DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
The claims when analyzed under 2019 Revised Patent Subject Matter Eligibility Guidance, are directed to abstract idea. Claim 1 for example, recites a method and, therefore, is a process. The claim recites the limitation of “identify an application installed in an application environment”; “receive an input associated with the application”; “generate one or more dynamic security policies associated with the application…”; “the one or more dynamic security policies defining one or more security operations…”; “store the one or more dynamic security policies…” These limitations, under broadest reasonable interpretation are directed performance of the limitation in a human mind or by a human. That is, nothing in the claim element precludes the step from practically being performed in the mind or by a human. For example, the claim encompasses a human simply “identify an application installed in an application environment…receive an input associated with the application…generate one or more dynamic security policies associated with the application…the one or more dynamic security policies defining one or more security operations…store the one or more dynamic security policies…” Thus, the claim is directed to abstract idea when analyzed under step 2A prong 1.
Claim is further analyzed in step 2A prong 2, to evaluate whether the claim as a whole integrates the recited judicial exception into a practical application of the exception. This evaluation is performed by identifying whether there are any additional elements recited in the claim beyond the judicial exception, and evaluating those additional elements individually and in combination to determine whether the claim as a whole integrates the exception into a practical application. The claim recites the additional elements of: “one or more processors”, “application environment”, “real world environment”, “simulated environment”; “a database system”; However, the additional elements fail to integrate the judicial application into a practical application and are not directed to an improvement in the functioning of a computer or an improvement to another technology. However, the remaining limitations appears to be generic computer functions which do not constitute meaningful limitations that would amount to significantly more than the abstract idea. The combination of the additional element is no more than generic computer functions. Thus, even in combination, the additional elements do not integrate the abstract idea into a practical application because they do not impose any meaningful limitations on practicing the abstract idea.
Claim is additionally analyzed under Step 2B to evaluates whether the claim as a whole amount to significantly more than the recited exception, whether any additional element, or combination of additional elements, adds an inventive concept to the claim. When claims evaluated under step 2B, it is no more than what is well-understood, routine, conventional activity in the field. The specification does not provide any indication anything other than a generic computer component. The merely “identify an application installed in an application environment…receive an input associated with the application…generate one or more dynamic security policies associated with the application…the one or more dynamic security policies defining one or more security operations…store the one or more dynamic security policies…” is a well-understood, routing and conventional function when it is claimed in a merely generic manner as it is here.
Independent claims 10 and 16 include limitations similar to the limitations of claim 1 and are rejected under 35 U.S.C. 101 as being directed to abstract idea for the same reasons discussed above with respect to claim 1.
Dependent claims 2-9, 11-15 and 17-20 do not cure the deficiency of the independent claims 1, 10 and 16 and are directed to abstract idea when analyzed under 2019 Revised Patent Subject Matter Eligibility Guidance.
Regarding Claim 2:
Claim 2 merely adds an additional abstract idea, namely “wherein the application is a distributed application hosted by an application server” which is considered an insignificant extra solution activity. No additional elements are introduced in claim 2 that would integrate the judicial exception into a practical application. As a whole, claim 2 fails to integrate the judicial exception into a practical application is found non‐statutory under 35 U.S.C. 101 with the addition of the abstract idea.
Regarding Claims 3, 11, 17:
Claims 3, 11 and 17 merely adds an additional abstract idea, namely “wherein the input is received from a client device, and the one or more dynamic security policies are generated responsive to receiving the input” which could be performed in the mind or by a human. Claims 3, 11 and 17 are introduced an additional elements “a client device” (Claim 3, 11 and 17) and “the device”(Claim 17). However, the additional elements fails to integrate the judicial exception into a practical application. As a whole, claims 3, 11 and 17 fails to integrate the judicial exception into a practical application is found non‐statutory under 35 U.S.C. 101 with the addition of the abstract idea.
Regarding Claims 4, 12 and 18:
Claims 4, 12 and 18 merely adds an additional abstract idea, namely “generate a plurality of dynamic security policies…” which could be performed in the mind or by a human.
No additional elements is introduced in claims 4 and 12, that would integrate the judicial exception into a practical application. Claim 18 introduce an additional elements “the device” and “processing device”. However, the additional elements fails to integrate the judicial exception into a practical application. As a whole, claims 4, 12 and 18 fails to integrate the judicial exception into a practical application is found non‐statutory under 35 U.S.C. 101 with the addition of the abstract idea.
