Prosecution Insights
Last updated: April 19, 2026
Application No. 18/421,854

PROGRAMMATIC DATA SECURITY AND COMPLIANCE REMEDIATION FOR NETWORK COMPUTING ENVIRONMENT

Final Rejection §101§102§103§112
Filed
Jan 24, 2024
Examiner
BECHTEL, KEVIN M
Art Unit
2491
Tech Center
2400 — Computer Networks
Assignee
Uber Technologies, Inc.
OA Round
2 (Final)
70%
Grant Probability
Favorable
3-4
OA Rounds
3y 1m
To Grant
99%
With Interview

Examiner Intelligence

Grants 70% — above average
70%
Career Allow Rate
312 granted / 448 resolved
+11.6% vs TC avg
Strong +64% interview lift
Without
With
+63.6%
Interview Lift
resolved cases with interview
Typical timeline
3y 1m
Avg Prosecution
28 currently pending
Career history
476
Total Applications
across all art units

Statute-Specific Performance

§101
15.4%
-24.6% vs TC avg
§103
32.2%
-7.8% vs TC avg
§102
20.2%
-19.8% vs TC avg
§112
22.6%
-17.4% vs TC avg
Black line = Tech Center average estimate • Based on career data from 448 resolved cases

Office Action

§101 §102 §103 §112
DETAILED ACTION Notice of AIA Status The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA . Response to Amendment The amendment filed 2026-02-04 has been entered and fully considered. Response to Arguments Applicant’s arguments, see pages 7-10, filed 2026-02-04, with respect to the rejection of claims 1-4 and 17-20 under 35 U.S.C. § 101 have been fully considered but they are not persuasive. Applicant first alleges that the claims are patent eligible under Step 2A because “the claims provide a technical solution to a technical problem”, as the claims allegedly provide a technological solution, by restricting access to data storage containers when the data objects of the container do not satisfy “a set of rules associated with the context classification of the data storage container” and by “performing one or more remediation actions on the one or more data objects, to protect the one or more data objects from unwanted exposure”. The Examiner respectfully submits, however, that the claims must include the components or steps of the invention that provide the improvement described in the specification; See MPEP § 2106.04(d)(1). More particularly, because the claims do not provide any structure or function regarding the “set of rules”, “context classification”, or “remediation action”, rather than necessarily “protect the one or more data objects from unwanted exposure”, the claims encompass embodiments that fail to protect the data objects or may degrade the security and performance of a computer in general. Simply claiming a desired improvement of “to protect the one or more data objects from unwanted exposure” is insufficient; instead, the performance of the claim steps must necessarily result in the described improvement. Applicant similarly alleges that the claims are patent eligible under Step 2B because of “the specificity and technological solution provided by the claims”; however, the Examiner notes that there are no particular arguments regarding how the claim elements “transform the nature of the claim” into a patent-eligible application. Thus, the Examiner respectfully submits that the rejection is proper. Applicant’s arguments, see pages 10-11, filed 2026-02-04, with respect to the rejection of claims 1-2, 17-18, and 20 under 35 U.S.C. § 102(a)(1) and of claims 3-4 and 19 under 35 U.S.C. § 103 have been fully considered but they are not persuasive. In response to applicant’s argument that Bonney fails to disclose “in response to determining that at least one of the one or more data objects does not satisfy the set of rules associated with the context classification, implementing a measure to restrict access by the set of entities or computing devices to the data storage container,” let alone “upon performing the one or more remediation actions, making the data storage container accessible on the network computing environment” because the disclosure of Bonney at [0086] is allegedly insufficient to teach these claim limitations, the Examiner respectfully disagrees. The Examiner first notes that Applicant’s arguments do not comply with 37 CFR 1.111(c) because they do not clearly point out the patentable novelty which he or she thinks the claims present in view of the state of the art disclosed by the references cited or the objections made, as they do not show how the amended claim language avoids such references or objections. As recognized by Applicant, Bonney discloses “if a determination is made that the security measures applied to the data, at the data level, are not in compliance with the data security policies, the data security policy compliance data is used to apply the correct security measures to obtain conformance with the one or more data security policies”. Further, as noted in the amended rejection at ¶9, Bonney also discloses that these security measures include authentication and access control (e.g., [0080]-[0091]). Thus, a correction that changes that authorized roles or users or otherwise changes the authentication requirements would encompass making the data inaccessible (restricting access) to some entities as well as also making the data available to other entities, thereby teaching the amended claim limitations. Thus, the Examiner respectfully submits that the rejection is proper. Information Disclosure Statement The information disclosure statement (IDS) submitted