Remarks
Claims 1, 3, 8, 10, 11, and 18-20 are pending.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 5/1/2026 has been entered.
Response to Arguments
Applicant's arguments filed 5/1/2026 have been fully considered but they are not persuasive.
Applicant alleges “In the Notice, the Examiner asserted that the claims have not been properly amended with the appropriate markings. In particular, the Examiner pointed to the end of claim 1, which included an underlining under the period.” While the Examiner did send out a notice of non-compliant amendment, the notice being responded to here was sent by a Legal Instruments Examiner. The Examiner had sent out a notice of non-compliant amendment in response to the after final amendment, and Applicant was already given an opportunity to correct the issues without receiving a second one from the LIE noted in the second notice of non-compliant amendment.
Applicant's arguments filed 2/18/2026 have been fully considered but they are not persuasive.
With respect to Applicant’s allegations on pages 8-9 regarding Brown and the identity profile of the claims, it is noted that Brown explicitly discloses that a separate profile may be created for each client (e.g., paragraph 36: “consumer profiles 126 can include data regarding respective clients”). These can be generated from data in an identity and access management platform, such as in paragraph 36: “data from multiple accounts in the identity repository 122 can be linked to or otherwise associated with a given consumer profile 126”.
Another way in which Brown meets this is in the consumer profiles being generated using data from contributor computing devices (e.g., paragraph 36: “data included in the consumer profiles 126 can be received from one or more contributor computing systems 102” where “contributor computing system 102 can include any computing device or group of computing devices operated by an online merchant, an e-commerce system, an employer, a payroll system, a human-resource management system, an insurance provider system, a healthcare provider system, a government data-provider system, etc.” as in paragraph 23, for example). These are simply examples of how Brown discloses the generating limitation being argued.
With respect to Applicant’s allegations spanning pages 9-10, it is noted that the features upon which applicant relies (i.e., specification, paragraph 4 and 60, for example) are not recited in the rejected claim(s). Although the claims are interpreted in light of the specification, limitations from the specification are not read into the claims. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993).
With respect to Applicant’s allegations regarding Brown on page 10 in section ii, Brown certainly discloses log message data, in the fashion described in the rejection, and Applicant has not provided any argument there against. For example, the rejection rejects the limitation receiving first log message data, the first log message data including log objects including a first log object corresponding to the first object classification and being free of any log object corresponding to the second object classification with Brown’s disclosure of each profile being associated with keys, such as any of the data/information that is stored therein or could be stored therein, and historical, transaction, account, etc. data that may be added to with any of the data/information, accessing of the profiles described above, transmitting of fraud related messaging, including fraud warning, no fraud warnings, etc., as examples. For example, receiving any data, such as transaction data, account data, ID data, or any other data used in the below detection. Clearly, here the log message data is described as “any of the data/information that is stored therein or could be stored therein, and historical, transaction, account, etc.” (with “therein” being with respect to the profile). Applicant has simply ignored what the rejection cites against the log data. The specification stats that “Log message data may include machine-readable data generated in response to occurrences on one or more networks” and Applicant fails to explain why Applicant believes this extremely broad definition of log message data is not met by the data generated from the occurrences on networks in Brown.
With respect to Applicant’s allegations regarding Petersen in section ii, Petersen quite explicitly enriches log message data with keys: “one manner of enriching structured data such as log messages with geolocation information which may be used in subsequent processing of the log messages” and “locations for the log message may be written to additional reporting fields that may be appropriately appended to the raw text of the log message for subsequent processing”, as examples (Paragraphs 243 and 245). Petersen also discloses that these locations may be correlated with identifiers (e.g., paragraph 242), and, thus, associated with the profiles and enabling identification thereof, since the identifier and location can be correlated.
With respect to Applicant’s allegations in section iii, Brown clearly discloses using the enriched first log message data to monitor the one or more data systems and generate monitoring information based at least in part on the first identity profile, wherein the using comprises processing the enriched first log message data with at least one processing rule using the respective key in Brown’s disclosure of detecting fraud or the like with the profiles, which include the keys, as shown above and below, and they are processed using a rule (e.g., the rules used to detect fraud, for example, in paragraphs 41 and 50).
