Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 9/2/26 has been entered.
Claims 1, 3-11, 13-19, and 21 are pending.
Response to Arguments
Applicant’s arguments with respect to claim(s) 1, 3-11, 13-19, and 21 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1, 3, 5-8, 10, 11, 13, 15-19, and 21 is/are rejected under 35 U.S.C. 103 as being unpatentable over USP Application Publication 2023/0075296 to Morley, III et al., hereinafter Morley in view of USP 12,647,411 to Dong et al., hereinafter Dong.
As per claims 1, 11, and 21, Morley teaches a method for managing access control to one or more resources, the method comprising:
receiving a permission request for a user to access the one or more resources [login to application generates an identity token; 0075 and 0079];
generating an access request based at least in part on the permission request [application service, according to identity token, identifies user attribute set relevant to the application for providing suitable permissions and access levels; 0079];
notifying one or more reviewers to review the access request [communicate with authentication service; 0081];
receiving an indication of the access request being approved [new identity token received; 0082]; and
automatically granting permission to the user to access the one or more resources [sends new token to identity provider to complete the login of the user; 0082];
wherein the generating an access request includes:
determining a desired level of access for the user to access the one or more resources based on the permission request, [access level not sufficient for the request application; 0080] the desired level of access including a first set of security primitives [set of application specific user attributes needed to access a specific application; 0029];
determining a difference between the desired level of access and an existing level of access for the user [difference between what is sufficient and what was included with included identity token (0061); 0079-0081]; and
generating the access request based at least in part on the difference [coordinates with authentication server when the access level of the identity token was insufficient for the required application per the authorization policy. An appropriate authentication mechanism is chosen that would allow a new identity token creation which contains the permission needed to access the desired application where the initial identity did not possess on account of the previous authentication mechanism; 0081];
wherein the method is performed by one or more processors (0039).
Morley is silent in explicitly teaching the existing level of access for the user including a second set of security primitives, the difference between the desired level of access and an existing level of access for the user including a difference subset of security primitives that is a subset of the first set of security primitives, the subset of the first set of security primitives being not in the second set of security primitives; and generating the access request based at least in part on the difference subset of security primitives. On the other hand Dong teaches the existing level of access for the user including a second set of security primitives, the difference between the desired level of access and an existing level of access for the user including a difference subset of security primitives that is a subset of the first set of security primitives, the subset of the first set of security primitives being not in the second set of security primitives; and generating the access request based at least in part on the difference subset of security primitives [Table 2, and col. 30, lines 13-22 and col. 32, lines 49-61]. Dong teaches a desired level needed to access a server. The desired level is the goal authentication level a user needs to be granted access. This is the total needed from the sum of what the user currently has plus what additional security primitive that must be satisfied in order to raise the user to the goal. In Morley the goal is the set of application specific user attributes needed to access a specific application. Morley also looks at the current user’s access level and compares to what the application requires. Dong raises the level using the criteria shown in Table 2 which shows a simply log-in may not be enough to satisfy the goal. The system then requests other security primitives such as OTP over SMS. Where the subset of first set of security primitives are all of the ones above what the user has, the system only needs to use one in that set to raise the current level to the goal level. In the example given, the user is level 5, needs level 15, so the system requests the OTP SMS having level 10, to raise total level to 15 in order to meet the security requirements. The system of Morley could have implemented this process in order to guide the user into elevating his/her access level. After completing the extra challenges, the new level could be carried in the new token. In this situation the token is not the security primitive but rather the authentication information relied upon to meet the necessary security level. The token is merely the envelope to convey that certain authentication protocols have taken place. In Dong, the set of higher order primitives do not include the existing primitive that the user already has. The claim is obvious because one of ordinary skill in the art can combine methods known before the effective filing date which produce predictable results.
