DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Status of Claims
This Office action is in response to correspondence received June 9, 2026.
Claims 1, 9, and 17 are amended. Claims 1-20 are pending and have been examined.
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on June 9, 2026 has been entered.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
The claim(s) recite(s):
Claims 1 and 17:
A method comprising:
receiving a body of training data comprising a policy document and policy action codes that correspond with the policy document, wherein the policy action codes comprise machine- readable computer code to implement policies contained in the policy document;
processing the policy document to generate a structured dataset of policy actions;
generating a trained model to create a mapping between the policy actions and the policy action codes;
receiving a new policy document;
generating new policy action codes from the new policy document using the trained model, wherein the new policy document is compiled to generate a new structured dataset of policy actions, wherein the new structured dataset of policy actions includes at least policy subjects identified based on an analysis of labeled text within the new policy document and policy variables configured to provide boundaries for new policy actions;
updating the training data based on the new policy document;
testing the trained model using a portion of the training data updated based on the new policy document, wherein an error value is computed for each test sample and a distribution of test sample errors is computed;
and sending the new policy action codes
[performing an action] to comply with policies contained in the new policy document.
Claim 9:
receive a body of training data comprising a policy document and policy action codes that correspond with the policy document, wherein the policy action codes comprise machine-readable computer code to implement policies contained in the policy document;
process the policy document to generate a structured dataset of policy actions;
generate a trained model to create a mapping between the policy actions and the policy action codes;
receive a new policy document ;
generate new policy action codes from the new policy document using the trained model, wherein the new policy document is compiled to generate a new structured dataset of policy actions, wherein the new structured dataset of policy actions includes at least policy subjects identified based on an analysis of labeled text within the new policy document and policy variables configured to provide boundaries for new policy actions;
update the training data based on the new policy document;
test the trained model using a portion of the training data updated based on the new policy document, wherein an error value is computed for each test sample and a distribution of test sample errors is computed;
send the new policy action codes
[performing an action] to comply with policies contained in the new policy document.
audit the computing environment using the new policy action codes to generate a human-readable compliance validated document;
and store the human-readable compliance validated document
The abstract idea in claims 1, 9, and 17, which are similar in scope (claim 9 has two more limitations than 1 and 17), are a mental process as these steps are those that can be performed mentally or with the aid of pen and paper, and additionally recite mathematical relationships that are mathematical relationships. First, training data can be received mentally through observation. This includes machine readable code which as described in pars 052, 059, could be text (“policy documents and…policy actions”). Then, one could mentally process the received information and generate a structured dataset, which could be a table written on paper. Then, one could generate a trained model mentally by taking the dataset and mapping between actions and codes. This could be done on paper. Then, one could receive a new policy document by looking at it, and the new policy document that is “compiled” (assembled) “to generate” (for the purpose of generating) a new structured dataset (data set is information – structured means rules), identified based on an analysis of labeled text (mental step of looking at labels and analyzing them). Then, one could generate new action codes by using the mapping previously created. Then one could update training data based on new policy document, by changing values that are different from the new document to the old document. Finally, the new policy action codes can be mentally sent by writing them on pen and paper. Per claim 9, a computing environment can be audited using new action codes to generate a document that is human readable, ie, the previously determined new action codes can be compared to a computing environment through observation and a document generated ie written. Then a document can be stored ie written on pen and paper which is storage of a document as a document is defined by its contents. Further, policy subjects are identified based on the new policy document and configuring policy variables to provide boundaries for new policy actions are mental judgments because one can identify a subject and then configure (set, determine) variables to provide boundaries (for example upper or lower limits, like a budget) for new policy actions. Then one could update training data based on new policy document, by changing values that are different from the new document to the old document. These steps are therefore mental process steps.
Then, per testing the trained model using training data updated based on the new policy document, one can compute an error value and make a distribution of test sample errors by using mathematical relationships such as Boolean compare, and counting (counting FALSE), then summing the values and plotting the values as a distribution.
. This judicial exception is not integrated into a practical application because the elements both individually and in combination amount to instructions to apply the abstract idea to a generic computer. The processing, memory, “system comprising…memory, processor,” and to/from a client device amount to no more than instructions that the abstract idea will be performed on a computer, in any way, and information is sent to and from a client device. Likewise with “wherein the new policy action codes comprise machine-readable computer code that, when deployed on a computing device, automatically configures the computing environment” is a further apply it step because it is applying computer code to a device to configure the device. This is similar to Requiring the use of software to tailor information and provide it to the user on a generic computer, Intellectual Ventures I LLC v. Capital One Bank (USA), 792 F.3d 1363, 1370-71, 115 USPQ2d 1636, 1642 (Fed. Cir. 2015). Overall the claims are similar to precedent as TLI Communications and FairWarning in MPEP 2106.05(f)(2) and therefore is no more than apply it steps. For this reason, there is not a practical application of the abstract ideas claimed in the independent claims.
The claim(s) does/do not include additional elements that are sufficient to amount to significantly more than the judicial exception because for the same reasons that there is not a practical application, the combination of additional elements are not significantly more than the abstract idea. The reasoning is carried over because, as the combination of elements claimed are merely instructions to apply a generic (or ordinary) computer to the abstract idea, “apply it” limitations are not significantly more than the abstract idea. Therefore, Applicant has not recited significantly more than the abstract idea.
Claims 2 and 10, which are similar in scope, further define the abstract idea by taking the new policy document to through a mental process (observation, judgment), generate a new structured data set and then inputting into a trained model. Inputting into a trained model is, under a broadest reasonable interpretation in light of the specification, a mental process as a trained model can have inputs (variables) which can receive information, the extent of the claim.
Claims 3 and 11, which are similar in scope, is similar to the final limitation in claim 1 which, as the codes were previously sent, now sending new policy actions is a further mental process step and to a client device is a mere apply it instruction.
Claims 4, 12, and 18, which are similar in scope, has an apply it limitation with “using a natural language processor,” and the limitations process the policy document…to generate labeled text is a further mental process step. As claimed, using a NLP is an apply it step because it is equivalent to applying an NLP to the abstract idea, as the NLP’s is only claimed in terms of its functional result and not with detail as to the steps which the NLP performs.
Claims 5, 13, and 19, which are similar in scope, has an additional element of a classifier but it is an applied element as it is described in terms of its functional result and moreover is described in the specification as “any suitable type of classifier,” therefore only limited by its functional result. Par 034. The steps are further mental process steps because they are identifying information from label text, which could be done mentally through observing label text and making judgments about the information within.
