DETAILED ACTION
1. A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 9/9/2026 has been entered.
2. Claims 1-7, 9, 11, 21-27 and 29-32 are pending. Claims 1 and 21 are independent.
Response to Arguments
3. Applicant's arguments filed 9/9/2026 have been fully considered; however, they are not persuasive.
Applicant alleged that “Toth's deviation score is a deterministic summation of predetermined, weighted distance increments, not a score determined using a machine learning model.” Examiners respectfully disagree. Toth explicitly discloses that “a machine learning algorithm may evaluate the user's current authentication request and behavior against the behavioral profile to determine an authentication-focused risk score” [para. 25]. This statement summarizes the process of determining an authentication-focused risk score which is performed by the machine learning algorithm/model. Therefore, the authentication-focused risk score is determined by the machine learning algorithm/model.
Applicant alleged that Toth “does not process the authentication request or login credentials,mapped by the Office as "the first input" (Office Action at 6, citing Toth [0044]), in determining that score” and that “the Office's claim mapping itself recites only "processing one or more parameters" and identifies no disclosure in Toth of processing "the first input" to determine the first risk score.” Examiners respectfully disagree. Toth discloses that “client authentication computing platform 110 may capture information identifying what authenticators were submitted and/or otherwise used (e.g., username, password, biometrics, and/or the like), what event type has been requested (e.g., balance inquiry, funds transfer, bill pay, and/or the like), and/or other information, and any and/or all of this information may be used by client authentication computing platform 110 in determining a deviation score” [para. 48]. Therefore, login credentials, e.g. username, password, biometrics, are used to determine the deviation score.
Considering the determination of the second risk score, Applicant alleged that “the machine learning model of Toth is used to build and refine the behavioral profile (Toth, [0033], [0051]); it is not used to determine a score.” This argument has previously been addressed above, Toth explicitly discloses that “a machine learning algorithm may evaluate the user's current authentication request and behavior against the behavioral profile to determine an authentication-focused risk score” [para. 25]. This statement summarizes the process of determining an authentication-focused risk score which is performed by the machine learning algorithm/model. Therefore, the authentication-focused risk score is determined by the machine learning algorithm/model.
Applicant further alleged that “A binary determination of whether a challenge is passed or failed is neither determined "using the machine learning model' nor a "risk score."” As being addressed in previous responses to Applicant’s arguments, Toth’s entire invention is directed to a machine-learning algorithm/model that may evaluate the user's current authentication request and behavior against the behavioral profile to determine a risk score or risk state. Therefore, the machine learning algorithm/model also includes the determination of whether a challenge is passed or failed.
Applicant also alleged that “Toth thus acts on the outcome of the challenge directly, without determining a second risk score or mapping such a score to a set of risk levels.” Examiners respectfully disagree. Toth’s outcome of the challenge is broadly interpreted as “a second risk score” and is mapping to a set of risk levels, e.g. pass or fail.
Claim Rejections - 35 USC § 112
4. The following is a quotation of the first paragraph of 35 U.S.C. 112(a):
(a) IN GENERAL.—The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor or joint inventor of carrying out the invention.
The following is a quotation of the first paragraph of pre-AIA 35 U.S.C. 112:
The specification shall contain a written description of the invention, and of the manner and process of making and using it, in such full, clear, concise, and exact terms as to enable any person skilled in the art to which it pertains, or with which it is most nearly connected, to make and use the same, and shall set forth the best mode contemplated by the inventor of carrying out his invention.
5. Claim 32 is rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement. The claim(s) contains subject matter which was not described in the specification in such a way as to reasonably convey to one skilled in the relevant art that the inventor or a joint inventor, or for applications subject to pre-AIA 35 U.S.C. 112, the inventor(s), at the time the application was filed, had possession of the claimed invention.
Claim 32 recites “use one or more first machine learning models to select, from an access history associated with the entity, data relevant to the attempt to access the first service for determining the first risk score; provide the selected data and the first input as input to one or more second machine learning models; and use the one or more second machine learning models to determine the first risk score.” (emphasis added). Thus, claim 32 requires two different machine learn models the first machine learning model for selecting access history and the second machine learning model for determining the first risk score using the selected access history as input. However, the specification discloses the learning model 114 determining [para. 50]. Thus, the specification only discloses only one learning machine model for selecting access history as an input to determine the first risk score. Therefore, claim 32 is rejected under 35 U.S.C. 112(a) or 35 U.S.C. 112 (pre-AIA ), first paragraph, as failing to comply with the written description requirement.
