Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
FINAL ACTION
This action is in response to applicant’s claim amendment(s) submitted on 05/08/2026. Claims 1, 10-12 and 15-19 are amended. Claims 1-20 are pending.
Response to Arguments
Examiner’s Remarks – Specification Objection (Abstract)
The examiner withdraws the objection in view of applicant’s Abstract amendment.
Examiner’s Remarks - 35 USC § 103 – Claims 1, 10 and 17
The examiner notes that the applicant has amended each independent claim to recite the following: “generate, based on the user behavior information, and by using a second machine learning model that is distinct from the first machine learning model, certification information that indicates whether the security access is to be renewed or revoked, wherein the second machine learning model is used after the security access has been granted, and is configured to analyze post-grant user behavior information to determine whether continued access is appropriate”. The examiner notes that the applicant now alleges a deficiency on the part of the prior art in view of the claim amendment(s). The examiner contends that in view of the new claim amendment(s), the examiner introduces Djosic et al. (US Patent No. 12,058,135) to the record. The examiner contends that Djosic teaches the use of a plurality of learning models to control access. See rejection below.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Choi et al. (US Patent Publication No. 2016/0057150 and Choi hereinafter) in view of Djosic et al. (US Patent No. 12,058,135 and Djosic hereinafter).
As to claims 1 and 10, Choi teaches a system for using artificial intelligence to facilitate security access management, the system comprising:
one or more memories (i.e. …illustrates in figure 4, figure element(s) 406 memory);
and one or more processors (i.e. …illustrates in figure 4, figure element(s) 404 processor), communicatively coupled to the one or more memories (i.e. …illustrates in figure 4, figure element(s) 406 memory), configured to: obtain a user profile that is associated with a user (i.e., …teaches in par. 0027 the following: “event analytics access provision 200 obtains user roles and attributes.”),
determine, based on the user profile, and by using a first machine learning model, (i.e., teaches in par. 0017 the following: “Historical reference 122 is a collection of individual user data stored on server 120 for analytical purposes. Historical reference 122 includes individual user data (e.g., username, roles, department, manager, job id, usage, etc.). Historical reference 122 can be implemented with any type of storage device that is capable of storing data that may be accessed and utilized by event analytics access provision 200. In one embodiment, historical reference 122 resides on server 120. In another embodiment, historical reference 122 resides on computing device 110. In other embodiments, historical reference 122 may reside on another server or another computing device connected over network 130, provided that historical reference 122 is accessible to security intelligence system 128, event analytics access provision 200, and event analytics access de-provision 300.”. …teaches in par. 0020 the following: “Security intelligence system 128 may identify risks through unusual patterns of access associated with a user id”. …teaches in par. 0044 the following: “in accordance with an embodiment of the present invention. In the depicted embodiment as shown in FIG. 3, an existing user id's role assignment grants access to managed system 126, but the user id may no longer require the current access provided by the assigned role. For example, a user may only access managed system 126 when required to change a password but does not utilize available resources. The current role and access for the user id can be evaluated to determine the actual user id needs to maintain optimal security on managed system 126.” …teaches in par. 0010 the following: “compare the existing user id activity against criteria, such as previous user id activity”);
that the user is to be granted a security access (i.e., …teaches in par. 0026 the following: “access to the system is granted (i.e., user id exists, authentication and authorization criteria are met, and assigned role grants access to restricted resource)”),
cause, based on determining that the user is to be granted the security access, the security access to be granted to the user (i.e., …teaches in par. 0054 the following: “the resource owner, upon review of the results comparison and recommendations made by event analytics access de-provision 300, reinstates user id access.” …teaches in par. 0026 the following: “access to the system is granted (i.e., user id exists, authentication and authorization criteria are met, and assigned role grants access to restricted resource)”);
obtain, subsequent to causing the security access to be granted to the user, user behavior information associated with the user (i.e., …teaches in par. 0049 the following: “…atypical activity refers to the actual recorded audit event activity for a user id not matching an expected defined activity for the user id. For example, an atypical activity may include one user id accessing managed system 126 once every six months to change a password while other user ids access managed system 126 daily …teaches in par. 0010 the following: “compare the existing user id activity against criteria, such as previous user id activity, a pre-determined threshold (e.g., minimum activity requirement), and with respect to compliance with policy rules to ensure security by automatically suspending or de-provisioning the roles of a user when criteria is not sustained.”);