on 2026-02-04 is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner. Claim Rejections - 35 USC § 101 35 U.S.C. 101 reads as follows: Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title. Claims 1-4 and 17-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea (35 U.S.C. 101 Judicial Exception) without significantly more. The claims recite performing a remedial action if data objects are determined not to satisfy the rules associated with the context classification of their storage container, a form of observation, evaluation, judgment, and/or opinion, which is a concept performed in the human mind and thus grouped as Mental processes. This judicial exception is not integrated into a practical application because the generically recited computer elements do not add a meaningful limitation to the abstract idea because they amount to simply implementing the abstract idea on a computer. The claims do not include additional elements that are sufficient to amount to significantly more than the judicial exception because the additional elements, when considered separately and in combination, do not add significantly more to the abstract idea, as they are well-understood, routine, conventional computer functions as recognized by the courts. Based upon consideration of all the relevant factors with respect to the claimed invention as a whole, the claims are determined to be directed to an abstract idea without significantly more. The rationale for this determination is explained infra: The following are Principles of Law: A patent may be obtained for “any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof”; 35 U.S.C. § 101. The Supreme Court has consistently held that this provision contains an important implicit exception: laws of nature, natural phenomena, and abstract ideas are not patentable; See Alice Corp. v. CLS Bank Int’l, 134 S. Ct. 2347, 2354 (2014); Gottschalk v. Benson, 409 U.S. 63, 67 (1972) (“Phenomena of nature, though just discovered, mental processes, and abstract intellectual concepts are not patentable, as they are the basic tools of scientific and technological work.”). Notwithstanding that a law of nature or an abstract idea, by itself, is not patentable, an application of these concepts may be deserving of patent protection; See Mayo Collaborative Servs. v. Prometheus Labs., Inc., 132 S. Ct. 1289, 1293–94 (2012). In Mayo, the Court stated that “to transform an unpatentable law of nature into a patent-eligible application of such a law, one must do more than simply state the law of nature while adding the words ‘apply it.’” Mayo, 132 S. Ct. at 1294 (citation omitted). In Alice, the Court reaffirmed the framework set forth previously in Mayo “for distinguishing patents that claim laws of nature, natural phenomena, and abstract ideas from those that claim patent-eligible applications of these concepts.” Alice, 134 S. Ct. at 2355. The test for determining subject matter eligibility requires a first step of determining whether the claims are directed to a process, machine, manufacture, or composition of matter. If the claims are directed to one of the four patent-eligible subject matter categories, then the Examiner must perform a two-part analysis to determine whether a claim that is directed to a judicial exception recites additional elements that amount to significantly more than the exception. The first part of the second step in the analysis is to “determine whether the claims at issue are directed to one of those patent-ineligible concepts.” Id. If the claims are directed to a patent-ineligible concept, then the second part of the second step in the analysis is to consider the elements of the claims “individually and ‘as an ordered combination”’ to determine whether there are additional elements that “‘transform the nature of the claim’ into a patent-eligible application.” Id. (quoting Mayo, 132 S. Ct. at 1298, 1297). In other words, the second step in the analysis is to “search for an ‘inventive concept’‒ i.e., an element or combination of elements that is ‘sufficient to ensure that the patent in practice amounts to significantly more than a patent on the [ineligible concept] itself.’” Id. (brackets in original) (quoting Mayo, 132 S. Ct. at 1294). The prohibition against patenting an abstract idea “cannot be circumvented by attempting to limit the use of the formula to a particular technological environment or adding insignificant post-solution activity.” Bilski v. Kappos, 561 U.S. 593, 610–11 (2010) (citation and internal quotation marks omitted). The Court in Alice noted that “[s]imply appending conventional steps, specified at a high level of generality,” was not “enough” [in Mayo] to supply an “‘inventive concept.’” Alice, 134 S. Ct. at 2357 (quoting Mayo, 132 S. Ct. at 1300, 1297, 1294). In the “2019 Revised Patent Subject Matter Eligibility Guidance” (2019 PEG), the USPTO has prepared revised guidance for use by USPTO personnel in evaluating subject matter eligibility based upon rulings by the courts. The Examiner is bound by and applies the framework as set forth by the Court in Mayo and reaffirmed by the Court in Alice and follows the 2019 PEG for determining whether the claims are directed to patent-eligible subject matter. Step 1: Are the claims at issue directed to a process, machine, manufacture, or composition of matter? The Examiner finds that the claims are