DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 1/2/2026 has been entered.
Response to Amendment / Arguments
Regarding claims rejected under 35 USC 112(b):
Applicant’s amendment is considered to have overcome the applied rejection. In response, the rejection has been withdrawn.
Regarding claims rejected under 35 USC 103:
Applicant’s arguments, in view of the amended claim language, have been fully considered and are persuasive. Therefore, the rejection has been withdrawn. However, upon further consideration, a new ground(s) of rejection is made in view of “Compliance Automated Standard Solution (COMPASS), Part 3: Artifacts and Personas” by a different inventive entity.
A new ground(s) of rejection is additionally made in view of Nedbal (US 2011/0277031 A1) and Hadar (US 2021/0273978 A1).
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Barry (US 10,691,493 B1) in view of “Compliance Automated Standard Solution (COMPASS), Part 3: Artifacts and Personas,” hereinafter “Compass.”
Regarding claim 1, Barry discloses: A computer-implemented method, comprising operations for:
in a policy assessor hierarchy, wherein a plurality of Policy Validation Point (PVP)/orchestrators (interpreted as a component “that may act as a PVP, as an orchestrator or as both a PVP and an orchestrator” in view of the definition in [0036] of the instant specification) are located at multiple, different levels,
Refer to at least FIG. 2-5, Col. 16, Ll. 39-48&63-67, and Col. 18, Ll. 1-4 of Barry with respect to policy ingestion, distribution, and enforcement modules (e.g., Col. 4, Ll. 21-24 of Barry) in a hierarchical arrangement of a multi-layer infrastructure.
Refer to at least Col. 9, Ll. 60-Col. 10, Ll. 4 and Col. 17, Ll. 51-59 of Barry with respect to an example orchestrator performing policy enforcement (i.e., concerning the PVP-and-orchestrator aspect).
and wherein a first PVP/orchestrator of the plurality of PVP/orchestrators at a higher-level of the policy assessor hierarchy has more granular controls than a second PVP/orchestrator of the plurality of PVP/orchestrators at a lower-level of the policy assessor hierarchy,
Refer to at least Col. 18, Ll. 47-56 of Barry with respect to policy granularity associated with different levels.
receiving, at the first PVP/orchestrator, a higher-level policy;
Refer to at least Col. 6, Ll. 22-33, Col. 7, Ll. 29-39, Col. 17, Ll. 51-59, and Col. 18, Ll. 11-19&50-56 of Barry with respect to defining policy, receiving policy, and policy ingestion (e.g., at a respective orchestrator of a given layer). The higher level layers are associated with higher level policy.
converting, at the first PVP/orchestrator, the higher-level policy to a lower-level policy by converting an access enforcement control of the higher-level policy to one or more rules;
Refer to at least Col. 13, Ll. 29-35, Col. 18, Ll. 41-46, Col. 18, Ll. 50-56, and Col. 17, Ll. 38-Col. 18, Ll. 26, and Col. 18, Ll. 50-56 of Barry with respect to policy translation from higher level policy to policy rules.
sending, at the first PVP/orchestrator, the lower-level policy to the second PVP/orchestrator; converting, at the second PVP/orchestrator, the lower-level policy;
Refer to at least Col. 7, Ll. 36-45, Col. 17, Ll. 62-67, and Col. 18, Ll. 14-26 of Barry with respect to a given one of the orchestrators at a particular one of the layers using templates and/or profiles to translate policy into primitives relevant to the next layer in the hierarchy and then sending the translated policy to one or more other ones of the orchestrators at that next layer.
sending, at the second PVP/orchestrator, [translated policy] to an operating system rules tool (e.g., Col. 8, Ll. 3-56 of Barry);
Refer to at least Col. 15, Ll. 27-29, Col. 17, Ll. 19-25, and Col. 17, Ll. 62-67 of Barry with respect to converting policy to infrastructure specific M&O actions to manage, monitor, and provision the infrastructure.
receiving, at the second PVP/orchestrator, an assessment result; returning, at the second PVP/orchestrator, the assessment result to the first PVP/orchestrator for aggregating with multiple results (“for aggregating with multiple results” has been interpreted as a statement of intended use).