Regarding Claim 5:
Claim 5 merely adds an additional abstract idea, namely “wherein each of the plurality of dynamic security policies is associated with a different security operation” which is considered an insignificant extra solution activity. No additional elements are introduced in claim 5 that would integrate the judicial exception into a practical application. As a whole, claim 5 fails to integrate the judicial exception into a practical application is found non‐statutory under 35 U.S.C. 101 with the addition of the abstract idea.
Regarding Claims 6, 13 and 19:
Claims 6, 13 and 19 merely adds an additional abstract idea, namely “generate one or more reference data objects…” which is an mental process or could be done by a human. No additional elements is introduced in claims 6 and 13, that would integrate the judicial exception into a practical application. Claim 19 introduce an additional elements “the device” and “processing device”. However, the additional elements fails to integrate the judicial exception into a practical application. As a whole, claims 6, 13 and 19 fails to integrate the judicial exception into a practical application is found non‐statutory under 35 U.S.C. 101 with the addition of the abstract idea.
Regarding Claims 7, 14 and 20:
Claims 7, 14 and 20 merely adds an additional abstract idea, namely “identify a plurality of sensitive data objects in application data…”; “generate one or more output data objects…” which is an mental process or could be done by a human. No additional elements is introduced in claims 7 and 14 that would integrate the judicial exception into a practical application. Claim 20 introduce an additional elements “the device” and “processing device”. However, the additional elements fails to integrate the judicial exception into a practical application. As a whole, claims 7, 14 and 20 fails to integrate the judicial exception into a practical application is found non‐statutory under 35 U.S.C. 101 with the addition of the abstract idea.
Regarding Claims 8 and 15:
Claims 8 and 15 merely adds an additional abstract idea, namely “wherein the plurality of sensitive data objects is identified based, at least in part, on data properties stored as data tags…” which is an mental process or it could be done by a human. No additional elements are introduced in claims 8 and 15 that would integrate the judicial exception into a practical application. As a whole, claims 8 and 15 fails to integrate the judicial exception into a practical application is found non‐statutory under 35 U.S.C. 101 with the addition of the abstract idea.
Regarding Claim 9:
Claim 9 merely adds an additional abstract idea, namely “wherein the one or more security operations is selected from a group consisting of a masking operation, a redaction operation, and a deletion operation…”which is an mental process or could be done by a human. No additional elements are introduced in claim 9 that would integrate the judicial exception into a practical application. As a whole, claim 9 fails to integrate the judicial exception into a practical application is found non‐statutory under 35 U.S.C. 101 with the addition of the abstract idea.
Regarding Claim 10 and 16:
Independent claims 10 and 16 include limitations similar to the limitations of claim 1 and are rejected under 35 U.S.C. 101 as being directed to abstract idea for the same reasons discussed above with respect to claim 1.
Additional elements “one or more processors” (in Claims 10) and “processing device” (in Claims 16) are introduced. However, the additional elements fails to integrate the judicial exception into a practical application. As a whole, claims 10 and 16 fails to integrate the judicial exception into a practical application is found non‐statutory under 35 U.S.C. 101 with the addition of the abstract idea.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-8, 10-15, 16-20 are rejected under 35 U.S.C. 103 as being unpatentable over Bhasker et al. (U. S. PGPub. No. 2021/0194888 A1) (hereinafter “Bhasker”), and further in view of Lang et al. (U. S. PGPub. No. 2019/0258953 A1) (hereinafter “Lang”).
