DETAILED ACTION
Claims 1-15 are pending for examination. Claims 1, 8, and 9 are amended.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-15 are rejected under 35 U.S.C. 101 because the claimed invention recites a judicial exception, is directed to that judicial exception, an abstract idea, as it has not been integrated into practical application and the claims do not recite significantly more than the judicial exception.
Step 1: Claims 1-7 are directed to methods and fall within the statutory category of processes. Claim 8 is directed to a computer readable medium and falls within the statutory category of articles of manufacture. Claims 9-15 are directed to systems and fall within the statutory categories of machines. Therefore, “Are the claims to a process, machine, manufacture, or composition of matter?” Yes.
In order to evaluate the Step 2A inquiry “Is the claim directed to a law of nature, a natural
phenomenon or an abstract idea?” we must determine, at Step 2A Prong 1, whether the claim recites a
law of nature, a natural phenomenon or an abstract idea and further whether the claim recites
additional elements that integrate the judicial exception into a practical application.
Step 2A Prong 1:
Claims 1, 8, and 9: The limitations of “detecting in a log…a plurality of access events…,” “determining a first set of permissions…,” “determining a second set of permissions…,” “detecting a difference between the second set of permissions and the first set of permissions,” and “determining if the detected difference poses a cybersecurity risk,” as drafted, is a process that, but for the recitation of generic computing components, under its broadest reasonable interpretation, covers performance of the limitation in the mind. For example, a person examine a received log of data to examine events, determine permissions, compare permissions, and decide if detected differences are relevant.
Therefore, Yes, claims 1, 8, and 9 recite judicial exceptions.
The claims have been identified to recite judicial exceptions, Step 2A Prong 2 will evaluate whether the claims are directed to the judicial exception.
Step 2A Prong 2:
Claims 1, 8, and 9: The judicial exception is not integrated into a practical application. In
particular the claims recite the following additional elements — “a cloud computing environment, “ “a configuration code, “a plurality of code objects,” “a non-transitory computer readable medium,” “a processing circuitry,” and “a memory,” which are merely recitations of generic computing components and functions (see MPEP § 2106.05(b)) which do not integrate a judicial exception into practical application. Further, claims 1, 8, and 9 recite the following additional elements – “accessing a configuration code…,” which is merely a recitation of insignificant pre-solution data gathering activity (see MPEP § 2106.05(g)), which does not integrate a judicial exception into practical application and will also be addressed below in Step 2B as also being Well-Understood, Routine and Conventional, and “generating an updated code object…,” which is merely an instruction to apply the abstract idea (see MPEP § 2106.05(g)).
Therefore, “Do the claims recite additional elements that integrate the judicial exception into a
practical application?” No, these additional elements do not integrate the abstract idea into a practical
application and they do not impose any meaningful limits on practicing the abstract idea. The claims are
directed to an abstract idea.
After having evaluated the inquiries set forth in Step 2A Prongs 1 and 2, it has been concluded that claims 1, 8, and 9 not only recite a judicial exception but that the claims are directed to the judicial exception as the judicial exception has not been integrated into practical application.
Step 2B:
Claims 1, 8, and 9: The claims do not include additional elements, alone or in combination,
that are sufficient to amount to significantly more than the judicial exception. As discussed above with
respect to integration of the abstract idea into a practical application, the additional elements amount
to no more than generic computing elements a recitation of field of use/technological environment and insignificant extra-solution data gathering which do not amount to significantly more than the abstract idea. Further, to the extent that “accessing a configuration code…” and “generating an updated code object…” are positively recited steps of receiving data and applying the results of the mental process steps, this would be insignificant extra-solution data gathering and applying of the judicial exception which is also Well-Understood, Routine and Conventional (see MPEP § 2106.05(d)(II) “The courts have recognized the following computer functions as well‐understood, routine, and conventional functions when they are claimed in a merely generic manner (e.g., at a high level of generality) or as insignificant extra-solution activity. i. Receiving or transmitting data over a network,”).
Therefore, “Do the claims recite additional elements that amount to significantly more than the judicial exception?” No, these additional elements alone or in combination, do not amount to significantly more than the judicial exception.
Having concluded analysis within the provided framework, claims 1, 8, and 9 do not recite patent eligible subject matter under 35 U.S.C. 101.
Claims 2-7 are rejected under 35 U.S.C. 101 as non-statutory for at least the reasons stated above. The claims are dependent on Claim 1, but do not add any feature or subject matter that would solve the non-statutory deficiencies of Claim 1. Specifically, each claim simply clarifies details of the various claimed elements or adds further mental processes that are similar to the steps in claim 1. Claims 2-7 do not add any steps or elements, when considered both individually and as a combination, that would convert claim 1 into patent-eligible subject matter. Similarly, claims 10-15 also do not add any steps or elements, when considered both individually and as a combination, that would convert their independent claim into patent-eligible subject matter.
Response to Arguments
Applicant's arguments filed on 10/09/2025 have been fully considered but they are not persuasive.
With respect to prior art rejections, applicant argues the following in the remarks:
a. On pages 2-4, applicant argues that no mental process steps are present because the claimed limitations cannot be reasonably performed by the human mind or with pen and paper. Specifically, it is cited that the human mind cannot (a) access a configuration code, because that would require compute elements, (b) the human mind cannot detect in a log…a plurality of access events, because accessing the log requires computing elements, and (c) the human mind cannot detect a difference in permissions within the log, because that would require memorization or vast numbers of calculations.
b. On pages 5-7, applicant cites portions of the instant specification that are purported to demonstrate an improvement in the technology, including specification paragraphs 57, 97, and 98.
The examiner respectfully disagrees with the applicant:
a. The examiner would point out that (a) the step of accessing the configuration data was not claimed to be a mental process. Instead, it was an additional element that was discussed later. The examiner never suggested that accessing the configuration data was a mental process. (b) Again, the step of accessing the log is not in question. By the claim language, the log has been accessed before the detection step occurs. Surely, a person could peruse a log that had already been made available and detect entries made therein. Finally, (c) it would not be unreasonable at all to compare permissions within the log to find a single difference. Note that the claim language does not require every difference to be exhaustively discovered. Only a single difference is required. It is not unreasonable at all to imagine a person examining a log that included permissions data, comparing a first set of permissions data to a second, and noting a single difference. Thus, the rejection stands.
b. While the examiner would agree that the specification cites claimed advantages, those claimed advantages (from the specification) are not included in the claim language. As cited by applicant from paragraphs 97 and 98, “it is advantageous to check if a principal utilizes their permissions, what permissions are utilized…, and what access a principal is attempting to perform. For example…, it is beneficial to provide a principal access only to what is required…” The examiner would point out that none of this is included in the claim language for the independent claims. There is no specificity required at all in claim 1, for example. Any detected difference is acceptable, and any possible risk is considered. While there might be specific algorithms present in the specification that could overcome this rejection, those specific algorithms are not present in the very generic and broad claims. Thus, the rejection stands.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Gregory Kessler whose telephone number is (571)270-7762. The examiner can normally be reached M-Th 8:30 - 5, Alternate Fridays 8:30-4.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Bradley Teets can be reached at (571)272-3338. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/GREGORY A KESSLER/Primary Examiner, Art Unit 2197
Prosecution Insights