Petersen is also cited as rejecting this limitation, for example, in Petersen’s disclosure of processing of logs using keys, such as location, and rules, for example (e.g., “the enriched log message may be processed 732 using at least one processing rule” where “one manner of enriching structured data such as log messages with geolocation information which may be used in subsequent processing of the log messages” and “locations for the log message may be written to additional reporting fields that may be appropriately appended to the raw text of the log message for subsequent processing”, as examples).
Claim Interpretation
Applicant explicitly disclaims all claim interpretations that are not performed by a physical computer machine in pages 10-12 of the response dated 11/14/2022.
The claims include subject matter that does not affect claim scope, such as anywhere “enabling” or similar language is used. This is intended use and does not need to be performed.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1, 3, 8, 10, 11, and 18-20 are rejected under 35 U.S.C. 103 as being unpatentable over Brown (U.S. Patent Application Publication 2020/0145436) in view of Petersen (U.S. Patent Application Publication 2012/0246303).
Regarding Claim 1,
Brown discloses a computer implemented method performed by one or more processors in a data network monitoring system, the data network monitoring system monitoring one or more data platforms of one or more data systems, comprising:
(Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, 62-69, and associated figures; this is the system of Brown that implements Brown’s invention, perhaps as a fraud detection computing system, portion thereof, or the like, as examples);
Obtaining, from a first database of a first IAM platform, first objects of at least a first object classification of a plurality of object classifications, wherein the first database has a first plurality of unique identities of an organization and a first plurality of objects, each one of the unique identities of the first plurality of unique identities comprising one of a person and a group of people, wherein one or more objects of the first plurality of objects is associated with each of the unique identities of the first plurality of unique identities, wherein the first plurality of objects corresponds to respective ones of the plurality of object classifications (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 46, 47, 49-53, 56-61, and associated figures; objects from various entities including databases, each associated with an identity (e.g., an account, user, identity, or the like), classified in any of many classifications (e.g., synthetic, primary, secondary, fraud facilitating, associated, presence of transactions, absence of transactions, flagged, credit, financial, account, contributor, ID, client, sensitive data, transaction, data from certain entity, legal name, company name, social insurance number, credit card number, date, email address, and many other classifications), for example);
Obtaining, from the first IAM platform, second objects of at least a second object classification of the plurality of object classifications, the first and second object classifications being different (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 46, 47, 49-53, 56-61, and associated figures; get objects of a second of the above, for example);
Generating, for each unique identity of the first plurality of unique identities, an identity profile with individual ones of the respective obtained objects of the first and second object classifications corresponding to each unique identity, wherein a first plurality of identity profiles are generated for the organization from the first objects of the first IAM platform (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38, 46, 47, 49-53, 56-61, and associated figures; generating a profile, which could be explicitly called a profile, or some other data, such as any data/information stored regarding a certain identity, including relationships/associations between entities, for example);
Assigning, based upon a respective object classification corresponding to each object, an object type of a plurality of object types to each object in each of the first plurality of identity profiles, wherein the plurality of object types comprises a first object type and a different second object type, wherein objects of the first object type distinguish between the unique identities of the first plurality of unique identities (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 29, 30, 33-36, 38, 46, 47, 49-53, 56-61, and associated figures; assigning an object type, such as one of the ones described above, for example);
Storing the first plurality of identity profiles in a second database (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38, 46, 47, 49-53, 56-61, and associated figures; storing the above described profiles, for example);
Associating each identity profile of the first plurality of identity profiles with a different respective key such that each of the different respective keys distinguishes an associated identity profile from all other identity profiles of the first plurality of identity profiles, wherein different respective keys are distinct from data of the first plurality of identity profiles (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; each profile is associated with keys, such as any of the data/information that is stored therein or could be stored therein, and historical, transaction, account, etc. data that may be added to with any of the data/information, accessing of the profiles described above, transmitting of fraud related messaging, including fraud warning, no fraud warnings, etc., as examples. Each of these keys noted above are distinct from other data in this profile as well as distinct from all data in all other profiles);
Receiving first log message data, the first log message data including log objects including a first log object corresponding to the first object classification and being free of any log object corresponding to the second object classification (Exemplary Citations: for example, Abstract, Paragraphs 5, 12-16, 18, 20, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; each profile is associated with keys, such as any of the data/information that is stored therein or could be stored therein, and historical, transaction, account, etc. data that may be added to with any of the data/information, accessing of the profiles described above, transmitting of fraud related messaging, including fraud warning, no fraud warnings, etc., as examples. For example, receiving any data, such as transaction data, account data, ID data, or any other data used in the below detection);