Regarding Claim 1, Bhasker teaches:
one or more processors configured to (Bhasker: [0042] Processor(s) 103 may be implemented by one or more programmable processors to execute one or more executable instructions, such as a computer program, to perform the functions of the system):
identify an application installed in an application environment (Bhasker: [0029], one or more appliances 108 installed within environment 101. [0066] In some embodiments, the preferred browser identified by the gateway service 408 may be a specialized browser embedded in the resource access application 424 (when the resource application is installed on the client 202));
receive an input associated with the application (Bhasker: [0061], Upon receiving a sign-on request, the identity service 418 may cause the resource access application 424 (via the client interface service 416) to prompt the user 426 for the user's authentication credentials (=input) (e.g., user-name and password). Upon receiving the user's authentication credentials (=input), [0062], The cloud-based identity service may then cause the client 202 to prompt the user 426 to enter the user's authentication credentials);
generate one or more dynamic security policies associated with the application based, at least in part, on the input and one or more application components (Bhasker: [0088] Via the policy server 506, an organization can define security policies related to users 516 and devices 502 associated with the organization. A security policy can determine the type of access that particular users/devices and/or groups of users/devices should be permitted with respect to the organization's applications and content…an organization define a security policy that prevents users from viewing certain types of content from outside the organization's offices), the one or more dynamic security policies defining one or more security operations for application data objects included in the application (Bhasker: [0088], an organization define a security policy that permits only certain users to view sensitive content (=application data object). As another example, an organization define a security policy that prevents users from viewing certain types of content from outside the organization's offices. As another example, an organization define a security policy that allows users to access sensitive content using one SaaS application (e.g., an application the organization deems to be secure), while preventing users from accessing sensitive content from a different SaaS application (e.g., an application the organization deems to be insecure),
and a database system configured to store the one or more dynamic security policies associated with the application (Bhasker: [0129] Within security policies database 910, policy server 900 can maintain information regarding security policies defined by one or more organizations for enforcement within the network environment. A given security policy can determine the type of access that particular user/device, or a group of users/devices, has with respect to the organization's content, applications, and other resources).
Bhasker does not explicitly disclose:
wherein one or more dynamic security policies include access control policies tested against real world and simulated environments.
However, in an analogous art, Lang teach:
wherein one or more dynamic security policies include access control policies tested against real world and simulated environments (Lang: [0151] implementing and executing the policy across an actual environment (=real world) (e.g. enforcing access control policies, executing exploits)….implementing and executing the policy across a simulated environment (e.g. simulating enforcing access control policies, simulating executing simulated exploits));
It would be obvious to a person having ordinary skill in the art, before the effective filing date of the invention, to modify Bhasker’s method of defining security policies for one secure SaaS application in order to prevent users from accessing sensitive content from a different insecure SaaS application by applying Lang’s method of implementing and executing policy across actual environment and simulated environment, in order to provide assisted policy management and better automation of supporting activities (Lang: [0003]).
Regarding Claim 2, Bhasker in view of Lang teaches:
The system of claim 1, (see rejection of claim 1 above),
wherein the application is a distributed application hosted by an application server (Bhasker: [0169]. A computer program can be deployed to be executed on one computer or on multiple computers at one site or distributed across multiple sites and interconnected by a communication network).
Regarding Claim 3, Bhasker in view of Lang teaches:
The system of claim 1, (see rejection of claim 1 above),
wherein the input is received from a client device (Bhasker: [0061], Upon receiving a sign-on request, the identity service 418 may cause the resource access application 424 (via the client interface service 416) to prompt the user 426 for the user's authentication credentials (e.g., user-name and password). Upon receiving the user's authentication credentials, [0062], The cloud-based identity service may then cause the client 202 to prompt the user 426 to enter the user's authentication credentials), and the one or more dynamic security policies are generated responsive to receiving the input (Bhasker: [0088], an organization may define a security policy that allows users to access sensitive content using one SaaS application (e.g., an application the organization deems to be secure), while preventing users from accessing sensitive content from a different SaaS application (e.g., an application the organization deems to be insecure). A security policy targeting a particular user or group of users may be applicable to the device/devices assigned to the user/users).
Regarding Claim 4, Bhasker in view of Lang teaches:
The system of claim 1, (see rejection of claim 1 above),
wherein the one or more processors are further configured to (Bhasker: [0042] Processor(s) 103 may be implemented by one or more programmable processors to execute one or more executable instructions, such as a computer program, to perform the functions of the system):
generate a plurality of dynamic security policies based, at least in part, on an identified data object type (Bhasker: [0088], A security policy targeting a particular user or group of users may be applicable to the device/devices assigned to the user/users. In some embodiments, an organization can define several classes of sensitive content, such as “not sensitive,” “sensitive,” and “highly sensitive” and define different security policies for different the different classes).
Regarding Claim 5, Bhasker in view of Lang teaches:
The system of claim 4, (see rejection of claim 4 above),
wherein each of the plurality of dynamic security policies is associated with a different security operation (Bhasker: [0109], , security module 716 may detect when the user performs (or attempts to perform) certain actions within the client apps 714, such as uploading content, downloading content, sharing content, or copying/pasting content. In response to detecting such an action, security module 716 may identify and remove/redact (=security operations) sensitive information in the content being acted upon. Security module 716 can continually monitor user behavior and actions on the client device 700 to enforce an organization's security policy with respect to sensitive information).
