Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendment
The following is a FINAL Office action in reply to the Amendments and Arguments received on August 14, 2026.
Status of Claims
Claims 1, 3-5, 10-12, 14-17, and 20-21 have been amended.
Claims 1-21 are currently pending and have been examined.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-21 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1:
Claims 1-14 and 21are drawn to methods while claim(s) 15-20 is/are drawn to an apparatus. As such, claims 1-21 are drawn to one of the statutory categories of invention (Step 1: YES).
Step 2A - Prong One:
Claim 1 (representative of independent claim(s) 15 and 21) recites the following steps:
receiving policy information relating to an entity, the policy information including information associated with a plurality of controls for implementing policies of the entity;
extracting the plurality of controls from the policy information;
identifying, a first plurality of controls from the plurality of controls which by the entity is responsible for configuring to perform a first type of task relating to the policy information,
identifying a second plurality of controls from the plurality of controls which the service provider is responsible for configuring to perform a second type of task relating to the policy information, different from the first type of task;
based on the identifying of the first plurality of controls and the identifying of the second plurality of controls, assigning the first plurality of controls from the plurality of controls configurable by the entity and the second plurality of controls from the plurality of controls configurable by the service provider;
providing, for presentation a user associated with the entity, one or more of the first plurality of controls to implement the policies of the entity:
receiving, information configuring one or more of the first plurality of controls to set at least one of permission or privilege rights associated with the entity:
applying, the one or more of the first plurality of controls to perform an entity management task; and
applying, one or more of the second plurality of controls, to perform a network security task to ensure the entity complies with one or more network security compliance requirements to prevent or reduce security risks..
These steps, under its broadest reasonable interpretation, encompass a human manually (e.g., in their mind, or using paper and pen) recommend controls by implementing policies of the entity and controls (i.e., one or more concepts performed in the human mind, such as one or more observations, evaluations, judgments, opinions), but for the recitation of generic computer components. If one or more claim limitations, under their broadest reasonable interpretation, covers performance of the limitation(s) in the mind but for the recitation of generic computer components, then it falls within the "mental processes" subject matter grouping of abstract ideas.
As such, the Examiner concludes that claim 1 recites an abstract idea (Step 2A - Prong One: YES).
Independent claim(s) 15 and 21 are determined to recite an abstract idea under the same analysis.
Step 2A - Prong Two:
This judicial exception is not integrated into a practical application. The claim(s) recite the additional elements/limitations of:
one or more computing devices of an information management system,
a machine learning resource associated with the one or more computing devices,
machine learning resource,
associated with the information management system
via a user computing device
a user interface screen comprising user interface elements
by the one or more computing devices, via an input to one or more of the user interface elements
one or more computing devices,
configured via the input to the one or more user interface elements,
A server computing system, comprising: one or more processors; and one or more non-transitory computer-readable media that store instructions that, when executed by the one or more processors, cause the server computing system to perform operations,
server computing system,
a controls database
The requirement to execute the claimed steps/functions listed above is equivalent to adding the words ''apply it'' on a generic computer and/or mere instructions to implement the abstract idea on a generic computer. This/these limitation(s) do/does not impose any meaningful limits on producing the abstract idea and therefore do/does not integrate the abstract idea into a practical application (see MPEP 2106.05(f)).
Additionally, “Step 2A - Prong 2”, the recited additional element(s) of “configure one or more computing infrastructure devices of the service provider" and “wherein the machine learning resource is trained to classify controls according to a responsibility as to whether the controls are to be configured by a service provider associated with the information management system, by the entity, by an authorized third party, or in a shared manner” and “configured via the input to the one or more user interface elements,” serve merely to generally link the use of the judicial exception to a particular technological environment or field of use. These limitations therefore do not integrate the abstract idea into a practical application (see MPEP 2106.05(h)).
Step 2B:
The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception.
As discussed above in "Step 2A - Prong 2", the requirement to execute the claimed steps/functions listed above is equivalent to adding the words "apply it" on a generic computer and/or mere instructions to implement the abstract idea on a generic computer. These limitations therefore do not qualify as "significantly more" (see MPEP 2106.05 (f)).
As discussed above in “Step 2A - Prong 2”, the recited additional element(s) of ”configure one or more computing infrastructure devices of the service provider” and “wherein the machine learning resource is trained to classify controls according to a responsibility as to whether the controls are to be configured by a service provider associated with the information management system, by the entity, by an authorized third party, or in a shared manner” and “configured via the input to the one or more user interface elements,” serves merely to generally link the use of the judicial exception to a particular technological environment or field of use. These limitations therefore do not qualify as “significantly more5' (see MPEP 2106.05(g, h)).
The Examiner has therefore determined that no additional element, or combination of additional claims elements is/are sufficient to ensure the claim(s) amount to significantly more than the abstract idea identified above (Step 2B: NO).
Regarding Dependent Claims:
Dependent claims 2-4, 9 and 16 and fail to include any additional elements and are further part of the abstract idea as identified by the Examiner.
Dependent claims 5-8, 10-14 and 17-20 include additional limitations that are part of the abstract idea except for:
via the machine learning resource
a controls database
computing assets
by the one or more computing devices
one or more computing infrastructure devices
a term frequency-inverse document frequency method
The additional elements of the dependent claims are equivalent to adding the words ''apply it'' on a generic computer and/or mere instructions to implement the abstract idea on a generic computer, as well as serving to merely generally link the use of the judicial exception to a particular technological environment or field of use, . Even in combination, these additional elements do not integrate the abstract idea into a practical application and do not amount to significantly more than the abstract idea itself. The claims are ineligible.
