Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This Office Action is in response to the amendment filed 2/2/2026 for application 18/615,785.
Claims 1 and 3-20 have been examined and are pending. Claims 1, 16, and 19 have been amended. Claim 2 has been canceled. Claims 1, 16, and 19 are independent claims. This Action is made FINAL.
Information Disclosure Statement
The information disclosure statements(IDS) submitted on 1/2/2026 is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement has been considered by the examiner.
Response to Arguments
The 35 USC 101 rejection is withdrawn as the claims have been amended.
Applicants’ arguments, see Applicant Arguments/Remarks Made in an Amendment, filed 2/2/2026, with respect to the rejections of claims 1 and 3-20 have been fully considered but are not persuasive.
Applicant asserts as follows: REJECTIONS UNDER 35 U.S.C. § 103 The Office Action rejected claims 1, 7-10, 14, 16, 17, 19 and 20 under 35 U.S.C. § 103 as being unpatentable over U.S. Patent Publication No. 2024/0179187 (Chin) in view of U.S. Patent Publication No 2022/0385668 (Simonetti) and U.S. Patent Publication No. 2010/0305919 (Ganai). Applicant respectfully submits that the independent claims as presented for reconsideration are not anticipated nor made obvious by Chin in view of Simonetti and Ganai either singly or in combination with any other reference of record. In particular, as discussed in the interview, the prior art does not teach or suggest the subject matter recited by currently amended independent claim 1 in connection with determining policy equivalence in role-based access control (RBAC) policies. More specifically, Chin, whether considered alone or in combinations with Simonetti and Ganai, does not teach or suggest "extracting from the first policy expression a first set of multiple segments including a first segment, wherein each segment consists of a pairing of a first action in the first RBAC policy with a first set of notactions in the first RBAC policy." As recited by currently amended independent claim 1.
Examiner respectfully disagrees. Claim 1 was and is properly rejected by the combination of Chin, Simonetti, and Ganai. Chin discloses, paragraphs 0068, extracting from the first policy expression a first set of multiple segments including a first segment by disclosing two policies are determined as duplicate policies when operations of the two policies are identical to each other. Simonetti, paragraphs 0043, 0074, 0092, 0079, extracting from the first policy expression each segment consists of a pairing of a first action in the first RBAC policy with a first set of notactions in the first RBAC policy by disclosing policy, list of actions, notaction, action; policy, notaction, action, operations; role, security policies associated with role, access permissions, policy statement including NotAction, resultant Action.
Applicant asserts as follows: Additionally, Chin, whether considered alone or in combinations with Simonetti and Ganai, does not teach or suggest, "causing the first RBAC policy to be removed from a set of RBAC policies based on the determination that the first RBAC policy is a semantic duplication of the second RBAC policy." As recited by currently amended independent claim 1.
Examiner respectfully disagrees. Claim 1 was and is properly rejected by the combination of Chin, Simonetti, and Ganai. Chin, discloses, paragraph 0067, causing the first policy to be removed from a set of policies based on the determination that the first policy is a semantic duplication of the second policy by disclosing identify duplicate policies, the policy file may be completely removed. Simonetti discloses, paragraphs 0043, 0074, 0092, based on not determining a counterexample input, determining that the first RBAC policy is a semantic duplication of the second RBAC policy, causing the first RBAC policy to be removed from a set of RBAC policies based on the determination that the first RBAC policy is a semantic duplication of the second RBAC policy by disclosing policy, list of actions, notaction, action; policy, notaction, action, operations; role, security policies associated with role, access permissions.