certification information that indicates whether the security access is to be renewed or revoked (i.e., …teaches in par. 0053 the following: “event analytics access de-provision 300 notifies the user and the resource owner of an account status change…”. …teaches in par. 0054 the following: “…the resource owner, upon review of the results comparison and recommendations made by event analytics access de-provision 300, reinstates user id access. Identity manager system 124 reactivates the user id and restores access to managed system 126.” … further teaches in par. 0054 the following: “the resource owner, upon review of the request and recommendations made by event analytics access de-provision 300, revokes access to managed system 126”);
and cause, based on the certification information, one of: the security access to be renewed when the certification information indicates that the security access is to be renewed (i.e., …teaches in par. 0054 the following: “the resource owner, upon review of the results comparison and recommendations made by event analytics access de-provision 300, reinstates user id access.” …further in teaches in par. 0054 the following: “Identity manager system 124 reactivates the user id”) or the security access to be revoked when the certification information indicates that the security access is to be revoked (i.e., …teaches in par. 0052 the following: “event analytics access de-provision 300 provides identity manager system 124 with an instruction to suspend access of a specific user (i.e., changes user id access authorization to suspended status) pending resource owner action. In one embodiment, in response to receipt of the suspension order, identity manager system 124 temporarily automatically suspends access to managed system 126 for the user id associated with the audit event.” …teaches in par. 0054 the following: “and recommendations made by event analytics access de-provision 300, revokes access to managed system 126. Identity manager system 124 removes the role associated with the user id, and the user id no longer has access to managed system 126.”).
The system of Choi does not expressly teach:
generate, based on the user behavior information, and by using a second machine learning model that is distinct from the first machine learning model,
wherein the second machine learning model is used after the security access has been granted, and is configured to analyze post-grant user behavior information to determine whether continued access is appropriate.
In this instance the examiner notes the teachings of prior art reference Djosic.
With regards to applicant’s claim limitation element of, “generate, based on the user behavior information, and by using a second machine learning model that is distinct from the first machine learning model”, Djosic teaches as part of his claim 1 claim element(s) the following: “generate, prior to operations at an API gateway and using a first machine learning model, a first risk score representing an assessment associated with the API traffic; generate, at the API gateway and using a second machine learning model, a second risk score based on an assessment associated with the API traffic observed at the API gateway, the second risk score being a function of said first risk score and said assessment associated with the API traffic observed at the API gateway, said second risk score being greater than said first risk score; prior to continued transmission of the API traffic to the destination device, generate, by a third machine learning model, a third risk score representing an assessment of the API traffic at the destination device positioned subsequent to the API gateway, the third risk score being a function of said second risk score and said assessment of said API traffic at said destination device positioned subsequent to said API gateway, said third risk score being greater than said second risk score and said first risk score”.
With regards to applicant’s claim limitation elements of, “wherein the second machine learning model is used after the security access has been granted, and is configured to analyze post-grant user behavior information to determine whether continued access is appropriate”, Djosic teaches as part of his claim 1 claim element(s) the following: “generate, prior to operations at an API gateway and using a first machine learning model, a first risk score representing an assessment associated with the API traffic; generate, at the API gateway and using a second machine learning model, a second risk score based on an assessment associated with the API traffic observed at the API gateway, the second risk score being a function of said first risk score and said assessment associated with the API traffic observed at the API gateway, said second risk score being greater than said first risk score; prior to continued transmission of the API traffic to the destination device, generate, by a third machine learning model, a third risk score representing an assessment of the API traffic at the destination device positioned subsequent to the API gateway, the third risk score being a function of said second risk score and said assessment of said API traffic at said destination device positioned subsequent to said API gateway, said third risk score being greater than said second risk score and said first risk score”.
Thus, it would have been obvious to one of ordinary skill in the art before the effective filing date of the of the claimed invention was made to implement the teachings of Choi with the teachings of Djosic by having their system comprise an enhanced access learning model process. One would have been motivated to do so to provide a simple and effective means to dynamically authenticate, wherein the enhanced access learning model process helps facilitate stronger access control within the network and makes it easier to configure network security parameters.
