DETAILED ACTION
This Office Action is in response to the request for continued examination filed on 03/27/2026 in which claims 1 and 11 have been amended. Claims 6, 10, 16 and 20 have been canceled. Claims 21-24 have been added. Claims 1-5, 7-9, 11-15, 17-19, and 21-24 are presented for examination on the merits.
Notice of Pre-AIA or AIA Status
The present application is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
1. A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 03/27/2026 has been entered.
Response to Arguments
2. Applicant's arguments in pages 6-8 of the REMARKS filed on 02/27/2026 with respect to the rejection under 35 USC § 103(a) are acknowledged. After careful review and in light of Applicant’s amendments, remarks, and Examiner’s newly performed search and consideration, claims 1-5, 7-9, 11-15, 17-19, and 21-24 are now newly rejected under 35 U.S.C. 103(a) for the reasons specified below.
Claim Rejections - 35 USC § 103
3. In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
4. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
5. The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
6. This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
7. Claims 1-5, 7-9, 11-15, 17-19, and 21-24 are rejected under 35 U.S.C. 103 as being unpatentable over Pon et al. (US 20160112284 A1, hereinafter, Pon) in view of Gill et al. (US 20120224057 A1, hereinafter, Gill) and further in view of Ben-Noon et al. (US 20220366050 A1, hereinafter, Ben-Noon).
Regarding claim 1, Pon discloses a method of offline workflows in an edge-based data platform (Para 0057: generate an alert or a report for when the details when a web server goes offline), the method comprising:
[accessing log data describing activity associated with a user] (Para 0005, 0063, 0066: policy-based scans is performed wherein user receives a notification/report when information for an asset in inventory changes or when a specific event occurs);
generating, based on the log data, one or more alerts (Para 0056-0057: generate alerts or reports based on the periodic scans performed on entries in an inventory list…. when an alert is triggered, an icon (e.g., the warning icon 318) displayed by a GUI generated by the discovery and inventory application 109);
initiating, based on the one or more alerts, a workflow to acknowledge the one or more alerts by the user (Para 0064-0065: when the user 502 confirms the alert, the discovery and inventory application 504 may initiate a mitigation workflow, at 530. For example, if the alert is for phishing, initiating the mitigation workflow may include contacting a third-party takedown service), [wherein the workflow requires reauthentication by the user; and controlling access by the user to one or more resources until completion of the workflow].
Pon does not explicitly states but Gill from the same or similar fields of endeavor teaches accessing log data describing activity associated with a user (Gill, Para 0261, 0273, 0391: users Activity and access log.. continuously monitor super-user activity and enforce policies).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have accessing log data describing activity associated with a user as taught by Gill in the teachings of Pon for the advantage of providing complete solutions for role-based, rules-driven access enforcement, the techniques including situational awareness and addressing blended risk assessment and security across logical systems (Gill, Abstract).
The combination of Pon and Gill does not explicitly states but Ben Noon from the same or similar fields of endeavor teaches wherein the workflow requires reauthentication by the user (Ben Noon, Para 0060, 0064, 0079-0080, 0082: If SWB(n,e).sub.b does not possess the CyberSafe security token, the given MyCompany resource proceeds to a block 194 and refuses the requested access and raises an alert. On the other hand, if SWB(n,e).sub.b comprises the CyberSafe security token, optionally in a block 188 the MyCompany resource redirects SWB(n,e).sub.b to MyCompany's IDP wherein the IDP runs a multifactor authentication (MFA) ID check on user U.sub.n and if in a decision block 190 the multifactor check is determined not to be OK proceeds to block 194 and refuses the request access. Therefore, multifactor authentication (MFA) ID is used for additional authentication along with security token. In a block 208 the security hub provides SWB(n,e).sub.b with an IP address of the proxy and a password for access to the proxy services. Optionally, in a block 210 SWB(n,e).sub.b uses the proxy address and password to request access to the given MyCompany resource via the proxy. Upon receiving the request the IDP associated with MyCompany runs optionally a multifactor authentication (MFA) check on the request. The multifactor check optionally includes, in addition to a multifactor check on user U.sub.n, a check as to whether or not the request was received from the IP address of the proxy; Fig. 4 and associated texts); and
controlling access by the user to one or more resources until completion of the workflow (Ben Noon, Paras 0058-0061: if the MFA ID check is OK, in a block 191 the given MyCompany resource double checks the request submitted by SWB(n,e).sub.b, and queries CyberSafe hub 52 as to whether or not SWB(n,e).sub.b has notified the CyberSafe hub of the request and if U.sub.n is authorized to access the given MyCompany resource. In a decision block 192 if the hub corroborates the request and confirms permission, optionally in a block 193, the given MyCompany resource allows the requested access; Fig. 5B and associated texts).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to have wherein the workflow requires reauthentication by the user; and controlling access by the user to one or more resources until completion of the workflow as taught by Ben-Noon in the teachings of Pon and Gill for the advantage of providing secure access to a digital resource of a group of digital resources each configured to have a cyber secure isolated environment (CISE) isolated from ambient software (Ben-Noon, Abstract).