Applicant asserts as follows: More specifically, while Chin relates to a system where "two policies are determined as duplicate policies when operations of the two policies are identical to each other." Chin at[0068]. Chin does not provide any additional detail that specifically teaches or suggests features related to determining policy equivalence in role-based access control (RBAC) policies having similar features as "extracting from the first policy expression a first set of multiple segments" and "determining whether there is a counterexample input that is allowed by the first action of the first segment... but not allowed by all segments of the second RBAC policy by using a symbolic abstraction model that generates symbolic counterexample expressions and a satisfiability solver model that solves for counterexamples" as recited by currently amended independent claim 1. The addition of Simonetti does not overcome the deficiencies of Chin to teach or suggest this subject matter of the claims. In particular, Simonetti describes, identify[ing] a first set of security policies associated with the first role, and a second set of security policies associated with the second role... generate[ing] a first set of effective access permissions associated with the first role, and a second set of effective access permissions associated with the second role, wherein the first set of effective access permissions is generated based on the first set of security policies by resolving at least a conflict between the first security policy and the second security policy, and wherein the first set of effective access permissions defines a scope of a name for a system resource, or defines a scope of a name for a role. Simonetti at [0092]. For example, FIG. 4C of Simonetti appears to teach that a new list is created with complete allow statements therein to be compared against a deny list (See e.g., FIG. 4C). However, Simonetti appears to be silent regarding "extracting from the first policy expression a first set of multiple segments including a first segment, wherein each segment consists of a pairing of a first action in the first RBAC policy with a first set of notactions in the first RBAC policy." Further, the addition of Ganai does not overcome the deficiencies of Chin and Simonetti to teach or suggest the subject matter of the claims. Rather it appears that Ganai is being relied upon to teach concepts related to symbolic abstraction models and satisfiability solver models. See Office Action at page 8. Nevertheless, while Ganai appears to describe features related to symbolic abstraction models and satisfiability solver models, Ganai does not teach or suggest the subject matter above related to extracting segments from a policy expression or removing duplicate policy expressions.
Examiner respectfully disagrees. Claim 1 was and is properly rejected by the combination of Chin, Simonetti, and Ganai. Regarding claim 1, Chin discloses, paragraph 0068, a computer-implemented method for determining policy equivalence in role-based access control (RBAC) policies comprising generating a first policy expression by disclosing two policies are determined as duplicate policies when operations of the two policies are identical to each other; paragraph 0068, extracting from the first policy expression a first set of multiple segments including a first segment by disclosing two policies are determined as duplicate policies when operations of the two policies are identical to each other; paragraph 0068, determining whether there is a counterexample input by disclosing two policies are determined as duplicate policies when operations of the two policies are identical to each other; paragraph 0068, based on not determining a counterexample input, determining that the first policy is a semantic duplication of the second policy by disclosing two policies are determined as duplicate policies when operations of the two policies are identical to each other; paragraph 0067, causing the first policy to be removed from a set of policies based on the determination that the first policy is a semantic duplication of the second policy by disclosing identify duplicate policies, the policy file may be completely removed.
Chin discloses generating a first policy expression; extracting from the first policy expression a first set of multiple segments including a first segment; determining whether there is a counterexample input; based on not determining a counterexample input, determining that the first policy is a semantic duplication of the second policy;causing the first policy to be removed from a set of policies based on the determination that the first policy is a semantic duplication of the second policy, but does not explicitly disclose generating a first policy expression for a first RBAC policy and a second policy expression for a second RBAC policy; extracting from the first policy expression a first set of multiple segments including a first segment, wherein each segment consists of a pairing of a first action in the first RBAC policy with a first set of notactions in the first RBAC policy; determining whether there is a counterexample input that is allowed by the first action of the first segment and the first set of not actions in the first segment of the first policy expression but not allowed by all segments of the second RBAC policy; based on not determining a counterexample input, determining that the first RBAC policy is a semantic duplication of the second RBAC policy; causing the first RBAC policy to be removed from a set of RBAC policies based on the determination that the first RBAC policy is a semantic duplication of the second RBAC policy..
Simonetti discloses, paragraphs 0043, 0074, 0092, generating a first policy expression for a first RBAC policy and a second policy expression for a second RBAC policy by disclosing policy, list of actions, notaction, action; policy, notaction, action, operations; role, security policies associated with role, access permissions; paragraphs 0043, 0074, 0092, 0079, extracting from the first policy expression each segment consists of a pairing of a first action in the first RBAC policy with a first set of notactions in the first RBAC policy by disclosing policy, list of actions, notaction, action; policy, notaction, action, operations; role, security policies associated with role, access permissions, policy statement including NotAction, resultant Action; paragraphs 0043, 0074, 0092, determining whether there is a counterexample input that is allowed by the first action of the first segment and the first set of not actions in the first segment of the first policy expression but not allowed by all segments of the second RBAC policy by disclosing policy, list of actions, notaction, action; policy, notaction, action, operations; role, security policies associated with role, access permissions; paragraphs 0043, 0074, 0092, based on not determining a counterexample input, determining that the first RBAC policy is a semantic duplication of the second RBAC policy, causing the first RBAC policy to be removed from a set of RBAC policies based on the determination that the first RBAC policy is a semantic duplication of the second RBAC policy by disclosing policy, list of actions, notaction, action; policy, notaction, action, operations; role, security policies associated with role, access permissions.
