c) or different static routes (e.g., 150a, 150b, 150c) in any desired fashion (e.g., round robin, etc.) when routing traffic to the servers).
As to claim 12, Smith-Smith et al. discloses the method of claim 11, wherein dynamically calculating available capacity comprises includes predicting usage of the existing encapsulation tunnels (Smith et al., para.[0043]; discloses a DS router could use a round robin (or other load balancing) algorithm to select tunnels and/or unicast IP addresses on which to transmit injected, filtered traffic, in order to provide load balancing on the servers while still providing for anycast data scrubbers and anycast servers).
As to claim 14, Smith-Smith et al. discloses the system of claim 13, wherein the identifying the available capacity includes determining bandwidth of a network card in a first router of the first threat mitigation system (Smith, para. [0018]; discloses the scrubbers have large bandwidth and small bandwidth that are linked to a network card connected to the scrubber), identifying a number of existing encapsulation tunnels configured on the network interface card (Smith et al. para.[0034]; discloses a DS router (e.g., 115a) receiving traffic from an data scrubber (e.g., 110a) can implement load balancing among the servers 105 by selecting different tunnels (e.g., 125a, 125b, 125c) or different static routes (e.g., 150a, 150b, 150c) in any desired fashion (e.g., round robin, etc.) when routing traffic to the servers), and predicting usage of the existing encapsulation tunnels (Smith et al., para.[0043]; discloses a DS router could use a round robin (or other load balancing) algorithm to select tunnels and/or unicast IP addresses on which to transmit injected, filtered traffic, in order to provide load balancing on the servers while still providing for anycast data scrubbers and anycast servers).
As to claim 15, Smith-Smith et al. discloses the system of claim 13, wherein the automatically configuring includes: configuring a router of the first threat mitigation system with an internet protocol (IP) address of a router at the target service; and transmitting a first signaling message to a router of the target service including an IP address of the router of the first threat mitigation system (Smith, para. [0043]; discloses the orchestrator 122 may distribute the scrubbing profile associated with the attacked IP addresses to the small scrubber 212 or other tier of the scrubbing architecture 120. As above, the small scrubber 212 may again announce, in a BGP session or other address announcement, the IP addresses of the destination device 110 to receive the traffic intended for the destination device) and instructions for configuring the first encapsulation tunnel at the router of the target service (Smith et al., para.[0035]; discloses transmits the traffic through the MPLS tunnel 125 (or other tunnel), which encapsulates IP addresses of the traffic and prevents normal routing of the filtered traffic (which might cause the traffic to be routed back to the data scrubbers 110,).
As to claim 16, Smith-Smith et al. discloses the system of claim 15, wherein the method further comprises: identifying a second threat mitigation system; concurrently with the configuring of the router of the first threat mitigation system, configuring a router of the second threat mitigation system with an internet protocol (IP) address of the router at the target service; and transmitting, concurrently with the first signaling message, a second signaling message to the router at the target service including routing parameters of the router of the second threat mitigation system and instructions for configuring a second encapsulation tunnel at the router of the target service (Smith, para. [0043]; discloses orchestrator distributing to the small scrubber 212 may again announce, in a BGP session or other address announcement to other tiers of the scrubbing architecture, the IP addresses of the destination device 110 to receive the traffic intended for the destination device).
As to claim 17, Smith-Smith et al. discloses the system of claim 13, wherein the method further comprises: receiving, by the first threat mitigation system, instructions for packet filtering from a threat intelligence service; receiving, at the first threat mitigation system, a network packet directed to the target service; determining, by the first threat mitigation system, whether to forward the network packet based on the instructions; in response to a determination to forward the network packet based on the instructions, transmitting the packet via the first encapsulation tunnel to the target service (Smith, para.[0029]; discloses the scrubbing devices of the architecture 102 analyze communication packets to determine if such packets may be potentially malicious to a destination device, such as by being part of a DDOS attack, and remove or reroute such packets before reaching the destination device 110. As explained in more detail below, the scrubbing controller 316 and/or the orchestrator 122 may control the operation of the scrubbing devices of the architecture 120, such as configuring the scrubbing devices with scrubbing profiles that instructs the scrubbing devices on the scrubbing services to apply to received packets. The incoming stream of communication packets for the destination device 110 that is scrubbed in the scrubbing architecture 120 may then be transmitted to the clean router 304 which provides the cleaned stream of packets to the VPN 322 over connection ).
As to claim 18, Smith-Smith et al. discloses the system of claim 13, wherein the method further comprises: wherein the available capacity comprises multiple available bandwidths, and wherein the second selection comprises one of the multiple available bandwidths (Smith, para. [0040]; discloses the scrubbing architecture 120 may include other tiers that correspond to other threshold values such that traffic for the destination device 110 may be transferred to a tier based on the threshold value associated with the tier. In this manner the traffic for the destination device 110 may move up the tiers of the architecture 120 to scrubbing devices with larger and larger input bandwidths to accommodate larger and larger incoming attacks. Further, in one instance, the large scrubbers 206-210 (or any other scrubber of the architecture 120) may be geographically located near known originations of DDOS attacks).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Azaria et al. (U.S. 2021/0185083 A1) discloses network devices implementing a scrubbing center for mitigating distributed denial of service attacks, where the scrubbing center is communicatively coupled to a plurality of clients and one or more servers. The method includes determining a set of packet fingerprints seen in a set of packets sent between the plurality of clients and the one or more servers, assigning a risk value to each packet fingerprint in the set of packet fingerprints based on analyzing previous security decisions made for packets having that packet fingerprint, and responsive to detecting an occurrence of a potential distributed denial of service attack, activating a security measure for each of one or more packet fingerprints in the set of packet fingerprints based on the risk value assigned to that packet fingerprint.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JOE CHACKO whose telephone number is (571)270-3318. The examiner can normally be reached Monday-Friday 7am-5pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Ario Etienne can be reached on 5712724001. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/JOE CHACKO/Primary Examiner, Art Unit 2457
Prosecution Insights