Regarding Claim 6, Bhasker in view of Lang teaches:
The system of claim 1, (see rejection of claim 1 above),
wherein the one or more processors are further configured to (Bhasker: [0042] Processor(s) 103 may be implemented by one or more programmable processors to execute one or more executable instructions, such as a computer program, to perform the functions of the system):
generate one or more reference data objects based, at least in part, on the one or more dynamic security policies (Bhasker: [0121], client device 700 alert the user (e.g., by displaying a message or other indicator) (=reference data) when the user is downloading or otherwise accessing sensitive content and/or when sensitive content has been modified prior to it being displayed to the user… client device 700 provide the user with additional information (=reference data) explaining why content was modified, such as notifying the user that they are accessing the content from an insecure location, from an insecure device, over an insecure network connection, etc).
Regarding Claim 7, Bhasker in view of Lang teaches:
The system of claim 1, (see rejection of claim 1 above),
wherein the one or more processors are further configured to(Bhasker: [0042] Processor(s) 103 may be implemented by one or more programmable processors to execute one or more executable instructions, such as a computer program, to perform the functions of the system):
identify a plurality of sensitive data objects in application data associated with the application (Bhasker: [0120], Security module 716 may use the output of text processors 718, image processors 720, and/or ML engine 724 to determine if content includes sensitive information and, in response, may invoke one or more document editors 726 to remove/redact that information before the content is displayed or otherwise made accessible the user);
and generate one or more output data objects based, at least in part, on identified plurality of sensitive data objects (Bhasker: [0118], As output, ML engine 724 may classify the content or portions thereof as sensitive or not sensitive. In the case of text-based content, ML engine 724 may classify particular words, sentences, lines, paragraphs, or other groupings of text as sensitive or not sensitive. In the case of image-based content, ML engine 724 may classify particular regions of the image (e.g., regions defined by geometric coordinates and/or dimensions) as sensitive or not sensitive. In some embodiments, ML engine may output a classification having three or more possible states/values (e.g., “highly sensitive,” “sensitive,” or “not sensitive”)
Regarding Claim 8, Bhasker in view of Lang teaches:
The system of claim 7, (see rejection of claim 7 above),
wherein the plurality of sensitive data objects is identified based, at least in part, on data properties stored as data tags (Bhasker: [0114], The training dataset may be labeled (=tags) to indicate which documents are sensitive and which are non-sensitive. In some embodiments, more than two sensitive classifications can be used—e.g., “highly sensitive,” “sensitive,” and “not sensitive”—and the training dataset may include documents from more than one class and be labeled (=tags) accordingly).
Regarding Claim 10, this claim contains identical limitations found within that of claim 1 above albeit directed to a different statutory category (method medium). For this reason the same grounds of rejection are applied to claim 10.
Regarding Claim 11, this claim contains identical limitations found within that of claim 3 above albeit directed to a different statutory category (method medium). For this reason the same grounds of rejection are applied to claim 11.
Regarding Claim 12, this claim contains identical limitations found within that of claim 4 above albeit directed to a different statutory category (method medium). For this reason the same grounds of rejection are applied to claim 12.
Regarding Claim 13, this claim contains identical limitations found within that of claim 6 above albeit directed to a different statutory category (method medium). For this reason the same grounds of rejection are applied to claim 13.
Regarding Claim 14, this claim contains identical limitations found within that of claim 7 above albeit directed to a different statutory category (method medium). For this reason the same grounds of rejection are applied to claim 14.
Regarding Claim 15, this claim contains identical limitations found within that of claim 8 above albeit directed to a different statutory category (method medium). For this reason the same grounds of rejection are applied to claim 15.
Regarding Claim 16, Bhasker teaches:
first communications interface communicatively coupled to a client device (Bhasker: [0045] Communications interfaces 118 may include one or more interfaces to enable computing device 100 to access a computer network such as a Local Area Network (LAN), a Wide Area Network (WAN), a Personal Area Network (PAN), or the Internet through a variety of wired and/or wireless connections, including cellular connections);
a processing device comprising one or more processors configured to (Bhasker: [0042] Processor(s) 103 may be implemented by one or more programmable processors to execute one or more executable instructions, such as a computer program, to perform the functions of the system):
This claim contains identical limitations found within that of claim 1 above albeit directed to a different statutory category (apparatus medium). For this reason the same grounds of rejection are applied to claim 16.
