DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
General Remarks
This communication is considered fully responsive to Applicant’s response filed 02/06/2026.
Application filed: 12/12/2023
Applicant’s PgPUB: 2025/0193198
Claims:
Claims 1, 3-17, 19-21 and 23 are pending.
Claims 1, 8 and 15 are independent.
Claims 2, 18 and 22 are canceled.
Claim 23 is new.
IDS:
Previous IDS:
IDS filed 12/12/2023 has been considered.
Response to Arguments
Applicant’s arguments, see Applicant’s response, filed 02/06/2026, with respect to the rejection(s) of claim(s) 1, 3-17, 19-21 and 23 under 35 U.S.C. 103 have been fully considered and are persuasive to overcome the prior rejection. However, upon further consideration, a new ground(s) of rejection is made in view of U.S. Patent Application Publication No. 2013/0036200 A1 to .
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent may not be obtained though the invention is not identically disclosed or described as set forth in section 102 of this title, if the differences between the subject matter sought to be patented and the prior art are such that the subject matter as a whole would have been obvious at the time the invention was made to a person having ordinary skill in the art to which said subject matter pertains. Patentability shall not be negatived by the manner in which the invention was made.
Claims 1, 5-8, 15, 16, 20 and 23 are rejected under 35 U.S.C. 103 as being unpatentable over U.S. Patent Application Publication No. 2022/0385668 A1 to Simonetti et al. (“Simonetti”) in view of U.S. Patent Application Publication No. 2021/0240839 A1 to Tsirkin et al. (“Tsirkin”) in further view of U.S. Patent Application Publication No. 2013/0036200 A1 to Roberts et al. (“Roberts”).
As to claim 1, Simonetti discloses:
a system for resource access security, the system comprising:
one or more memories (Fig. 1, Memory, 143 of Simonetti); and
one or more processors, communicatively coupled to the one or more memories (Fig. 1, Processor, 141 of Simonetti), configured to:
obtain a plurality of identifiers of a plurality of entities (Fig. 1; ¶0024 – Simonetti teaches IAM system 131 can receive a request 119 for access to system resources 133 from entities (i.e., plurality of entities) in enterprise system 110 such as principal 111. Principal 111 can be a user 116, a role 113, a machine 115, or an application 151.);
obtain one or more indications of a plurality of resources (Fig. 1, 133, System Resources; ¶0025 of Simonetti);
obtain one or more indications of one or more access policies that control access to the plurality of resources by the plurality of entities (Fig. 1, Governance Guidelines, Policy Database, 112, Policies, 113);
determine, based at least in part on the plurality of identifiers, the plurality of resources, or the one or more access policies, that the one or more access policies permit access to a resource, of the plurality of resources, by a first entity of the plurality of entities (Fig. 1, Computing Device, 140), via at least a second entity (Enterprise system, 110; IAM system, 131) of the plurality of entities (¶0015 – Simonetti teaches IAM systems can provide access control to system resources by a role on a per-request basis; ¶0024 – Simonetti teaches Cloud computing system 130 can include IAM system 131, which can manage system resources 133. IAM system 131 can receive a request 119 for access to system resources 133 from entities in enterprise system 110 such as entity 111. Entity 111 can be resource objects to be used for authentication to access an account of IAM system 131, e.g., an account. IAM system 131 can include a plurality of data storage systems for storing system resources 133 to be accessed by enterprise system 110.); and
perform, based at least in part on determining that the one or more access policies permit access to the resource by the first entity via at least the second entity, a security action associated with the resource (Fig. 1, Set of security rules, 124; ¶0024, ¶0028 – Simonetti teaches Cloud computing system 130 can include IAM system 131, which can manage system resources 133. IAM system 131 can receive a request 119 for access to system resources 133 from entities in enterprise system 110 such as entity 111. Entity 111 can be resource objects to be used for authentication to access an account of IAM system 131, e.g., an account. IAM system 131 can include a plurality of data storage systems for storing system resources 133 to be accessed by enterprise system 110.).
Tsirkin discloses what Simonetti does not expressly disclose.