Detecting that at least one of the log objects present in the received first log message data is of the first object type (Exemplary Citations: for example, Abstract, Paragraphs 5, 12-16, 18, 20, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; each profile is associated with keys, such as any of the data/information that is stored therein or could be stored therein, and historical, transaction, account, etc. data that may be added to with any of the data/information, accessing of the profiles described above, transmitting of fraud related messaging, including fraud warning, no fraud warnings, etc., as examples. For example, objects related to a secondary ID, objects related to a primary ID, objects related to a certain transaction, fraud related messages, etc., as examples);
Identifying at least a first identity profile of the first plurality of identity profiles in which the at least one of the objects of the first object type is located (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; each profile is associated with keys, such as any of the data/information that is stored therein or could be stored therein, and historical, transaction, account, etc. data that may be added to with any of the data/information, accessing of the profiles described above, transmitting of fraud related messaging, including fraud warning, no fraud warnings, etc., as examples. For example, profile as described above including objects as described above);
Enriching the received first log message data with a first respective key associated with the first identity profile by adding the first respective key to the received first log message data, wherein the first identity profile includes a first respective obtained object of the second classification (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; each profile is associated with keys, such as any of the data/information that is stored therein or could be stored therein, and historical, transaction, account, etc. data that may be added to with any of the data/information, accessing of the profiles described above, transmitting of fraud related messaging, including fraud warning, no fraud warnings, etc., as examples. For example, adding key, as described above, to the first log message data, described above); and
Using the enriched first log message data to monitor the one or more data systems and generate monitoring information based at least in part on the first identity profile, wherein the using comprises processing the enriched first log message data with at least one processing rule using the respective key (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; detecting fraud or the like with the above, for example);
But does not appear to explicitly disclose that adding comprises appending, the first respective key thereby enabling identification of the first identity profile including the first respective obtained object and enabling identifications of a larger range of log message data for analysis, wherein the first respective obtained object is not associated with the first log message data prior to enriching the received first log message data.
Petersen, however, discloses that adding comprises appending, the first respective key thereby enabling identification of the first identity profile including the first respective obtained object and enabling identifications of a larger range of log message data for analysis, wherein the first respective obtained object is not associated with the first log message data prior to enriching the received first log message data (For example, Exemplary Citations: for example, Paragraphs 12, 13, 225, 241-250, and associated figures; enriching logs by appending data to the logs, where the appended data will be used in the operating step (thus making the operating step data base larger than before), for example);
Enriching the received first log message data with a first respective key associated with the first identity profile by appending the first respective key to the received first log message data, wherein the first identity profile includes a first respective obtained object of the second classification, the first respective key thereby enabling identification of the first identity profile including the first respective obtained object and enabling identifications of a larger range of log message data for analysis, wherein the first respective obtained object is not associated with the first log message data prior to enriching the received first log message, wherein different respective keys are distinct from data of the first plurality of identity profiles (For example, Exemplary Citations: for example, Paragraphs 12, 13, 225, 241-250, and associated figures; enriching logs by appending data to the logs/messages, where the appended data will be used in the operating step (thus making the operating step data base larger than before), for example. The appended information is distinct from profile data); and
Using the enriched first log message data to monitor the one or more data systems and generate monitoring information based at least in part on the first identity profile, wherein the using comprises processing the enriched first log message data with at least one processing rule using the respective key (example, Exemplary Citations: for example, Paragraphs 12, 13, 225, 241-250, and associated figures; processing of logs using keys, such as location, and rules, for example (e.g., “the enriched log message may be processed 732 using at least one processing rule” where “one manner of enriching structured data such as log messages with geolocation information which may be used in subsequent processing of the log messages” and “locations for the log message may be written to additional reporting fields that may be appropriately appended to the raw text of the log message for subsequent processing”, as examples), for example). It would have been obvious to one of ordinary skill in the art at the time of applicant’s invention, which is before any effective filing date of the claimed invention, to incorporate the log collection, structuring, and processing techniques of Petersen into the synthetic online entity detection system of Brown in order to allow the system to deal with additional kinds of logs, to allow for processing of additional forms of data, to provide for usage of well-known identifiers, to detect additional forms of normal/abnormal data, and/or to increase security in the system.
