DETAILED ACTION
Claims 1, 3-4, 18 are amended. Claims 1-20 are pending.
Priority: 4/27/2021(FP)
Assignee: GrabTaxi
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Note: In the Remarks, the Applicant does not mention the relevant specification paragraph(s) that recite the amendment(s).
Claim(s) 1-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
1.Amended Claims 1,18 are rejected for reciting a limitation that is unclear, vague and indefinite.
Amended claim 1 recites, ‘the data storage table being a data storage table or a partition thereof’.
Nowhere does the spec recite this limitation. Para-0084 of the spec recites, ‘a data storage table may be a sub-table (e.g. a partition) of a larger table’.
The phrase 'the data storage table being a data storage table’ is redundant and adds no substantive value to the claim. Stating that an object is what it already is (A is A), provides no new technical information. Such language only adds verbosity without adding meaning, rendering the claim indefinite. Claim 18 has the same issue. For examination, the spec is used.
The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
Note: In the Remarks, the Applicant does not mention the relevant specification paragraph(s) that recite the amendment(s).
Claim(s) 1-20 are rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
1.Amended Claims 1,18 are rejected for reciting limitations that are unsupported by the spec.
Amended Claim recites, ‘….controller configured to….determine the data storage table associated with the data element of the request based on the identifier of the storage location included in the request’.
Nowhere does the spec recite this limitation. There is no recitation of ‘the data element of the request’ in the spec. Para-0004 of the spec recites, ‘the request comprises a identifier of the ….location of the data element’.
As per the spec, the request is associated with the location of the data element, not the data element itself.
Claim 1 further recites, ‘determine whether the data access client has access rights to the determined data storage table allowing the data access client to access the data element’. The spec does not disclose this limitation using circular language. Spec, Para-0004 recites, ‘determine whether the data access client has access rights to the determined data storage table allowing the access to the data element’.
As shown, the inconsistent terminology and phrasing changes the scope of claim 1 beyond what was originally disclosed. Hence the limitations are unsupported by the spec and are rejected for the same reason. Claim 18 has the same issue. For examination, the spec is used.
Note: Amendments should align with the specification's original language to ensure the claims are clear and supported.
2.Amended Claims 1,18 are rejected for reciting limitations that are unsupported by the spec.
Amended claim 1 recites ‘access the data storage table to access the data element of the request by the data access client, in response to the request and the grant of access to the data access client having access rights of at least one of read access and write access to the data element of the request’.
Nowhere does the spec recite this limitation. W.r.t. to the controller, the spec does not recite, ‘access the data storage table to access the data element of the request by the data access client’.
The controller performed steps recited in claim 1 follow the steps of spec, Fig. 5, starting from step 501,502,503. In step 504, the last step recites, ‘grant the….client access to the data element if the…. client has access rights to the determined data storage table allowing the access to the data element’.
The limitation fails to define the controller’s actions, by blending controller functionality with the client. Based on the Fig. 5 flow diagram, the claimed limitation is unsupported by the spec.
Furthermore, Fig. 5, step 504 suggests that determining access rights to the table means read access or write access to the data element. The spec does not disclose separately determining read access or write access to the data element.
The claimed limitation relies on terms and phrases not explicitly recited in the original disclosure. Hence claim 1 is rejected for reciting a limitation unsupported by the spec with regards to scope and improper construction. Claim 18 has the same issue.
3.Amended Claims 3-4 are rejected for reciting limitations involving ‘reverse lookup mapping’ of a search tree, which lacks written description support in the spec.
Amended claim 3 recites, ‘wherein the….controller is configured to determine the data storage table by reverse lookup mapping from the identifier of the storage location’. And claim 4 recites, ‘wherein the identifier…is a Uniform Resource Identifier and the ….controller….to perform the reverse lookup mapping by….traversal of a search tree which comprises a node for each character of the URI and which comprises a leaf node comprising an indication of the data storage table’.
Claims 3-4 recite determining the ‘data storage table’ or an indication of it. But claims 3-4 do not recite determining the ‘data element’, even though claim 1 recites that the request includes a URI of the location of the ‘data element’.
Neither the claims nor the spec recite the structure/format of the URI based on the received request. Neither the claims nor the spec define ‘reverse lookup mapping’ (RLM) or how the ‘search tree’ is built from scratch. There is no written description of how reverse lookup/RLM is performed to determine the ‘data storage table’ to fulfill the client request.
Though spec, Para-0007 and claim 4 recite that the ‘search tree comprises a node for each character of the URI and which comprises a leaf node comprising an indication of the data storage table’, the recitation fails the written description requirement because the spec does not recite the (parsed) structure of the URI based on the received request, and determine the contents of each (parent) node and its child/leaf node. The figures do not provide any information.
Spec, Para-0050 recites, ‘a reverse index mechanism is used that allows identifying the associated table (or tables) for a given file/directory URI’. But there is no written description about the ‘reverse index’ or the ‘reverse index mechanism’.
The URI is a non-trivial string of characters. Claim 4 requires specific contents within each node, parent and child, of the search tree. But the written description is insufficient, thereby demonstrating that the applicant was not in possession of determining the contents of the nodes and their children in the search tree, to determine the data storage table, when the tree is traversed.
The spec does not disclose where the search tree is stored. This is a major drawback of the disclosure.
In summary, the applicant's possession of ‘reverse lookup mapping’ at the time of filing was incomplete. Hence claims 3-4 are rejected for lack of written description support to determine the data storage table via RLM.
Claim Rejections - 35 USC§ 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Note: On August 4, 2025, the USPTO memo on patent eligibility rejections focused on AI inventions. Though the memo addressed eligibility for software-related inventions, the memo also stated that it “is not intended to announce any new USPTO practice or procedure and is meant to be consistent with existing USPTO guidance.”
That being said, the amendments do not overcome the rejection because they do not add ‘significantly more’ to the exception, to recite an inventive concept and/or technical improvement. Based on the arguments, the rejection has been clarified and maintained.
