Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This office action is in response to the communication filed on 9/23/2026.
Response to Arguments
Applicant's arguments filed 8/25/2026 have been fully considered and are moot in view of the new grounds of rejection presented below.
All objections and rejections not set forth below have been withdrawn.
Claims 1-6, 8-13, and 15-19 have been examined.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-3, 5, 8-10, 12, 15-17, and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Manoria et al. (US Patent Application Publication Number 2022/0385677), and further in view of Sant-Miller et al. (US Patent Application Publication Number 2020/0128025) hereinafter referred to as Sant-Miller.
Regarding claims 1, 8, and 15, Manoria disclosed a server associated with a cloud-based system (Manoria Fig. 3 for example), the server comprising:
a processing device (Manoria Fig. 1A for example);
a memory device configured to store a computer program having instructions that, when executed, cause a processing device to perform the steps of (Manoria Fig. 1A for example):
receiving, from an Identity Provider (IDP), authentication for a user and a user device (Manoria Paragraphs 0064-0068 and 0084-0102 for example);
providing the user and the user device access to a cloud service based on the authentication via the cloud based system (Manoria Paragraphs 0064-0068 for example);
monitoring the access to the cloud service, and gathering a baseline for the access over a period of time to develop a profile defining normal user behavior (Manoria Paragraphs 0064-0065 and 0084-0102 for example);
responsive to detecting anomalous behavior in the access relative to the baseline, obtaining information relating to the user from one or more cloud services via one or more connectors, the information including at least one of: access information, device information, or contextual information, and notifying the IDP for remediation based on the anomalous behavior (Manoria Fig. 5 and Paragraphs 0084-0102 for example); and
responsive to detecting the anomalous behavior and notifying the IDP, initiating remediation via the cloud-based system while the user is accessing the cloud service, the remediation including at least one of: disabling an account of the user, disabling access by the user device, or requiring the user to change a password (Manoria Fig. 5 and Paragraphs 0084-0102 for example).
Manoria did not explicitly state that the access is monitored continuously (although it is fairly well implied in that the system logs the activities and utilizes the historical information about user activity patterns to determine suspicious activity).
Sant-Miller taught in a network security system involving establishing a baseline, that network behavior can be continuously monitored for trends and for unusual events (Sant-Miller Paragraph 0036 for example).
IT would have been obvious to the person having ordinary skill in the art before the effective filing date of the invention to have employed the teachings of Sant-Miller in the cloud monitoring system of Manoria by continuously monitoring the access behavior. This would have been obvious because the person having ordinary skill in the art would have been motivated to identify unusual events/exploitations (i.e. continuous monitoring will can identify exploitation that could be overlooked with less than continuous monitoring).
Regarding claims 2, 9, and 16, Manoria and Sant-Miller taught that the remediation includes disabling one or more accounts of the user, wherein the one or more accounts of the user are determined based on the information obtained via the one or more connectors (Manoria Paragraphs 0099-0101 for example).
Regarding claims 3, 10, and 17, Manoria and Sant-Miller taught that the remediation includes disabling access by the user device (Manoria Paragraphs 0099-0101 for example).
Regarding claims 5, 12, and 19, Manoria and Sant-Miller taught that the remediation is performed by while the user and the user device is accessing the cloud service (Manoria Fig. 5 and Paragraphs 0084-0102 for example).
Claims 4, 11, and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Manoria and Sant-Miller, and further in view of Corella (US Patent Application Publication Number 2008/0313721).
While Manoria and Sant-Miller taught detection of compromised login credentials and performing remediation, Manoria did not explicitly teach that the remediation includes requiring the user to change a password responsive to multiple invalid password attempts.
Corella taught a method of detecting and responding to password guessing attacks including counting the number of incorrect password login attempts and upon reaching a threshold number of incorrect attempts requiring the user to change their password (Corella Fig. 12 and Paragraphs 0027, 0047-0063 for example).
It would have been obvious to the person having ordinary skill in the art before the effective filing date of the invention to have employed the teachings of Corella in the security system of Manoria and Sant-Miller by implementing remediation including requiring the user to change their password for the particular service upon detection of a threshold number of incorrect password login attempts for the user’s account for a service. This would have been obvious because the person having ordinary skill in the art would have been motivated to protect the system against password guessing attacks.
Claims 6 and 13 are rejected under 35 U.S.C. 103 as being unpatentable over Manoria and Sant-Miller, and further in view of Kirti (US Patent Application Publication Number 2018/0375886).
Regarding claim 6, while Manoria and Sant-Miller taught detecting anomalous behavior based upon a baseline that is gathered for the access over a period of time (historical) and defines a profile defining normal user behavior (historical information about user activity patterns) (Manoria Paragraph 0087 for example), Manoria and Sant-Miller did not explicitly teach that the anomalous behavior is based on an Internet Protocol (IP) address and type of the user device changing more frequently than the baseline.
Kirti taught a method for detecting anomalous behavior based on an Internet Protocol (IP) address and type of the user device changing more frequently than a baseline (Kirti Paragraphs 0106, 0112, 0119, 0131, and 0143-0153 for example).
It would have been obvious to the person having ordinary skill in the art before the effective filing date of the invention to have employed the teachings of Kirti in the security system of Manoria and Sant-Miller by further detecting suspicious behavior based upon an Internet Protocol (IP) address and type of the user device changing more frequently than a baseline. This would have been obvious because the person having ordinary skill in the art would have been motivated to utilize the additional methods for detecting suspicious behavior thereby detecting more potential attacks.
Regarding claim 13, while Manoria and Sant-Miller taught detecting anomalous behavior, Manoria and Sant-Miller did not explicitly teach that the anomalous behavior is based on an Internet Protocol (IP) address and type of the user device changing more frequently than a baseline.
Kirti taught a method for detecting anomalous behavior based on an Internet Protocol (IP) address and type of the user device changing more frequently than a baseline (Kirti Paragraphs 0106, 0112, 0119, 0131, and 0143-0153 for example).
It would have been obvious to the person having ordinary skill in the art before the effective filing date of the invention to have employed the teachings of Kirti in the security system of Manoria and Sant-Miller by further detecting suspicious behavior based upon an Internet Protocol (IP) address and type of the user device changing more frequently than a baseline. This would have been obvious because the person having ordinary skill in the art would have been motivated to utilize the additional methods for detecting suspicious behavior thereby detecting more potential attacks.
Claims 11, and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Manoria and Sant-Miller, and further in view of Kutner (US Patent Application Publication Number 2020/0213334).
While Manoria and Sant-Miller taught detection of compromised login credentials and performing remediation, Manoria did not explicitly teach that the remediation includes requiring the user to change a password.
Kutner taught that protective actions should be implemented upon determination of compromised credentials including requiring the user to change their password (Kutner Paragraph 0021 for example).
It would have been obvious to the person having ordinary skill in the art before the effective filing date of the invention to have employed the teachings of Kutner in the security system of Manoria and Sant-Miller by requiring the user to change their password upon detection of the password being compromised. This would have been obvious because the person having ordinary skill in the art would have been motivated to protect the system against illicit access by any imposters.
Conclusion
Claims 1-6, 8-13, and 15-19 have been rejected.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MATTHEW T HENNING whose telephone number is (571)272-3790. The examiner can normally be reached Monday-Friday 7AM-2PM ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, William Korzuch can be reached at (571)272-7589. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MATTHEW T HENNING/ Primary Examiner, Art Unit 2491