Tsirkin discloses:
wherein the one or more processors are further configured to:
obtain a plurality of access logs, wherein the one or more processors, to perform the security action (¶0037, ¶0044, ¶0059 – Tsirkin teaches recognition of unauthorized access to logs and then removing that access and/or denying other subsequent access requests), are configured to:
remove, based on the plurality of access logs, access to the resource by the first entity via at least the second entity (¶0037, ¶0044, ¶0059 – Tsirkin teaches recognition of unauthorized access to logs and then removing that access and/or denying other subsequent access requests).
Simonetti and Tsirkin are analogous arts because they are from the same field of endeavor with respect to network resource access.
Before the effective filing date, it would have been obvious to a person of ordinary skill in the art to incorporate modifications of access and log usage as discussed in Tsirkin with a system for resource access security as discussed in Simonetti by adding the functionality of Tsirkin to the system/method of Simonetti in order to use logs to determine unauthorized access (Tsirkin, ¶0037).
Roberts discloses what Simonetti and Tsirkin do not expressly disclose.
Roberts discloses:
where the first entity has a first level of access to the resource and the second entity has a second level of access to the resource (Fig. 2, Fig. 3, Fig. 8, Abstract – Roberts teaches use of a primary access device (i.e., PAD) and a secondary access device (i.e., SAD). The PAD gets a resource (i.e., media content) and is able to deliver that content to a SAD). The PAD has direct access (i.e, second level access) and the SAD has indirect access via the SAD (i.e., first level access)).
Simonetti, Tsirkin and Roberts are analogous arts because they are from the same field of endeavor with respect to network resource access.
Before the effective filing date, it would have been obvious to a person of ordinary skill in the art to incorporate direct and indirect resource access as discussed in Roberts with modifications of access and log usage as discussed in Tsirkin with a system for resource access security as discussed in Simonetti by adding the functionality of Roberts to the system/method of Simonetti and Tsirkin in order to tailor content to a particular device (Roberts, ¶0001, ¶0002).
As to claim 5, Simonetti, Tsirkin and Roberts discloses:
system of claim 1, and
Simonetti discloses:
wherein the plurality of entities, the plurality of resources, and the one or more access policies are associated with an enterprise (Fig. 1 of Simonetti), and wherein the one or more processors, to obtain the plurality of identifiers, the one or more indications of the plurality of resources, and the one or more indications of the one or more access policies, are configured to:
obtain the plurality of identifiers, the one or more indications of the plurality of resources, and the one or more indications of the one or more access policies from one or more data sources associated with the enterprise (¶0128 – Simonetti teaches the security policies, e.g., policy 113a, policy 113b, or policy 113c, can generate an effective policy 123 for role 113, which can define a set of effective access permissions 125 by role 113 to access system resources 133.).
As to claim 6, Simonetti, Tsirkin and Roberts discloses:
system of claim 1, and
Simonetti discloses:
wherein each entity, of the plurality of entities, is associated with a user, a server, or a system account (Fig. 1, Entity, 11; Role, 113; Machine, 115; User 116, Role, 151 of Simonetti).
As to claim 7, Simonetti, Tsirkin and Roberts discloses:
system of claim 1, and
Simonetti discloses:
wherein each resource, of the plurality of resources, is associated with an application or a data store (Fig. 1, System resource, 133; ¶0025 of Simonetti).