Chin and Simonetti do not explicitly disclose by using a symbolic abstraction model that generates symbolic counterexample expressions and a satisfiability solver model that solves for counterexamples.
Ganai discloses, paragraphs 0008, 0031, by using a symbolic abstraction model that generates symbolic counterexample expressions and a satisfiability solver model that solves for counterexamples by disclosing symbolic model checking, expressions; satisfiability by an SMT solver.
The Examiner respectfully suggests that the claims be further amended and details in the specification be incorporated to distinguish the claimed invention over prior art of record. Should the Applicant desire an interview to further clarify the claim interpretation/rejections, please contact the Examiner at (571) 272 5368 to schedule an interview.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically discloses as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claims 1, 7-10, 14, 16, 17, 19, and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Chin (US20240179187), filed November 14, 2023, in view of Simonetti (US20220385668), filed May 28, 2021, and Ganai (US20100305919), filed April 2, 2010.
Regarding claim 1, Chin discloses a computer-implemented method for determining policy equivalence in role-based access control (RBAC) policies comprising generating a first policy expression (Chin, paragraph 0068, two policies are determined as duplicate policies when operations of the two policies are identical to each other);
extracting from the first policy expression a first set of multiple segments including a first segment (Chin, paragraph 0068, two policies are determined as duplicate policies when operations of the two policies are identical to each other);
determining whether there is a counterexample input (Chin, paragraph 0068, two policies are determined as duplicate policies when operations of the two policies are identical to each other);
based on not determining a counterexample input, determining that the first policy is a semantic duplication of the second policy (Chin, paragraph 0068, two policies are determined as duplicate policies when operations of the two policies are identical to each other);
causing the first policy to be removed from a set of policies based on the determination that the first policy is a semantic duplication of the second policy (Chin, paragraph 0067, identify duplicate policies, the policy file may be completely removed).
Chin discloses generating a first policy expression; extracting from the first policy expression a first set of multiple segments including a first segment; determining whether there is a counterexample input; based on not determining a counterexample input, determining that the first policy is a semantic duplication of the second policy;
causing the first policy to be removed from a set of policies based on the determination that the first policy is a semantic duplication of the second policy, but does not explicitly disclose
generating a first policy expression for a first RBAC policy and a second policy expression for a second RBAC policy;
extracting from the first policy expression a first set of multiple segments including a first segment, wherein each segment consists of a pairing of a first action in the first RBAC policy with a first set of notactions in the first RBAC policy;
determining whether there is a counterexample input that is allowed by the first action of the first segment and the first set of not actions in the first segment of the first policy expression but not allowed by all segments of the second RBAC policy;
based on not determining a counterexample input, determining that the first RBAC policy is a semantic duplication of the second RBAC policy;
causing the first RBAC policy to be removed from a set of RBAC policies based on the determination that the first RBAC policy is a semantic duplication of the second RBAC policy..
However, in an analogous art, Simonetti discloses generating a first policy expression for a first RBAC policy and a second policy expression for a second RBAC policy (Simonetti, paragraph 0043, policy, list of actions, notaction, action; paragraph 0074, policy, notaction, action, operations; paragraph 0092, role, security policies associated with role, access permissions);
extracting from the first policy expression each segment consists of a pairing of a first action in the first RBAC policy with a first set of notactions in the first RBAC policy (Simonetti, paragraph 0043, policy, list of actions, notaction, action; paragraph 0074, policy, notaction, action, operations; paragraph 0092, role, security policies associated with role, access permissions, paragraph 0079, policy statement including NotAction, resultant Action);
determining whether there is a counterexample input that is allowed by the first action of the first segment and the first set of not actions in the first segment of the first policy expression but not allowed by all segments of the second RBAC policy (Simonetti, paragraph 0043, policy, list of actions, notaction, action; paragraph 0074, policy, notaction, action, operations; paragraph 0092, role, security policies associated with role, access permissions);
based on not determining a counterexample input, determining that the first RBAC policy is a semantic duplication of the second RBAC policy, causing the first RBAC policy to be removed from a set of RBAC policies based on the determination that the first RBAC policy is a semantic duplication of the second RBAC policy (Simonetti, paragraph 0043, policy, list of actions, notaction, action; paragraph 0074, policy, notaction, action, operations; paragraph 0092, role, security policies associated with role, access permissions).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Simonetti with the computer-implemented method / computer-implemented system of Chin to include actions and notactions in a policy to provide users with the benefits of evaluating effective access permissions regarding security policies (Simonetti: paragraph 0004).
