Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This Office Action is in response to the application 18/867,084 on 11/19/2024; claims 4, 9-10, 14, and 15 have been amended; Claims 1 and 11 are independent claims. Claims 1-15 have been examined and are pending. This Action is made non-FINAL.
Drawings
The drawings were received on 11/19/2024. These drawings are reviewed and accepted by the Examiner.
Priority
This application is a 371 of PCT/US23/86508 filed on 12/29/2023 and Provisional Application No.: 63/478,140 filed on 12/31/2022. Priority date has been accepted.
Information Disclosure Statement
The information disclosure statement (IDS), submitted on 11/19/2024, is being considered by the examiner.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.\
Claims 1-3, 5-8, 10-13, and 15 are rejected under 35 U.S.C. 103 as being unpatentable over Ryan Rogers et al. (“Rogers,” Linkedln’s Audience Engagemetns API: A Privacy Preserving Data Analytics System at Scale, November 17, 2020, pages 1-28), in view of Hockenbrocht et al. (“Hockenbrocht,” US 2019/0318121).
Regarding claim 1, Rogers teaches a method in one or more servers for managing privacy budgets, the method comprising:
receiving a request to analyze a dataset (Rogers: page 6: “The application entity, based on the request received from the analyst, generates queries to the underlying database”),the dataset associated with a privacy budget corresponding to a number of times the dataset can be analyzed (Rogers: page 2, we need to implement a budgeting tool into the API so that analysts cannot repeatedly query the dataset thus making noise addition pointless."; page 13, "In order to compute the parameters (εper, δ) that we use in each call to our algorithms2 over an entire sequence of interactions with the API, we also want to know how many queries the API will allow, denoted as l* that we term the call budget, which will effectively impact δ* );
transmitting, to a first server that implements a first privacy budget service to maintain a first instance of the privacy budget (Rogers: page 7, "The application can independently invoke budget management functions, such as the following: Getting the available budget for an analyst to verify whether a query can even start to execute "; Section 4, page 8, "budget management operations require a remote call to a distributed system because the budget management service needs to provide a consistent view to all application instances.), a first request to determine whether there is sufficient privacy budget to analyze the dataset (Rogers: page 7, “Getting the available budget for an analyst to verify whether a query can even start to execute”; Rogers, Figure 1; Section 4.2, p. 9: "We create one key per analyst of a table..., and the data against the key is atomically changed when we need to update the budget.");
receiving, from the first server, a first response indicating whether there is sufficient privacy budget, according to the first privacy budget service (Rogers: Section 4.2, page 10, "To check whether an analyst's ID has enough budget to run a query that will consume at most a given cost, we use checkBudget (ID, cost), which returns either true or false "; page 8, "If the budget is exhausted for an analyst then the budget management service does not allow the query to be executed and tells the application that the analyst has exhausted their entire budget.");
processing the dataset in accordance with the first response (Rogers: page 8; “Once the budget management service allows for the query to be evaluated, the application queries Pinot as it would have without the privacy system only now with the translated query … The DP library will then run the corresponding DP algorithm on the Pinot result."; page 8, "If the budget is exhausted for an analyst then the budget management service does not allow the query to be executed."; "If the budget is exhausted for an analyst then the budget management service does not allow the query to be executed and tells the application that the analyst has exhausted their entire budget. If the budget is not depleted, yet what remains is less than the expected cost of the query, then we still do not evaluate the query.").
Rogers does not explicit disclose transmitting, to a second server that implements a second privacy budget service to maintain a second instance the privacy budget, a second request to determine whether there is sufficient privacy budget to analyze the dataset, wherein the second privacy budget service is independent from the first privacy budget service; receiving, from the second server, a second response indicating whether is sufficient privacy budget, according to the second privacy budget service; and the second response.