directed to one of the four statutory categories. Step 2A – Prong One: Does the claim recite an abstract idea, law of nature, or natural phenomenon? The Examiner finds that the claims are directed to the abstract idea of performing a remedial action if data objects are determined not to satisfy the rules associated with the context classification of their storage container, a form of observation, evaluation, judgment, and/or opinion, which is a concept performed in the human mind and thus grouped as Mental processes. Step 2A – Prong Two: Does the claim recite additional elements that integrate the Judicial Exception into a practical application? The abstract idea is not integrated into a practical application because the generically recited computer elements do not add a meaningful limitation to the abstract idea because they amount to simply implementing the abstract idea on a computer. In determining whether the abstract idea was integrated into a practical application, the Examiner has considered whether there were any limitations indicative of integration into a practical application, such as: (1) Improvements to the functioning of a computer, or to any other technology or technical field; See MPEP § 2106.05(a) (2) Applying or using a judicial exception to effect a particular treatment or prophylaxis for a disease or medical condition; See Vanda Memo (Recent Subject Matter Eligibility Decision: Vanda Pharmaceuticals Inc. v. West-Ward Pharmaceuticals) (3) Applying the judicial exception with, or by use of, a particular machine; See MPEP § 2106.05(b) (4) Effecting a transformation or reduction of a particular article to a different state or thing; See MPEP § 2106.05(c) (5) Applying or using the judicial exception in some other meaningful way beyond generally linking the use of the judicial exception to a particular technological environment, such that the claim as a whole is more than a drafting effort designed to monopolize the exception; See MPEP § 2106.05(e) and Vanda Memo The Examiner notes that clam features of: performing a remedial action if data objects are determined not to satisfy the rules associated with the context classification of their storage container do not improve the functioning of a computer or technical field, do not effect a particular treatment or prophylaxis for a disease or medical condition, do not apply or use a particular machine, do not effect a transformation or reduction of a particular article to a different state or thing, and do not apply or use the judicial exception in some other meaningful way beyond generally linking the use of the judicial exception to a particular technological environment, such that the claim as a whole is more than a drafting effort designed to monopolize the exception. Instead of a practical application, the claim features of performing a remedial action if data objects are determined not to satisfy the rules associated with the context classification of their storage container merely use a general-purpose computer as a tool to perform the abstract idea (See MPEP § 2106.05(f)) and merely generally link the use of the abstract idea to a field of use (See MPEP § 2106.05(h)). Thus, the Examiner finds that the claimed invention does not recite additional elements that integrate the Judicial Exception into a practical application. Step 2B: Is there something else in the claims that ensures that they are directed to significantly more than a patent-ineligible concept? The claims, as a whole, require nothing significantly more than generic computer implementation or can be performed entirely by a human. The additional element(s) or combination of element(s) in the claims other than the abstract idea per se amount to no more than recitation of generic computer structure (e.g. computer-readable medium, processor, and/or memory) that serves to perform generic computer functions (e.g. determining classification, analyzing data objects, and performing remedial actions) that are well-understood, routine, and conventional activities previously known to the pertinent industry. The claimed context classification, data objects, set of rules, level of a security, and entropy are all numbers, data structures, or datum. Each of these elements are individually dispositive of patent eligibility because of the following legal holdings: “Data in its ethereal, non-physical form is simply information that does not fall under any of the categories of eligible subject matter under section 101.” Digitech Image Techs., LLC v. Electronics for Imaging, Inc., 758 F.3d 1344, 1350 (Fed. Cir. 2014). The Supreme Court has also explained that “[a]bstract software code is an idea without physical embodiment,” i.e., an abstraction. Microsoft Corp. v. AT&T Corp., 550 U.S. 437, 449 (2007). A claim that recites no more than software, logic, or a data structure (i.e., an abstract idea) – with no structural tie or functional interrelationship to an article of manufacture, machine, process or composition of matter does not fall within any statutory category and is not patentable subject matter; data structures in ethereal, non-physical form are non-statutory subject matter. In re Warmerdam, 33 F.3d 1354, 1361 (Fed. Cir. 1994); see Nuijten, 500 F.3d at 1357. Furthermore, the claimed invention does not have a specific asserted improvement in computer capabilities, nor is it a specific