Claims 1-20 are rejected under 35 U.S.C. § 101 because the claimed invention is directed to a judicial exception (i.e., a law of nature, a natural phenomenon, or an abstract idea) without significantly more.
Claim 1 recites, ‘A data storage system comprising: a data storage….;
a data storage access interface to receive a request for an access to a data element….; an access controller to determine a data storage table; determine whether the data access client has access rights….; grant the data access client access….’.
Claim 1 is directed to ‘a data storage system comprising a data storage and an access controller’ and claim 18 is directed to 'a method for controlling access to data stored in a data storage’. Hence they are directed to a statutory category, i.e., a machine (Step 1: Yes).
Under revised Step 2A, Prong 1 of the eligibility analysis, it is necessary to evaluate whether the claim recites a judicial exception by referring to subject matter groupings articulated in 2106.04(a) of the MPEP. In consideration of the analysis, the claims recite an abstract idea.
Claims 1, 3-4, 18 use a ‘search tree’ to recite the abstract idea of a data storage system receiving an access request with an identifier from a client/user to access a ‘data element’ in a table of a data storage/database. The access controller grants access to the client if it determines that the client has access rights to the data element.
Claim 3 recites that the access controller determines the table by ‘reverse lookup mapping’ based on the received identifier/URI. And claim 4 recites that the access controller performs the ‘reverse lookup mapping’ by traversing the pre-populated, hierarchical ‘search tree’ which comprises parent nodes and their respective leaf/child nodes.
A ‘search tree’ is based on graph theory, a subfield of mathematics and a basic concept in computer science. The spec recites that the URI is represented as the search tree. Therefore claims 3-4 recite the abstract idea of traversing a tree structure that uses mathematical ordering relationships to locate nodes in the tree. Traversing a tree is an activity a human can do with a pencil and paper. In fact, the static pre-populated tree encourages an effortless pencil-paper approach to readily locate nodes rather than employ a realistic assessment of the technical requirements to understand how the tree was built (from the beginning). Thus the pre-populated tree searching is a ‘mental process’. What further validates the abstract idea is that the underlying tree design and search rules of the tree remain the same regardless of whether the tree is used in a client server application, an embedded application or a simple sorting algorithm.
Therefore, receiving by the access controller a client/user request to access a data storage element, search a pre-populated tree to determine access or denial for the client, and notify the client, is a mental process that can be performed using a pen and paper. It is similar to the abstract idea of ‘organizing human activity’ that involves collecting and comparing information from the client, use rules to search-n-locate in a pre-populated tree, determine options for the client and transmit the result to the client. Hence claims 1, 3-4, 18 combine multiple abstract ideas, such as using a tree in a system and method of organizing human activity. Both, the ‘search tree’ and organizing human activity, use a hierarchical structure, with the main goal at the root, that branches into sub-goals and actions, which are then evaluated to reach a final outcome. Even if the claims require a computer, they may still be considered a mental process since the computer is used merely as a tool to perform the mental steps. See MPEP 2106.04(a)(2). Thus claims 1, 3-4, 18 recite an abstract idea.
Under revised Step 2A, Prong 2 of the eligibility analysis, if it is determined that the claims recite a judicial exception, it is then necessary to evaluate whether the claims recite additional elements that integrate the judicial exception into a practical application of that exception.
In this case, claims 1, 18, 6-12 recite additional elements such as ‘a data access interface’, ‘access rights’, ‘a temporary access token’, ‘an access stream’ and ‘a logging system’. Here the data access client interacting with the data access interface and an access stream to request and receive the temporary access token, while the entire transaction is logged in the logging system, does not provide significantly more than the judicial exception because these features are well-understood, routine, and conventional activity previously known to the industry of client access control, data management, and data processing.
Claims 15, 16 recite additional elements such as ‘a datalake’, and ‘a cloud data storage’, without reciting how these additional elements can be integrated to function as ‘data storage’ in the ‘data storage system’ to assist in the reverse lookup of the tree that is dynamically changing as multiple clients send requests to the ‘data storage system’.
In essence, the additional elements recited in claims 1, 18, 6-12, and 15-16, individually and in combination, do not integrate the exception into a practical application. This is because they are merely being used to apply the abstract idea using a generic processor, as defined in MPEP 2106.04(d).
Furthermore, the additional elements, ‘a data storage’, ‘a datalake’, and ‘a cloud data storage’, are mentioned without reciting their structure, location, volatility and management. Hence these additional elements amount to software structures unsupported by underlying hardware components. They merely comprise the software to access and store data via database queries, in the cloud or datalake. See MPEP 2106.01 (I). Hence claims 1-20 are drawn to software per se.
Though the spec recites, ‘controlling access to data stored in a data storage’, claims 1-20 merely recite software data structures (tree, table), and software instructions (database query), without any hardware support. The generic controller's interaction with the database represents a conventional use of the tree rather than a specific, technical improvement in database functionality or a specialized algorithm in reverse lookup of the tree. Claims 1-20 are directed to organizing, storing and retrieving data related to the tree structure, which is well-known in the art.
Claim 13 recites that ‘the access to the data element is a write access or a read access’, and claim 14 recites that ‘the access to the data element is an access to a plurality of data elements including the data element’. These steps are considered to be insignificant extra-solution activity. Extra-solution activity are activities that are incidental to the primary method that are merely a nominal or tangential addition to the claim. See MPEP 2106.05(g).
Under Step 2B of the eligibility analysis, if it is determined that the claims recite a judicial exception that is not integrated into a practical application of that exception, it is then necessary to evaluate the additional elements individually and in combination to determine whether they provide an inventive concept.