Regarding Claim 3,
Brown as modified by Petersen discloses the method of claim 1, in addition, Brown discloses that each identity profile includes at least one first data structure defined by (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures):
At least one object of the at least first object type (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; the object above, for example);
At least one object classification of the at least one object of the first object type (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; the classification above, for example); and
The at least first object type (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; the type above, for example);
Wherein each identity profile includes at least one second data structure defined by (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures):
At least one object of at least a second object type (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; the object above, for example);
The at least one object classification of the at least one object of the at least the second object type (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; the classification above, for example); and
The at least the second object type (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; the type above, for example); and
Wherein each object comprises a value, wherein each corresponding object classification describes the value, and wherein each corresponding object type describes the at least one object classification (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures).
Regarding Claim 8,
Brown as modified by Petersen discloses the method of claim 1, in addition, Brown discloses accessing a second IAM platform that includes a third database having a second plurality of unique identities of the organization and a second plurality of objects associated with each unique identity of the second plurality of unique identities (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; another source, for example);
Ascertaining that at least one of the unique identities of the second plurality of unique identities corresponds to at least one of the unique identities of the first plurality of unique identities (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; associating identities from multiple sources, for example);
Obtaining, from the second IAM platform, objects of the second plurality of objects for the at least one of the unique identities of the second plurality of unique identities (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; as above, for example); and
Updating at least one identity profile of the first plurality of identity profiles with the objects of the second plurality of objects (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; adding information to profiles above, for example).
Regarding Claim 10,
Brown as modified by Petersen discloses the method of claim 1, in addition, Brown discloses accessing a second IAM platform that includes a third database having a second plurality of unique identities of the organization and a second plurality of objects associated with each unique identity of the second plurality of unique identities (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; as above, for another source, for example);
Obtaining, from the second IAM platform, first objects of the first classification for the second plurality of unique identities (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; as above, for another source, for example);
Obtaining, from the second IAM platform, second objects of the second object classification for the second plurality of unique identities (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; as above, for another source, for example);
Assigning, based upon a respective object classification corresponding to each object of the second plurality of objects, an object type to each object of the second plurality of objects (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; as above, for another source, for example);
Generating, for each unique identity of the second plurality of unique identities, an identity profile with respective obtained objects of at least the first and second object classifications corresponding to each unique identity of the second plurality of unique identities, wherein a second plurality of identity profiles are generated for the organization from the second objects of the second IAM platform (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; as above, for another source, for example);
Storing the second plurality of identity profiles in a fourth database (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; as above, for another source, for example); and
Associating each identity profile of the second plurality of identity profiles with a different respective key (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; as above, for another source, for example).
Regarding Claim 11,
Brown as modified by Petersen discloses the method of claim 10, in addition, Brown discloses ascertaining that at least one unique identity of the second plurality of unique identities corresponds to at least one unique identity of the first plurality of unique identities (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; associating data with respect to multiple entities that are primary/secondary and associated with each other, for example); and
Merging, based on the ascertaining, at least one identity profile of the second plurality of identity profiles with at least one identity profile of the first plurality of identity profiles (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; associating data with respect to multiple entities that are primary/secondary and associated with each other, for example);
Wherein the merging includes (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; associating data with respect to multiple entities that are primary/secondary and associated with each other, for example):
Identifying objects in the at least one identity profile of the second plurality of identity profiles not present in the at least one identity profile of the first plurality of identity profiles (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; associating data with respect to multiple entities that are primary/secondary and associated with each other, for example); and
Updating the at least one identity profile of the first plurality of identity profiles with the identified objects of the at least one identity profile of the second plurality of identity profiles (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; associating data with respect to multiple entities that are primary/secondary and associated with each other, for example).