Refer to at least the abstract, Col. 2, Ll. 64-Col. 3, Ll. 2, and Col. 7, Ll. 11-17 of Barry with respect to propagating a result of the monitoring through the layers of hierarchy for performing an adjustment if needed.
Barry does not specify: the higher-level policy conversion further comprising using a mapping of rules to controls; the lower level policy conversion further comprising converting the one or more rules to one or more checks using a mapping of rules to checks; the sent translated policy further comprising the one or more checks; the assessment result further regarding the one or more checks from the operating system rules tool, wherein the operating system rules tool executes the one or more checks on an executing service to determine that the access enforcement control is enforced. However, Barry in view of Compass discloses: the higher-level policy conversion further comprising using a mapping of rules to controls;
Refer to at least FIG. 1, “Regulators – Control Issuers,” and “Product Vendors, Service Providers, and CISO – Control Providers” of Compass with respect to mapping controls to rules.
the lower level policy conversion further comprising converting the one or more rules to one or more checks using a mapping of rules to checks; the sent translated policy further comprising the one or more checks;
Refer to at least FIG. 1 and “Policy Validation Points, Validation Tools – Control Assessors” of Compass with respect to mapping controls to policy rules to policy checks.
the assessment result further regarding the one or more checks from the operating system rules tool, wherein the operating system rules tool executes the one or more checks on an executing service to determine that the access enforcement control is enforced.
Refer to at least FIG. 1, “Policy Validation Points, Validation Tools – Control Assessors,” and “CISO and System Owners – Control Operators and Their System Security Plan” of Compass with respect to generating system assessment results; with respect to providing control response for auditing.
The teachings of Compass likewise concern policy translation and enforcement, and are considered to be within the same field of endeavor and combinable as such.
Therefore it would have been obvious to one of ordinary skill in the art before the filing date of Applicant’s invention to modify the teachings of Barry to further implement the policy translation using mappings between controls, rules, and checks as in Compass because the particular known technique was recognized as part of the ordinary capabilities of one skilled in the art (i.e., translation using mappings). It further would have been obvious to implement performing and assessing checks for at least the purpose of ensuring compliance and integrity (i.e., that the policy is being enforced correctly and in compliance with regulations and requirements).
Regarding claim 2, Barry-Compass discloses: The computer-implemented method of claim 1, wherein a specific exchange protocol is provided for communication between components at adjacent levels of the policy assessor hierarchy.
Refer to at least Col. 3, Ll. 40-67 of Barry with respect to example network protocols for communication between components.
Regarding claim 3, Barry-Compass discloses: The computer-implemented method of claim 1, wherein the operations further comprise: under the control of at the first PVP/orchestrator, receiving the multiple results from one or more other PVPs/orchestrators at lower- levels of the policy assessor hierarchy; aggregating the multiple results; and returning the aggregated results.
Refer to at least FIG. 1 and “Policy Validation Points, Validation Tools – Control Assessors” of Compass with respect to automatically aggregating policy result status.
Therefore it would have been obvious to one of ordinary skill in the art before the filing date of Applicant’s invention to modify the teachings of Barry-Compass to further implement result aggregation for at least the purpose of analysis and remediation (e.g., “for the consumption of the Assessors, Compliance Officers, and Auditors” as in the cited portions of Compass).
Regarding claim 4, Barry-Compass discloses: The computer-implemented method of claim 1, wherein the operations further comprise: in response to the component being the
determining a compliance granularity of the higher-level policy to be sent to a component of a particular lower-level of the policy assessor hierarchy, wherein the component is selected from a group consisting of another PVP/orchestrator, a cloud tool, and the operating system rules tool;
Refer to at least “Product Vendors, Service Providers, and CISO – Control Providers” of Compass with respect to requirements and controls at different granularities.
another PVP/orchestrator, converting the higher-level policy into a policy profile; and
Refer to at least FIG. 17 and Col. 17, Ll. 62-67 of Barry with respect to converting policy between orchestrators and using templates/profiles.
in response to the component being the cloud tool, converting the higher-level policy into a cloud policy.