implementation of a solution to a problem in the software arts; See Enfish, LLC v. Microsoft Corp., 822 F.3d 1327 (Fed. Cir. 2016). Rather, the claims are merely directed towards performing a remedial action if data objects are determined not to satisfy the rules associated with the context classification of their storage container, which is similar to ideas that the courts have found to be abstract, as noted supra, and the claims are without a “practical application” or anything “significantly more”. Considering each of the claim elements in turn, the function performed by the computer system at each step of the process does no more than require a generic computer to perform a well-understood, routine, and conventional activity at a high level of generality. For example, determining classification, analyzing data objects, and performing remedial actions are merely forms of performing repetitive calculations or generic actions, which has been found by the courts to be a well-understood, routine, conventional activity in computers; See e.g. Versata Dev. Group, Inc. v. SAP Am., Inc., 793 F.3d 1306, 1334, 115 USPQ2d 1681, 1701 (Fed. Cir. 2015); OIP Techs., 788 F.3d at 1363, 115 USPQ2d at 1092-93. Further, making a data storage container accessible on the network is merely enabling receiving or transmitting data over a network, which has been found by the courts to be a well-understood, routine, conventional activity in computers; See e.g. Symantec, 838 F.3d at 1321, 120 USPQ2d at 1362 (utilizing an intermediary computer to forward information); TLI Communications LLC v. AV Auto. LLC, 823 F.3d 607, 610, 118 USPQ2d 1744, 1745 (Fed. Cir. 2016) (using a telephone for image transmission); OIP Techs., Inc., v. Amazon.com, Inc., 788 F.3d 1359, 1363, 115 USPQ2d 1090, 1093 (Fed. Cir. 2015) (sending messages over a network); buySAFE, Inc. v. Google, Inc., 765 F.3d 1350, 1355, 112 USPQ2d 1093, 1096 (Fed. Cir. 2014) (computer receives and sends information over a network). Further note that the abstract idea of performing a remedial action if data objects are determined not to satisfy the rules associated with the context classification of their storage container to which the claimed invention is directed has a prior art basis outside of a computing environment, e.g. elementary test-taking where students are show a plurality of objects and tasked to identify the one that does not belong. The prohibition against patenting an abstract idea “cannot be circumvented by attempting to limit the use of the formula to a particular technological environment or adding insignificant post-solution activity.” Bilski v. Kappos, 561 U.S. 593, 610–11 (2010) (citation and internal quotation marks omitted). The Court in Alice noted that “[s]imply appending conventional steps, specified at a high level of generality,” was not “enough” [in Mayo] to supply an “‘inventive concept.’” Alice, 134 S. Ct. at 2357 (quoting Mayo, 132 S. Ct. at 1300, 1297, 1294). Viewed as a whole, the claims simply recite the steps of using generic computer components. The claims do not purport, for example, to improve the functioning of the computer system itself. Nor does it effect an improvement in any other technology or technical field. Instead, the claims amount to nothing significantly more than an instruction to implement the abstract idea using generic computer components. This is insufficient to transform an abstract idea into a patent-eligible invention. The dependent claims likewise incorporate the deficiencies of a claim upon which they ultimately depend and are also directed to non-patent-eligible subject matter. Claim Rejections - 35 USC § 112 The following is a quotation of 35 U.S.C. 112(a): (a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention. The following is a quotation of 35 U.S.C. 112(b): (b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention. Claims 1-4 and 17-20 are rejected under 35 U.S.C. 112(a) as failing to comply with the written description requirement. The claims contain subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor at the time the application was filed, had possession of the claimed invention. Specifically, claim 1 recites the limitations “based on the context classification, (i) making the data storage container accessible on the network computing environment to a set of entities or computing devices” and “upon performing the one or more remediation actions, making the data storage container accessible on the network computing environment”, and these limitations do not appear to be supported by the original disclosure. That is, although the Specification describes making the data storage container accessible on the network computing environment, e.g. [0024], as well as both performing context classification (e.g. [0024]) and performing remediation such as making the data storage container inaccessible (e.g. [0084]), the Specification does not appear to support “making the data storage container accessible” “based on the context classification” or based “upon performing the one or more remediation actions” as recited in the claims. Claims 17 and 20 are rejected under a similar rationale. The dependent claims included in the statement of rejection but not specifically addressed in the body of the rejection have inherited the deficiencies of their parent claim and have not resolved the deficiencies. Therefore, they