As to claim 8, Simonetti discloses:
a method of resource access security, comprising:
obtaining a plurality of identifiers of a plurality of entities (Fig. 1; ¶0024 – Simonetti teaches IAM system 131 can receive a request 119 for access to system resources 133 from entities (i.e., plurality of entities) in enterprise system 110 such as principal 111. Principal 111 can be a user 116, a role 113, a machine 115, or an application 151.);
obtaining one or more indications of a plurality of resources (Fig. 1, 133, System Resources; ¶0025 of Simonetti);
obtaining one or more indications of one or more access policies that control access to the plurality of resources by the plurality of entities (Fig. 1, Governance Guidelines, Policy Database, 112, Policies, 113);
determining, based at least in part on the plurality of identifiers, the plurality of resources, or the one or more access policies, that the one or more access policies permit access to a resource, of the plurality of resources, by a first entity of the plurality of entities (Fig. 1, Computing Device, 140), via at least a second entity (Enterprise system, 110; IAM system, 131) of the plurality of entities (¶0015 – Simonetti teaches IAM systems can provide access control to system resources by a role on a per-request basis; ¶0024 – Simonetti teaches Cloud computing system 130 can include IAM system 131, which can manage system resources 133. IAM system 131 can receive a request 119 for access to system resources 133 from entities in enterprise system 110 such as entity 111. Entity 111 can be resource objects to be used for authentication to access an account of IAM system 131, e.g., an account. IAM system 131 can include a plurality of data storage systems for storing system resources 133 to be accessed by enterprise system 110.); and
performing, based at least in part on determining that the one or more access policies permit access to the resource by the first entity via at least the second entity, a security action associated with the resource (¶0029 – Simonetti teaches Role 113 and its compliance status 153 can be displayed on GUI; ¶0092 – Simonetti teaches compare a permissible scope of the name for the system resource defined by a set of security rules with the scope of the name for the system resource to generate a first comparison result, and compare a permissible scope of the name for the role defined by the set of security rules with the scope of the name of the role to generate a second comparison result; and display on a graphical user interface (GUI), the first role and a first compliance status with respect to the set of security rules, and the second role and a second compliance status with respect to the set of security rules,),
displaying a graphical representation associated with access to the resource by the first entity (¶0029 – Simonetti teaches Role 113 and its compliance status 153 can be displayed on GUI; ¶0092 – Simonetti teaches compare a permissible scope of the name for the system resource defined by a set of security rules with the scope of the name for the system resource to generate a first comparison result, and compare a permissible scope of the name for the role defined by the set of security rules with the scope of the name of the role to generate a second comparison result; and display on a graphical user interface (GUI), the first role and a first compliance status with respect to the set of security rules, and the second role and a second compliance status with respect to the set of security rules,); and
Tsirkin discloses what Simonetti does not expressly disclose.
Tsirkin discloses:
obtaining a plurality of access logs (¶0037, ¶0044, ¶0059 – Tsirkin teaches recognition of unauthorized access to logs and then removing that access and/or denying other subsequent access requests); and
wherein performing the security action comprises:
removing, based on the plurality of access logs, access to the resource by the first entity via at least the second entity (¶0037, ¶0044, ¶0059 – Tsirkin teaches recognition of unauthorized access to logs and then removing that access and/or denying other subsequent access requests).
The suggestion/motivation and obviousness rejection is the same as in claim 1.
Roberts discloses what Simonetti and Tsirkin do not expressly disclose.
Roberts discloses:
where the first entity has a first level of access to the resource and the second entity has a second level of access to the resource (Fig. 2, Fig. 3, Fig. 8, Abstract – Roberts teaches use of a primary access device (i.e., PAD) and a secondary access device (i.e., SAD). The PAD gets a resource (i.e., media content) and is able to deliver that content to a SAD). The PAD has direct access (i.e, second level access) and the SAD has indirect access via the SAD (i.e., first level access)).
The suggestion/motivation and obviousness rejection is the same as in claim 1.
As to claim 15, similar rejection as to claim 1.
As to claim 16, Simonetti, Tsirkin and Roberts discloses:
non-transitory computer-readable medium of claim 15, and
Simonetti discloses:
wherein the one or more instructions further cause the resource access security system to:
displaying, based at least in part on determining that the one or more access policies permit access to the resource by the first entity via at least the second entity, a graphical representation associated with the access to the resource by the first entity (¶0029 – Simonetti teaches Role 113 and its compliance status 153 can be displayed on GUI; ¶0092 – Simonetti teaches compare a permissible scope of the name for the system resource defined by a set of security rules with the scope of the name for the system resource to generate a first comparison result, and compare a permissible scope of the name for the role defined by the set of security rules with the scope of the name of the role to generate a second comparison result; and display on a graphical user interface (GUI), the first role and a first compliance status with respect to the set of security rules, and the second role and a second compliance status with respect to the set of security rules,).
As to claim 20, similar rejection as to claim 5.