However, in an analogous art, Hockenbrocht discloses
a system including a second privacy budget service to maintain a second instance the privacy budget (Hockenbrocht: fig. 12, par. 00126, Group budget 1235A is a distinct budget separate from personal budget 1225A; pars. 0125-0126, each budget independently tracks its own cumulative spend and maximum spend), a second request to determine whether there is sufficient privacy budget to analyze the dataset, wherein the second privacy budget service is independent from the first privacy budget service (Hockenbrocht: par. 0133. "The differentially private security system 102 accesses one or more privacy budgets relevant to the query."; par. 0128, just because a privacy budget associated with one of a user and a group is not exceeded by a query doesn't guarantee that the query will be processed; Hockenbrocht, par. [0125]: "each user 1220 queries the table 1210 using a client 104 and is associated with a respective privacy budget (e.g., budget 1225A, budget 1225B, budget 1225C)"; par. [0126]: "Group 1230A is associated with a group budget 1235A.") Each budget instance operates independently: exhaustion of one does not affect the count of the other).
receiving a second response indicating whether is sufficient privacy budget, according to the second privacy budget service (Hockenbrocht: par. 0135, discloses: "[I]f the sums of the privacy spend and the cumulative privacy spends associated with each privacy budget corresponding to the query are each less than the maximum privacy spend allowed by the corresponding privacy budget, the query is performed."; par. 0136, "If, for at least one privacy budget, the sum of the determined privacy spend and the cumulative privacy spend corresponding to the privacy budget is instead greater than the maximum privacy spend allowed by the budget, a security policy is accessed and a security action is performed. … security action can include rejecting the query; pars. 0126, 0128.)
processing the dataset in accordance with... the second response (Hockenbrocht: discloses: par. 0128, "[J]ust because a privacy budget associated with one of a user and a group is not exceeded by a query doesn't guarantee that the query will be processed."; par. 0135, "If the sums... associated with each privacy budget... are each less than the maximum privacy spend... the query is performed."); par. 0136, If, for at least one privacy budget, the sum of the determined privacy spend and the cumulative privacy spend corresponding to the privacy budget is instead greater than the maximum privacy spend allowed by the budget, a security policy is accessed and a security action is performed . A security policy defines one or more security actions to be performed in response to the cumulative privacy spend associated with a query request exceeding a budget. For instance, a security action can include rejecting the query).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Hockenbrocht with the method and system of Rogers to include transmitting, to a second server that implements a second privacy budget service to maintain a second instance the privacy budget, a second request to determine whether there is sufficient privacy budget to analyze the dataset, wherein the second privacy budget service is independent from the first privacy budget service); receiving, from the second server, a second response indicating whether is sufficient privacy budget, according to the second privacy budget service; and processing the dataset in accordance with... the second response. One of ordinary skill would have been motivated to implement Rogers' distributed budget management architecture with two independent budget service instances — specifically, deploying Hockenbrocht's second independent budget instance on a second server and transmitting a request to it — for the following reasons.
Reason 1: Rogers identifies the need. Rogers expressly recognizes that the budget management service “needs to provide a consistent view to all application instances” (Rogers, page 8) and privacy budget management service that is able to track each analyst's privacy budget over multiple data centers. Hence, we can ensure the budget is enforced across large scale systems in real-time (Rogers, page 2) Hockenbrocht's two independent budget instances directly solve this problem.
Reason 2: Hockenbrocht states the purpose. Hockenbrocht expressly teaches that "[b]udget tracking can prevent situations where multiple independent entities can collectively query a differentially private database, and can combine results to obtain more information about the underlying data...than would otherwise be permissible." (Hockenbrocht, para. [0131].) This directly motivates deploying each of Hockenbrocht's independent budget instances on a separate server — as Rogers' architecture already provides — to prevent coordinated circumvention across independent data centers.
Reason 3: The combination yields predictable results. Both references address the same problem: enforcing a strict privacy budget to prevent dataset reconstruction. Hockenbrocht teaches that processing proceeds only when each independent budget instance confirms sufficiency — "the sums...associated with each privacy budget...are each less than the maximum...the query is performed." (Hockenbrocht, para. [0135].) Applying Hockenbrocht's two independent budget instances to Rogers' existing distributed server architecture is a predictable combination with no unexpected results. Maintaining two independent budget instances that both must approve before processing is a well-known design pattern for tamper resistance. KSR Int'l Co. v. Teleflex Inc., 550 U.S. 398 (2007).