Claims 6, 14, and 20, which are similar in scope, further describe the mental process of the independent claims. A human readable natural language text document is text, which one can mentally process by reading it.
Claims 7 and 15, which are similar in scope, further describe the policy document as a standard issued by a standards organization. This is a part of the mental process identified in the independent claims because one could read this kind of policy document and in fact this would be typical or normal to do so, and reading is the mental process of observation.
Claims 8 and 16, which are similar in scope, recite the additional element of defining the trained model. This is an apply it element because though the trained models are kinds of AI there is no detail as to how they are implemented or trained and therefore they are recited as instructions to apply the AI model to the abstract idea. Therefore, claims 8 and 16 do not recite a practical application or significantly more .
Therefore claims 1-20 are rejected under 35 USC 101.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claim(s) 1-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Bulut et al., US PGPUB 20210055933 A1 ("Bulut"), in view of Hernandez et al., US PGPUB 20210120041 A1 (“Hernandez”), further in view of Durvasula et al., US PGPUB 20230123077 A1 (“Durvasula”).
Per claims 1, 9, and 17, which are similar in scope, Bulut teaches receiving a body of training data comprising a policy document and policy action codes that correspond with the policy document, wherein the policy action codes comprise machine- readable computer code to implement policies contained in the policy document in par 020: “Given the above problem with current compliance policy management and/or scheduling technologies not discovering dependencies between compliance policies and/or scheduling parallel execution plan(s) to execute two or more compliance policies simultaneously, the present disclosure can be implemented to produce a solution to this problem in the form of systems, computer-implemented methods, and/or computer program products that can: a) use previous history of compliance policy dependencies to train a machine learning model to determine whether a given set of policies (e.g., two policies (P.sub.1, P.sub.2)).” See also par 089: “Input: previously submitted compliance policy description and corresponding code pairs {{D.sub.i, D.sub.j,} {C.sub.i, C.sub.j}} and their associated labels L.sub.ij {1, 0}, where the label designations 1 and 0 can represent dependency or not and direction of dependency.” For implementing policies contained in the policy document see par 020: “c) add compliance policy P.sub.i to a Directed Acyclic Graph (DAG) and repeat the process until all unknown dependencies are determined; d) schedule a compliance policy execution based on the number of parallelism (e.g. number of available central processing units (CPU)) and DAG; and/or e) use operational data (e.g., service tickets, request tickets, incidents, etc.) and expert feedback (e.g., subject matter expert (SME) feedback to update the dependencies.”
Bulut then teaches processing the policy document to generate a structured dataset of policy actions in par 063: “In some embodiments, compliance policy management and scheduling system 102, policy analyzer component 108, and/or trainer component 202 can compile such historical data into a historical data index (e.g., a log) that can be stored on a memory device such as, for instance, memory 104 and/or a remote memory device (e.g., a memory device of a remote server).”
See pars 092-093 for the structured dataset: “"Store {T.sub.i,j, C.sub.i,j} as a feature vector in a list X, where list X can be stored on a memory device such as, for instance, memory 104 and/or a remote memory device a memory device of a remote server).
Store L.sub.ij in a list Y, where list Y can be stored on a memory device such as, for instance, memory 104 and/or a remote memory device (e.g., a memory device of a remote server)."
See also par 059: “The policy analyzer component 108 can employ a model and/or a natural language extraction process to identify such similarities defined above based on a cosine similarity between vector representations of text extracted from, for instance, descriptions of compliance policies, codes of compliance policies, and/or a common weakness enumeration (CWE) system corresponding to respective compliance policies. For example, policy analyzer component 108 can employ a natural language extraction process defined above and/or a model that has been trained (e.g., via trainer component 202 as described below with reference to FIG. 2) to identify such similarities based on such a cosine similarity. In some embodiments, policy analyzer component 108 can employ a model defined above and/or a natural language extraction process to identify such similarities between a certain new compliance policy and existing compliance policies (e.g., historical compliance policies), where dependency relationships and/or corresponding directions of such dependency relationships between such existing compliance policies are known (e.g., dependency relationships and/or corresponding dependency relationship direction(s) that have been verified by, for instance, an expert entity, operational data, etc.). In some embodiments, for example, where policy analyzer component 108 identifies one or more such similarities defined above between a certain new compliance policy and a certain existing compliance policy that has one or more dependency relationships with one or more other existing compliance policies, policy analyzer component 108 can determine that the new compliance policy has the same one or more dependency relationships and/or corresponding dependency relationship direction(s) with such other existing compliance policies.”
For structured dataset which takes from the policy analyzer component, see par 061: “In some embodiments, compliance policy management and scheduling system 102 can present to such an expert entity defined above one or more dependency relationships and/or corresponding dependency relationship direction(s) identified by policy analyzer component 108 and/or receive feedback data from such an expert entity corresponding to the dependency relationship(s) and/or corresponding direction(s) identified by policy analyzer component 108. For example, compliance policy management and scheduling system 102 can comprise an interface component including, but not limited to, an application programming interface (API), a graphical user interface (GUI), and/or another interface component that can present (e.g., via a computer monitor, a display, a screen, etc.) to such an expert entity defined above the dependency relationship(s) and/or corresponding direction(s) identified by policy analyzer component 108 and/or receive feedback data from the expert entity corresponding to the dependency relationship(s) and/or corresponding direction(s) identified by policy analyzer component 108.” As the dependency relationships are identified as pairs (see par 020), they are a structured dataset.
Bulut then teaches generating, by a processing device, a trained model to create a mapping between the policy actions and the policy action codes in par 063: “In some embodiments, such historical data can comprise training data that policy analyzer component 108 can use to learn (e.g., via active learning, explicit learning, implicit learning, etc.) to identify one or more dependency relationships and/or corresponding dependency relationship direction(s) between compliance policies.” See also par 094: “Train a model (e.g., a support vector machine (SVM) model) using list X as input and list Y as output. Calculate text similarity T.sub.i,j and code similarity C.sub.i,j scores for description D and code C. For example, calculate text similarity by calculating cosine similarity using equation (1) below.” See also par 091.
Bulut then teaches receiving a new policy document in par 0106: “In some embodiments, based on receiving a new compliance policy P.sub.7, policy analyzer component 108 (e.g., via policy correlation ML model 302) can identify (e.g., as described above with reference to FIGS. 1, 2, and 3) one or more dependency relationships (denoted as correlated to in FIG. 4) and/or corresponding dependency relationship direction(s) between new compliance policy P.sub.7 and existing compliance policies P.sub.2 and P.sub.5 as illustrated in FIG. 4” See also par 097: “In some embodiments, policy analyzer component 108 can receive a new compliance policy (denoted in FIG. 3 as New policy (P.sub.k). In some embodiments, policy analyzer component 108 can employ policy correlation ML model 302 to identify one or more dependency relationships and/or corresponding dependency relationship direction(s) between such a new compliance policy P.sub.k and one or more existing compliance policies denoted as P.sub.i, P.sub.j in FIG. 3 (e.g., the one or more compliance policies defined above).”