As to claim 2, the system of Choi and Djosic as applied to claim 1 above teaches access control, specifically Choi teaches a system of claim 1, wherein the one or more processors, to obtain the user profile that is associated with the user (i.e., …teaches in par. 0010 the following: “compare the existing user id activity against criteria, such as previous user id activity”), are configured to:
monitor a data structure that stores user profiles associated with a plurality of users (i.e., …teaches in par. 0010 the following: “monitor and store existing user id access activity to the provisioned resource”);
determine, based on monitoring the data structure, update information associated with the data structure (i.e., …teaches in par. 0025 the following: “updates a system that records activity within the enterprise environment …teaches in par. 0010 the following: “monitor and store existing user id access activity to the provisioned resource”),
wherein the update information indicates that the user profile associated with the user has been added to the data structure or that the user profile has been modified within the data structure (i.e., …teaches in par. 0010 the following: “monitor and store existing user id access activity to the provisioned resource” …teaches in par. 0028 the following: “updates an audit event log and historical reference 122” …teaches in par. 0028 the following: “updates the audit event log with the user roles and attributes within, for example, security intelligence system 128, for correlation with user actions taken on managed system 126 by the user id.”. …teaches in par. 0025 the following: “updates a system that records activity within the enterprise environment”);
and obtain, based on the update information, the user profile from the data structure (i.e., …teaches in par. 0010 the following: “compare the existing user id activity against criteria, such as previous user id activity, a pre-determined threshold (e.g., minimum activity requirement), and with respect to compliance with policy rules to ensure security by automatically suspending or de-provisioning the roles of a user when criteria is not sustained.”).
As to claim 3, the system of Choi and Djosic as applied to claim 1 above teaches access control, specifically Choi teaches a system of claim 1, wherein the one or more processors, to obtain the user profile that is associated with the user (i.e., …teaches in par. 0010 the following: “compare the existing user id activity against criteria, such as previous user id activity”), are configured to: receive a security access grant request for the user (i.e., …teaches in par. 0020 the following: “user access is controlled through a login in which access is granted to the enterprise computing environment through credentials and the assignment of roles (roles may also be referred to as permissions, access rights, and/or privileges)” …teaches in par. 0024 the following: “a user attempts to access managed system 126 through user interface 112. Event analytics access provision 200 receives a notification of an audit event (e.g., login attempt, authorization event) from managed system 126. In one embodiment, event analytics access provision 200 receives a notification of a successful audit event (e.g., access granted).”);
identify, based on the security access grant request, identification information associated with the user (i.e. …teaches as part of his abstract the following: “determining access activity associated with the first user id.”);
and obtain, based on the identification information, the user profile from a data structure that stores user profiles associated with a plurality of users (i.e., …teaches in par. 0010 the following: “compare the existing user id activity against criteria, such as previous user id activity, a pre-determined threshold (e.g., minimum activity requirement), and with respect to compliance with policy rules to ensure security by automatically suspending or de-provisioning the roles of a user when criteria is not sustained.” …teaches in par. 0034 the following: “compares the attributes of the user id associated with the failed audit event with the attributes of the user ids and successful audit events from historical reference 122.”).
As to claims 4 and 11, the system of Choi and Djosic as applied to claim 1 above teaches access control, specifically Choi teaches a system of claim 1, wherein the one or more processors, to cause the security access to be granted to the user (i.e., …teaches in par. 0023 the following: “granting user access…”), are configured to: update a data structure that stores security access grant information to indicate that the user is granted the security access (i.e., …teaches in par. 0043 the following: “updates the user id with the new role assignment.” …teaches in par. 0054 the following: “modifies the user id roles and assigns a new role based on the results comparison identifying a more similar role based on matching attributes. Identity manager system 124 updates the roles assigned to the user id and restores modified access to managed system 126.”. …teaches in par. 0054 the following: “reinstates user id access. Identity manager system 124 reactivates the user id and restores access to managed system 126”).