As to claim 23, Simonetti, Tsirkin and Roberts discloses:
system of claim 1, and
Roberts discloses:
wherein the first entity accesses the resources based on using a layered access path via at least the second entity (Fig. 2, Fig. 3, Fig. 8, Abstract – Roberts teaches use of a primary access device (i.e., PAD) and a secondary access device (i.e., SAD). The PAD gets a resource (i.e., media content) and is able to deliver that content to a SAD). The PAD has direct access (i.e, second level access) and the SAD has indirect access via the SAD (i.e., first level access)). The suggestion/motivation and obviousness rejection is the same as in claim 1.
Claims 3, 4, 19, 21 and 22 are rejected under 35 U.S.C. 103 as being unpatentable over U.S. Patent Application Publication No. 2022/0385668 A1 to Simonetti et al. (“Simonetti”) in view of U.S. Patent Application Publication No. 2021/0240839 A1 to Tsirkin et al. (“Tsirkin”) in further view of U.S. Patent Application Publication No. 2013/0036200 A1 to Roberts et al. (“Roberts”) in further view of U.S. Patent Application Publication No. 2021/0160247 A1 to Gaddam et al. (“Gaddam”).
As to claim 3, Simonetti, Tsirkin and Roberts discloses:
system of claim 2, and
Gaddam discloses what Simonetti, Tsirkin and Roberts do not expressly disclose.
Gaddam discloses:
wherein the one or more processors, to remove the access to the resource by the first entity via at least the second entity, are configured to:
remove the access to the resource by the first entity via at least the second entity using machine learning (¶0027, ¶0038, ¶0058, ¶0059, ¶0091 – Gaddam teaches use of machine learning model to determine if access to a resource is legitimate and whether to deny the request or not.).
Simonetti, Tsirkin, Roberts and Gaddam are analogous arts because they are from the same field of endeavor with respect to network resource access.
Before the effective filing date, it would have been obvious to a person of ordinary skill in the art to incorporate machine learning and logs to adjust resource access as discussed in Gaddam with direct and indirect resource access as discussed in Roberts with modifications of access and log usage as discussed in Tsirkin with a system for resource access security as discussed in Simonetti by adding the functionality of Gaddam to the system/method of Simonetti, Tsirkin and Roberts in order to determine whether a request is legitimate (Gaddam, ¶0004).
As to claim 4, Simonetti, Tsirkin and Roberts discloses:
system of claim 1,
Gaddam discloses what Simonetti, Tsirkin and Roberts does not expressly disclose.
Gaddam discloses:
wherein the one or more processors,
to determine that the one or more access policies permit access to the resource by the first entity via at least the second entity, are configured to:
determine that the one or more access policies permit access to the resource by the first entity via at least the second entity and via at least a third entity of the plurality of entities (Fig. 1, Fig. 2, ¶0083, ¶0099 – Gaddam teaches accessing resources via the resource access system which can consist of one or more devices such as the resource access system, resource gateway and resource database (i.e., via second and third entities)). The suggestion/motivation and obviousness rejection is the same as in claim 3.
As to claim 19, similar rejection as to claim 4.
As to claim 21, Simonetti, Tsirkin and Roberts discloses:
system of claim 1,
Gaddam discloses what Simonetti, Tsirkin and Roberts does not expressly disclose.
Gaddam discloses:
wherein the security action is performed based on access patterns (Fig. 3, ¶0113 – Gaddam teaches that incoming data can comprise data used by the policy engine in order to inform the selection of a resource access policy. This can include raw or processed request data included or associated with the request to access the resource. It can also include other data generated, such as other features of the feature vector correspond to a different entity profile (such as behavior patterns that correspond to entity B). The incoming data 302 could comprise some message or indication generated by the entity determination element that entity B may be using the credential of entity A in order to access resources.).
As to claim 22, similar rejection as to claim 21.
Claims 9-14 and 18 are rejected under 35 U.S.C. 103 as being unpatentable over U.S. Patent Application Publication No. 2022/0385668 A1 to Simonetti et al. (“Simonetti”) in view of U.S. Patent Application Publication No. 2021/0240839 A1 to Tsirkin et al. (“Tsirkin”) in further view of U.S. Patent Application Publication No. 2013/0036200 A1 to Roberts et al. (“Roberts”) in further view of U.S. Patent Application Publication No. 2025/0039184 A1 to Zhang et al. (“Zhang”).