Chin and Simonetti do not explicitly disclose by using a symbolic abstraction model that generates symbolic counterexample expressions and a satisfiability solver model that solves for counterexamples.
However, in an analogous art, Ganai discloses by using a symbolic abstraction model that generates symbolic counterexample expressions and a satisfiability solver model that solves for counterexamples (Ganai, paragraph 0008, symbolic model checking, expressions; paragraph 0031, satisfiability by an SMT solver).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Ganai with the computer-implemented method / computer-implemented system of Chin and Simonetti to include using a symbolic abstraction model that generates symbolic counterexample expressions and a satisfiability solver model that solves for counterexamples to provide users with the benefits of sequential model checking (Ganai: abstract).
Regarding claim 7, Chin, Simonetti, and Ganai disclose the computer-implemented method of claim 1. Chin, Simonetti, and Ganai disclose wherein dividing the first policy expression into the first set of multiple segments includes generating a segment for each action in the first RBAC policy, wherein each action includes a corresponding set of one or more notactions from the first RBAC policy. (Simonetti, paragraph 0043, action, notaction).
Regarding claim 8, Chin, Simonetti, and Ganai disclose the computer-implemented method of claim 1. Chin, Simonetti, and Ganai disclose wherein the first policy expression is a regular expression of actions and notactions included in the first RBAC policy. (Simonetti, paragraph 0043, action, notaction, policy)
Regarding claim 9, Chin, Simonetti, and Ganai disclose the computer-implemented method of claim 1. Chin, Simonetti, and Ganai disclose dividing the first policy expression into a second segment that pairs a second action of the first RBAC policy with a second set of notactions in the first RBAC policy (Chin, paragraph 0068, two policies are determined as duplicate policies when operations of the two policies are identical to each other) (Simonetti, paragraph 0043, policy, list of actions, notaction, action; paragraph 0074, policy, notaction, action, operations; paragraph 0092, role, security policies associated with role, access permissions);
determining whether there is a counterexample input that is allowed by the second action and the second set of notactions in the first segment of the first policy expression but not allowed by all segments of the second RBAC policy by using the symbolic abstraction model and the satisfiability solver model (Chin, paragraph 0068, two policies are determined as duplicate policies when operations of the two policies are identical to each other) (Simonetti, paragraph 0043, policy, list of actions, notaction, action; paragraph 0074, policy, notaction, action, operations; paragraph 0092, role, security policies associated with role, access permissions); and
based on not determining the counterexample input, determining that the first RBAC policy is the semantic duplication of the second RBAC policy further based on the second segment of the first policy expression being semantically equivalent to the second policy expression. (Chin, paragraph 0068, two policies are determined as duplicate policies when operations of the two policies are identical to each other) (Simonetti, paragraph 0043, policy, list of actions, notaction, action; paragraph 0074, policy, notaction, action, operations; paragraph 0092, role, security policies associated with role, access permissions) (Ganai, paragraph 0008, symbolic model checking, expressions; paragraph 0031, satisfiability by an SMT solver)
Regarding claim 10, Chin, Simonetti, and Ganai disclose the computer-implemented method of claim 1. Chin, Simonetti, and Ganai disclose
further comprising: comparing each segment in the first set of multiple segments of the first policy expression with all segments of the second RBAC policy to determine semantic equivalence; and based on not determining the counterexample input when comparing each segment in the first set of multiple segments, determining that the first RBAC policy is the semantic duplication of the second RBAC policy. (Chin, paragraph 0068, two policies are determined as duplicate policies when operations of the two policies are identical to each other).
Regarding claim 14, Chin, Simonetti, and Ganai disclose the computer-implemented method of claim 1. Chin, Simonetti, and Ganai disclose further comprising identifying the first RBAC policy and the second RBAC policy from a set of RBAC policies on a cloud computing system (Simonetti, paragraph 0068, policy can be stored in a cloud and specified by markup language).