Refer to at least Col. 9, Ll. 21-25 and Col. 15, Ll. 56-Col. 16, Ll. 2 of Barry with respect to providing policy for cloud-based tools and enforcement.
Therefore it would have been obvious to one of ordinary skill in the art before the filing date of Applicant’s invention to modify the teachings of Barry-Compass to further implement determining a compliance granularity as part of policy translation for at least the purpose of supporting compatibility with disparate systems as in the cited portions of Compass.
Regarding claim 5, it is rejected for substantially the same reasons as claim 1 above (e.g., converting to more than one rule).
Regarding claim 6, it is rejected for substantially the same reasons as claim 1 above (e.g., converting to more than one check; conversion of multiple rules).
Regarding claim 7, it is rejected for substantially the same reasons as claim 1 above (e.g., Col. 9, Ll. 60-Col. 10, Ll. 4 and Col. 17, Ll. 51-59 of Barry).
Regarding independent claim 8, it is substantially similar to independent claim 1 above, and is therefore likewise rejected.
Regarding claims 9, 11-13, and 14, they are substantially similar to claims 2, 4-7 above. Claims 9, 11-12, and 14 are therefore likewise rejected.
Regarding independent claim 15, it is substantially similar to independent claim 1 above, and is therefore likewise rejected.
Regarding claims 10 and 17, they are substantially similar to claim 3 above, and are therefore likewise rejected.
Regarding claims 16 and 18-20, they are substantially similar to claims 2 and 4-7 above. Claims 16 and 18-19 are therefore likewise rejected.
Claim(s) 1-20 is/are rejected under 35 U.S.C. 103 as being unpatentable over Barry (US 10,691,493 B1) in view of Nedbal (US 2011/0277031 A1) and Hadar (US 2021/0273978 A1).
Regarding claim 1, Barry discloses: A computer-implemented method, comprising operations for:
in a policy assessor hierarchy, wherein a plurality of Policy Validation Point (PVP)/orchestrators (interpreted as a component “that may act as a PVP, as an orchestrator or as both a PVP and an orchestrator” in view of the definition in [0036] of the instant specification) are located at multiple, different levels,
Refer to at least FIG. 2-5, Col. 16, Ll. 39-48&63-67, and Col. 18, Ll. 1-4 of Barry with respect to policy ingestion, distribution, and enforcement modules (e.g., Col. 4, Ll. 21-24 of Barry) in a hierarchical arrangement of a multi-layer infrastructure.
Refer to at least Col. 9, Ll. 60-Col. 10, Ll. 4 and Col. 17, Ll. 51-59 of Barry with respect to an example orchestrator performing policy enforcement (i.e., concerning the PVP-and-orchestrator aspect).
and wherein a first PVP/orchestrator of the plurality of PVP/orchestrators at a higher-level of the policy assessor hierarchy has more granular controls than a second PVP/orchestrator of the plurality of PVP/orchestrators at a lower-level of the policy assessor hierarchy,
Refer to at least Col. 18, Ll. 47-56 of Barry with respect to policy granularity associated with different levels.
receiving, at the first PVP/orchestrator, a higher-level policy;
Refer to at least Col. 6, Ll. 22-33, Col. 7, Ll. 29-39, Col. 17, Ll. 51-59, and Col. 18, Ll. 11-19&50-56 of Barry with respect to defining policy, receiving policy, and policy ingestion (e.g., at a respective orchestrator of a given layer). The higher level layers are associated with higher level policy.