In this case, claims 1-20 recite a ‘data storage system’, a server, where the client sends a request with an identifier to access a table in a database in the server, wherein the request is processed by the controller, to grant or deny access to the client, is nothing more than routine, well-understood, well-documented activity between a client and a server. Implementing access control via access rights using standard components like a client, generic controller and database, does not constitute an inventive concept. This arrangement is simply the application of a well-understood, routine technique for mapping access privileges to data, which does not provide an unconventional inventive concept. Claims 1-20 recite a standard, conventional computer-based approach to database security that was well-known at the time of filing. The claims focus on collecting, analyzing, and outputting data related to the tree traversal, is well-known and does not constitute a technical improvement. Claims 1-20 do not provide an improvement in data access technology and/or database processing.
Since the claims do not recite how the data access client, the generic access controller, and the additional elements, considered individually or in combination, enhance the functioning of the ‘data storage system’ or provide a clear technological improvement, the claims do not provide an inventive concept. The claims amount to no more than applying the abstract idea using a generic computer. For court cases, please see at least: Digitech Image Tech's v. Electronics for Imaging, 758 F. 3d 1344; Planet Bingo, LLC v. VKGS, LLC, 576 Fed. Appx. 1005; Affinity Labs of Texas, LLC v. DirecTV, LLC, 838 F.3d 1253.
Hence independent claims 1 and 18 recite limitations of the abstract idea and are ineligible subject matter. Dependent claims 2-17, 19-20 also being ineligible, do not aid in the eligibility of their respective parent.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-2, 5-7, 13-14, 18-20 are rejected under AIA 35 U.S.C. 103 as being unpatentable over Geller et al (20160173406) in view of Hamilton et al (8910240) and Wissner at al (20100268700).
As per Claim 1, Geller discloses a data storage system (Geller, [Figs. 1, 2A-2B, 3, 7]; [0048 - The system architecture in Fig. 1 may includes components configured to provide a resource-based web services access control model. Fig. 2A shows an access control service/ACS 150 is interposed between web services interface 130 and a number of web services resources 140]) comprising:
a data storage (Geller, [Figs. 2A-2B: data store 160]) storing data comprising a plurality of data elements (Geller, [0059 - Fig. 3 shows resource table 300, displaying a number of access control entries/ACEs 310, each of which corresponds to a record/data element including a number of fields. ACE 310 includes resource URI field 320, principal ID field 330, subject pool field 340, and an access type field 350]),
each data element being associated with a data storage table (Geller, [Figs. 3, 6, 11, 14-15]; [0069 - ACS 150 is configured to generate and maintain one or more tables that correspond to different views of the data reflected in table 300. For example, data in two different table views are optimized for searching according to either principals/clients 100 or resources 140. Such table views are stored within data store 160 in a manner similar to storage of table 300]),
the data storage table being a data storage table ([See 112(b)]) or a partition thereof (Geller, [Figs. 3, 6, 11, 14-15]);
a data storage access interface (Geller, [Figs. 2A, 7: web services interface 130]) configured to receive from a data access client (Geller, [Fig. 2A: web services client]), a request to the data storage for an access to a data element (Geller, [0071,0072 – In Fig. 4, step 400, web services client 110, on behalf of a principal 100, generates a request specifying one or more access operations directed to a web services resource 140. In step 402, client 110 conveys the generated request to web services interface 130]),
the request including an identifier of a storage location of the data element (Geller, [0071 – In Fig. 4, client 110 generates an HTTP request or an XML document specifying the URI/Uniform Resource Identifier of resource 140 and information about the requested operation, e.g., read, write, delete etc.; Since it is well-known that a URI is a sequence of characters that identifies a logical or physical resource, it implies that the request includes an identifier of a storage location of the data element]);
an access controller (Geller, [Fig. 2B: ACS 150]; [Fig. 12: storage host controller 510]) configured to:
determine the data storage table associated with the data element ([See 112(a)]) of the request (Geller, [0077 – In Fig. 5, step 502, for each received request specifying a desired access operation, a particular resource 140 and a particular principal 100, ACS 150 determines whether an ACE 130/row/data storage table/sub-table exists that is associated with both the particular resource 140/identifier and the particular principal 100, and that specifies one or more access types]) based on the identifier of the storage location included in the request (Geller, [0078 - ACS 150 is configured to search through one or more instances of table 300, stored as a collection of records by data store 160, to determine whether any ACE 310/data storage table/sub-table/row matches the resource identifier, e.g., the URI of resource 140 and the access identifier of principal 100, and one or more access types/access rights to perform the specified access operation according to the access policy for resource 140; Para-0084 of the spec defines ‘data storage table’ as a sub-table/ACE 310/row of a larger table/Fig. 3:Resource Table 300]; [Fig. 5: step 504 - ACE exists? Yes, thereby determining the data storage table/ACE 310/sub-table/row associated with the data element based on the identifier of the storage location included in the request]);
determine whether the data access client has access rights to the determined data storage table allowing the data access client to access ([See 112(a)]) the data element (Geller, [Fig. 5: step 504 - ACE exists?]; [0031 - The access control information includes information identifying a particular user or principal/client as well as information identifying the access privileges/access rights held by the principal with respect to the particular web services resource]);
grant the data access client access to the data element in an instance the data access client has access rights to the determined data storage table allowing the access to the data element (Geller, [Fig. 5: step 504 - ACE exists? Yes, step 506 - Allow request to proceed]; [0082 – In Fig. 5, in response to determining that there exists at least one ACE 310 corresponding to resource 140 and principal 100 and indicating one or more access types/access rights sufficient to perform the requested operation, ACS 150 is configured to allow the request to proceed to resource 140 in step 506]),
access the data storage table to access the data element of the request by the data access client ([See 112(a)]), in response to the request and the grant of access to the data access client (Geller, [Fig. 4: steps 400 to 410]) having access rights (Geller, [0088 - The ListResourceAccess operation function to allow the entity/controller invoking the operation to determine what principals 100 have any sort of access rights to a resource 140]) of at least one of read access and write access (Geller, [0127 – In Fig. 10, step 1000, manager 161 receives a request from a client to store/write a structured data record within a table]) to the data element of the request (Geller, [0041 - A URI is used to identify a resource/data element 140]; [0039 - <path> identifies the path to be resolved by the host to access the identified resource/data element. One example of a URL/URI corresponding to a resource 140 is:http://storage.host.com/smith/music/Artist/Album/Trackl.mp3; Here file Track1.mp3 is the data element]).