As to claim 5, the system of Choi and Djosic as applied to claim 1 above teaches access control, specifically Choi teaches a system of claim 1, wherein the one or more processors, to cause the security access to be granted to the user (i.e., …teaches in par. 0023 the following: “granting user access…”), are configured to:
update a data structure that stores security access grant information to indicate that the user is recommended to be granted the security access (i.e. …teaches in par. 0054 the following: “upon review of the results comparison and recommendations made by event analytics access de-provision 300, reinstates user id access. Identity manager system 124 reactivates the user id and restores access to managed system 126.”),
wherein updating the data structure allows a notification to be provided to another device that is associated with another user (i.e., …teaches in par. 0042 the following: “provides a submission message to multiple user ids (e.g., resource owner, requester, managers) through combinations of the aforementioned notifications or through other notification methods not mentioned.” …teaches in par. 0043 the following: “provides an approved notification of the resource access request.”.),
which allows the other user to interact with the other device to cause the other device to update the data structure to indicate that the user is granted the security access (i.e., …teaches in par. 0026 the following: “Upon entering a valid user id and password, access to the system is granted (i.e., user id exists, authentication and authorization criteria are met, and assigned role grants access to restricted resource).”).
As to claims 6 and 13, the system of Choi and Djosic as applied to claim 1 above teaches access control, specifically Choi teaches a system of claim 1, wherein the one or more processors, to generate the certification information (i.e., …teaches in par. 0053 the following: “event analytics access de-provision 300 notifies the user and the resource owner of an account status change…”), are configured to:
determine, by processing the user behavior information using the second machine learning model, a user behavior classification (i.e., …teaches in par. 0049 the following: “, atypical activity refers to the actual recorded audit event activity for a user id not matching an expected defined activity for the user id. For example, an atypical activity may include one user id accessing managed system 126 once every six months to change a password while other user ids access managed system 126 daily.”);
and generate, based on the user behavior classification, the certification information (i.e.., …teaches in par. 0050 the following: “determines the access is atypical (decision 314, yes branch), event analytics access de-provision 300 continues to step 316. If event analytics access de-provision 300 determines the access is not atypical (decision 314, no branch), event analytics access de-provision 300 completes and user id roles remain unchanged.” …teaches in par. 0051 the following: “creates an access resource change request. Event analytics access de-provision 300 creates an access resource change request for the user id associated with the audit event. Event analytics access de-provision 300 includes the results of the comparison from decision 314 in the access resource change request for identity manager system 124. In some embodiments, event analytics access de-provision 300 may also include a recommended permanent action (e.g., change of user id role, remove access) to identity manager system 124.”),
wherein the certification information indicates that the security access is to be renewed when the user behavior classification indicates normal user behavior (i.e., ...teaches in par. 0054 the following: “the resource owner of identity manager system 124 performs manual actions in order for permanent role assignments to be implemented for the user id associated with the audit event. In one embodiment, the resource owner, upon review of the results comparison and recommendations made by event analytics access de-provision 300, reinstates user id access. Identity manager system 124 reactivates the user id and restores access to managed system 126. In another embodiment, the resource owner, upon review of the request and recommendations made by event analytics access de-provision 300, modifies the user id roles and assigns a new role based on the results comparison identifying a more similar role based on matching attributes.”),
and wherein the certification information indicates that the security access is to be revoked when the user behavior classification indicates not normal user behavior (i.e., …teaches in par. 0054 the following: “the resource owner, upon review of the request and recommendations made by event analytics access de-provision 300, revokes access to managed system 126. Identity manager system 124 removes the role associated with the user id, and the user id no longer has access to managed system 126.”).