Regarding Claim 18,
Brown as modified by Petersen discloses the method of claim 1, in addition, Brown discloses receiving second log message data (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures);
Detecting that at least one other object of the objects of the first object type is present in the received second log message data (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures);
Identifying the first identity profile as including the at least one other object of the objects of the first object type (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures); and
Enriching the received second log message data with the respective key associated with the first identity profile, wherein using the respective key comprises processing the enriched first and second log message data based on the respective key (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures).
Regarding Claim 19,
Brown as modified by Petersen discloses the method of claim 1, in addition, Brown discloses that using the respective key comprises (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures):
Accessing the first identity profile (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures);
Referencing at least one other object of the first object type with a first log message data processing rule (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures); and
Triggering the first log message data processing rule based on the at least one other object of the first object type (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures).
Regarding Claim 20,
Brown as modified by Petersen discloses the method of claim 1, in addition, Brown discloses determining that the first log message data is indicative of a successful authentication onto a network of the organization from a networked device (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; requiring and receiving authentication from a consumer computing system, for example);
Recording the networked device and the respective key of the identified at least one of the identity profiles in an inference database (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; all transaction/account/historical data in the system is recorded, for example);
Receiving second log message data (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; as above, for example);
Detecting that the networked device is present in the received second log message data (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; consumer computing system is in the data, for example);
Identifying the networked device in the inference database (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; finding the consumer computing system, for example); and
Enriching the received second log message data with the respective key based on the respective key being associated with the networked device in the inference database (Exemplary Citations: for example, Abstract, Paragraphs 12-16, 18, 20, 23-25, 29, 30, 33-36, 38-43, 46, 47, 49-53, 56-61, and associated figures; as above, for example); and
Petersen discloses that the networked device is identified with an IP address (Exemplary Citations: for example, Paragraphs 27, 83, 99, 102, 103, 118, 120, 126-128, 132, 135-137, 145, 149, 151, 158, 161, 170, 213, 219, 242, 243, 249, 250, 254, etc., and associated figures, as examples; IP address used in logs, enriched data, etc., for example);
Determining that the first log message data is indicative of a successful authentication onto a network of the organization from an IP address (Exemplary Citations: for example, Paragraphs 12, 13, 27, 83, 99, 102, 103, 118, 120, 126-128, 132, 135-137, 145, 149, 151, 158, 161, 170, 213, 219, 225, 241-250, 254, etc., and associated figures);
Recording the IP address and the respective key of the identified at least one of the identity profiles in an inference database (Exemplary Citations: for example, Paragraphs 12, 13, 27, 83, 99, 102, 103, 118, 120, 126-128, 132, 135-137, 145, 149, 151, 158, 161, 170, 213, 219, 225, 241-250, 254, etc., and associated figures);
Receiving second log message data (Exemplary Citations: for example, Paragraphs 12, 13, 27, 83, 99, 102, 103, 118, 120, 126-128, 132, 135-137, 145, 149, 151, 158, 161, 170, 213, 219, 225, 241-250, 254, etc., and associated figures);
Detecting that the IP address is present in the received second log message data (Exemplary Citations: for example, Paragraphs 12, 13, 27, 83, 99, 102, 103, 118, 120, 126-128, 132, 135-137, 145, 149, 151, 158, 161, 170, 213, 219, 225, 241-250, 254, etc., and associated figures);
Identifying the IP address in the inference database (Exemplary Citations: for example, Paragraphs 12, 13, 27, 83, 99, 102, 103, 118, 120, 126-128, 132, 135-137, 145, 149, 151, 158, 161, 170, 213, 219, 225, 241-250, 254, etc., and associated figures); and
Enriching the received second log message data with the respective key based on the respective key being associated with the IP address in the inference database (Exemplary Citations: for example, Paragraphs 12, 13, 27, 83, 99, 102, 103, 118, 120, 126-128, 132, 135-137, 145, 149, 151, 158, 161, 170, 213, 219, 225, 241-250, 254, etc., and associated figures).
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Jeffrey D Popham whose telephone number is (571)272-7215. The examiner can normally be reached Monday through Friday 9:00-5:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Nickerson can be reached at (469) 295-9235. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Jeffrey D. Popham/Primary Examiner, Art Unit 2432