Bulut then teaches generating new policy action codes from the new policy document using the trained model, in par 097: “In some embodiments, policy analyzer component 108 can employ policy correlation ML model 302 to identify one or more dependency relationships and/or corresponding dependency relationship direction(s) between such a new compliance policy P.sub.k and one or more existing compliance policies denoted as P.sub.i, P.sub.j in FIG. 3 (e.g., the one or more compliance policies defined above).” See also par 0107 for another teaching of generating new policy action codes from the new policy document.
Bulut then teaches wherein the new policy document is compiled to generate a new structured dataset of policy actions, in par 098: “In some embodiments, policy correlation ML model 302 can comprise a model defined above that has been trained (e.g., via trainer component 202 as described above with reference to FIG. 2) to identify one or more dependency relationships between compliance policies and corresponding dependency relationship direction(s) based on one or more features such as, for example, compliance policy description similarity (denoted as Description Similarity in FIG. 3), compliance policy code similarity (denoted as Code Similarity in FIG. 3), and/or compliance policy weakness similarity (denoted as Weakness Similarity in FIG. 3) as described above with reference to FIG. 1.” See also par 099: “, policy analyzer component 108 can employ expert entity 306 to validate and/or invalidate one or more dependency relationships between compliance policies and/or corresponding dependency relationship direction(s) that have been identified by policy analyzer component 108 and/or policy correlation ML model 302. For example, policy analyzer component 108 can employ expert entity 306 to validate and/or invalidate one or more dependency relationships and/or corresponding dependency relationship direction(s) between new compliance policy P.sub.k and the one or more existing compliance policies P.sub.i, P.sub.j that have been identified by policy analyzer component 108 and/or policy correlation ML model 302.” Note that expert entity includes a machine learning model, see par 099.
Bulut then teaches wherein the new structured dataset of policy actions includes at least policies identified based on an analysis of labeled text within the new policy document in par 0110-0118: “In some embodiments, system 500 can comprise an illustration of how compliance policy management and scheduling system 102 (e.g., via policy analyzer component 108, policy correlation ML model 302, expert entity 306, etc.) can actively learn to classify one or more compliance policy dependency relationships and/or corresponding dependency relationship direction(s) between compliance policies in accordance with one or more embodiments of the subject disclosure described herein. For example, system 500 can comprise an illustration of how compliance policy management and scheduling system 102 (e.g., via policy analyzer component 108, policy correlation ML model 302, expert entity 306, etc.) can actively learn to classify such one or more compliance policy dependency relationships and/or corresponding dependency relationship direction(s) between compliance policies using, for instance, algorithm (3) defined below.
[0111] Algorithm (3)
[0112] Inputs: Labeled set D.sub.l, submitted policy P.sub.i.
[0113] Train a classifier f.sub.l based on training data D.sub.l.
[0114] while True [0115] Predict a label for a given code C based on code and description similarity. [0116] Use feedback/operational data to validate that code C worked or not {l.sub.1, l.sub.2}. [0117] Update training data (D.sub.l) with policy P.sub.i and its label. [0118] Retrain a classifier f.sub.i using D.sub.l.”
and policy variables configured to provide boundaries for new policy actions.”
These paragraphs describe, according to par 0109, the compliance policy management and scheduling in accordance with the embodiments described herein, therefore the embodiment described in pars 098-099 which describes receiving a new compliance policy document, is actively classified and labeled based on the teachings of 0109-0118. Labeled text is being analyzed is taught in par 0112, because the claim recites “labeled text” and the training set D.sub.i . The policy P.sub.i is the policy see par 097 for examples: compliance policies are “Policy_linux_password, policy_linux_ssh and policy_linux_file_permissions” The training set D.sub.i that is labeled is labeled text because the training set includes text see par 085: “historical data defined above (e.g., dependency data corresponding to historical compliance policies, expert feedback, and/or operational data feedback)”
Bulut then teaches updating the training data based on the new policy document; training data updated based on the new policy document in par 0102: “In some embodiments, policy analyzer component 108 can collect (e.g., from database 304) and/or use such operational data as training data to actively learn (e.g., as described above with reference to FIGS. 1 and 2) to identify one or more dependency relationships and/or corresponding dependency relationship direction(s) between a subsequently received new compliance policy and existing compliance policies.” See also par 0108. This refers back to teachings in par 098: “In some embodiments, policy correlation ML model 302 can comprise a model defined above that has been trained (e.g., via trainer component 202 as described above with reference to FIG. 2) to identify one or more dependency relationships between compliance policies and corresponding dependency relationship direction(s) based on a history of verified policy dependencies that can be stored in database 304 as illustrated in FIG. 3. In some embodiments, such a history of verified policy dependencies can comprise dependency data corresponding to historical compliance policies (e.g., dependency relationship(s) and/or corresponding dependency relationship direction(s) between historical compliance policies that have been validated or invalidated). In some embodiments, policy correlation ML model 302 can comprise a model defined above that has been trained (e.g., via trainer component 202 as described above with reference to FIG. 2) to identify one or more dependency relationships between compliance policies and corresponding dependency relationship direction(s) based on one or more features such as, for example, compliance policy description similarity (denoted as Description Similarity in FIG. 3), compliance policy code similarity (denoted as Code Similarity in FIG. 3), and/or compliance policy weakness similarity (denoted as Weakness Similarity in FIG. 3) as described above with reference to FIG. 1.” See also par 087: “In some embodiments, trainer component 202 can train a model defined above to learn one or more dependency relationships and/or corresponding dependency relationship direction(s) between compliance policies based on previously obtained historical data defined above (e.g., dependency data corresponding to historical compliance policies, expert feedback, and/or operational data feedback) using, for instance, algorithm (2) defined below.”