As per claims 3 and 13, Morley teaches the generating an access request includes:
determining a plurality of desired levels of access, wherein each desired level of access of the plurality of desired levels of access provides the user access to the one or more resources [the application profile identifies a user attributes set relevant to the application for providing suitable permissions and access levels to the user; 0079];
determining a plurality of differences between the plurality of desired levels of access and an existing level of access for the user, wherein each difference of the plurality of differences is a respective difference between a desired level of access of the plurality of desired levels of access and the existing level of access [the included token is used to retrieve the user attributes which constitutes the existing level of access; 0079];
selecting a minimum difference from the plurality of differences [system requires the user to bring up their level of access to meet the required levels of access for the application; 0080 and 0081]; and
generating the access request based at least in part on the minimum difference [authentication service handles authentication to the required level; 0081].
As per claims 5 and 15, Morley teaches prior to receiving the permission request: denying the user access to the one or more resources; and in response to the denying, displaying a user interface for the user to request permission to access the one or more resources, wherein the permission request is received via the displayed user interface [the process is interpreted as the user opening the application and receiving a login screen as shown in 0029. The user is then initially authenticated and an identity token is generated. This identity token is then utilized as described previously in 0079-0080. The user must login or everything after that is denied.]
As per claims 6 and 16, Morley teaches the notifying one or more reviewers to review the access request includes: prompting the user or the one or more reviewers to take one or more actions (0081).
As per claims 7 and 17, Morley teaches the one or more actions include uploading a document or completing a checkpoint [new identity token is received; 0082].
As per claims 8 and 18, Morley teaches the notifying one or more reviewers to review the access request comprises: asking the user or the one or more reviewers to update the permission request for the user to access the one or more resources (0081); and in response to the asking, receiving an updated permission request [new identity token; 0082].
As per claims 10 and 19, Morley teaches the permission request is a blind permission request and does not include a prompt indicating why the user should have access (0075 and 0079).
Claims 4 and 14 are rejected under 35 U.S.C. 103 as being unpatentable over Morley and Dong as applied to claim 1 above, and further in view of USP Application Publication 2022/04054512 to Mustafi et al., hereinafter Mustafi.
As per claims 4 and 14, Morley and Dong are silent in explicitly teaching the one or more resources include a marking, and wherein the marking corresponds to at least one selected from a group consisting of a sensitivity level, a training level, a user type, and an organization type. Mustafi teaches the one or more resources include a marking, and wherein the marking corresponds to at least one selected from a group consisting of a sensitivity level (0011 and 0037) as a means to determine what access level is required for a given resource. Morley already determines this same idea in terms of access level requirement when a resource request is made. Marking the resource as taught by Mustafi is an obvious way to indicate the access level requirement. The claim is obvious because one of ordinary skill in the art can combine methods known before the effective filing date which produce predictable results.
Claim 9 is rejected under 35 U.S.C. 103 as being unpatentable over Morley and Dong as applied to claim 1 above, and further in view of USP Application Publication 2022/0164465 to Prettejohn et al., hereinafter Prettejohn.
As per claim 9, Morley and Dong are silent in explicitly teaching the permission request includes a prompt indicating why the user should have access. Prettejohn teaches the permission request includes a prompt indicating why the user should have access (0122). Specifically, Prettejohn teaches a user given a reason or justification as to why a user needs access to a data asset. Including this information could have assisted the decision making of Morley when the initial identity token lacks sufficient attributes to access the request resource. Morley even teaching AI overriding certain decisions of the access control process (0083). If justification was given as taught by Prettejohn, the system could detect times where access should be given if outside of the normal policy driven process. The claim is obvious because one of ordinary skill in the art can combine methods known before the effective filing date which produce predictable results.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MICHAEL R. VAUGHAN whose telephone number is (571)270-7316. The examiner can normally be reached on Monday - Friday, 9:30am - 5:30pm, EST. If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lynn Feild can be reached on (571) 272-2092. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MICHAEL R VAUGHAN/
Primary Examiner, Art Unit 2431
Prosecution Insights