Regarding claim 16, Chin discloses system for determining policy equivalence in role-based access control (RBAC) policies comprising: a processing system; and a computer memory comprising instructions that, when executed by the processing system, cause the system to perform operations of (Chin, paragraph 0051, memory, policy, system)
generating a first policy expression for a first RBAC policy and a second policy expression for a second RBAC policy (Chin, paragraph 0068, two policies are determined as duplicate policies when operations of the two policies are identical to each other)
extracting from(Chin, paragraph 0068, two policies are determined as duplicate policies when operations of the two policies are identical to each other);
based on not determining a counterexample input, determining that the first RBAC policy is a semantic duplication of the second RBAC policy (Chin, paragraph 0068, two policies are determined as duplicate policies when operations of the two policies are identical to each other);
causing the first policy to be removed from a set of policies based on the determination that the first policy is a semantic duplication of the second policy (Chin, paragraph 0067, identify duplicate policies, the policy file may be completely removed).
Chin discloses generating a first policy expression; extracting fromcausing the first policy to be removed from a set of policies based on the determination that the first policy is a semantic duplication of the second policy, but does not explicitly disclose generating a first policy expression for a first RBAC policy and a second policy expression for a second RBAC policy; extracting fromeach segment consists of a pairing ofcausing the first RBAC policy to be removed from a set of RBAC policies based on the determination that the first RBAC policy is a semantic duplication of the second RBAC policy.
However, in an analogous art, Simonetti discloses generating a first policy expression for a first RBAC policy and a second policy expression for a second RBAC policy (Simonetti, paragraph 0043, policy, list of actions, notaction, action; paragraph 0074, policy, notaction, action, operations; paragraph 0092, role, security policies associated with role, access permissions);
extracting fromeach segment consists of a pairing of(Simonetti, paragraph 0043, policy, list of actions, notaction, action; paragraph 0074, policy, notaction, action, operations; paragraph 0092, role, security policies associated with role, access permissions);
determining whether there is a counterexample input that is allowed by the first action of the first segment and the first set of not actions in the first segment of the first policy expression but not allowed by all segments of the second RBAC policy (Simonetti, paragraph 0043, policy, list of actions, notaction, action; paragraph 0074, policy, notaction, action, operations; paragraph 0092, role, security policies associated with role, access permissions);
based on not determining a counterexample input, determining that the first RBAC policy is a semantic duplication of the second RBAC policy, causing the first RBAC policy to be removed from a set of RBAC policies based on the determination that the first RBAC policy is a semantic duplication of the second RBAC policy (Simonetti, paragraph 0043, policy, list of actions, notaction, action; paragraph 0074, policy, notaction, action, operations; paragraph 0092, role, security policies associated with role, access permissions).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Simonetti with the computer-implemented method / computer-implemented system of Chin to include actions and notactions in a policy to provide users with the benefits of evaluating effective access permissions regarding security policies (Simonetti: paragraph 0004).
Chin and Simonetti do not explicitly disclose by using a symbolic abstraction model that generates symbolic counterexample expressions and a satisfiability solver model that solves for counterexamples.
However, in an analogous art, Ganai discloses by using a symbolic abstraction model that generates symbolic counterexample expressions and a satisfiability solver model that solves for counterexamples (Ganai, paragraph 0008, symbolic model checking, expressions; paragraph 0031, satisfiability by an SMT solver).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Ganai with the computer-implemented method / computer-implemented system of Chin and Simonetti to include using a symbolic abstraction model that generates symbolic counterexample expressions and a satisfiability solver model that solves for counterexamples to provide users with the benefits of sequential model checking (Ganai: abstract).
Regarding claim 17, Chin, Simonetti, and Ganai disclose the system of claim 16. Chin, Simonetti, and Ganai disclose wherein the first segment includes the first action and does not include other actions from the first RBAC policy. (Simonetti, paragraph 0043, policy, list of actions, notaction, action; paragraph 0074, policy, notaction, action, operations; paragraph 0092, role, security policies associated with role, access permissions)
Regarding claim 19, Chin disclosing computer-implemented method for determining policy equivalence in policies comprising (Chin, paragraph 0068, two policies are determined as duplicate policies when operations of the two policies are identical to each other)
generating a first policy expression for a first policy and a second policy expression for a second policy (Chin, paragraph 0068, two policies are determined as duplicate policies when operations of the two policies are identical to each other);
extracting from(Chin, paragraph 0068, two policies are determined as duplicate policies when operations of the two policies are identical to each other);
determining whether there is a counterexample input (Chin, paragraph 0068, two policies are determined as duplicate policies when operations of the two policies are identical to each other);
based on not determining a counterexample input, determining that the first policy is a duplicate of the second policy (Chin, paragraph 0068, two policies are determined as duplicate policies when operations of the two policies are identical to each other);
removing the first policy from a set of policies based on the determination that the first policy is a semantic duplication of the second policy (Chin, paragraph 0067, identify duplicate policies, the policy file may be completely removed).