Bulut then teaches and sending the new policy action codes, wherein the new policy action codes comprise machine-readable computer code that, when deployed on a computing environment, automatically configures the computing environment to comply with policies contained in the new policy document in par 0100: “scheduler component 110 can generate one or more policy execution plans that can be executed by one or more computing resources of cloud computing environment 308. For example, scheduler component 110 can generate a parallel policy execution plan comprising Run List 1, Run List 2, and Run List 3 as illustrated in FIG. 3, where compliance policies of each of such run lists can have dependency relationships with one another but not with compliance policies of the other run lists. For instance, as illustrated in FIG. 3, scheduler component 110 can generate a parallel policy execution plan comprising Run list 1, Run List 2, and Run List 3, where compliance policies P.sub.1, P.sub.7, P.sub.9 of Run List 1 can have dependency relationships with one another but not with compliance policies P.sub.2, P.sub.3, P.sub.10 or compliance policies P.sub.4, P.sub.5, P.sub.8 of Run List 2 and Run List 3, respectively.” See also par 0121: “For example, at a time t.sub.2, scheduler component 110 can schedule simultaneous execution of compliance policies of execution plans E.sub.1 and E.sub.2 illustrated in FIG. 6B. In this example, execution plan E.sub.1 can comprise compliance policy P.sub.2 that can be executed by a first computing resource (e.g., a first computing resource of cloud computing environment 308) and execution plan E.sub.2 can comprise compliance policy P.sub.3 that can be executed simultaneously with compliance policy P.sub.2 by a second computing resource (e.g., a second computing resource of cloud computing environment 308).” See also par 0108: “In some implementations, multiple different computing resources of cloud computing environment 308 can simultaneously execute code corresponding to compliance policies of such policy execution plan(s) that can be generated by scheduler component 110 based on updated directed acyclic graph (DAG) 406 (e.g., as described above). In some embodiments, based on execution (e.g., via one or more computing resources of cloud computing environment 308) of code corresponding to compliance policies of such policy execution plan(s) that can be generated by scheduler component 110, operational data indicative of operational results from executing such compliance policies (e.g., incident reports, service tickets, request tickets, etc.) can be compiled and/or stored on database 304 as described above with reference to FIG. 3.” This teaches machine readable code (code teaches this) and executed teaches deployed, and cloud computing environment teaches environment, and
Per claim 9, Bulut teaches audit the computing environment using the new policy action codes to generate a human-readable compliance validated document in par 0127: “In another example, by generating such an updated directed acyclic graph and/or such a policy execution plan based on the updated directed acyclic graph as described above, compliance policy management and scheduling system 102 can facilitate reduced processing cycles performed by a processing unit (e.g., processor 106) to accurately execute the compliance policies of such a policy execution plan. For instance, compliance policy management and scheduling system 102 can facilitate reduced processing cycles performed by a processing unit (e.g., processor 106) associated with compliance policy management and scheduling system 102 and/or a computing device that executes one or more compliance policies of the policy execution plan, thereby facilitating at least one of improved accuracy, efficiency, or performance of such a processing unit (e.g., processor 106), as well as reduced computation cost of such a processing unit.” See also par 067 where DAG graph is generated visually and therefore human-readable compliance validated document.
Bulut then teaches and store the human-readable compliance validated document in a non-transitory computer-readable storage medium in par 0102: where compliance policy is stored in a database.
Bulut does not teach wherein policy subjects are identified based on the new policy document and policy variables configured to provide boundaries for new policy actions.
Hernandez teaches assessing policies that govern operations of enterprise components of an enterprise computing system. See abstract.
Hernandez teaches wherein policy subjects are identified based on the new policy document and policy variables configured to provide boundaries for new policy actions in par 027 where a coverage component identifies the policy type and determines whether a policy is in scope or out of scope of other regulations (policy variable). Then in conjunction with par
See par 027: “The coverage component 114 can receive regulation data associated with various regulations and standards (e.g., HIPAA, FFIEC, PCI-DSS, etc.). The coverage component 114, which provides a first level analysis, can identify multiple set policies. For example, the coverage component 114 can identify a customer policy, which is in scope of a regulation and a standard, a customer policy, which is above and beyond the regulation and the standard, and a policy in the regulation and the standard which is not covered by the customer policy. If policies are in scope of the regulation and the standard, then other components (e.g., the compliance component 104, the optimization component 108, etc.) can be utilized. The policy database 106 can store the regulation data, in addition to various customer policies, for future use. Customer policies can include, but are not limited to: logging requirements, password requirements, credit card number requirements, etc. The coverage component 114 can also determine whether a customer policy is in scope or goes above and beyond a targeted regulation. For example, the customer logging mechanism can require that every log entry for any activity performed by the end user is prefixed with the end user's email address in order to determine any activity at a system and/or application level. This policy is not a part of any of the requirements for any of the existing regulations and standards (e.g., HIPAA, FFIEC, PCI-DSS, etc.). Thus, the coverage component 114 can determine that the policy is out of scope with the existing regulations and standards.”
For policy type see par 036: “Additionally, some terms can have a higher relevance to specific types of polices. Therefore, an assessment of the terms of the electronic document can provide an indication of what type of policy is or should be associated with the electronic document.” Policy type teaching policy subject.
In par 039 the deviation component teaches a risk score and a deviation. The risk score in par 039 and the in scope or out of scope in par 027 teach policy variables that provide boundaries because the boundary in par 039 is that a certain deviation has to be performed to lower a risk score and in pars 027-030 that policies are enforced (a boundary) based on various variables based on type of organization (see par 028) or other types (type of server).
It would have been obvious to one ordinarily skilled in the art before the effective filing date of the claimed invention to modify the compliance teaching of Bulut with the policy variables, subject, and boundaries teaching of Hernandez because Hernandez teaches that with multiple policies to follow and different time factors (immediately after a risk is assessed), if policies are not properly analyzed and implemented then a server device could be in noncompliance. Because Hernandez teaches a way to manage enforcement of policies based on these different and multiple inputs, one would be motivated to modify Bulut with Hernandez to comply with policy more effectively.
Bulut does not teach receiving…from a client device…sending to a client device…when deployed on a computing environment of the client device; testing the trained model using a portion of training data updated, wherein an error value is computed for each test sample and a distribution of test sample errors is computed;
Durvasula teaches automated cloud data and technology solution delivery see par 002.
Durvasula teaches receiving…from a client device…sending to a client device…when deployed on a computing environment of the client device in par 092: “At block 414, for example, the I/O module 146 may transmit one or more configuration inquiries to the user via the network 110. For example, the customer may be using the client device 102 to receive the transmitted inquiries. The memory of the client device 102 may include a set of computer-executable instructions that receive the inquiries and display them in a graphical user interface, for example. The set of instructions in the client device 102 may collect the user's responses via an input device (e.g., a touchpad) and transmit the responses to each respective inquiry to the I/O module 146 via the network 110.”