are rejected based on the same rationale as applied to their parent claims above. Claims 1-4 and 17-20 are rejected under 35 U.S.C. 112(b) as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor regards as the invention. Specifically, claim 1 recites the limitations “making the data storage container accessible on the network computing environment to a set of entities or computing devices” and “upon performing the one or more remediation actions, making the data storage container accessible on the network computing environment”, and the two recitations of data storage container being made accessible are unclear. More particularly, since the data storage container is previously made accessible, without any intervening recitation that makes it inaccessible, it’s unclear how the second recitation of “making the data storage container accessible on the network computing environment” is being performed or otherwise expands on the first recitation of “making the data storage container accessible on the network computing environment”. Thus, the limitations are unclear. Claims 17 and 20 are rejected under a similar rationale. The dependent claims included in the statement of rejection but not specifically addressed in the body of the rejection have inherited the deficiencies of their parent claim and have not resolved the deficiencies. Therefore, they are rejected based on the same rationale as applied to their parent claims above. Claim Rejections - 35 USC § 102 The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action: A person shall be entitled to a patent unless – (a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale or otherwise available to the public before the effective filing date of the claimed invention. Claims 1-2, 17-18, and 20 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by Bonney et al. (US Pre-Grant Publication No. 20150347773-A1, hereinafter “Bonney”). With respect to independent claim 1, Bonney discloses a non-transitory computer-readable medium that stores instructions, which when executed by one or more processors, cause the one or more processors to perform operations that include: determining a context classification of a data storage container {paras. 0063-0067 and 0086: “the data included in the database is scanned to determine the various types of data in the database, and/or the various security classifications and security measures applied to the data in the database”}, the data storage container being provided with a memory resource of a network computing environment {paras. 0033 and 0043: “production environment 1 includes computing environment 10, for instance a local area network, or the Internet”}. based on the context classification, (i) making the data storage container accessible on the network computing environment to a set of entities or computing devices {para. 0080: “one or more data security policies requiring all access to the data be authenticated; one or more data security policies requiring specific identification/authentication procedures, such as mandatory multifactor authentication; one or more data security policies requiring all access to the data be associated with authorized roles”}, and (ii) analyzing one or more data objects stored in the data storage container to determine whether each of the one or more data objects satisfies a set of rules associated with the context classification of the data storage container {paras. 0080 and 0086: “the security measures applied to each type of data in the database are analyzed to determine if the security measures applied to the data, at the data level, is in compliance with the data security policies”; analyzing reads on both the security measures themselves as the data objects or the analysis of the data itself indirectly by virtue of their corresponding security measures (e.g. “specific encryption, or a defined level of encryption, for data”)}. in response to determining that at least one of the one or more data objects does not satisfy the set of rules associated with the context classification, implementing a measure to restrict access by the set of entities or computing devices to the data storage container {paras. 0080-0091: “if a determination is made that the security measures applied to the data, at the data level, are not in compliance with the data security policies, the data security policy compliance data is used to apply the correct security measures to obtain conformance with the one or more data security policies”, this could include correcting “one or more data security policies requiring specific identification/authentication procedures, such as mandatory multifactor authentication; one or more data security policies requiring all access to the data be associated with authorized roles”}. performing one or more remediation actions, on the one or more data objects {para. 0086: “if a determination is made that the security measures applied to the data, at the data level, are not in compliance with the data security policies, the data security policy compliance data is used to apply the correct security measures to obtain conformance with the one or more data security policies”}, to protect the one or more data objects from unwanted exposure {note that this is an intended usage limitation that suggests or makes optional a limitation, but does not require steps to be performed and does not necessarily limit the claim to a particular structure; thus the limitation does not limit the scope of the claim; See MPEP § 2103(I)(C)}. upon performing the one or more remediation actions, making the data storage container accessible on the network computing environment {paras. 