converting, at the first PVP/orchestrator, the higher-level policy to a lower-level policy by converting an access enforcement control of the higher-level policy to one or more rules;
Refer to at least Col. 13, Ll. 29-35, Col. 18, Ll. 41-46, Col. 18, Ll. 50-56, and Col. 17, Ll. 38-Col. 18, Ll. 26, and Col. 18, Ll. 50-56 of Barry with respect to policy translation from higher level policy to policy rules.
sending, at the first PVP/orchestrator, the lower-level policy to the second PVP/orchestrator; converting, at the second PVP/orchestrator, the lower-level policy;
Refer to at least Col. 7, Ll. 36-45, Col. 17, Ll. 62-67, and Col. 18, Ll. 14-26 of Barry with respect to a given one of the orchestrators at a particular one of the layers using templates and/or profiles to translate policy into primitives relevant to the next layer in the hierarchy and then sending the translated policy to one or more other ones of the orchestrators at that next layer.
sending, at the second PVP/orchestrator, [translated policy] to an operating system rules tool (e.g., Col. 8, Ll. 3-56 of Barry);
Refer to at least Col. 15, Ll. 27-29, Col. 17, Ll. 19-25, and Col. 17, Ll. 62-67 of Barry with respect to converting policy to infrastructure specific M&O actions to manage, monitor, and provision the infrastructure.
receiving, at the second PVP/orchestrator, an assessment result; returning, at the second PVP/orchestrator, the assessment result to the first PVP/orchestrator for aggregating with multiple results (“for aggregating with multiple results” has been interpreted as a statement of intended use).
Refer to at least the abstract, Col. 2, Ll. 64-Col. 3, Ll. 2, and Col. 7, Ll. 11-17 of Barry with respect to propagating a result of the monitoring through the layers of hierarchy for performing an adjustment if needed.
Barry does not specify: the higher-level policy conversion further comprising using a mapping of rules to controls; the lower level policy conversion further comprising converting the one or more rules to one or more checks using a mapping of rules to checks; the sent translated policy further comprising the one or more checks; the assessment result further regarding the one or more checks from the operating system rules tool, wherein the operating system rules tool executes the one or more checks on an executing service to determine that the access enforcement control is enforced. However, Barry in view Nedbal discloses: the lower level policy conversion further comprising converting the one or more rules to one or more checks using a mapping of rules to checks; the sent translated policy further comprising the one or more checks;
Refer to at least [0006]-[0007], [0024]-[0025], and [0042] of Nedbal with respect to mapping rules, checks, and security operations. For instance, a rule set is parsed into security checks, security processes, and security operations.
the assessment result further regarding the one or more checks from the operating system rules tool, wherein the operating system rules tool executes the one or more checks on an executing service to determine that the access enforcement control is enforced.
Refer to at least [0038] of Nedbal with respect to places entries as to whether particular security checks were true.
The teachings of Nedbal likewise concern rule translation and enforcement, and are considered to be within the same field of endeavor and combinable as such.
Therefore it would have been obvious to one of ordinary skill in the art before the filing date of Applicant’s invention to modify the teachings of Barry to further implement the policy translation using mappings between rules and checks because the particular known technique was recognized as part of the ordinary capabilities of one skilled in the art (i.e., translation using mappings). It further would have been obvious to implement performing and assessing checks for at least the purpose of ensuring compliance and integrity (i.e., that the policy is being enforced correctly and in compliance with regulations and requirements).
Barry-Nedbal does not specify: the higher-level policy conversion further comprising using a mapping of rules to controls. However, Barry-Nedbal in view of Hadar discloses: the higher-level policy conversion further comprising using a mapping of rules to controls.
Refer to at least [0006] of Hadar with respect to a traceability matrix that maps security controls to rules.
The teachings of Hadar likewise concern security policy and enforcement, and are considered to be within the same field of endeavor and combinable as such.
Therefore it would have been obvious to one of ordinary skill in the art before the filing date of Applicant’s invention to modify the teachings of Barry-Nedbal to further implement mapping between security controls and rules because the particular known technique was recognized as part of the ordinary capabilities of one skilled in the art (i.e., translation using mappings).