As to claim 7, the system of Choi and Djosic as applied to claim 1 above teaches access control, specifically Choi teaches a system of claim 1, wherein the one or more processors, to generate the certification information (i.e., …teaches in par. 0053 the following: “event analytics access de-provision 300 notifies the user and the resource owner of an account status change…”), are configured to:
a temporal indicator of usage of the security access by the user (i.e., …teaches in par. 0052 the following: “identity manager system 124 temporarily automatically suspends access to managed system 126 for the user id associated with the audit event”);
and generate, based on the temporal indicator, the certification information, wherein the certification information indicates that the security access is to be renewed when the temporal indicator indicates recent usage of the security access by the user (i.e., …teaches in par. 0054 the following: “the resource owner of identity manager system 124 performs manual actions in order for permanent role assignments to be implemented for the user id associated with the audit event. In one embodiment, the resource owner, upon review of the results comparison and recommendations made by event analytics access de-provision 300, reinstates user id access. Identity manager system 124 reactivates the user id and restores access to managed system 126. In another embodiment, the resource owner, upon review of the request and recommendations made by event analytics access de-provision 300, modifies the user id roles and assigns a new role based on the results comparison identifying a more similar role based on matching attributes.”),
and wherein the certification information indicates that the security access is to be revoked when the temporal indicator indicates not recent usage of the security access by the user (i.e., …teaches in par. 0054 the following: “the resource owner, upon review of the request and recommendations made by event analytics access de-provision 300, revokes access to managed system 126. Identity manager system 124 removes the role associated with the user id, and the user id no longer has access to managed system 126.”).
The system of Choi does not expressly teach:
“determine, by processing the user behavior information using the second machine learning model”.
In this instance the examiner notes the teachings of prior art reference Djosic.
Djosic teaches as part of his claim 1 claim element(s) the following: “generate, prior to operations at an API gateway and using a first machine learning model, a first risk score representing an assessment associated with the API traffic; generate, at the API gateway and using a second machine learning model, a second risk score based on an assessment associated with the API traffic observed at the API gateway, the second risk score being a function of said first risk score and said assessment associated with the API traffic observed at the API gateway, said second risk score being greater than said first risk score; prior to continued transmission of the API traffic to the destination device, generate, by a third machine learning model, a third risk score representing an assessment of the API traffic at the destination device positioned subsequent to the API gateway, the third risk score being a function of said second risk score and said assessment of said API traffic at said destination device positioned subsequent to said API gateway, said third risk score being greater than said second risk score and said first risk score”.
Thus, it would have been obvious to one of ordinary skill in the art before the effective filing date of the of the claimed invention was made to implement the teachings of Choi with the teachings of Djosic by having their system comprise an enhanced access learning model process. One would have been motivated to do so to provide a simple and effective means to dynamically authenticate, wherein the enhanced access learning model process helps facilitate stronger access control within the network and makes it easier to configure network security parameters.
As to claim 8, the system of Choi and Djosic as applied to claim 1 above teaches access control, specifically Choi teaches a system of claim 1, wherein the one or more processors, to cause the security access to be revoked (i.e., …teaches in par. 0044 the following: “…revoking access), are configured to: update a data structure that stores security access grant information to indicate that the user is not granted the security access (i.e., …teaches in par. 0044 the following: “modifying existing user access (e.g., suspension of access, revoking access, changing roles) executing within the distributed data processing environment 100”).
As to claim 9, the system of Choi and Djosic as applied to claim 1 above teaches access control, specifically Choi teaches a system of claim 1, wherein the one or more processors, to cause the security access to be revoked (i.e., …teaches in par. 0044 the following: “…revoking access), are configured to: update a data structure that stores security access grant information to indicate that the user is not recommended to be granted the security access (i.e., …teaches in par. 0054 the following: “upon review of the request and recommendations made by event analytics access de-provision 300, revokes access to managed system 126. Identity manager system 124 removes the role associated with the user id, and the user id no longer has access to managed system 126.”),
wherein updating the data structure allows a notification to be provided to another device that is associated with another user (i.e., …teaches in par. 0042 the following: “provides a submission message to multiple user ids (e.g., resource owner, requester, managers) through combinations of the aforementioned notifications or through other notification methods not mentioned.” …teaches in par. 0043 the following: “provides an approved notification of the resource access request.”),
which allows the other user to interact with the other device to cause the other device to update the data structure to indicate that the user is not granted the security access (i.e., …teaches in par. 0054 the following: “upon review of the request and recommendations made by event analytics access de-provision 300, revokes access to managed system 126. Identity manager system 124 removes the role associated with the user id, and the user id no longer has access to managed system 126.”).