Hamilton clarifies receiving the URI in the request from the data access client as follows,
a data storage access interface (Hamilton, [Fig. 1: universal interface 114]; [Col. 17, lines 17-19 - Fig. 9: Computing device 900 implemented as a standard server 920]) configured to receive a request for an access (Hamilton, [Col. 6, lines 5-7 - An authority scope can determine whether a content provider has permission/access rights to read from the device, write to the device]) to a data element (Hamilton, [Col. 7, lines 60-63 - In Fig. 3, when the clock content provider processes a request to read ‘content://clock/alarm/1’, the clock content provider can read from the ‘alarm’ table in the ‘clock’ database and return the requested column, which is column ‘1/data element]) from a data access client (Hamilton, [Col. 2, lines 66-67 – In Fig. 1, mobile device 104 is a cell phone that includes operating platform 102 with applications 108,110,112 to send a request]; [Col. 2, lines 22-23 - Fig. 9 shows a computer device/900 and a mobile computer device/950, thereby implying that mobile computer device 950 sends a request to computing device 900]; [Col. 19, lines 39-41 - A client/950 and server/900 are generally remote from each other and interact through a communication network]),
the request including an identifier of a storage location of the data element (Hamilton, [Col. 1, lines 45-47 - An application transmits a request having a uniform resource identifier/URI associated with data and a data store that is accessible for storing and retrieving the data]; [Col. 2, lines 41-45 - The URI has a hierarchal structure/tree that permits applications to specify the type of data to retrieve/read or store/write. A URI ‘content://contacts/phones/Bob’ indicates that the data specified by the URI is a phone number for a user Bob that is stored as contact information/data element]);
Therefore it would have been obvious to a person of ordinary skill at the time of filing to incorporate the URI of Hamilton into the access control system of Geller, for the benefit of retrieving and storing all data on a device using URIs. Every piece of content has a string that uniquely identifies it. Different applications can retrieve data stored on the device using a single mechanism by specifying the data with a URI (Hamilton, Col. 2, lines 31-36).
Wissner discloses verifying client access rights as follows,
access the data storage table (Wissner, [Fig. 2: databases 216, 218]; [0063 – In Fig. 2, host server 200 retrieves data stored in repositories/databases 128,130,132 based on query submitted by user/client, thereby implying accessing the data storage table]) to access the data element (Wissner, [0244 - In Fig. 25, step 2508, an advertisement/data element is presented to the user in the user interface, thereby implying access of data element]) of the request ([See 112(a)]) by the data access client (Wissner, [Fig. 1: client device 102N]), in response to the request (Wissner, [0141 – In Fig. 3, host server 300 includes UI module 312]; [0046 - The location identifier of electronic content/data element or a source is a web address that a web browser uses to locate the content of the source for access by a user via a web browser, e.g., URI]; [0076 – In Fig. 2, host 200 includes web application server 212 which accepts a request from the user/client and responds to the request by providing the requestor with web pages, such as HTML documents/data element and objects that can include static and/or dynamic content]) and the grant of access to the data access client (Wissner, [0142 - The user can login before requesting search such that personalized semantic types and associated attributes can be used in performing search; Here login by user suggests determining access and grant of access to client/user]) having access rights of at least one of read access and write access to the data element (Wissner, [0089 - An object is any electronic object stored, shared, distributed, and/or accessed, such as documents, articles, audio files, video files, multimedia content, etc.]; [0089 - The location identifier of the object can be a location identifier in the WWW]) of the request (Wissner, [0070 – In Fig. 2, host server 200 includes firewall 204 to enforce a predetermined set of access rights between a particular set of machines and applications/users to regulate resource sharing between these entities. Firewall 204 manages access to an access control list which details permissions including the access and operation rights of an object by an individual/user, a machine, and/or an application, and the circumstances under which the permission rights stand]).
Therefore it would have been obvious to a person of ordinary skill at the time of filing to incorporate the access rights of Wissner into the access control system of Geller,Hamilton for the benefit of performing search and search optimization using a pattern of a location identifier (Wissner, 0045).
As per Claim 2, the rejection of claim 1 is incorporated, and Geller discloses,
wherein the identifier of the storage location is a Uniform Resource Identifier (Geller, [0040 - A URI identifies host, domain and path/location information associated with a resource 140 that is sufficient to uniquely identify that resource within a particular naming scheme]; [0041 - A URI has the general format: <scheme>:<host.domain>/<path>; See RFC 3986]).
As per Claim 5, the rejection of claim 1 is incorporated, and Geller discloses,
wherein the access controller is configured to reject the data access client (Geller, [0083 – In Fig. 5, step 508 – Deny/reject request, thereby implying that the client access is rejected]) access to the data element (Geller, [0076 – In Fig. 5, step 500, ACS 150 receives requests that are submitted by clients 110 on behalf of principals 100 and that are forwarded via interface 130]) in an instance the data access client does not have access rights to the determined data storage table allowing the access to the data element (Geller, [0077 – In Fig. 5, steps 502-504, for each received request specifying a desired access operation, a resource 140 and a principal 100, ACS 150 determines whether an ACE 130 exists that is associated with both the resource 140 and principal 100, and that specifies one or more access types/rights that are sufficient to perform the specified access operation]; [Fig. 5: step 504 – ACE exists? No]).