Durvusala then teaches testing the trained model using a portion of training data updated, wherein an error value is computed for each test sample and a distribution of test sample errors is computed in par 054: “In some aspects, training may be performed by successive evaluation (e.g., looping) of the network, using training labeled training samples. The process of training the ANN may cause weights, or parameters, of the ANN to be created. The weights may be initialized to random values. The weights may be adjusted as the network is successively trained, by using one of several gradient descent algorithms, to reduce loss and to cause the values output by the network to converge to expected, or “learned”, values. In an aspect, a regression may be used which has no activation function. Therein, input data may be normalized by mean centering, and a mean squared error loss function may be used, in addition to mean absolute error, to determine the appropriate loss as well as to quantify the accuracy of the outputs.”
Then see par 0104: “Once a detailed objective of the future data and architecture state are approved by the customer, a validation ML validates the future data and architecture state for accuracy and completeness to generate a detailed future data and architecture state input template. If the machine learning model validation check fails, the customer may be is directed back to the detailed questionnaire to re-explain their objective in the context of the failure error/s. If the data and architecture landscape is not complete, the ML model may identify gaps and provide recommendations contingent on the customer's confirmation.” Then see par 0105: “Continuing the example, the NLP module 148 may, via the I/O module 146, transmit a message (e.g., an HTTP POST message) to the client computing device comprising a JavaScript Object Notation (JSON) payload including each identified objective and score. The client device 102 may parse and display the JSON to the user via a web page or other graphical user interface (not depicted).”
It would have been obvious to one ordinarily skilled in the art before the effective filing date of the claimed invention to modify the compliance policy code and ML teaching of Bulut with the client device teaching of Durvasula because Durvasula teaches “conventional static visualization techniques that are shared across many organization are inefficient, because among other things, users are not able to apply filters and such visualizations do not update to keep pace with changes in data over time” in par 003. The solution Durvasula teaches is “modularizing and codifying processes for performing environmental discovery/scanning, environmental validation, and automated knowledge engine generation using machine learning (ML) and/or artificial intelligence (AI), including those existing processes on premises involving legacy technologies” in par 035. Because Durvasula teaches further efficiencies in implementing [blank] as a service which is related to the teachings of software policy compliance teaching of Bulut, one would be motivated to modify Durvasula with Bulut.
Per claims 2 and 10, which are similar in scope, Bulut, Hernandez, and Durvasula teach the limitations of claims 1 and 9, above. Bulut further teaches generating the new policy action codes comprises: processing the new policy document to generate a new structured dataset of new policy actions in par 0106: “In some embodiments, based on receiving a new compliance policy P.sub.7, policy analyzer component 108 (e.g., via policy correlation ML model 302) can identify (e.g., as described above with reference to FIGS. 1, 2, and 3) one or more dependency relationships (denoted as correlated to in FIG. 4) and/or corresponding dependency relationship direction(s) between new compliance policy P.sub.7 and existing compliance policies P.sub.2 and P.sub.5 as illustrated in FIG. 4. In some embodiments, expert entity can validate or invalidate such one or more dependency relationships and/or corresponding dependency relationship direction(s) identified by policy analyzer component 108 (e.g., via policy correlation ML model 302) between new compliance policy P.sub.1 and existing compliance policies P.sub.2 and P.sub.5 as illustrated in FIG. 4.”
Bulut then teaches and inputting the new policy actions to the trained model in par 0108: “In some embodiments, policy analyzer component 108 can collect (e.g., from database 304) and/or use such operational data as training data to actively learn (e.g., as described above with reference to FIGS. 1, 2, and 3) to identify one or more dependency relationships and/or corresponding dependency relationship direction(s) between a subsequently received new compliance policy and existing compliance policies.”
Per claims 3 and 11, which are similar in scope, Bulut, Hernandez, and Durvasula teach the limitations of claims 2 and 10, above. Bulut further teaches sending new policy actions in par 0120: “For example, at a time scheduler component 110 can schedule simultaneous execution of compliance policies of execution plans E.sub.1 and E.sub.2 illustrated in FIG. 6A. In this example, execution plan E.sub.1 can comprise compliance policy P.sub.1 that can be executed by a first computing resource (e.g., a first computing resource of cloud computing environment 308) and execution plan E.sub.2 can comprise no compliance policies, as compliance policies P.sub.2 and P.sub.3 are dependent on compliance policy P.sub.1, and therefore, compliance policy P.sub.1 must be executed prior to execution of compliance policies P.sub.2 and/or P.sub.3.”
Bulut does not teach to the client device.
Durvasula to the client device teaches in par 092: “At block 414, for example, the I/O module 146 may transmit one or more configuration inquiries to the user via the network 110. For example, the customer may be using the client device 102 to receive the transmitted inquiries. The memory of the client device 102 may include a set of computer-executable instructions that receive the inquiries and display them in a graphical user interface, for example. The set of instructions in the client device 102 may collect the user's responses via an input device (e.g., a touchpad) and transmit the responses to each respective inquiry to the I/O module 146 via the network 110.”
It would have been obvious to one ordinarily skilled in the art before the effective filing date of the claimed invention to modify the compliance policy code and ML teaching of Bulut with the client device teaching of Durvasula because Durvasula teaches “conventional static visualization techniques that are shared across many organization are inefficient, because among other things, users are not able to apply filters and such visualizations do not update to keep pace with changes in data over time” in par 003. The solution Durvasula teaches is “modularizing and codifying processes for performing environmental discovery/scanning, environmental validation, and automated knowledge engine generation using machine learning (ML) and/or artificial intelligence (AI), including those existing processes on premises involving legacy technologies” in par 035. Because Durvasula teaches further efficiencies in implementing [blank] as a service which is related to the teachings of software policy compliance teaching of Bulut, one would be motivated to modify Durvasula with Bulut.
Per claims 4, 12, and 18, Bulut, Hernandez, and Durvasula teach the limitations of claims 1, 9, and 17 above. Bulut further teaches processing the policy document to generate the structured dataset of policy actions comprises processing the policy document using a natural language processor to generate the labeled text in par 065 where the policy analyzer component 108 classifies the text being input: “For instance, policy analyzer component 108 can employ an automatic classification system and/or an automatic classification process to learn such one or more dependency relationships and/or corresponding dependency relationship direction(s) based on feedback data (e.g., expert entity feedback, operational data feedback, etc.).” This is done with NLP process as taught in pars 058-059: “To facilitate identification of such one or more dependency relationships and/or corresponding dependency relationship direction(s) based on such one or more similarities defined above, policy analyzer component 108 can employ a model defined above and/or a natural language extraction process to identify such similarities. For example, policy analyzer component 108 can employ a model defined above and/or a natural language extraction process including, but not limited to, natural language processing (NLP), named entity recognition (NER), natural language annotation, and/or another natural language extraction process.