Regarding claim 2, the combination of Rogers and Hockenbrocht teaches the method of claim 1. The combination of Rogers and Hockenbrocht further teaches, wherein the processing includes:
determining that the first response and the second response both indicate there is sufficient privacy budget (Rogers: page 10, teaches that the budget management service determines whether sufficient budget exists via the checkBudget (ID, cost) function call which returns true or false; Hockenbrocht: par. [0135], "the sums...associated with each privacy budget...are each less than the maximum privacy spend...the query is performed."); par. [0128], teaches that "just because a privacy budget associated with one of a user and a group is not exceeded by a query doesn't guarantee that the query will be processed."); and
in response to the determining, analyzing the dataset and storing the results of the analyzing (Hockenbrocht: par. [0135], teaches that when both budget instances confirm sufficiency, the query is performed; Rogers: Figure 1, Data Store, page 9, Section 4.2 Espresso store).
Regarding claim 3, the combination of Rogers and Hockenbrocht teaches the method of claim 1. The combination of Rogers and Hockenbrocht further teaches wherein the processing includes:
analyzing the dataset (Rogers: page 6, "The application entity, based on the request received from the analyst, generates queries to the underlying database.");
determining that the first response and the second response both indicate there is sufficient privacy budget (Rogers: page 10, teaches that the budget management service determines whether sufficient budget exists via the checkBudget (ID, cost) function call which returns true or false; Hockenbrocht: par. 0135, "the sums...associated with each privacy budget...are each less than the maximum privacy spend...the query is performed."; par. 0128, further teaches that "just because a privacy budget associated with one of a user and a group is not exceeded by a query doesn't guarantee that the query will be processed."); and
in response to the determining, storing the results of the analyzing (Rogers: discloses an explicit Data Store component in its system architecture (Rogers, Figure 1) and uses an Espresso key-value store for data management. (Rogers, page 9.); Hockenbrocht: par. [0135], teaches that when BOTH budget instances confirm sufficiency, the query is performed and results are produced).
Regarding claim 5, the combination of Rogers and Hockenbrocht teaches the method of claim 1. The combination of Rogers and Hockenbrocht further teaches, wherein the processing includes:
determining that the first response indicates there is sufficient privacy budget and that the second response indicates there is insufficient privacy budget (Rogers: page 10, teaches that the budget management service determines whether sufficient budget exists via the checkBudget (ID, cost) function call which returns true or false; Hockenbrocht: par. 0128, "just because a privacy budget associated with one of a user and a group is not exceeded by a query doesn't guarantee that the query will be processed."; par. 0136, "if, for at least one privacy budget, the sum...is greater than the maximum privacy spend...a security action is performed."); and
in response to the determining, refraining from analyzing the dataset (Rogers: page 8, "does not allow the query to be executed."; Hockenbrocht: par. 0136, "a security action can include rejecting the query.").
Regarding claim 6, the combination of Rogers and Hockenbrocht teaches the method of claim 1. The combination of Rogers and Hockenbrocht further teaches wherein the processing includes:
analyzing the dataset (Rogers: page 6, "The application entity, based on the request received from the analyst, generates queries to the underlying database.").
determining that the first response indicates there is sufficient privacy budget and that the second response indicates there is insufficient privacy budget (Rogers: page 10, teaches that the budget management service determines whether sufficient budget exists via the checkBudget (ID, cost) function call which returns true or false; Hockenbrocht: par. 0128, "just because a privacy budget associated with one of a user and a group is not exceeded by a query doesn't guarantee that the query will be processed."; par. 0136, "if, for at least one privacy budget, the sum...is greater than the maximum privacy spend...a security action is performed."); and
in response to the determining, refraining from storing the results of the analyzing (Rogers: fig. 1, discloses an explicit Data Store component in its system architecture and uses an Espresso key-value store for data management; page 8, "does not allow the query to be executed."; Hockenbrocht: par. 0146, teaches that when at least one budget instance indicates insufficient, a security action is performed .. "providing a complete or partial set of query results to the client device while notifying the administrator or database manager that the query exceeded the maximum privacy spend.").
Regarding claim 7, the combination of Rogers and Hockenbrocht teaches the method of claim 1. The combination of Rogers and Hockenbrocht teaches wherein the processing includes:
determining that the first response and the second response both indicate there is insufficient privacy budget (Rogers teaches that the budget management service determines whether sufficient budget exists via the checkBudget(ID, cost) function call which returns true or false — false indicating insufficient budget. (Rogers, p. 10.) Hockenbrocht: par. 0135, a system maintaining two independent privacy budget instances — a personal budget and a group budget — and explicitly requires that EACH budget instance be evaluated before processing is permitted; Hockenbrocht: par. 0135, "the sums...associated with each privacy budget...are each less than the maximum privacy spend...the query is performed." "if, for at least one privacy budget, the sum...is greater than the maximum privacy spend...a security action is performed."); and
(b)in response to the determining, refraining from analyzing the dataset (Rogers: page 8, "does not allow the query to be executed.")
