Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-20 are presented for examination.
Response to Arguments
Applicant’s arguments with respect to claims 1-20 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-19 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claims 1 and 15 recite: “determining a new access-review rule based on the user input to auto-reject subsequent access decisions”. The phrase “to auto-reject…” is functional language describing the intended use or future capability of the generated rule, rather than a positive method step. It is unclear if the method actually requires the system to perform the future auto-rejection, or if merely generating a rule capable of doing so is sufficient.
Claim 17 states: “direct the processing system to: excluding the access decision from the subset…”. Claim 15 introduces a plural “subset of the access decisions”. Claim 17 suddenly references “the access decision” (singular) without ever affirmatively selecting or identifying a single decision from the subset. Therefore, the phrase lacks antecedent basis.
Claims 3 and 4 recite “…determining an access decision of the access decision…”. This phrasing is circular and it is unclear how an access decision can be determined “of” an access decision.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over US 2021/0360000 to Badawy et al., and further in view of US 10,848,499 to Badawy et al.
Regarding claim 1, Badawy ‘000 discloses a method for automated review of access decisions (an identity management system (access review system) operating in a distributed networked computer environment that utilizes processors and hardware circuitry to execute an “intelligent decision support agent” (automated review) to evaluate access requests, paragraphs 0013, 0142, 0210) the method comprising:
in processing circuitry of an access review system:
obtaining access decisions made responsive to access requests to a plurality of data environments (paragraphs 0154-0155: obtaining historical certification data, which comprises historical access requests (identity entitlement pairs) and their corresponding human “approval or denial decisions);
determining baseline rules for rejecting incorrect access decisions from a privilege graph, wherein the privilege graph includes nodes representing users that are connected to nodes representing resources of the plurality of data environments through intervening nodes representing attributes of the users, wherein each of the baseline rules represent at least one path through the privilege graph (0175-0176: using a “rules based agent 840” with “access request evaluation rules 842” that evaluate requests based on paths in an identity graph to generate denial recommendations).
While Badawy ‘000 explicitly teaches evaluating rules based on paths between user nodes and resource/entitlement nodes in the graph, it lacks an explicit description stating that the path must traverse through intervening nodes representing user attributes.
However Badawy ‘499 details the underlying graph architectures, constructing the identity graph such that it includes nodes representing various entity types, specifically: “k types of entities (nodes/vertices, e.g. identity, title, location, entitlement, etc.)”, 0057. The graph topology, user nodes (“identity-id”) are connected to resource nodes (“entitlement”) via their shared attribute nodes (“title, location”), satisfying the “intervening nodes representing attributes” limitation.
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to use Badawy’499’s specific topology (connecting users to entitlements through intervening attribute nodes like title and location) with Badawy ‘000’s access review pipeline, to successfully provide the system’s machine learning classifier with richer, more accurate graph-based features, thereby improving the accuracy of the automated approval/denial rules.
Badawy ‘000, as modified above, further discloses
determining, based on the baseline rules, a subset of the access decisions that should be rejected (the rules based agent evaluates the submitted access requests using the graph-based rules and outputs a “denial recommendation” for requests that fail the rules, effectively flagging the subset of decisions that should be rejected, 0176-0179);
receiving user input indicating additional ones of the access decisions for inclusion in the subset (the access requests are presented to a human manager via a user interface. The user provides their “actual approval or denial of the access request”, which is recorded by the system, 0179. When a user manually denies a request that the baseline rules failed to catch, this constitutes user input indicating an additional access decision to be rejected); and
determining a new access-review rule based on the user input to auto-reject subsequent access decisions made responsive to subsequent access requests to the plurality of data environments (taking the recorded user feedback (the human’s actual approval/denials) and using it to enhance the historical data to iteratively train a machine learning classifier. The classifier “observes patterns in data and makes estimated decisions, 0172. Once trained on this user input, the classifier is deployed to automatically score and output denial recommendations for “subsequent access requests”, 0181 and 0194. Note: A classifier’s decision boundary is functionally and legally equivalent to a “rule” in this context. Furthermore, Badawy ‘499 teaches using graph outliers to “evolve…enterprise roles” (i.e. update admin rules), 0018.).
Regarding claim 2, Badawy ‘000, as modified above, teaches the method of claim 1, comprising:
enforcing the access decisions on the access requests (0154: if an access request is approved the identity management system provision the access and the “entitlement may be associated with the identity in the identity data, 0154.).