Regarding claim 2, the combination of Pon, Gill, and Ben-Noon discloses the method of claim 1, wherein initiating the workflow comprises determining whether to initiate the workflow by comparing the one or more alerts to one or more policies (Pon Para 0057, 0062-0063: GUI includes a list 404 of options which policies the discovery and inventory application 109 will use to generate alerts).
Regarding claim 3, the combination of Pon, Gill, and Ben-Noon discloses the method of claim 1, wherein the log data is accessed from one or more services accessible to the user (Pon Para 0030, 0047: the discovery and inventory application 109 may invoke a software or service that receives the seed as input and returns a list of domains).
Regarding claim 4, the combination of Pon, Gill, and Ben-Noon discloses the method of claim 3, wherein the log data comprises Software-as-a-Service (SaaS) application logs (Gill Para 0162: attaching alert enterprise system 100 to SAAS systems).
Regarding claim 5, the combination of Pon, Gill, and Ben-Noon discloses the method of claim 3, wherein the log data comprises identity provider (IdP) logs (Gill, Para 0300: an AlertInsight subsystem contains a visual mapping and remediation layer 802, a data aggregation and continuous monitoring layer which includes ERP systems, Identity and Access Management (IAM) Provisioning and Roles Management systems).
Regarding claim 7, the combination of Pon, Gill, and Ben-Noon discloses the method of claim 1, further comprising: determining that the workflow was not completed; and providing a notification to another user indicating that the workflow was not completed (Pon, Para 0064: initiating the mitigation workflow includes contacting a third-party takedown service and providing details regarding the internet-facing asset to the third-party ).
Regarding claim 8, the combination of Pon, Gill, and Ben-Noon discloses the method of claim 7, wherein determining that the workflow was not completed comprises determining that the workflow was not completed within a time window after initiating the workflow (Gill Para 0582, 0387: list of users who have accessed a particular facility during a certain period of time…. AlertMonitor subsystem 408 that provides the ability to give administrators or technicians, highly privileged access for pre-set duration to conduct emergency response to incidents presently occurring. During this special access period all tasks are monitored, analyzed and logged ensuring complete visibility and transparency).
Regarding claim 9, the combination of Pon, Gill, and Ben-Noon discloses the method of claim 1, further comprising applying, to a user account associated with the user, one or more tags based on the one or more alerts (Gill Para 0462: set up as smart tags in the software)
Regarding claim 11; Claim 11 is similar in scope to claim 1, and is therefore rejected under similar rationale.
Regarding claim 12; Claim 12 is similar in scope to claim 2, and is therefore rejected under similar rationale.
Regarding claim 13; Claim 13 is similar in scope to claim 3, and is therefore rejected under similar rationale.
Regarding claim 14; Claim 14 is similar in scope to claim 4, and is therefore rejected under similar rationale.
Regarding claim 15; Claim 15 is similar in scope to claim 5, and is therefore rejected under similar rationale.