Regarding claim 8, the combination of Rogers and Hockenbrocht teaches the method of claim 1. The combination of Rogers and Hockenbrocht further teaches, wherein the processing includes:
analyzing the dataset (Rogers: page 6, "The application entity, based on the request received from the analyst, generates queries to the underlying database.");
determining that the first response and the second response both indicate there is insufficient privacy budget (Rogers teaches that the budget management service determines whether sufficient budget exists via the checkBudget (ID, cost) function call which returns true or false (Rogers, p. 10.); Hockenbrocht: par. 0135, teaches a system maintaining two independent privacy budget instances — a personal budget and a group budget; Hockenbrocht: par. 0135, "the sums...associated with each privacy budget...are each less than the maximum privacy spend...the query is performed."; par. 0136, "if, for at least one privacy budget, the sum...is greater than the maximum privacy spend...a security action is performed."); and
in response to the determining, refraining from storing the results of the analyzing (Rogers: fig. 1, discloses an explicit Data Store component in its system architecture and uses an Espresso key-value store for data management (Rogers, page 9); page 8, "does not allow the query to be executed."; Hockenbrocht: par. 0146, teaches that when at least one budget instance indicates insufficient, a security action is performed .. "providing a complete or partial set of query results to the client device while notifying the administrator or database manager that the query exceeded the maximum privacy spend.").
Regarding claim 10, the combination of Rogers and Hockenbrocht teaches the method of claim. The combination of Rogers and Hockenbrocht further teaches, wherein transmitting the first request includes: transmitting the first request via an application programming interface (API) call to the first privacy budget service (Rogers: page 2, we need to implement a budgeting tool into the API so that analysts cannot repeatedly query the dataset thus making noise addition pointless." ;page 8,“remote call to distributed system”; Section 4.2, page 10, "To check whether an analyst's ID has enough budget to run a query that will consume at most a given cost, we use checkBudget (ID, cost), which returns either true or false ")
Regarding claim 11, claim 11 is directed to a computing system for managing privacy budgets, the computing system comprising: one or more servers (Rogers: fig. 1; page 9, servers) ; and a non-transitory computer-readable medium (Rogers: fig. 1) storing instructions thereon that, when executed by the one or more servers associated with the method claimed in claim 1; claim 11 is similar in scope to claim 1, and is therefore rejected under similar rationale.
Regarding claim 12, claim 12 is similar in scope to claim 2, and is therefore rejected under similar rationale.
Regarding claim 13, the combination of Rogers and Hockenbrocht teaches the computing system of claim 11. The combination of Rogers and Hockenbrocht further teaches, wherein, to process the dataset, the instructions cause the computing system to:
determine that at least one of the first response or the second response indicates there is insufficient privacy budget (Rogers: page 10, teaches that the budget management service determines whether sufficient budget exists via the checkBudget (ID, cost) function call which returns true or false; Hockenbrocht: par. 0136, "if, for at least one privacy budget, the sum...is greater than the maximum privacy spend...a security action is performed."; par. 0135, "the sums...associated with each privacy budget...are each less than the maximum privacy spend...the query is performed"); and
in response to the determining, refrain from analyzing the dataset (Rogers: page 8, "does not allow the query to be executed.").
Regarding claim 15, claim 15 is similar in scope to claim 10, and is therefore rejected under similar rationale.
Claim 4 is rejected under 35 U.S.C. 103 as being unpatentable over Ryan Rogers et al. (“Rogers,” Linkedln’s Audience Engagemetns API: A Privacy Preserving Data Analytics System at Scale, November 17, 2020, pages 1-28), in view of Hockenbrocht et al. (“Hockenbrocht,” US 2019/0318121), further in view of Bernau et al. (“Bernau,” US 10,380,366).