Regarding claims 3 and 14, Badawy ‘000, as modified above, teaches the method of claim 1, wherein determining the subset comprising:
determining an access decision of the access decision occurred at a time corresponding to a previous version of the privilege graph; and excluding the access decision from the subset when the previous version of the privilege graph indicates the access decision was correct; calculating potential access decisions for an access request of the access requests at different timestamps; and presenting the potential access decisions to a user for review (maintaining “historical versions of the identity graph” using “time stamps”. It teaches querying the graph using specific timestamp to “determine the version of the identity graph closest in time” to evaluate pas decision, 0165. It also evaluates trending approval rates at different time stamps, 0163).
Regarding claim 4, Badawy ‘000, as modified above, teaches the method of claim 31wherein determining the subset comprises: determining an access decision of the access decision does not correspond to a data access authorization indicated in the privilege graph; and including the access decision in the subset (the rules based agent recommending denial based on graph metrics, such as lacking a feasible path or lacking immediate peer associations, 0176).
Regarding claims 5-7, Badawy ‘000, as modified above, teaches the method of claim 1, comprising: dividing the access decisions among users for review; and receiving the user input from the users; wherein dividing the access decisions comprises: providing a list including a portion of the access decisions to a user of the users, wherein the list identifies each of the access requests by attributes of an access request; wherein the attributes include a user making the access request, a resource being requested by the access request, and an indication of whether the access request was allowed or denied. (enterprise wide “certification campaigns” where access requests are divided and presented to respective managers, 0153. The UI explicitly lists the identity (“Catherine Simmons”), the resource/entitlement (“A92LCPC”) and allowed/denied recommendation status, 0208 and Fig. 11).
Regarding claim 8, Badawy ‘000, as modified above, teaches the method of claim 1, comprising: including the new access-review rule in the baseline rules for a subsequent determination of subsequent access request decisions that should be rejected (once the classifier is trained, it is deployed to process all subsequent access requests, effectively becoming the new baseline for automated approvals/denials, 0181).
Regarding claim 9, Badawy ‘000, as modified above, teaches the method of claim 1, wherein determining the new access-review rule comprises: suggesting the new access-review rule to a user; and receiving user input approving the new access-review rule (presenting an “interpretation of the classifier’s logic to the user to incite confidence and secure their validation, 0182. Additionally, Badawy ‘499 teaches presenting the mined roles (rules) to an administrator who can confirm and “redefine or govern existing roles”, 0040.).
Regarding claims 10-12, Badawy ‘000, as modified above, teaches the method of claim 1, wherein determining the new access-review rule comprises: after including the additional ones of the access decisions in the subset, identifying a pattern in the subset; and creating the new access-review rule to reject subsequent access decisions fitting the pattern;
wherein determining the new access-review rule comprises: accessing one or more previous subsets of previous access decisions that should be rejected from previously obtained access decisions; after including the additional ones of the access decisions in the subset, identifying a pattern in the subset and the one or more previous subsets; and creating the new access-review rule to reject subsequent access decisions fitting the pattern; suggesting the plurality of identified patterns to a user; receiving a selection of the pattern from the user; and creating the new access-review rule in response to the selection (using the classifier to observe patterns in the graph data, 0194. “An interpreter 830” that extracts the most influential patterns/features and displays them to the user as a histogram or visual explanation, 0184-0186. Furthermore, Badawy ‘499 teaches applying “community-detection algorithms” to identify clusters and “patterns in the graph data, 0060).
Regarding claim 13, Badawy ‘000, as modified above, teaches the method of claim 1, comprising: identifying a second entity having environments similar to a first entity having the plurality of data environments; and enforcing the new access-review rule for the second entity (JSON data structures explicitly track multi-tenant identifiers, 0086-0087. Badawy’499 teaches pruning across customers, 0043. It is a well known practice in SaaS and cloud security architectures to apply threat models or access review heuristics trained on one tenant’s data (first entity) to protect a similarly situated tenant (second entity).). It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to configure the identity management system of Badawy ‘000 to apply generalized classifier rules across multiple customer IDs to improve baseline security for all managed entities.
As per claims 15-19 and 20, this is an apparatus version of the claimed method discussed above in claims 1-14 wherein all claimed limitations have also been addressed and/or cited as set forth above.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to AUBREY H WYSZYNSKI whose telephone number is (571)272-8155. The examiner can normally be reached M-F 9-5.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, ALI SHAYANFAR can be reached at 571-270-1050. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/AUBREY H WYSZYNSKI/Primary Examiner, Art Unit 2434