.
Chin discloses extracting fromremoving the first policy from a set of policies based on the determination that the first policy is a semantic duplication of the second policy, but does not explicitly disclose extracting fromwherein each segment consists of a pairing of a first action in the first RBAC policy with a first set of notactions in the first RBAC policy; determining whether there is a counterexample input that is allowed by first action of the first segment of the first policy, based on not determining a counterexample input, determining that the first policy is a duplicate of the second policy, but not allowed by all segments of the second policy using a symbolic abstraction model and a satisfiability solver model; removing the first RBAC policy from a set of RBAC policies based on the determination that the first RBAC policy is a semantic duplication of the second RBAC policy.
However, in an analogous art, Simonetti discloses extracting fromwherein each segment consists of a pairing of a first action in the first RBAC policy with a first set of notactions in the first RBAC policy (Simonetti, paragraph 0043, policy, list of actions, notaction, action; paragraph 0074, policy, notaction, action, operations; paragraph 0092, role, security policies associated with role, access permissions, paragraph 0079, policy statement including NotAction, resultant Action);
determining whether there is a counterexample input that is allowed by the first action of the first segment of the first policy but not allowed by all segments of the second policy using a symbolic abstraction model and a satisfiability solver model (Simonetti, paragraph 0043, policy, list of actions, notaction, action; paragraph 0074, policy, notaction, action, operations; paragraph 0092, role, security policies associated with role, access permissions);
based on not determining a counterexample input, determining that the first policy is a duplicate of the second policy, removing the first RBAC policy from a set of RBAC policies based on the determination that the first RBAC policy is a semantic duplication of the second RBAC policy (Simonetti, paragraph 0043, policy, list of actions, notaction, action; paragraph 0074, policy, notaction, action, operations; paragraph 0092, role, security policies associated with role, access permissions) .
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Simonetti with the computer-implemented method / computer-implemented system of Chin to include extracting from the first policy expression multiple segments including a first segment, wherein each segment consists of a pairing of a first action in the first RBAC policy with a first set of notactions in the first RBAC policy; determining whether there is a counterexample input that is allowed by the first segment of the first policy but not allowed by all segments of the second policy using a symbolic abstraction model and a satisfiability solver model to provide users with the benefits of evaluating effective access permissions regarding security policies (Simonetti: paragraph 0004).
Chin and Simonetti disclose computer-implemented method for determining policy equivalence in policies, but do not explicitly disclose computer-implemented method for determining policy equivalence in role-based access control (RBAC) policies.
However, in an analogous art, Ganai discloses computer-implemented method for determining policy equivalence in role-based access control (RBAC) policies (Ganai, paragraph 0008, symbolic model checking, expressions; paragraph 0031, satisfiability by an SMT solver).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Ganai with the computer-implemented method / computer-implemented system of Chin and Simonetti to include computer-implemented method for determining policy equivalence in role-based access control (RBAC) policies to provide users with the benefits of sequential model checking (Ganai: abstract).
Regarding claim 20, Chin, Simonetti, and Ganai disclose the computer-implemented method of claim 19. Chin, Simonetti, and Ganai disclose wherein: using the symbolic abstraction model includes generating a symbolic counterexample expression that includes the first segment and the second policy expression; and using the satisfiability solver model includes solving a satisfiability function representation based on the symbolic counterexample expression (Ganai, paragraph 0008, symbolic model checking, expressions; paragraph 0031, satisfiability by an SMT solver)
Claims 18 is rejected under 35 U.S.C. 103 as being unpatentable over Chin (US20240179187), filed November 14, 2023, in view of Simonetti (US20220385668), filed May 28, 2021, and Ganai (US20100305919), filed April 2, 2010, and further in view of Beigi (US20080172350), field January 16, 2007.
Regarding claim 18, Chin, Simonetti, and Ganai disclose the system of claim 16.
Chin, Simonetti, and Ganai do not explicitly disclose wherein determining that the first RBAC policy is the semantic duplication of the second RBAC policy includes determining that the first RBAC policy has a different syntax from the second RBAC policy.