The policy analyzer component 108 can employ a model and/or a natural language extraction process to identify such similarities defined above based on a cosine similarity between vector representations of text extracted from, for instance, descriptions of compliance policies, codes of compliance policies, and/or a common weakness enumeration (CWE) system corresponding to respective compliance policies. For example, policy analyzer component 108 can employ a natural language extraction process defined above and/or a model that has been trained (e.g., via trainer component 202 as described below with reference to FIG. 2) to identify such similarities based on such a cosine similarity. In some embodiments, policy analyzer component 108 can employ a model defined above and/or a natural language extraction process to identify such similarities between a certain new compliance policy and existing compliance policies (e.g., historical compliance policies), where dependency relationships and/or corresponding directions of such dependency relationships between such existing compliance policies are known (e.g., dependency relationships and/or corresponding dependency relationship direction(s) that have been verified by, for instance, an expert entity, operational data, etc.).” The labeled text is generated using the ML model which includes the models described above in pars 0114-0118: “[0114] while True [0115] Predict a label for a given code C based on code and description similarity. [0116] Use feedback/operational data to validate that code C worked or not {l.sub.1, l.sub.2}. [0117] Update training data (D.sub.l) with policy P.sub.i and its label.”
Per claims 5, 13, and 19, Bulut, Hernandez, and Durvasula teach the limitations of claims 4, 12, and 18, above. Bulut further teaches processing the policy document to generate the structured dataset of policy actions further comprises processing the labeled text using a classifier to identify policy subjects in par 065 where the policy analyzer component 108 classifies the text being input: “For instance, policy analyzer component 108 can employ an automatic classification system and/or an automatic classification process to learn such one or more dependency relationships and/or corresponding dependency relationship direction(s) based on feedback data (e.g., expert entity feedback, operational data feedback, etc.).” Bulut then teaches actions corresponding to the policy subjects, in par 065: “In one embodiment, policy analyzer component 108 can employ a probabilistic and/or statistical-based analysis (e.g., factoring into the analysis utilities and costs) to learn such one or more dependency relationships and/or corresponding dependency relationship direction(s) based on feedback data (e.g., expert entity feedback, operational data feedback, etc.).” Bulut then teaches and policy variables that provide boundaries for the actions in pars 0113-0117: “Predict a label for a given code C based on code and description similarity. Use feedback/operational data to validate that code C worked or not {l.sub.1, l.sub.2}. Update training data (D.sub.l) with policy P.sub.i and its label.”
Per claims 6, 14, and 20, which are similar in scope, Bulut, Hernandez, and Durvasula teach the limitations of claims 4, 12, and 18, above. Bulut further teaches the policy document comprises a human-readable, natural- language text document that describes rules and guidelines to be followed by an enterprise in operating the enterprise, creating a product, or providing a service in par 018: “Given a set of compliance policies (e.g., policy_linux_file_permissions, policy_linux_pass_max_age, policy_linux_pass_min_age, etc.) for different platforms (e.g., Advanced Interactive eXecutive (AIX), Linux, Windows, etc.) some compliance policies depend on one or more other compliance policies. For example, given compliance policy P.sub.1—policy_linux_oracle_pass_max_age (set non-expiring password for an application; oracle database user) and compliance policy P.sub.2—policy_linux_pass_max_age (set expiring password in operating system (OS) level), compliance policy P.sub.2 can depend on compliance policy P.sub.1 (e.g., dependency: P.sub.1.fwdarw.P.sub.2). Execution of multiple compliance policies in synchronous order is time consuming. If dependencies between multiple compliance policies are known, execution of such policies can be performed asynchronously.”
Per claims 7 and 15, which are similar in scope, Bulut, Hernandez, and Durvasula teach the limitations of claims 1 and 9, above. Bulut further teaches the policy document comprises a published standard issued by a standards organization in par 018 where linux, Oracle, and Advanced Interactive eXecutive is taught.
Per claims 8 and 16, which are similar in scope, Bulut, Hernandez, and Durvasula teach the limitations of claims 1 and 9, above. Bulut further teaches the trained model is an artificial neural network, artificial intelligence model, or a machine learning model in par 066: “he policy analyzer component 108 can employ any suitable machine learning based techniques, statistical-based techniques, and/or probabilistic-based techniques to learn such one or more dependency relationships and/or corresponding dependency relationship direction(s) based on feedback data (e.g., expert entity feedback, operational data feedback, etc.). For example, policy analyzer component 108 can employ an expert system, fuzzy logic, support vector machine (SVM), Hidden Markov Models (HMMs), greedy search algorithms, rule-based systems, Bayesian models (e.g., Bayesian networks), neural networks, other non-linear training techniques, data fusion, utility-based analytical systems, systems employing Bayesian models, and/or another model.”
Therefore, claims 1-20 are rejected under 35 USC 103.
Response to Remarks
35 USC 101
Applicant respectfully submits that amended independent claim 1 is not directed to an abstract idea. Even assuming, arguendo, that claim 1 recites a judicial exception, which Applicant does not concede, the claim integrates any such exception into a practical application and is therefore patent-eligible under prong 2 of step 2A.
Applicant's specification describes a specific technical problem at paragraph [0016]: the conventional process for developing and implementing policy goals and ensuring compliance requires that written policies be reviewed by outside experts, technical components affected by the policies are defined, specific steps are defined for ensuring alignment, and the results are documented and presented to compliance auditors. "These processes are manual labor-intensive processes that are subject to human interpretation and judgement and are therefore prone to error." This is a technical problem rooted in the inability of existing computing systems to automatically translate policy documents into executable compliance code. The specification at paragraph [0017] describes the technical solution: "Aspects of the disclosure address the above-noted and other deficiencies by providing a system for automatically generating policy compliance assets that can be used to streamline the policy implementation and auditing processes." Paragraph [0017] further explains that "[t]he automatic generation of policy compliance assets may be accomplished through the training of an artificial intelligence model and/or machine learning model such as an artificial neural network, natural language processing, or the like." The system performs machine translation of human-readable policy documents into executable computer code.
Examiner responds: Performing (manual) processes faster on a computer is similar to FairWarning which found that this is an applied use of a computer, See MPEP 2106.05(f)(2). Therefore this is not persuasive. Further this describes a problem typically done manually (but not by necessity) that is now chosen to be done on a computer, see Id. which is only gaining the benefits of computer and computer related technology because such technology is being applied to the abstract idea (and runs faster solely due to the computer and other applied computing steps operating in their ordinary capacity). Therefore this is unpersuasive.