As per Claim 6, the rejection of claim 1 is incorporated, and Geller discloses,
comprising a data access interface (Geller, [Figs. 2A, 7: web services interface 130]),
wherein granting (Geller, [Fig. 5: step 504: ACE exists? Yes, step 506: Allow request to proceed]) and rejecting (Geller, [Fig. 5: step 504 - ACE exists? No, step 508 - Deny request]) access to the data element comprises transmitting to the data access interface, information specifying whether the data access client has access to the data element (Geller, [0048 – In Fig. 2A, ACS 150 is interposed between web services interface 130 and web services resources 140], [0111 – In Fig. 2B, interface 130 submits the request to resource 140 contingent upon a response from ACS 150 that the particular principal 150 has or does not have sufficient privileges to perform the request]).
As per Claim 7, the rejection of claim 1 is incorporated, and Geller discloses,
wherein the information specifies access rights (Geller, [0088 - The ListResourceAccess operation functions to allow the entity invoking the operation to determine what principals 100 have any sort of access rights to a resource 140]; [0089 - The GetUserRightsForResource operation functions to allow the entity invoking the operation to identify those access rights, if any, that a principal 100 has with respect to a resource 140, thereby implying that the operations determine the access rights which are included in the transmitted information]) of the data access client (Geller, [Figs. 11, 14-15 show access type/access rights 350 for each client]; [0059 - ACE 310 includes a resource URI field 320, a principal ID field 330, a subject pool field 340, and an access type field 350]).
As per Claim 13, the rejection of claim 1 is incorporated, and Geller discloses,
wherein the access to the data element is a write access (Geller, [0127 – In Fig. 10, step 1000, manager 161 receives a request from a client to store/write a structured data record within a table]) or wherein the access to the data element is a read access (Geller, [0146 - ReadRecords operation]; [0159 – In Fig. 12, host 163 receives numerous requests to read records from managers 161 on behalf of clients of data store 160]; [0114 – In Fig. 8: step 800, where web services interface 130 receives a web services request from client 110. The request specifies principal 100/access identifier, a web services resource 140/URI, and an access operation requested to be performed with respect to resource 140 on behalf of principal 100; Here the request can be a read access request]).
As per Claim 14, the rejection of claim 1 is incorporated, and Geller discloses,
wherein the access to the data element is an access to a plurality of data elements including the data element (Geller, [Figs. 3, 11, 14-15]; [0076 – In Fig. 5, ACS 150 receives requests that are submitted by clients 110 on behalf of principals 100 and that are forwarded via interface 130]; [0085 - ACS 150 is configured to concurrently perform Fig. 5 operations on multiple different requests for access operations to multiple distinct, unrelated resources 140, thereby implying that the access to the data element is an access to a plurality of data elements including the data element]).
As per Claim 18, it is similar to claim 1 and therefore the same mappings are incorporated.
As per Claim 19, it is similar to claims 1, 18 and therefore the same mappings are incorporated.
As per Claim 20, Geller discloses a computer-readable medium comprising program instructions, which, when executed by one or more processors (Geller, [0154 - Instructions stored on a computer-accessible medium and executable by a processor]), cause the one or more processors (Geller, [0203 – Fig. 18 shows computer system 1800 includes one or more processors 1810 coupled to a system memory 1820 via I/O interface 1830]) to perform the method of claim 18.
Claims 3-4 are rejected under AIA 35 U.S.C. 103(a) as being unpatentable over Geller et al (20160173406) in view of Hamilton et al (8910240), Wissner at al (20100268700) and Shukla et al (20200133967).
As per Claim 3, the rejection of claim 1 is incorporated, and Geller,Hamilton,Wissner discloses the hierarchical tree structure of the URI.
Shukla further discloses,
wherein the access controller is configured to determine the data storage table by reverse lookup mapping (Shukla, [Fig. 26: Realtime Document Index/RDI 2628]; [0318 - The serving stack stores the RDI, which is an inverted index that inverts the collected and indexed documents to a topic space, which maintains a mapping of the topics associated with one or more of the documents, e.g., which is not pre-sorted, but the topics and documents are associated with each other in the reverse index data structure; Since neither the spec nor the claim define ‘reverse lookup mapping’, the citation is a valid interpretation]; [0255 - A query is organized as a tree, e.g., a query tree. A node in the query tree can be a parent, or a child. A parent node has at least one child node below it]) based on the identifier of the storage location (Shukla, [0002 - A website is hosted on a web server that is typically accessible via a network, through a web address known as a Uniform Resource Indicator/URI or a Uniform Resource Locator/URL]; [0003 - A search engine performs a search based on the user query and output results that are presented in a ranked list, referred to as search results or hits, e.g., links or URIs/URLs for one or more web pages and/or websites]).
Therefore it would have been obvious to a person of ordinary skill at the time of filing to incorporate the search and feed system of Shukla into the access control system of Geller,Hamilton,Wissner for the benefit of using RDI which includes the indexer, scheduler, and inverted index serving stack of the search and feed system. The RDI is rapidly refreshed and updated based on online content changes in the online world to facilitate identifying new content to provide to users using the search and feed system (Shukla, 0307, 0309).