As to claim 12, the system of Choi and Djosic as applied to claim 10 above teaches access control, specifically Choi teaches a non-transitory computer-readable medium of claim 10, wherein the one or more instructions, to cause the security access to be granted to the user (i.e., …teaches in par. 0026 the following: “access to the system is granted (i.e., user id exists, authentication and authorization criteria are met, and assigned role grants access to restricted resource)”),
are cause the system: cause a data structure to be updated to indicate that the user is recommended to be granted the security access (i.e., …teaches in par. 0054 the following: “upon review of the results comparison and recommendations made by event analytics access de-provision 300, reinstates user id access.”),
wherein causing the data structure to be updated allows another device to update the data structure to indicate that the user is granted the security access (i.e., …teaches in par. 0054 the following: “upon review of the results comparison and recommendations made by event analytics access de-provision 300, reinstates user id access. Identity manager system 124 reactivates the user id and restores access to managed system 126. In another embodiment, the resource owner, upon review of the request and recommendations made by event analytics access de-provision 300, modifies the user id roles and assigns a new role based on the results comparison identifying a more similar role based on matching attributes.”).
As to claim 14, the system of Choi and Djosic as applied to claim 13 above teaches access control, specifically Choi teaches a non-transitory computer-readable medium of claim 13, wherein the certification information indicates that the security access is to be revoked when the user information indicates at least one: a behavior of the user is not normal user behavior, or a usage of the security access by the user is not a recent usage (i.e., …Applicant’s usage of the term “at least one of” places the above limitation in alternative form. As such with regards to applicant’s alternative limitation of, “a behavior of the user is not normal user behavior”, Choi taches in par. 0049 the following: “, event analytics access de-provision 300 determines if access is atypical. In one embodiment, atypical activity refers to the actual recorded audit event activity for a user id not matching an expected defined activity for the user id. For example, an atypical activity may include one user id accessing managed system 126 once every six months to change a password while other user ids access managed system 126 daily. In another embodiment, atypical activity refers to a user id utilizing managed system 126 in a manner in violation of the policy rules. ...teaches in par. 0044 the following: “event analytics access de-provision 300 for evaluating and modifying existing user access (e.g., suspension of access, revoking access, changing roles) executing within the distributed data processing environment”).
As to claim 15, the system of Choi and Djosic as applied to claim 10 above teaches access control, specifically Choi teaches a non-transitory computer-readable medium of claim 10, wherein the one or more instructions, to cause the security access to be revoked (i.e., …teaches in par. 0044 the following: “event analytics access de-provision 300 for evaluating and modifying existing user access (e.g., suspension of access, revoking access, changing roles) executing within the distributed data processing environment”),
cause the system: cause a data structure to be updated to indicate that the user is not granted the security access (i.e., …teaches in par. 0051 the following: “event analytics access de-provision 300 may also include a recommended permanent action (e.g., change of user id role, remove access) to identity manager system 124.”).
As to claim 16, the system of Choi and Djosic as applied to claim 10 above teaches access control, specifically Choi teaches a non-transitory computer-readable medium of claim 10, wherein the one or more instructions, to cause the security access to be revoked (i.e., …teaches in par. 0044 the following: “event analytics access de-provision 300 for evaluating and modifying existing user access (e.g., suspension of access, revoking access, changing roles) executing within the distributed data processing environment”), cause the system: cause a data structure to be updated to indicate that the user is not recommended to be granted the security access (i.e., …teaches in par. 0051 the following: “event analytics access de-provision 300 may also include a recommended permanent action (e.g., change of user id role, remove access) to identity manager system 124.”),
wherein causing the data structure to be updated allows another device to update the data structure to indicate that the user is not granted the security access (i.e., …teaches in par. 0043 the following: “Identity manager system 124 updates the user id with the revised role assignment.” …teaches in par. 0054 the following: “the resource owner, upon review of the request and recommendations made by event analytics access de-provision 300, revokes access to managed system 126. Identity manager system 124 removes the role associated with the user id, and the user id no longer has access to managed system 126.”.).