Critically, the output of the claimed method is not mere information or data, and is functional, machine-readable computer code that directly configures and audits computing
environments. As described in specification paragraph [0018]: "The generated policy compliance assets may include computer code written in a programming language, e.g., policy-as-code or infrastructure-as-code. Infrastructure as code refers to the use of code-based files to automate infrastructure setup and provisioning. Policy-as-code is the use of code to define and manage rules and conditions that govern IT operations or processes." Amended independent claim 1 expressly recites "sending the new policy action codes to the client device, wherein the new policy action codes comprise machine-readable computer code that, when deployed on a computing environment of the client device, automatically configures the computing environment to comply with policies contained in the new policy document."
The claimed method thus effects an improvement to the technical field of policy implementation and auditing by transforming human-readable natural-language documents into machine-executable code that is deployed to configure computing systems so that the computing systems comply with policies contained in a policy document, thereby improving reliability of the computing environment by reducing errors associated with manual policy implementation and auditing processes. In addition, this is a transformation that conventional processes cannot accomplish without extensive manual labor and not merely the use of a computer to speed up a manual process.
Applicant has created a technical field of policy implementation, this is under a broadest reasonable interpretation not a technical field, as policy implementation also encompasses implementing human decisions, which is not necessarily rooted in technology. Therefore that is unpersuasive. Applicant has only taken, in applicant’s words, a “manual policy” and applied computer technology to the manual policy. Nearly any manual process is sped up by using computers, and that is the precedent that Applicant cannot overcome, FairWarning, as that is all Applicant has claimed. At no point are there detailed technical steps for how the technology is claimed because Applicant has maintained a broad scope in the claims that only recites the desired function or result of applying technology, See MPEP 2106.05(f)(1). Therefore this is unpersuasive.
Moreover, the claimed step of "testing the trained model using a portion of training data updated based on the new policy document, wherein an error value is computed for each test sample and a distribution of test sample errors is computed" provides a specific technical mechanism for continuous model improvement. As described in paragraph [0038] of the specification, this iterative testing process ensures that the trained model's outputs converge to acceptable accuracy limits before the generated code is deployed. This is a quality assurance mechanism for the machine learning pipeline itself, which ensures that the automatically generated policy action codes will accurately implement the policies, thereby improving the reliability of the computing system. This is not merely "performing processes faster on a computer" as discussed in MPEP 2106.05(f)(2) (discussing TLI Communications and Fair Warning) , rather, it is a specific feedback mechanism that improves the accuracy and reliability of the trained model's code generation capability.
The Examiner cited Examples (including TLI Communications and FairWarning) from MPEP 2106.05(f)(2) where generic computer components merely "apply" an abstract idea.
However, the present claims are distinguishable. In TLI Communications, the claims merely recited recording, transmitting, and organizing digital images, for which the computer was used as a generic tool. In Fair Warning, the claims merely detected suspicious activity by analyzing data.
Here, the claims recite, among other things: (1) "processing the policy document to generate a structured dataset of policy actions"; (2) "generating, by a processing device, a trained model to create a mapping between the policy actions and the policy action codes"; (3) "generating new policy action codes from the new policy document using the trained model"; and (4) "testing the trained model using a portion of training data updated based on the new policy document, wherein an error value is computed for each test sample and a distribution of test sample errors is computed." This is a specific technical architecture for automated code generation, and not mere data analysis or organization on a generic computer.
The testing step is a part of the abstract idea as it is further collecting, analyzing, and presenting the results of comparison. The trained model, with respect, includes any mapping or any relation between policy actions and policy action codes, it could be taught by a two column graph, which is correctly identified as a part of the abstract idea. Therefore this is unpersuasive.
The Examiner previously responded to Applicant's arguments that "[p]erforming processes faster on a computer is similar to FairWarning which found that this is an applied use of a computer" and that "[o]ne ordinarily skilled would not recognize the speeding up of manual processes by using a computer to improve the computer or other technology itself as the computer is only used as a tool to speed up the processes." Applicant respectfully submits that the amended claims now address this concern directly. The amended claims no longer merely recite speeding up a process. They now expressly recite that the generated policy action codes comprise machine- readable computer code that, when deployed on the computing environment, automatically configures the computing environment to comply with policies, thereby improving reliability by reducing errors. This is not using a computer to speed up an existing manual process; rather, it is a specific technical improvement to the computing environment itself. Particularly, the computing environment is automatically reconfigured through deployed code that could not have been generated without the claimed ML pipeline.
The steps of errors reducing and generated policy action codes are a part of the abstract idea. Generating a machine readable output is merely generating an instruction for a computer to perform a step as opposed to a scope which includes a human performing the step. Applicant now states that the computer does not speed up the process, and that is an opinion, but the computer is nonetheless applied to now, apparently, slow the (formerly) manual process down or keep it the same speed, which does not overcome the apply it interpretation of the additional elements.
Additionally, and assuming only for the sake of argument that claim 1 is directed to a judicial exception, which Applicant is not herein conceding, claim 1 would still be patent-eligible because it recites additional elements that amount to significantly more than the alleged judicial exception.With respect to step 2B, when viewed as an ordered combination, the claim elements amount to significantly more than any alleged abstract idea. The specific ordered combination of: (1) "receiving a body of training data comprising a policy document and policy action codes that correspond with the policy document, wherein the policy action codes comprise machine-readable computer code to implement policies contained in the policy document"; (2) "processing the policy document to generate a structured dataset of policy actions"; (3) "generating, by a processing device, a trained model to create a mapping between the policy actions and the policy action codes"; (4) "receiving a new policy document from a client device"; (5) "generating new policy action codes from the new policy document using the trained model, wherein the new policy document is compiled to generate a new structured dataset of policy actions, wherein the new structured dataset of policy actions includes at least policy subjects identified based on an analysis of labeled text within the new policy document and policy variables configured to provide boundaries for new policy actions"; (6) "updating the training data based on the new policy document"; (7) "testing the trained model using a portion of training data updated based on the new policy document, wherein an error value is computed for each test sample and a distribution of test sample errors is computed"; and (8) "sending the new policy action codes to the client device, wherein the new policy action codes comprise machine-readable computer code that, when deployed on a computing environment of the client device, automatically configures the computing environment to comply with policies contained in the new policy document," is not well- understood, routine, or conventional activity. The Examiner has not provided evidence (e.g., citations to publications demonstrating that this specific combination is conventional) that this particular ordered combination of machine learning operations for policy-to-code translation is well-understood, routine, or conventional. Accordingly, Applicant submits that independent claim 1 recites additional elements that amount to significantly more than the alleged judicial exception.