As per Claim 4, the rejection of claim 1 is incorporated, and Geller discloses,
wherein the identifier of the storage location is a Uniform Resource Identifier (Geller, [0040 - A URI identifies host, domain and path/location information associated with resource 140 that is sufficient to uniquely identify that resource within a particular naming scheme]),
Shukla clarifies,
wherein the identifier of the storage location is a Uniform Resource Identifier (Shukla, [0002 - A website is hosted on a web server that is accessible via a network, through a web address/location, which is known as a URI or a URL]; [0240 – In Fig. 18, graph data store 1800 is a table data store with a graph structure overlay. Each column is used for each entity, e.g., website, person, company, location etc.]) and the access controller is configured to perform the reverse lookup mapping (Shukla, [0343 - At 2606, orchestrator 2620 performs a search of the user's interests in real time document index/RDI 2628]) by traversing a search tree (Shukla, [0047 - The query pattern matching technique comprises generating a query tree for the search query]; [0343 - The orchestrator server performs a search of the RDI, e.g., implemented as a real time graph in a Bigtable using the Laser Root, e.g., a server that collects information from a number of indexes and data sources, to store in a central repository and facilitate generation of a content feed for users, which is connected to leaves of the real time graph of the RDI server with a list of annotated interests to obtain online content/documents based on the set of annotated interests]; [at least Fig. 17: Graph data store 1720]) that comprises a node for each character of the Uniform Resource Identifier (Shukla, [0405 – In Fig. 32, query tree 3200 is a simplified query tree for the query ‘2017 events New York’. The query ‘2017 events new york’ is comprised of the tokens ‘2017’, ‘events’, and ‘new york’. The query tree includes a root node 3202 and one or more branches associated with the root node]) and includes a leaf node including an indication of the data storage table (Shukla, [0406 – In Fig. 32, each branch associated with the root node is associated with one or more leaf nodes, e.g., the tokens ‘Manhattan’ and ‘upstate’ are related to the token ‘new york’, etc.; Since the claim does not define ‘comprising an indication’, the citation is a valid interpretation]).
Therefore it would have been obvious to a person of ordinary skill at the time of filing to incorporate the search and feed system of Shukla into the access control system of Geller,Hamilton,Wissner for the benefit of using RDI which includes the indexer, scheduler, and inverted/reverse index serving stack of the search and feed system. The RDI is rapidly refreshed and updated based on online content changes in the online world to facilitate identifying new content to provide to users using the search and feed system (Shukla, 0307, 0309).
Claims 9-12 are rejected under AIA 35 U.S.C. 103(a) as being unpatentable over Geller et al (20160173406) in view of Hamilton et al (8910240), Wissner at al (20100268700) and Vepa et al (20170329957).
As per Claim 9, the rejection of claim 1 is incorporated, and Geller, Hamilton,Wissner disclose security tokens.
Vepa further discloses,
wherein granting the data access client access to the data element comprises transmitting a temporary access token to the data access interface (Vepa, [0248 – In Fig. 13, at step 1302, OAuth service 1340 validates the client by issuing a user/client combination asking for all of the allowed scopes from the Authorization module, i.e., a policy enforcement point/PEP API 1360/controller such as Cloud Gate 702 of Fig. 7. At step 1304, the response is the allowed scopes, which is computed and which is incorporated in the access token, thereby implying transmitting a temporary access token to the data access interface/OAuth service]),
wherein the data access interface is configured to open access for the data access client (Vepa, [0140 - Fig. 7 implements a Cloud Gate 702 running in web server 712 and acting as a Policy Enforcement Point/PEP configured to integrate with IDCS Policy Decision Point/PDP using open standards, e.g., OAuth2, OpenID Connect, etc., while securing access to web browser and REST API resources 714 of application. The PDP/interface is implemented at OAuth and/or OpenID Connect microservices 704]) for which it has received the temporary access token from the access controller (Vepa, [Fig. 13: step 1304, allowedscopes + custom claims received from PEP/controller]).
Therefore it would have been obvious to a person of ordinary skill at the time of filing to incorporate the mobile phone access of Vepa into the access control system of Geller,Hamilton,Wissner for the benefit of using a system that receives an access token request for an access token that corresponds to the resource, the request including user information and application information, the user information including roles of a user and the application information including dynamic roles of the application and dynamic roles for the application (Vepa, 0004).
As per Claim 10, the rejection of claim 6 is incorporated, and Geller,Hamilton,Wissner disclose security tokens.
Vepa further discloses,
wherein the request comprises a request for an access token (Vepa, [0308 – In Fig. 30, step 3002, OAuth Service 1340 of Fig. 13 receives an access token request for an access token that corresponds to the resource desired to be accessed by a user/application/client]),
granting the data access client access to the data element comprises transmitting a temporary access token to the data access client (Vepa, [0311 – In Fig. 30, at step 3006, the access token with the computed scopes is provided to the client]; [0248 – In Fig. 13, at step 1304, the response is the allowed scopes, which is computed and which is incorporated in the access token and sent back to client 1320 at step 1305]),
wherein the temporary access token includes an identification of the data access client (Vepa, [0154 - The client identifies itself as a client that lives in ‘tenant 1’ by including a ‘client assertion’ in the request. The client assertion includes a client ID/client 1 and the client tenancy ‘tenant 1’. As ‘client 1’ in ‘tenant 1’, the client has the right to invoke a request for a token on ‘tenant 3’, and the client wants the token for a user in ‘tenant 2’. Accordingly, a ‘user assertion’ is also passed as part of the same HTTP request. The access token that is generated/temporary access token will be issued in the context of the target tenancy which is the application tenancy/tenant 3 and will include the user tenancy/tenant 2]).
Therefore it would have been obvious to a person of ordinary skill at the time of filing to incorporate the mobile phone access of Vepa into the access control system of Geller,Hamilton,Wissner for the benefit of using a system that receives an access token request for an access token that corresponds to the resource, the request including user information and application information, the user information including roles of a user and the application information including dynamic roles of the application and dynamic roles for the application (Vepa, 0004).
As per Claim 11, the rejection of claim 1 is incorporated, and Geller discloses,
wherein the data access interface is configured to open access for the data access client for which it has received the temporary access token from the data access client (Geller, [0072 - Interface 130 verifies the credentials of principal 100/client, which is included within the request or received through a separate interrogation conducted by interface 130. Such credentials include the principal's access identifier or another identifier, such as a username, as well as a password, cookie or security token/temporary access token; See 112(b)]).