Claim Rejections - 35 USC § 102
6. In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
7. The following is a quotation of 35 U.S.C. 102 which forms the basis for all obviousness rejections set forth in this Office action:
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
8. Claims 1-5, 9, 11, 21-25, 29 and 32 are rejected under 35 U.S.C. 102 as being anticipated by Toth (US PG Pub. 2020/0184048).
As regarding claims 1 and 21, Toth discloses A server comprising:
a processor [para. 33]; and
a memory, wherein the memory stores instructions that, when executed by the processor [para. 33], cause the processor to:
receive a first input identifying an entity attempting to access a first service [para. 44; receiving a first authentication request];
determine, using a machine learning model, a first risk score of the entity, by processing the first input and one or more parameters [para. 44, 48 and 50; determining a deviation score];
identify, based on the first risk score, a second input request for the entity [para. 57; identifying an additional authentication challenge];
transmit the second input request to the first service [FIG. 5 and para. 55; transmitting a second authentication challenge];
receive a second input from the entity corresponding to the second input request [FIG. 5 and para. 55; receiving user input in responding the second authentication challenge];
determine, using the machine learning model, a second risk score of the entity by processing the second input and data corresponding to the second input request [FIG. 5 and para. 55; determining whether a user pass or fail the second authentication challenge];
determine a set of risk levels that the second risk score maps to [FIG. 5 and para. 55; determining whether a user pass or fail the second authentication challenge]; and
(1) allow the entity access to the first service in response to determining that the second risk score maps to a first set of risk levels [FIG. 5 and para. 55; allowing access to the resource if the second authentication is pass]; or
(2) restrict the entity from accessing the first service in response to determining that the second risk score maps to a second set of risk levels [FIG. 5 and para. 55; [FIG. 5 and para. 55; restricting access to the resource if the second authentication is failed].
As regarding claims 2 and 22, Toth further discloses The server of claim 1, wherein the first input comprises a request to access a feature of the first service [para. 7, 25 and 43-44; receiving user’s request to access one or more secured resources].
As regarding claims 3 and 23, Toth further discloses The server of claim 1, wherein the instructions further cause the processor to: map, at least, (1) a type of service and a determined risk score to one or more input requests and (2) a type of service of the first service and the first risk score to a mapped input request; and identify the mapped input request as the second input request [para. 53 and 60; mapping a type of access service and the deviation score to the request].
As regarding claims 4 and 24, Toth further discloses The server of claim 1, wherein the entity restricted from accessing the first service [para. 44; user initially needs to be authenticated using a first authentication to gain access], the instructions further cause the processor to [repeat similar steps recited in claims 1 and 21, respectively]:
determine, based on the second risk score, a third input request, different from the second input request, for the entity to access the first service [para. 50; determining a deviation score];
transmit the third input request to the first service [FIG. 5 and para. 55; transmitting a second authentication challenge];
receive a third input from the entity corresponding to the third input request [FIG. 5 and para. 55; receiving user input in responding the second authentication challenge];
determine, using the machine learning model, a third risk score of the entity, by processing the third input and data corresponding to the third input request [FIG. 5 and para. 55; determining whether a user pass or fail the second authentication challenge];
determine the set of risk levels that the third risk score maps to [FIG. 5 and para. 55; determining whether a user pass or fail the second authentication challenge]; and
(1) allow the entity access to the first service in response to determining that the third risk score maps to the first set of risk levels [FIG. 5 and para. 55; allowing access to the resource if the second authentication is pass]; or
(2) restrict the entity from accessing the first service in response to determining that the third risk score maps to the second set of risk levels [FIG. 5 and para. 55; [FIG. 5 and para. 55; restricting access to the resource if the second authentication is failed].
As regarding claims 5 and 25, Toth further discloses The server of claim 1, wherein the first input comprises data automatically retrieved from a user interface used to attempt access to the first service [para. 32 and 57; receiving user interaction data via a user interface].
As regarding claims 9 and 29, Toth further discloses The server of claim 1, wherein the one or more parameters comprise one or more of:
an access history of the entity for a second service [para. 25];
a type of access when attempting to access the first service [para. 25 and 48-51; determining a deviation score based on user behavior profile derived from previous interaction and the requested event type (e.g. balance inquiry, funds transfer, bill pay, and/or the like)]; and
a feature of the first service.