As to claim 17, Choi teaches a method, comprising:
certification information that indicates whether a security access granted to a user is to be renewed or revoked (i.e., …teaches in par. 0053 the following: “event analytics access de-provision 300 notifies the user and the resource owner of an account status change…”. …teaches in par. 0054 the following: “the resource owner, upon review of the results comparison and recommendations made by event analytics access de-provision 300, reinstates user id access.” …teaches in par. 0052 the following: “event analytics access de-provision 300 provides identity manager system 124 with an instruction to suspend access of a specific user (i.e., changes user id access authorization to suspended status) pending resource owner action. In one embodiment, in response to receipt of the suspension order, identity manager system 124 temporarily automatically suspends access to managed system 126 for the user id associated with the audit event.” …teaches in par. 0054 the following: “and recommendations made by event analytics access de-provision 300, revokes access to managed system 126. Identity manager system 124 removes the role associated with the user id, and the user id no longer has access to managed system 126.”);
and causing, by the system and based on the certification information, one of: the security access to be renewed when the certification information indicates that the security access is to be renewed (i.e., …teaches in par. 0054 the following: “the resource owner, upon review of the results comparison and recommendations made by event analytics access de-provision 300, reinstates user id access.” ), or the security access to be revoked when the certification information indicates that the security access is to be revoked (i.e., …teaches in par. 0052 the following: “event analytics access de-provision 300 provides identity manager system 124 with an instruction to suspend access of a specific user (i.e., changes user id access authorization to suspended status) pending resource owner action. In one embodiment, in response to receipt of the suspension order, identity manager system 124 temporarily automatically suspends access to managed system 126 for the user id associated with the audit event.” …teaches in par. 0054 the following: “and recommendations made by event analytics access de-provision 300, revokes access to managed system 126. Identity manager system 124 removes the role associated with the user id, and the user id no longer has access to managed system 126.”).
The system of Choi does not expressly teach:
determining, by a first machine learning model, that a user is to be granted a security access;
generating, by a system for using artificial intelligence to facilitate security access management, and by using at least one additional machine learning model that is distinct from the first machine learning model,
wherein the at least one additional machine learning model is used after the security access has been granted, and is configured to analyze post-grant user behavior information to determine whether continued access is appropriate.
In this instance the examiner notes the teachings of prior art reference Djosic.
With regards to applicant’s claim limitation element of “determining, by a first machine learning model, that a user is to be granted a security access”, Djosic teaches as part of his claim 1 claim element(s) the following: “generate, prior to operations at an API gateway and using a first machine learning model, a first risk score representing an assessment associated with the API traffic; generate, at the API gateway and using a second machine learning model, a second risk score based on an assessment associated with the API traffic observed at the API gateway, the second risk score being a function of said first risk score and said assessment associated with the API traffic observed at the API gateway, said second risk score being greater than said first risk score; prior to continued transmission of the API traffic to the destination device, generate, by a third machine learning model, a third risk score representing an assessment of the API traffic at the destination device positioned subsequent to the API gateway, the third risk score being a function of said second risk score and said assessment of said API traffic at said destination device positioned subsequent to said API gateway, said third risk score being greater than said second risk score and said first risk score”.
With regards to applicant’s claim limitation element of “generating, by a system for using artificial intelligence to facilitate security access management, and by using at least one additional machine learning model that is distinct from the first machine learning model”, Djosic teaches as part of his claim 1 claim limitation elements the following: “and perform an authorization action enabling transmission of the API traffic between the user device and the destination device based on any of the first, second or third risk scores, wherein to perform the authorization action the at least one processor is configured to one of: allow the API traffic; block the API traffic; send a security alert; or require an authorization credentials check from a user device associated with the API traffic.”.
With regards to applicant’s claim limitation element of “wherein the at least one additional machine learning model is used after the security access has been granted, and is configured to analyze post-grant user behavior information to determine whether continued access is appropriate”, Djosic teaches as part of his claim 1 claim element(s) the following: “generate, prior to operations at an API gateway and using a first machine learning model, a first risk score representing an assessment associated with the API traffic; generate, at the API gateway and using a second machine learning model, a second risk score based on an assessment associated with the API traffic observed at the API gateway, the second risk score being a function of said first risk score and said assessment associated with the API traffic observed at the API gateway, said second risk score being greater than said first risk score; prior to continued transmission of the API traffic to the destination device, generate, by a third machine learning model, a third risk score representing an assessment of the API traffic at the destination device positioned subsequent to the API gateway, the third risk score being a function of said second risk score and said assessment of said API traffic at said destination device positioned subsequent to said API gateway, said third risk score being greater than said second risk score and said first risk score”.