However, in an analogous art, Beigi discloses wherein determining that the first RBAC policy is the semantic duplication of the second RBAC policy includes determining that the first RBAC policy has a different syntax from the second RBAC policy (Beigi, paragraph 0018, semantically equivalent, policy, syntactically distinct; paragraph 0019, second policy, first policy, syntactically distinct, semantically eqivalent0.
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Beigi with the computer-implemented method / computer-implemented system of Chin, Simonetti, and Ganai to include wherein determining that the first RBAC policy is the semantic duplication of the second RBAC policy includes determining that the first RBAC policy has a different syntax from the second RBAC policy to provide users with the benefits of simplifying policy language (Beigi: paragraph 0004).
Claims 3-6 are rejected under 35 U.S.C. 103 as being unpatentable over Chin (US20240179187), filed November 14, 2023, in view of Simonetti (US20220385668), filed May 28, 2021, and Ganai (US20100305919), filed April 2, 2010, and further in view of Maes (US20060117376), filed May 5, 2005.
Regarding claim 3, Chin, Simonetti, and Ganai disclose the computer-implemented method of claim 1.
Chin, Simonetti, and Ganai do not explicitly disclose wherein the first policy expression includes any action in the first RBAC policy being true combined with all notactions in the first RBAC policy being false.
However, in an analogous art, Maes discloses wherein the first policy expression includes any action in the first RBAC policy being true combined with all notactions in the first RBAC policy being false (Maes, paragraph 0064, all conditions satisfied policy success, otherwise policy not satisfied).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Maes with the computer-implemented method / computer-implemented system of Chin, Simonetti, and Ganai to include wherein the first policy expression includes any action in the first RBAC policy being true combined with all notactions in the first RBAC policy being false to provide users with the benefits of policy enforcement (Maes: abstract).
Regarding claim 4, Chin, Simonetti, and Ganai disclose the computer-implemented method of claim 1.
Chin, Simonetti, and Ganai do not explicitly disclose wherein the symbolic abstraction model generates a first symbolic counterexample expression based on a first counterexample expression indicating that the first action is valid, the first set of notactions is invalid, and the second policy expression is invalid.
However, in an analogous art, Maes discloses wherein the symbolic abstraction model generates a first symbolic counterexample expression based on a first counterexample expression indicating that the first action is valid, the first set of notactions is invalid, and the second policy expression is invalid (Maes, paragraph 0064, all conditions satisfied policy success, otherwise policy not satisfied).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Maes with the computer-implemented method / computer-implemented system of Chin, Simonetti, and Ganai to include wherein the symbolic abstraction model generates a first symbolic counterexample expression based on a first counterexample expression indicating that the first action is valid, the first set of notactions is invalid, and the second policy expression is invalid to provide users with the benefits of policy enforcement (Maes: abstract).
Regarding claim 5, Chin, Simonetti, Ganai, and Maes disclose the computer-implemented method of claim 4. Chin, Simonetti, Ganai, and Maes disclose wherein the symbolic abstraction model generates a first satisfiability function representation of the first symbolic counterexample expression to provide the satisfiability solver model (Maes, paragraph 0064, all conditions satisfied policy success, otherwise policy not satisfied).
Regarding claim 6, Chin, Simonetti, Ganai, and Maes disclose the computer-implemented method of claim 5. Chin, Simonetti, Ganai, and Maes disclose wherein the satisfiability solver model fails to find a counterexample that satisfies the first satisfiability function representation indicating that the first counterexample expression is false (Maes, paragraph 0064, all conditions satisfied policy success, otherwise policy not satisfied).
Claims 11-13 are rejected under 35 U.S.C. 103 as being unpatentable over Chin (US20240179187), filed November 14, 2023, in view of Simonetti (US20220385668), filed May 28, 2021, and Ganai (US20100305919), filed April 2, 2010, and further in view of Basu (US20090150366), filed December 6, 2007.
Regarding claim 11, Chin, Simonetti, and Ganai disclose the computer-implemented method of claim 1.
Chin, Simonetti, and Ganai do not explicitly disclose further comprising: generating an equivalence check query between the first policy expression and the second policy expression upon generating the first policy expression and the second policy expression ; and separating the equivalence check query into a first directional check from the first policy expression to the second policy expression and a second directional check from the second policy expression to the first policy expression before dividing the first policy expression into the first set of multiple segments.