0080-0091: “to apply the correct security measures” may result in removal of “specific identification/authentication procedures” or increasing the “authorized roles” that have “access to the data”}. With respect to dependent claim 2, Bonney discloses wherein the context classification is tiered to reflect a level of a security or compliance concern of data objects that are stored in the data storage container {para. 0066: “data is, as a default, determined to be of the highest sensitivity type, and therefore requiring the highest data security type classification and levels of protection”}. With respect to claims 17-18, a corresponding reasoning as given earlier in this section with respect to claims 1-2 applies, mutatis mutandis, to the subject matter of claims 17-18; therefore, claims 17-18 are rejected, for similar reasons, under the grounds as set forth for claims 1-2. With respect to claim 20, a corresponding reasoning as given earlier in this section with respect to claim 1 applies, mutatis mutandis, to the subject matter of claim 20; therefore, claim 20 are rejected, for similar reasons, under the grounds as set forth for claim 1. Claim Rejections - 35 USC § 103 The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action: A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made. The factual inquiries set forth in Graham v. John Deere Co., 383 U.S. 1, 148 USPQ 459 (1966), that are applied for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows: 1. Determining the scope and contents of the prior art. 2. Ascertaining the differences between the prior art and the claims at issue. 3. Resolving the level of ordinary skill in the pertinent art. 4. Considering objective evidence present in the application indicating obviousness or nonobviousness. Claims 3-4 and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Bonney et al. (US Pre-Grant Publication No. 20150347773-A1, hereinafter “Bonney”) in view of LeCrone et al. (US Pre-Grant Publication No. 20210103490-A1, hereinafter “LeCrone”). With respect to dependent claim 3, although Bonney teaches wherein the context classification indicates that the data storage container is to store data objects with a highest security or compliance concern {para. 0066: “the highest sensitivity type, and therefore requiring the highest data security type classification and levels of protection”} and determining a level of encryption applied {paras. 0057 and 0086: determining the “specific encryption, or a defined level of encryption” applied by the “one or more database security measures”}, Bonney does not explicitly disclose determining whether the data is encrypted; however, LeCrone discloses wherein analyzing the one or more data objects includes determining whether each of the one or more data objects is encrypted {para. 0120: “determine a probability that data is encrypted based on a measure of the entropy”}. Bonney and LeCrone are analogous art because they are from the same field of endeavor or problem-solving area of data analysis. Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art, having the teachings of Bonney and LeCrone before him or her, to modify/develop the security compliance detection of Bonney’s system to utilize encryption detection via entropy. The suggestion and/or motivation for doing so would have been because it is merely combining prior art elements according to known methods to yield predictable results, e.g., enables determination that cryptographic security is actually applied. Therefore, it would have been obvious to combine the security compliance detection in Bonney’s system with encryption detection via entropy to obtain the invention as specified in the instant claim(s). The Examiner notes that this motivation applies to all dependent and/or otherwise subsequently addressed claims. With respect to dependent claim 4, LeCrone discloses wherein determining whether each of the one or more data objects is encrypted includes determining an entropy of each of the one or more data objects {para. 0120: “determine a probability that data is encrypted based on a measure of the entropy”}. With respect to claim 19, a corresponding reasoning as given earlier in this section with respect to claim 3 applies, mutatis mutandis, to the subject matter of claim 19; therefore, claim 19 is rejected, for similar reasons, under the grounds as set forth for claim 3. Conclusion Applicant’s amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a). A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any extension fee pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the date of this final action. Any inquiry concerning this communication or earlier communications from the examiner should be directed to Kevin Bechtel whose telephone number is 571-270-5436. The examiner can normally be reached Monday - Friday, 09:00 - 17:00 ET. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, William (“Bill”) Korzuch can be reached at 571-272-7589. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000. /Kevin Bechtel/ Primary Examiner, Art Unit 2491
Read full office action