Regarding Claim 17, this claim contains identical limitations found within that of claim 3 above albeit directed to a different statutory category (method medium). For this reason the same grounds of rejection are applied to claim 17.
Regarding Claim 18, this claim contains identical limitations found within that of claim 4 above albeit directed to a different statutory category (method medium). For this reason the same grounds of rejection are applied to claim 18.
Regarding Claim 19, this claim contains identical limitations found within that of claim 6 above albeit directed to a different statutory category (method medium). For this reason the same grounds of rejection are applied to claim 19.
Regarding Claim 20, this claim contains identical limitations found within that of claim 7 above albeit directed to a different statutory category (method medium). For this reason the same grounds of rejection are applied to claim 20.
Claim(s) 9 is rejected under 35 U.S.C. 103 as being unpatentable over Bhasker et al. (U. S. PGPub. No. 2021/0194888 A1) (hereinafter “Bhasker”), and further in view of Lang et al. (U. S. PGPub. No. 2019/0258953 A1) (hereinafter “Lang”); and in further view of BOUDREAU et al. (U. S. PGPub. No. 2018/0089449 A1) (hereinafter “Boudreau”).
Regarding Claim 9, Bhasker in view of Lang teaches:
The system of claim 1, (see rejection of claim 1 above),
Bhasker in view of Lang does not teach:
wherein the one or more security operations is selected from a group consisting of a masking operation, a redaction operation, and a deletion operation.
However, in an analogous art, Boudreau teaches:
wherein the one or more security operations is selected from a group (Boudreau: [0059] Otherwise, if the total message risk score meets or exceeds the high risk threshold, then at 116 one or more mitigation actions (=security operations) are selected from a group of different mitigation actions as a function of association to the content risk rating, sender risk rating, recipient risk rating and/or reach risk rating values or combinations thereof, and applied to the message. More particularly, mitigation actions are selected in response to association with different ones, or different combinations of, the low or high values of the content, sender, recipient and reach risk ratings…) consisting of a masking operation, a redaction operation, and a deletion operation (Boudreau: [0083], The highlighted content may also be associated with or replaced with a mitigation recommendation (=security operations) to reduce or eliminate the risks of unintended disclosure, such as partially redacting the information (for example, replacing some numbers with other characters or symbols, thus “XXX-XX-1234”), or removing the information of concern entirely and replacing with a notice (“Available as Needed”))
A person having ordinary skill in the art, before the effective filing date of the invention, would have found it obvious to modify Bhasker in view of Lang by applying the well-known technique as disclosed by Boudreau of one or more mitigation actions (=security operations) are selected from a group of different mitigation actions in order to apply mitigating action. The motivation is to provide protection from inappropriate or unauthorized data releases, and exposure of confidential, proprietary or classified information to competitors or unauthorized persons or governmental entities (Boudreau: [0002]).
Conclusion
The prior art made of record and not relied upon is considered pertinent to a disclosure. Refer to PTO-892, Notice of References Cited for a listing of analogous art.
Roth et al. (U. S. PGPub. No. 2016/0239677 A1): A user interface is described, such as a graphical user interface (GUI), operable to receive a representation of a security policy expressed in a first policy language, where that security policy will be supported by policy evaluation engines (or other such components) that are configured to operate using security policies expressed using a second (different) policy language. The representation of the security policy is persisted in a data store in accordance with the first policy language. Subsequently, in response to receiving a request to access a resource, a second representation of the security policy is generated by translating the content of the security policy into a second policy language that is associated with the policy evaluation engine. The second representation of the security policy is then evaluated by the policy evaluation engine to grant or deny access to the resource.
Buck et al. (U. S. PGPub. No. 2020/0285761 A1): For increased device security, a security policy manager is used to configure permissions for applications installed on mobile computing devices. In one approach, an evaluation server receives data associated with a context for a computing device. Based on the received data, a policy that is applicable for the current context of the computing device is identified. The identified policy has rules regarding access permissions for software installed on computing devices. The server determines a current policy implemented on the computing device, which includes determining an access permission for software installed on the computing device. The server determines that the access permission for the installed software does not comply with the policy applicable to the current context. Based on this determination, the server revokes the access permission for the installed software.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to RUPALI DHAKAD whose telephone number is (571)270-3743. The examiner can normally be reached M-F 8:30-5:30.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Alexander Lagor can be reached at 5712705143. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/R.D./Examiner, Art Unit 2437
/ALI S ABYANEH/Primary Examiner, Art Unit 2437
Prosecution Insights