As per Claim 12, the rejection of claim 9 is incorporated, and Geller,Hamilton,Wissner,Vepa disclose,
comprising a logging system configured to log the access (Vepa, [0089 - Privileged account management/PAM allows for a password checkout as well as setting time limits, forcing periodic changes, automatically tracking checkout, and reporting/logging on all activities; Here reporting implies that since logging is done, the log can be accessed]) with the identification of the data access client included in the temporary access token (Vepa, [0154 - The client identifies itself as a client that lives in ‘tenant 1’ by including a ‘client assertion’ in the request. The client assertion includes a client ID/client 1 and the client tenancy ‘tenant 1’, thereby implying that the client provides the identification that is included in the temporary access token]; [0116 - A login process includes validation of credentials, submission of a log report, updating of the last login time, etc.]; [0092 – audits, e.g. tracking/recording]).
Therefore it would have been obvious to a person of ordinary skill at the time of filing to incorporate the mobile phone access of Vepa into the access control system of Geller,Hamilton,Wissner for the benefit of using a system that receives an access token request for an access token that corresponds to the resource, the request including user information and application information, the user information including roles of a user and the application information including dynamic roles of the application and dynamic roles for the application (Vepa, 0004).
Claims 8, 15-17 are rejected under AIA 35 U.S.C. 103(a) as being unpatentable over Geller et al (20160173406) in view of Hamilton et al (8910240), Wissner at al (20100268700) and Paraschiv et al (20220121673).
As per Claim 8, the rejection of claim 1 is incorporated, and Geller,Hamilton,Wissner disclose a data access interface.
Paraschiv further discloses,
wherein the data access interface is configured to open an access stream to the data element in an instance the access controller has granted (Paraschiv, [0022 - As with the access management system 110, the access management system 118 allows users to create and manage users, roles, and groups, and use permissions to allow or deny access to cloud services and resources]; [0013 - Fig. 1 shows a shared data processing platform 100 in which a network-based data warehouse system 102 implements database stream tracking, e.g., view streams; Since the claim does not define ‘access stream’, the citation is a valid interpretation]) the data access client access to the data element (Paraschiv, [0018 - Data to be tracked via streams is stored and accessed on the cloud computing storage platform 104]).
Therefore it would have been obvious to a person of ordinary skill at the time of filing to incorporate the streams of Paraschiv into the access control system of Geller,Hamilton,Wissner for the benefit of using a shared data processing platform in which a network-based data warehouse system implements database stream tracking, e.g., view streams (Paraschiv, 0013).
As per Claim 15, the rejection of claim 1 is incorporated, and Geller,Hamilton,Wissner disclose a data store.
Paraschiv further discloses,
wherein the data storage is a data lake (Paraschiv, [0012 - A multi-stage database partition unloader exports data to a remote datastore such as a data lake]; [0020 – In Fig. 1, data storage devices 124-1 to 124-n is an Azure Data Lake]).
Therefore it would have been obvious to a person of ordinary skill at the time of filing to incorporate the data lake of Paraschiv into the access control system of Geller,Hamilton,Wissner for the benefit of using a multi-stage database partition unloader which can export data to a remote datastore such as a data lake, using a single database copy command that uses a partition expression to parallelize processing of the files into a plurality of result files at the remote location using a plurality of nodes in the database in a distributed and scalable approach (Paraschiv, 0012).
As per Claim 16, the rejection of claim 1 is incorporated, and Geller,Hamilton,Wissner disclose a data store.
Paraschiv further discloses,
wherein the data storage is a cloud data storage (Paraschiv, [0020 – In Fig. 1, data storage devices 124-1 to 124-n is part of a public cloud infrastructure or a private cloud infrastructure]).
Therefore it would have been obvious to a person of ordinary skill at the time of filing to incorporate the shared data processing platform of Paraschiv into the access control system of Geller,Hamilton,Wissner for the benefit of using the shared data processing platform which comprises the network-based data warehouse system, a cloud computing storage platform, and a remote computing device. The network-based data warehouse system is used for storing and accessing data in an integrated manner, and reporting and analysis of the integrated data from disparate sources (Paraschiv, 0014).
As per Claim 17, the rejection of claim 1 is incorporated, and Geller,Hamilton,Wissner disclose a data store.
Paraschiv further discloses,
wherein the data access client is implemented by a data processing entity operating according to a cluster computing framework (Paraschiv, [0021 – In Fig. 1, a set of processes on a compute node executes a query plan compiled by the compute service manager 112. Here, a fifth process handles all communication with a compute cluster for a given job provided by the compute service manager 112 and communicates information back to the compute service manager 112 and other compute nodes of the execution platform 114]; [0017 - The compute service manager 112 also performs query optimization and compilation as well as managing clusters of computing services that provide compute resources, e.g., virtual warehouses, virtual machines, EC2 clusters]).
Therefore it would have been obvious to a person of ordinary skill at the time of filing to incorporate the shared data processing platform of Paraschiv into the access control system of Geller,Hamilton,Wissner for the benefit of using the shared data processing platform which comprises the network-based data warehouse system, a cloud computing storage platform, and a remote computing device. The network-based data warehouse system is used for storing and accessing data in an integrated manner, and reporting and analysis of the integrated data from disparate sources (Paraschiv, 0014).
Response to Arguments
The Applicant's arguments filed on January 20, 2026 have been fully considered, but they are not persuasive. In order to overcome the prior art, the amendments recite improper, inconsistent and/or unsupported subject matter.
Applicant argues: ‘Moreover, since amended claim 1 ….recitation of "determine the data storage table associated with the data element of the request based on the identifier of the storage location included in the request"…is clearly…definite regarding the data element of (i.e., referenced by) the request’. (Rem, Pg. 8)
Response: The amendment is unsupported by the spec. Please see the 112(a).
The spec does not recite, ‘determine the data storage table associated with the data element of the request’. As per spec, Para-0004, the request is associated with the location of the data element, not the data element itself.
For example, an alarm time such as alarm-6 (data element) is shown by using URI: ‘content://alarms/wake-up/Bob/alarm-6’
The URI has to be parsed into a tree structure to get to the data element or resource. URI parsing involves breaking the identifier string into its constituent components based on a standardized syntax. The parsing or generating the tree is not explicitly recited in the spec.