Prosecution Timeline

Jan 24, 2024
Application Filed
Oct 31, 2025
Non-Final Rejection — §101, §102, §103
Feb 04, 2026
Response Filed
Feb 22, 2026
Final Rejection — §101, §102, §103 (current)

Precedent Cases

Applications granted by this same examiner with similar technology

Patent 12585790
TRAFFIC PROCESSING METHOD AND PROTECTION SYSTEM
2y 5m to grant Granted Mar 24, 2026
Patent 12587524
Authentication System and Method for Windows Systems
2y 5m to grant Granted Mar 24, 2026
Patent 12585800
EXTERNAL MULTI-CHANNEL COMMUNICATION MODULARIZATION, ROUTING, TRANSMISSION, AND ACCESS CONTROL IN A DATABASE SYSTEM
2y 5m to grant Granted Mar 24, 2026
Patent 12574410
NETWORK-BASED SECURITY WITH DECOYS AND DECEPTIVE BALANCING
2y 5m to grant Granted Mar 10, 2026
Patent 12572673
HIERARCHICALLY CONFIGURED INTERCONNECT-BASED ACCESS MECHANISM
2y 5m to grant Granted Mar 10, 2026
Study what changed to get past this examiner. Based on 5 most recent grants.

AI Strategy Recommendation

Get an AI-powered prosecution strategy using examiner precedents, rejection analysis, and claim mapping.
Powered by AI — typically takes 5-10 seconds

Prosecution Projections

3-4
Expected OA Rounds
70%
Grant Probability
99%
With Interview (+63.6%)
3y 1m
Median Time to Grant
Moderate
PTA Risk
Based on 448 resolved cases by this examiner. Grant probability derived from career allow rate.

Sign in with your work email

Enter your email to receive a magic link. No password needed.

Personal email addresses (Gmail, Yahoo, etc.) are not accepted.

Free tier: 3 strategy analyses per month