However, in an analogous art, Basu discloses further comprising: generating an equivalence check query between the first policy expression and the second policy expression upon generating the first policy expression and the second policy expression (Basu, paragraph 0021, determination of logical equivalence between two expressions, logical equivalence of a first expression and a second expression)
and separating the equivalence check query into a first directional check from the first policy expression to the second policy expression and a second directional check from the second policy expression to the first policy expression (Basu, paragraph 0021, commutative property)
before dividing the first policy expression into the first set of multiple segments (Basu, paragraph 0021, logical equivalence between two expressions, logical equivalence of a first expression and a second expression).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Basu with the computer-implemented method / computer-implemented system of Chin, Simonetti, and Ganai to include further comprising: generating an equivalence check query between the first policy expression and the second policy expression upon generating the first policy expression and the second policy expression ; and separating the equivalence check query into a first directional check from the first policy expression to the second policy expression and a second directional check from the second policy expression to the first policy expression before dividing the first policy expression into the first set of multiple segments to provide users with the benefits of techniques for representing and manipulating expressions (Basu: paragraph 0002).
Regarding claim 12, Chin, Simonetti, Ganai, and Basu disclose the computer-implemented method of claim 11. Chin, Simonetti, Ganai, and Basu disclose further comprising determining that the first policy expression is semantically equivalent to all the segments of the second policy expression based on no counterexamples being identified when evaluating the first directional check and the second directional check (Chin, paragraph 0068, two policies are determined as duplicate policies when operations of the two policies are identical to each other).
Regarding claim 13, Chin, Simonetti, Ganai, and Basu disclose the computer-implemented method of claim 12. Chin, Simonetti, Ganai, and Basu disclose wherein evaluating the second directional check includes: dividing the second policy expression into a second set of multiple segments that compare actions and corresponding sets of notactions (Chin, paragraph 0068, two policies are determined as duplicate policies when operations of the two policies are identical to each other);
generating counterexample segment expressions that compare each segment in the second set of multiple segments of the second policy expression with the first policy expression . (Chin, paragraph 0068, two policies are determined as duplicate policies when operations of the two policies are identical to each other) (Simonetti, paragraph 0043, policy, list of actions, notaction, action; paragraph 0074, policy, notaction, action, operations; paragraph 0092, role, security policies associated with role, access permissions); and
determining whether a counterexample exists for any of the counterexample segment expressions using the symbolic abstraction model and the satisfiability solver model. (Chin, paragraph 0068, two policies are determined as duplicate policies when operations of the two policies are identical to each other) (Ganai, paragraph 0008, symbolic model checking, expressions; paragraph 0031, satisfiability by an SMT solver).
Claim 15 is rejected under 35 U.S.C. 103 as being unpatentable over Chin (US20240179187), filed November 14, 2023, in view of Simonetti (US20220385668), filed May 28, 2021, and Ganai (US20100305919), filed April 2, 2010, and further in view of Strassner (US20080320550), filed June 21, 2007.
Regarding claim 15, Chin, Simonetti, and Ganai disclose the computer-implemented method of claim 1.
Chin, Simonetti, and Ganai disclose using a deterministic finite automaton equivalence algorithm (Ganai, paragraph 0059, obtain equivalence representations) to determine that the first RBAC policy and the third RBAC policy are semantically equivalent (Chin, paragraph 0068, two policies are determined as duplicate policies when operations of the two policies are identical to each other).
Chin, Simonetti, and Ganai do not explicitly disclose further comprising: determining that the first RBAC policy and a third RBAC policy each do not include attribute conditions.
However, in an analogous art, Strassner discloses determining that the first RBAC policy and a third RBAC policy each do not include attribute conditions (Strassner, paragraph 0029, a plurality of conditions to be satisfied for one or more policies, condition not satisfied).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Strassner with the computer-implemented method / computer-implemented system of Chin, Simonetti, and Ganai to include further comprising: determining that the first RBAC policy and a third RBAC policy each do not include attribute conditions to provide users with the benefits of model checking (Strassner: paragraph 0003).
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to WALTER J MALINOWSKI whose telephone number is (571)272-5368. The examiner can normally be reached 8-6:30 MTWH.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, LUU PHAM can be reached at 5712705002. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/W.J.M/Examiner, Art Unit 2439
/LUU T PHAM/Supervisory Patent Examiner, Art Unit 2439
Prosecution Insights