Response to Arguments
Applicant's arguments with respect to the rejection under 35 USC 101 have been fully considered but they are not persuasive.
Applicant Argues: "Claims do not recite a mental process when they do not contain limitations that can practically be performed in the human mind, for instance when the human mind is not equipped to perform the claim limitations." MPEP 2106. Here, the claims recite using a machine learning resource to identify and assign the first and second plurality of controls from policy information, providing a user interface screen for configuring the first plurality of controls, configuring the first plurality of controls to set permission and/or
privilege rights associated with the entity and applying the second plurality of controls to configure computing infrastructure devices. For example, a human cannot mentally set permission or privilege rights associated with an entity or configure computing infrastructure devices.
Examiner respectfully disagrees. The Examiner notes that “[c]laims can recite a mental process even if they are claimed as being performed on a computer,” and that “courts have found requiring a generic computer or nominally reciting a generic computer may still recite a mental process even though the claim limitations are not performed entirely in the human mind” (see p. 8 of the October 2019 Update: Subject Matter Eligibility). The Examiner also notes that “both product claims (e.g., computer system, computer-readable medium, etc.) and process claims may recite mental processes (see p. 8 of the October 2019 Update: Subject Matter Eligibility).
Here the claims recite steps that are merely executed using the machine. The human can parse a document to identify and later assign controls from policy information. The human can provide input to the machine that controls access, and therefore there is no technical improvement nor is it significantly more than the abstract idea itself.
Applicant Argues: Independent claim 1 is directed to an improvement in the technology of information
management systems, network security, and the efficient use of computing resources such as computing infrastructure devices (e.g., purpose-built chips, purpose-built servers, purpose built networks, purpose-built data centers).
Examiner respectfully disagrees. The Examiner notes that this claim of an improvement to the technology is not representative of an "actual" improvement to the technology itself, but at best is an improvement to the business method or abstract idea itself. Applicant can provide no tangible findings that there was actually anything different and/or improved in the instant system compared to prior "conventional systems", other than a mere allegation and unsubstantiated, conclusory statement that the instant invention improves existing systems. However, the Examiner respectfully notes that the features of the claimed invention does not represent an improvement, it is merely performing operations with a device (machine learning resource). The Applicant cannot point to anything that was specifically done either in the claimed subject matter, the specification, or provided reasoning to show how this is significantly more or provides an improvement to the technology of the conventional system implementation. Moreover, the Examiner respectfully notes that the needed "improvement" in terms of patent eligibility is not one resulting from programming a generic processor or machine learning resource to perform a different (or even improved) function, but rather a specific and actual improvement to the machine itself is needed. Based on these findings of fact, the Examiner contends the claims are indeed directed towards an abstract idea and Applicant's arguments to the contrary are considered to be non-persuasive.
The claims at issue extract information using the broadly cited machine learning resource, and identifies controls and provides a way for a user to select if they want to configure the controls. The claims merely represent mere instructions to implement an abstract idea on a computer.
Applicant Argues: The Specification discloses machine learning resources that extract controls from policy information which "greatly reduces the time currently required to perform such processes (e.g., from a few weeks to less than a few minutes)" and "increase[s] an accuracy and detection of controls which may be missed."
Examiner has not found support for Applicant’s claims of an improvement to the system. The Specification fails to clearly evidence how the use of a machine learning model being trained to extract controls from policy information is an actual technological improvement over, or differs from, the expected general concept of applying the ML resource. It is unclear how the ML resource is being integrated in any specialized manner that serves any specialized technical purpose/solution.
The claims are not rooted in machine learning technology, and the claims do not solve a technical problem that only arises in AI or machine learning. MPEP § 2106.05(a).
The amended limitations being referred to simply apply data analysis to train the generic ML resource to classify controls and do nothing more than use computational instructions to be implemented in a computer processing environment, simply to "apply it" without any improvement to the computer functionality or technology itself.
Applicant Argues: The features of independent claim 1 results in an improvement to the information management system itself by reciting the application and setting of appropriate controls which are accurately identified by the machine learning resource, which is trained to classify such controls, thereby improving and enhancing the security of the information management system. Therefore, the claimed subject matter - when considered as a whole - is clearly directed to a technical improvement and thus integrates the alleged judicial exception into a practical application of the alleged judicial exception.
In combination, the steps disclose a sequence of operations that include identifying first and second controls relating to policy information; offering an opportunity for a user to implement the controls using some high level and broadly cited interface and offering the user an opportunity to apply the controls. The only arguable inventive aspect of this set of steps is the particulars of the information processed. Apart from such particulars as is known of those of ordinary skill , the claimed combination of operations amounts to a generic, routine and conventional sequence of generic, routine and conventional operations of a computer system using human interaction.
None of the claims (independent or dependent) effects an improvement to another technology or technical field; nor does any of the claims amount to a technical improvement.
Accordingly, Examiner concludes that there are no meaningful limitations in the claims that transform the judicial exception into a patent eligible application such that the claims amount to significantly more than the judicial exception itself.
Applicant's arguments with respect to the rejection under 35 USC 103 have been fully considered and they are persuasive.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action. Any inquiry concerning this communication or earlier communications from the examiner should be directed to RASHIDA R SHORTER whose telephone number is (571)272-9345. The examiner can normally be reached Monday- Friday from 9am- 530pm. Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jessica Lemieux can be reached at (571) 270-3445. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300. Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/RASHIDA R SHORTER/Primary Examiner, Art Unit 3626