Since the amendment is unrecited in the spec, the amendment changes the scope of claim 1 and hence recites new matter. Hence the 112(a). Amendments should align with the specification's original language to ensure the claims are clear and supported.
Applicant further argues: ‘Applicant….submits that claim 1 is currently amended to recite "access the data storage table to access the data element of the request by the data access client, …..at least one of read access and write access to the data element of the request"’. (Rem, Pg. 8).
Response: The amendment is unsupported by the flowchart of Fig. 5 of the spec. Please see 112(a).
As mentioned in the 112(a), the spec recites that if it is determined that the client has access rights (read access or write access) to the table then the client has access rights to the data element. In fact, claims 3-4 recite determining only the ‘data storage table’.
The spec does not explicitly disclose how the controller accesses the data element during tree traversal or determines/reads the value of the data element. Therefore claim 1 reciting, ‘data element of the request’ in various limitations is improper. The 112(a) is justified.
Applicant further argues: ‘Applicant notes that the amended claim submitted herein, provide the benefit(s) of enforcing access control wherein no client has direct access to the data storage (e.g., Specification, paragraph [0051]), the access authorizations are applicable to all forms of data access… [0049]’. (Rem, Pg. 11)
Response: The scope is determined by the claim and not by the argument.
Claims 1-20 are directed to the abstract idea of managing data access to a database, using a tree. Restricting direct client access to a database via an access controller is a well-known, conventional, and generic computer function that has been implemented in the art for decades to enhance security and efficiency, and does not provide an inventive concept. The client-controller-database configuration does not improve the storage system itself, but rather uses a computer to automate a basic, well-known business practice in e-Commerce. The claims fail to provide 'significantly more' than the routine, generic use of a computer in database access.
Applicant refers to various spec paragraphs to establish an inventive concept. Though applicant argues increased security, authenticating client access to a database is a well-known process and a basic security requirement. The generic controller's interaction with the client and database to authorize the client represents a conventional use of database security to determine access rights rather than a specific, technical improvement in controller functionality. Though spec, Para-0049 makes a fleeting mention of ‘cloud IAM systems’ a security framework, neither the spec nor the claims disclose an improvement in data access control by integrating the controller with ‘cloud IAM systems’.
Para-0049 also fleetingly recites well-known, third-party data processing engines like Apache Spark, and Apache Hadoop Filesystem, without reciting how any of these data processing engines can be integrated with the claimed client-controller-database setup to improve access control. The claims lack specific recitations of a particular technical integration with a system like Hadoop, which would potentially demonstrate an improvement to system architecture, processing time, or energy consumption. Without such specific claim limitations integrated with a third-party practical application, the claims remain an abstract idea and thus do not constitute patent-eligible subject matter.
Applicant further argues: ‘Applicant submits that amended claim 1, when the ….integrate the alleged abstract idea(s) into a practical application because amended claims 1 and 18 improve the technical field of data access control, as disclosed in the Specification’. (Rem, Pg. 11)
Response: The spec functions as a ‘wish list’ rather than a technical invention, thus failing to integrate the from abstract idea(s) into a practical application.
For example, claims 15, 16 recite additional elements such as ‘a datalake’, and ‘a cloud data storage’, without reciting how these additional elements can be integrated to function as ‘data storage’ in the ‘data storage system’ to assist in the reverse lookup of the tree that is dynamically changing as multiple clients with different access rights send requests to the ‘data storage system’ to access various data storage tables and their data elements.
While the spec fleetingly lists various well-known, third-party frameworks (e.g., cloud IAM Systems, Apache Hadoop Filesystem, Apache Spark, RBAC Apache Ranger, Azure Active Directory, Elasticsearch, Logstash, Kibana etc.), it fails to disclose how any of these technologies can be specifically configured and integrated with the claimed ‘data storage system’ to solve the technical problem of ‘data access control’. The spec offers only a surface-level recitation of technologies rather than a detailed, working invention. In other words, the spec recites using a computer as a 'tool' to receive a client request, search a tree and determine if the client can access the database, rather than improving the storage system’s own functionality by integrating with a practical application/framework.
Applicant further argues: However, Geller does not disclose….a system configured to ‘determine the data storage table associated with the data element of the request based on the identifier of the storage location included in the request’. (Rem, Pg. 13)
Response: The amendment is improper and unsupported by the spec. Please see the 112(a). Relying on an improper amendment to mischaracterize the prior art, invalidates the argument.
Furthermore, the argument is incomplete because it merely states a general statement. It does not clearly identify the differences between the disclosure and the prior art, explaining their differences with detailed explanations and technical reasoning to show how the disclosure is better than the prior art in disclosing the above requirement.
Applicant further argues: ‘In some embodiments, the identifier included in the request might include or be based on…a URI/ URL. The aspect of determining the particular data table that stores a data element of a requested based on the resource identifier is not disclosed in Gellar’. (Rem, Pg. 13)
Response: This argument is incorrect.
The above requirement is recited in claims 3-4 and the combination of Gellar,Vepa,Shukla disclose the above requirement. Please see O/A.
That said, please see the 112(a) because claims 3-4 fail the written description requirement to disclose how ‘reverse lookup mapping’ based on the URI, builds the ‘reverse index’ to traverse the tree in a reverse way. The lack of adequate written description (no flowcharts, algorithms/steps, or figures) suggests that based on the received URI in the client request, the controller does not reasonably determine the data storage table. This further suggests that the associated data element is undetermined. In other words, claims 1,18 fail to fulfill the client request.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ARVIND TALUKDAR whose telephone number is (303)297-4475. The examiner can normally be reached M-F, 10 am-6pm EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Hosain Alam can be reached at 571-272-3978. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
Arvind Talukdar
Primary Examiner
Art Unit 2132
/ARVIND TALUKDAR/Primary Examiner, Art Unit 2132
Prosecution Insights