As regarding claim 11, Toth further discloses The server of claim 1, wherein the first input comprises one or more of: an indication of a location of the entity [para. 25 and 49]; an IP address of the entity [para. 25]; a User Agent (UA) string identifying a browser used by the entity to attempt to access the first service; and a type of operating system used by the entity when attempting to access the first service.
As regarding claim 22, Toth further discloses The computer-implemented method of claim 21, wherein the first input comprises a request to access a feature of the first service [para. 44; a request to login].
As regarding claim 23, Toth further discloses The computer-implemented method of claim 21, wherein identifying, based on the first risk score, comprises: mapping, at least, (1) a type of service and a determined risk score to one or more input requests and (2) a type of service of the first service and the first risk score to a mapped input request; and identifying the mapped input request as the second input request [para. 53 and 60; mapping a type of access service and the deviation score to the request].
As regarding claim 32, Toth further discloses The server of claim 1, wherein, to determine the first risk score of the entity, the instructions further cause the processor to: use one or more first machine learning models to select, from an access history associated with the entity, data relevant to the attempt to access the first service for determining the first risk score; provide the selected data and the first input as input to one or more second machine learning models; and use the one or more second machine learning models to determine the first risk score [para. 25; “A machine-learning algorithm may evaluate the user's current authentication request and behavior against the behavioral profile to determine an authentication-focused risk score or risk state”].
Claim Rejections - 35 USC § 103
9. In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
10. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
11. Claims 6 and 26 are rejected under 35 U.S.C. 103 as being unpatentable over Toth (US PG Pub. 2020/0184048) in view of Yampolskiy (US PG Pub. 2016/0173521).
As regarding claims 6 and 26, Toth discloses determining the first risk score of the entity [para. 25 and 48-51; determining a deviation score].
Toth does not explicitly disclose retrieve a previous risk score associated with the entity; and process the previous risk score and the one or more parameters, using the machine learning model, to update the previous risk score to the first risk score. However, Yampolskiy discloses it [para. 88, 92 and 99-100].
It would have been obvious to one of ordinary skill in the art at the time the effective filing of the invention to modify Toth’s system to further comprise the missing claim features, as disclosed by Yampolskiy, in order to improve identification of risk.
12. Claims 7 and 27 are rejected under 35 U.S.C. 103 as being unpatentable over Toth (US PG Pub. 2020/0184048) in view of O’Brien (US PG Pub. 2017/0103230).
As regarding claims 7 and 27, Toth does not explicitly disclose that the second input request includes one or more of a request for a document identifying the entity, or a field for an alphanumeric identifier associated with a form of identification for the entity. However, O’Brien discloses it [para. 42-42].
It would have been obvious to one of ordinary skill in the art at the time the effective filing of the invention to modify Toth’s system to further comprise the missing claim features, as disclosed by O’Brien, to allow the user to select a preferred user authentication methods from a plurality of user authentication options.
13. Claims 30 and 31 are rejected under 35 U.S.C. 103 as being unpatentable over Toth (US PG Pub. 2020/0184048) in view of Pan (US PG Pub. 2017/0103378).
As regarding claim 30, Toth further discloses The server of claim 1, wherein the one or more parameters comprise an access history associated with the entity, the access history comprising historical interaction data of the entity with the first service and a second service that is different from the first service [para. 25, 28 and 48-51; determining a deviation score based on user behavior profile derived from previous interaction and the requested event type (e.g. balance inquiry, funds transfer, bill pay, and/or the like) to access one of plurality of online services, e.g. online banking service and mobile banking service].
Toth does not explicitly disclose the first service is provided by a first service provider and the second service is provided by a second service provider different from the first service provider. However, Pan discloses it [para. 12; a plurality of online banking services provided by different banks].
It would have been obvious to one of ordinary skill in the art at the time the effective filing of the invention to modify Toth’s system to further comprise the missing claim features, as disclosed by Pan, to allow different service providers to provide online services to their customers.
As regarding claim 31, Toth and Pan further discloses The server of claim 30, wherein the machine learning model is trained using historical interaction data of the entity aggregated across a plurality of services including at least the first service and the second service [Toth para. 25 and 48-51; learning historical interaction data associated with accessing online resources to determine the deviation score].
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to THONG P TRUONG whose telephone number is (571)270-7905. The examiner can normally be reached on M-F 8:30AM - 5:30PM.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, Applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Pwu can be reached on 57127267986798. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/THONG TRUONG/
Examiner, Art Unit 2433
/JEFFREY C PWU/Supervisory Patent Examiner, Art Unit 2433