While the discussion herein has focused on claim 1, independent claims 9 and 17 have been amended to recite similar limitations and are likewise patent-eligible. The dependent claims are dependent on their respective base claims and therefore include all of the features of their respective base claims and additional features therein. As such, these claims are also allowable based upon their respective base claims and the additional features therein. Accordingly, Applicant respectfully requests withdrawal of the claim rejections under 35 U.S.C. § 101.
This ordered combination was properly addressed by determining the abstract idea, which was not persuasively argued against, then the additional elements, which were not found to be a practical application or significantly more.
Therefore the 101 rejection is maintained.
Claim Rejections 35 U.S.C. 103
Claim(s) 1-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Bulut et al., US PGPUB 20210055933 ("Bulut"), in view of Hernandez et al., US PGPUB 20210120041 ("Hernandez"), further in view of Durvasula et al., US PGPUB 20230123077 ("Durvasula").
Applicant respectfully submits that the cited references, alone or in combination, fail to teach or suggest at least the following features of amended independent claim 1: "updating the training data based on the new policy document," "testing the trained model using a portion of training data updated based on the new policy document, wherein an error value is computed for each test sample and a distribution of test sample errors is computed," and "sending the new policy action codes to the client device, wherein the new policy action codes comprise machine-readable computer code that, when deployed on a computing environment of the client device, automatically configures the computing environment to comply with policies contained in the new policy document."
As an initial matter, Applicant respectfully notes a fundamental distinction between the claimed invention and Bulut. Amended independent claim 1 recites, among other things, "generating, by a processing device, a trained model to create a mapping between the policy actions and the policy action codes," "receiving a new policy document from a client device," "generating new policy action codes from the new policy document using the trained model," and "sending the new policy action codes to the client device, wherein the new policy action codes comprise machine-readable computer code that, when deployed on a computing environment of the client device, automatically configures the computing environment to comply with policies contained in the new policy document." See specification at paragraphs [0017]-[0018], [0026], and [0036].
In contrast, Bulut is directed to identifying dependency relationships between compliance policies and scheduling their execution. Bulut's system determines whether policies depend on one another (e.g., whether policy P1 must execute before policy P2) and generates execution schedules (Run Lists) for parallel execution. See Bulut at paragraphs [0018]-[0020]. Bulut does not disclose "generating new policy action codes from the new policy document using the trained model" or "sending the new policy action codes to the client device, wherein the new policy action codes comprise machine-readable computer code that, when deployed on a computing environment of the client device, automatically configures the computing environment to comply with policies
In Bulut, the trained model is generated in par 063 which is apparent where training data is used to learn to identify dependency relationships between compliance policies. There is nothing "contrasting" here with Applicant's claims because, with respect to Applicant, finding relations between policies teaches finding a mapping.
Receiving a new policy is taught in par 0106: the analyzer component performs the dependency relations (see par 063) when a new compliance policy is received. Again, Applicant is pointing to other parts of Bulut as if they contradicted these teachings. Bulut as a patent application teaches many different iterations of the teachings and therefore looking to this or that paragraph and saying actually Bulut does not teach something (found elsewhere in the reference) is not persuasive.
Further, Applicant narrows Bulut that only "pre-existing policies" whatever that means can be scheduled for execution. With respect, that is nowhere in Bulut. This is an overly narrow reading. In pars 0110-0118 the dependency relation is used in the scheduling of executing compliance policies. Since, as was previously taught, the dependency is made with new policy documents, those are also executable. Not simply "pre-existing policies" which is a teaching first nowhere. Again, Applicant narrows Bulut where new policy documents were previously taught in the dependency relations see par 063 (note, unaddressed entirely by Applicant). Applicant states that: "Bulut's "operational data" used for active learning of dependency relationships is fundamentally different from the claimed "body of training data comprising a policy document and policy action codes that correspond with the policy document."" But has no explanation why operational data such as expert feedback does not teach a new policy document. Where is the new policy document exclusive of expert feedback? Further, new policy data is mapped to policy data in pars 098-099 also unaddressed here, and these paragraphs were cited in the previous rejection. The arguments amount to a selective reading of the reference to avoid the "new policy" teaching or equivalent term teaching of new policy in order to try and argue against it. To the explicit teaching of new policy being mapped to old policy for dependency relations which then extends to any teaching of dependency relations in the reference, Applicant cites 98 (which teaches it) then says, Applicant disagrees, and goes on to talk about other paragraphs and does not address par 099 either. Therefore the arguments avoid the teachings that have been provided; this is unpersuasive and the rejection is maintained.
Durvasula's description of gradient descent during training is not the same as "testing the trained model using a portion of training data updated based on the new policy document," as recited in amended independent claim 1.Moreover, Durvasula at paragraph [0104] describes a "validation ML" that "validates the future data and architecture state for accuracy and completeness."
Despite Applicant’s arguments, the breadth of Applicant’s claims is taught by Durvasula’s validation teaches testing, and why would cloud migration not be a part of a policy document? The architecture state for cloud migration is a policy: “The present techniques enable AI and ML-based based decision making for multi-cloud, hybrid cloud and cloud agnostic data and technology deliveries and transformations across Infrastructure-as-a-Service (IaaS), Platform-as-a-Service (PaaS), Software-as-a-Service (SaaS), etc. The present techniques may enable a warehouse of modularized data and technology building blocks that are continuously updated and improved via cloud-native or cloud agnostic or open source services and packages driving data enablement.” Par 037. This “decision making” is a policy which a company is following.
Further, is Applicant trying to limit the scope of compliance policy? In par 016 of Applicant specification, Applicant describes policies as a compliance standard that the company wishes to adhere to or that applies to a particular product. Durvasula’s deliveries and transformations describe specific steps ie policy for a particular product (SaaS and cloud migration) in line with Applicant’s teaching. Because Durvasula teaches in fact what Applicant says Durvasula does not, albeit with equivalence that one ordinarily skilled in the art would understand, the argument is unpersuasive.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to RICHARD W. CRANDALL whose telephone number is (313)446-6562. The examiner can normally be reached M - F, 8:00 AM - 5:00 PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Anita Coupe can be reached at (571) 270-3614. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/RICHARD W. CRANDALL/ Primary Examiner, Art Unit 3619
Prosecution Insights