Regarding claim 17; Claim 17 is similar in scope to claim 7, and is therefore rejected under similar rationale.
Regarding claim 18; Claim 18 is similar in scope to claim 8, and is therefore rejected under similar rationale.
Regarding claim 19; Claim 19 is similar in scope to claim 9, and is therefore rejected under similar rationale.
Regarding claim 21, the combination of Pon, Gill, and Ben-Noon discloses the method of claim 1, wherein generating the one or more alerts comprises detecting a configuration drift between a deployed infrastructure (Ben-Noon Para 0079-0080 : If SWB.sub.b decides in decision block 274 to amend, the browser optionally proceeds to a block 276 and amends the browser configuration for user U.sub.n and/or amends a functionality of website ws.sub.w. By way of example, amending configuration of SWB.sub.b for user U.sub.n may comprise preventing U.sub.n from clicking on certain actionable content that website ws.sub.w displays, and amending website ws.sub.w may comprise changing website permissions and/or disabling a website link) and an associated infrastructure-as-code (IaC) configuration file (Para 0033, 0009, 0052: SWB 64 is an independent application comprising CyberSafe features and/or functionalities, or an existing web browser, such as Google Chrome, Microsoft Edge, Apple Safari, Mozilla Firefox, Opera, or Brave, modified and provided with additional CyberSafe features and/or functionalities by changes and/or additions to browser code and/or by integrating with CyberSafe extensions).
Regarding claim 22, the combination of Pon, Gill, and Ben-Noon discloses the method of claim 1, wherein generating the one or more alerts comprises detecting a behavioral change based on clustering entities in a graph-based behavioral model (Ben-Noon, Para 0034, 0041, 0051: quire data characterizing websites visited by MyCompany users that may be used to classify cyber risks associated with the websites; acquire data characterizing browser extensions that may compromise SWB 64 security features; acquire data that may be processed to determine normal behavior and use of MyCompany resources by MyCompany users as a group and/or as individuals wherein values for SRI and/or RSRI are determined based on heuristic models or a neural network operating on an input feature vector).
Regarding claim 23, the combination of Pon, Gill, and Ben-Noon discloses the method of claim 1, wherein the workflow is executed as a set of jobs organized as a direct graph and scheduled by a microservice (Gill, Para 0121: enables a user to get information about scheduled data synchronization jobs. The user may create the jobs and schedule the jobs according to business or other particular needs and perform the desired operation accordingly).
Regarding claim 23, the combination of Pon, Gill, and Ben-Noon discloses the non-transitory computer readable medium of claim 11, wherein generating the one or more alerts comprises detecting ransomware activity associated with the user (Pon, Para 0005: policy-based scans can be performed associated with malware or a distributed denial of service (DDoS) attack, etc. The user can receive a notification/report when information for an asset in inventory changes or when a specific event occurs (e.g., suspected malware was found on a website in inventory).
Examiner Notes
8. The Examiner notes that incorporating the combined limitations of claims 21 and 22 or combined limitations of claims 21 and 23 into independent claim 1 would better clarify the subject matter/embodiment of claimed invention. Similarly, amending independent claim 11 with aforesaid claim limitations would help advance the prosecution as it would clarify the claimed invention.
Conclusion
9. The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Downie et al. (US 11983094 B2) discloses improving diagnosis of defects wherein analytic focus is automatically walked back from an initial symptomatic diagnostic context to a previous diagnostic context that is closer to underlying causes.
Beauchesne et al. (US 20200329062 A1) discloses an improved approach for detecting potentially malicious activity on a network wherein the improved approach generates a multi-dimensional activity model based on captured network activity.
10. Any inquiry concerning this communication or earlier communications from the examiner should be directed to MAHFUZUR RAHMAN whose telephone number is (571)270-7638. The examiner can normally be reached on Monday thru Friday.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Yin-Chen Shaw can be reached on 571-272-8878. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MAHFUZUR RAHMAN/Primary Examiner, Art Unit 2498
Prosecution Insights