Regarding claim 2, Barry-Nedbal-Hadar discloses: The computer-implemented method of claim 1, wherein a specific exchange protocol is provided for communication between components at adjacent levels of the policy assessor hierarchy.
Refer to at least Col. 3, Ll. 40-67 of Barry with respect to example network protocols for communication between components.
Regarding claim 3, Barry-Nedbal-Hadar discloses: The computer-implemented method of claim 1, wherein the operations further comprise: under the control of at the first PVP/orchestrator, receiving the multiple results from one or more other PVPs/orchestrators at lower- levels of the policy assessor hierarchy; aggregating the multiple results; and returning the aggregated results.
Refer to at least the abstract, Col. 2, Ll. 64-Col. 3, Ll. 2, and Col. 7, Ll. 11-17 of Barry with respect to propagating a result of the monitoring through the layers of hierarchy for performing an adjustment if needed.
Refer to at least [0043] of Hadar with respect to aggregating discovered information as an attack graph.
Therefore it would have been obvious to one of ordinary skill in the art before the filing date of Applicant’s invention to modify the teachings of Barry-Nedbal-Hadar to further implement discovered information aggregation for at least the purpose of analysis and remediation (e.g., for analysts to use in determining security policy effectiveness and issues).
Regarding claim 4, Barry-Nedbal-Hadar discloses: The computer-implemented method of claim 1, wherein the operations further comprise: in response to the component being the
determining a compliance granularity of the higher-level policy to be sent to a component of a particular lower-level of the policy assessor hierarchy, wherein the component is selected from a group consisting of another PVP/orchestrator, a cloud tool, and the operating system rules tool;
Refer to at least [0003]-[0004] and [0025] of Hadar with respect to identifying security requirements for prioritization.
another PVP/orchestrator, converting the higher-level policy into a policy profile; and
Refer to at least FIG. 17 and Col. 17, Ll. 62-67 of Barry with respect to converting policy between orchestrators and using templates/profiles.
in response to the component being the cloud tool, converting the higher-level policy into a cloud policy.
Refer to at least Col. 9, Ll. 21-25 and Col. 15, Ll. 56-Col. 16, Ll. 2 of Barry with respect to providing policy for cloud-based tools and enforcement.
Therefore it would have been obvious to one of ordinary skill in the art before the filing date of Applicant’s invention to modify the teachings of Barry-Nedbal-Hadar to further implement determining security requirements for least the purpose of supporting compatibility and prioritization as in the cited portions of Hadar.
Regarding claim 5, it is rejected for substantially the same reasons as claim 1 above (e.g., converting to more than one rule).
Regarding claim 6, it is rejected for substantially the same reasons as claim 1 above (e.g., converting to more than one check; conversion of multiple rules).
Regarding claim 7, it is rejected for substantially the same reasons as claim 1 above (e.g., Col. 9, Ll. 60-Col. 10, Ll. 4 and Col. 17, Ll. 51-59 of Barry).
Regarding independent claim 8, it is substantially similar to independent claim 1 above, and is therefore likewise rejected.
Regarding claims 9, 11-13, and 14, they are substantially similar to claims 2, 4-7 above. Claims 9, 11-12, and 14 are therefore likewise rejected.
Regarding independent claim 15, it is substantially similar to independent claim 1 above, and is therefore likewise rejected.
Regarding claims 10 and 17, they are substantially similar to claim 3 above, and are therefore likewise rejected.
Regarding claims 16 and 18-20, they are substantially similar to claims 2 and 4-7 above. Claims 16 and 18-19 are therefore likewise rejected.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to VADIM SAVENKOV whose telephone number is (571)270-5751. The examiner can normally be reached 12PM-8PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey L Nickerson can be reached at (469) 295-9235. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/Jeffrey Nickerson/Supervisory Patent Examiner, Art Unit 2432
/V.S/ Examiner, Art Unit 2432