Regarding claim 4, the combination of Rogers and Hockenbrocht teaches the method of claim 2. The combination of Rogers and Hockenbrocht, further teaches comprising:
causing the first privacy budget service and the second private budget service to decrement the first instance of the privacy budget and the second instance of the privacy budget (Rogers: page 8, " If the budget is not depleted, yet what remains is less than the expected cost"; Rogers: Section 6.1, pages 13-14 "each access must deduct from the same budget."; Hockenbrocht, par. 0134, "for each privacy budget, the privacy spend associated with the query is added to the cumulative spend to determine if the sum exceeds the maximum privacy spend."; pars. [0125]-[0126], [0134], Hockenbrocht teaches both the personal budget 1225A and group budget 1235A are each independently updated per query) but does not explicitly disclose “atomically”.
However, in an analogous art, Bernau teaches a privacy budget management system in which privacy budget balance updates are recorded via a distributed ledger (Bernau: abstract, updates the balance for the privacy budget in the distributed ledger) Bernau further teaches that the privacy budget and associated data are stored in distributed ledger (Bernau: abstract, "a privacy budget for the data offer...stored in the distributed ledger).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of Bernau with the method and system of Rogers and Hockenbrocht to include “automatically”. One would have been motivated to ensure atomic all-or-nothing updates across distributed nodes (Bernau: abstract) One of ordinary skill in the art a reading Rogers' requirement for consistent cross-datacenter budget deduction and Hockenbrocht's requirement that each independent budget instance be decremented per query would have been motivated to apply Bernau's atomic distributed ledger update technique to ensure that both the first and second budget instances are decremented atomically — preventing the budget inconsistency that would result if one instance were decremented but the other were not due to a system failure between the two decrements. The combination yields predictable results with no unexpected outcomes. KSR Int'l Co. v. Teleflex Inc., 550 U.S. 398 (2007).
Claim 9 and 14 are rejected under 35 U.S.C. 103 as being unpatentable over Ryan Rogers et al. (“Rogers,” Linkedln’s Audience Engagemetns API: A Privacy Preserving Data Analytics System at Scale, November 17, 2020, pages 1-28), in view of Hockenbrocht et al. (“Hockenbrocht,” US 2019/0318121), further in view of Frank McSherry (“McSherry,” Privacy Integrated Queries An Extensible Platform for Privacy-Preserving Data Analysis, 2009, pages 1-20).
Regarding claim 9, the combination of Rogers and Hockenbrocht teaches the method of claim. The combination of Rogers and Hockenbrocht discloses dataset, the first privacy, and receiving the request to process the dataset but does not explicitly disclose wherein: “the dataset is included in a group of datasets,” “the privacy budget is defined for the group of datasets” and “receiving the request to process the dataset includes receiving a request to process the group of datasets.
However, in an analogous art, McSherry discloses
the dataset is included in a group of datasets (McSherry: page 19, Col. 2, integrated multiple independent data sources”; page 20, Col. 1, Data providers can use Privacy Integrated Queries (PINQ) to wrap arbitrary LINQ data sources), and
the privacy budget is defined for the group of datasets (McSherry: page 20, Col. 2, Data providers can use PINQ to wrap arbitrary LINQ data sources with a specified privacy allotment for each analyst.)
receiving the request to process the dataset includes receiving a request to process the group of datasets (McSherry: page 19, Col. 2, “analyses integrating multiple independent data sources”).
Therefore, it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine the teachings of McSherry with the method and system of Rogers and Hockenbrocht to include the dataset is included in a group of datasets, the privacy budget is defined for the group of datasets and receiving the request to process the dataset includes receiving a request to process the group of datasets . One would have been motivated to organize multiple data sources under a single privacy allotment – a natural and well-known database management technique. The combination yields predictable result no unexpected outcomes. KSR Int’l Co. v. Teleflex., 550 U.S. 398 (2007).
Regarding claim 14, claim 14 is similar in scope to claim 9, and is therefore rejected under similar rationale.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to CANH LE whose telephone number is (571)270-1380. The examiner can normally be reached on Monday to Friday 6:00AM to 3:30PM other Friday off.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Luu Pham, can be reached at telephone number 571-270-5002. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from Patent Center and the Private Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from Patent Center or Private PAIR. Status information for unpublished applications is available through Patent Center and Private PAIR for authorized users only. Should you have questions about access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) Form at https://www.uspto.gov/patents/uspto-automated- interview-request-air-form.
/Canh Le/
Examiner, Art Unit 2439
March 5th, 2025
/LUU T PHAM/Supervisory Patent Examiner, Art Unit 2439