Thus, it would have been obvious to one of ordinary skill in the art before the effective filing date of the of the claimed invention was made to implement the teachings of Choi with the teachings of Djosic by having their system comprise an enhanced access learning model process. One would have been motivated to do so to provide a simple and effective means to dynamically authenticate, wherein the enhanced access learning model process helps facilitate stronger access control within the network and makes it easier to configure network security parameters.
As to claim 18, the system of Choi and Djosic as applied to claim 17 above teaches access control, specifically Choi teaches a method of claim 17, further comprising:
and causing, based on determining that the user is to be granted the security access, the security access to be granted to the user (i.e., …teaches in par. 0026 the following: “For example, an existing user id requests access to managed system 126. Upon entering a valid user id and password, access to the system is granted (i.e., user id exists, authentication and authorization criteria are met, and assigned role grants access to restricted resource).”).
As to claim 19, the system of Choi and Djosic as applied to claim 17 above teaches access control, specifically Choi teaches a method of claim 17, wherein generating the certification information comprises: and generating, based on the user information (i.e., …Choi teaches as part of his claim 5 limitation(s) the following: “determining, by one or more computer processors, whether the access activity for the first user id is atypical; and in response to determining the access activity for the first user id is atypical, recommending, by one or more computer processors, at least suspending access for the first user id to a resource”), the certification information (i.e., …teaches in par. 0053 the following: “event analytics access de-provision 300 notifies the user and the resource owner of an account status change…”).
Choi does not expressly teach:
“determining, using the at least one additional machine learning model, user information”.
In this instance the examiner notes the teachings of prior art reference Djosic.
Djosic teaches as part of his claim 1 claim element(s) the following: “generate, prior to operations at an API gateway and using a first machine learning model, a first risk score representing an assessment associated with the API traffic; generate, at the API gateway and using a second machine learning model, a second risk score based on an assessment associated with the API traffic observed at the API gateway, the second risk score being a function of said first risk score and said assessment associated with the API traffic observed at the API gateway, said second risk score being greater than said first risk score; prior to continued transmission of the API traffic to the destination device, generate, by a third machine learning model, a third risk score representing an assessment of the API traffic at the destination device positioned subsequent to the API gateway, the third risk score being a function of said second risk score and said assessment of said API traffic at said destination device positioned subsequent to said API gateway, said third risk score being greater than said second risk score and said first risk score”.
Thus, it would have been obvious to one of ordinary skill in the art before the effective filing date of the of the claimed invention was made to implement the teachings of Choi with the teachings of Djosic by having their system comprise an enhanced access learning model process. One would have been motivated to do so to provide a simple and effective means to dynamically authenticate, wherein the enhanced access learning model process helps facilitate stronger access control within the network and makes it easier to configure network security parameters.
As to claim 20, the system of Choi and Djosic as applied to claim 19 above teaches access control, specifically Choi teaches a method of claim 19, wherein the certification information indicates that the security access is to be revoked when the user information indicates that at least one of: a behavior of the user is not normal user behavior, a usage of the security access by the user is not a recent usage, or the user does not continue to need grant of the security access (i.e., …Applicant’s usage of the term “at least one of” places the above limitation in alternative form. As such with regards to applicant’s alternative limitation of, “a behavior of the user is not normal user behavior”, Choi taches in par. 0049 the following: “, event analytics access de-provision 300 determines if access is atypical. In one embodiment, atypical activity refers to the actual recorded audit event activity for a user id not matching an expected defined activity for the user id. For example, an atypical activity may include one user id accessing managed system 126 once every six months to change a password while other user ids access managed system 126 daily. In another embodiment, atypical activity refers to a user id utilizing managed system 126 in a manner in violation of the policy rules. ...teaches in par. 0044 the following: “event analytics access de-provision 300 for evaluating and modifying existing user access (e.g., suspension of access, revoking access, changing roles) executing within the distributed data processing environment”).
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Contact Information
Any inquiry concerning this communication or earlier communications from the examiner should be directed to BRYAN F WRIGHT whose telephone number is (571)270-3826.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Eleni Shiferaw can be reached on (571)272-3867. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/BRYAN F WRIGHT/Examiner, Art Unit 2497
Prosecution Insights