As to claim 9, Simonetti, Tsirkin and Roberts discloses:
method of claim 8,
Zhang discloses what Simonetti, Tsirkin and Roberts does not expressly disclose.
Zhang discloses:
wherein displaying the graphical representation includes displaying at least a first node associated with the resource, a second node associated with the first entity, and an edge associated with the access to the resource by the first entity (Fig. 9, ¶0107 – Zhang teaches nodes 902 represent compute resources and nodes 904 represent storage resources. Illustratively, the storage resources include data stores or buckets within a particular cloud service. Nodes 906 represent roles and/or users. The links (e.g., access paths) or edges 908 between nodes 902 and 906 represent that compute resources that can access the particular roles represented by nodes 906. The edges or links 910 represent the storage resources that can be accessed by the particular roles or users represented by nodes 906.).
Simonetti, Tsirkin, Roberts and Zhang are analogous arts because they are from the same field of endeavor with respect to network resource access.
Before the effective filing date, it would have been obvious to a person of ordinary skill in the art to incorporate data displays as discussed in Zhang with a direct and indirect resource access as discussed in Roberts with modifications of access and log usage as discussed in Tsirkin with a system for resource access security as discussed in Simonetti by adding the functionality of Zhang to the system/method of Simonetti, Tsirkin and Roberts in order to demonstrate how relationship information can be displayed to user.
As to claim 10, Simonetti, Tsirkin, Roberts and Zhang discloses:
method of claim 9, and
Zhang discloses:
wherein displaying the graphical representation further includes displaying a third node associated with the second entity, and wherein displaying the edge includes displaying a first edge associated with the first node and the third node (Fig. 9, ¶0107of Zhang), the method further comprising:
displaying a second edge associated with the third node and the second node (Fig. 9, ¶0107 of Zhang). The suggestion/motivation and obviousness rejection is the same as in claim 9.
As to claim 11, Simonetti, Tsirkin, Roberts and Zhang discloses:
method of claim 9, and
Zhang discloses:
wherein displaying the graphical representation includes displaying:
a plurality of second nodes, including the second node, wherein the plurality of second nodes is associated with a plurality of first entities of the plurality of entities, and wherein the plurality of first entities includes the first entity (Fig. 9, ¶0107of Zhang), and
a plurality of edges, including the edge, associated with access to the resource by the plurality of first entities (Fig. 9, ¶0107of Zhang). The suggestion/motivation and obviousness rejection is the same as in claim 9.
As to claim 12, Simonetti, Tsirkin, Roberts and Zhang discloses:
method of claim 9, and
Zhang discloses:
wherein displaying the graphical representation includes displaying:
a plurality of first nodes, including the first node, wherein the plurality of first nodes is associated with the plurality of resources (Fig. 9, ¶0107of Zhang),
the second node (Fig. 9, ¶0107of Zhang), and
a plurality of edges, including the edge, associated with access to the plurality of resources by the first entity (Fig. 9, ¶0107of Zhang). The suggestion/motivation and obviousness rejection is the same as in claim 9.
As to claim 13, Simonetti, Tsirkin and Roberts discloses:
method of claim 8,
Zhang discloses what Simonetti, Tsirkin and Roberts does not expressly disclose.
Zhang discloses:
wherein displaying the graphical representation includes displaying an indication that the first entity is associated with a user, a server, or a system account (Fig. 9, ¶0107 of Zhang). The suggestion/motivation and obviousness rejection is the same as in claim 9.
As to claim 14, Simonetti, Tsirkin and Roberts discloses:
method of claim 8,
Zhang discloses what Simonetti, Tsirkin and Roberts does not expressly disclose.
Zhang discloses:
wherein displaying the graphical representation includes displaying an indication that the resource is associated with an application or a data store (Fig. 9, ¶0107 of Zhang). The suggestion/motivation and obviousness rejection is the same as in claim 9.
As to claim 17, similar rejection as to claim 9.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to TAYLOR A ELFERVIG whose telephone number is (571)270-5687. The examiner can normally be reached Monday (10:00 AM CST) - Friday (4:00 PM CST).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Oscar Louie can be reached at (571) 270-1684. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/TAYLOR A ELFERVIG/Primary Examiner, Art Unit 2445