DETAILED ACTION
Response to Arguments
Claims 1-20 are currently pending. Claims 1, 4, 5, 17, 19, and 20 were amended.
35 U.S.C. § 112(b)
The rejection of claims 4, 5, and 19 under 35 U.S.C. § 112(b) as being indefinite had been withdrawn in view of the arguments presented on pg. 8 of the REMARKS filed on May 22, 2026.
35 U.S.C. § 101
Applicant argues on pp. 10-11 of the REMARKS that the independent claims do not recite a judicial exception and recite features that integrate any alleged judicial exception into a practical application. The arguments have been fully considered and are not persuasive.
Applicant argues on pg. 10 of the REMARKS that amended independent claim 1 recites features that cannot be performed in the human mind. However, the Examiner respectfully disagrees. According to MPEP 2106.04(a):
Examiners should determine whether a claim recites an abstract idea by (1) identifying the specific limitation(s) in the claim under examination that the examiner believes recites an abstract idea, and (2) determining whether the identified limitations(s) fall within at least one of the groupings of abstract ideas listed above. The groupings of abstract ideas, and their relationship to the body of judicial precedent, are further discussed in MPEP § 2106.04(a)(2).
If the identified limitation(s) falls within at least one of the groupings of abstract ideas, it is reasonable to conclude that the claim recites an abstract idea in Step 2A Prong One. The claim then requires further analysis in Step 2A Prong Two, to determine whether any additional elements in the claim integrate the abstract idea into a practical application, see MPEP § 2106.04(d).
It is noted that not every step in a claim is analyzed to determine the presence of an abstract idea (e.g., mental processes, mathematical concepts). Herein, only the “converting” and “analyzing” limitations are identified as the abstract ideas of mathematical concepts and mental processes. This is further discussed in Claim Rejections - 35 USC § 101. Specifically, conversion (transformation) of digital data was identified as mathematical concepts. See MPEP 2106.04(a)(2)(I): “The Supreme Court has identified a number of concepts falling within this grouping as abstract ideas including: a procedure for converting binary-coded decimal numerals into pure binary form, Gottschalk v. Benson, 409 U.S. 63, 65, 175 USPQ2d 673, 674 (1972).” Furthermore, analyzing data, without providing details to that analysis, can include human mind processes under broadest reasonable interpretation (BRI). The inclusion of the term “data structures” to the claimed steps is not sufficient to preclude any mental activities, as the data structures are not explicitly defined in any context to preclude such activities. Furthermore, the analysis of various data structures is possible via the human mind or via paper/pen – e.g., comparing numbers in an array, a record, or a tuple, etc.) The analysis fails to provide any steps, details, and/or context to that would have made mental processes impossible – e.g., accessing specific memory addresses to manipulate a stored data structure. The remaining steps and features are analyzed as additional elements under Step 2A Prong Two. For example, while it is true that “outputting…via an output interface of the DMS” is not a mental process, it is an additional element that is analyzed under Step 2A Prong Two to determine if such element integrates the abstract idea into a practical application. In this case, the output step is merely displaying data on a screen. This is a post-solution activity of outputting data, which was identified by the courts as insignificant extra-solution activity. Simply displaying results of the analysis is not an active improvement to the functioning of computer. Furthermore, the “obtaining” step is mere data gathering. See MPEP 2106.05(g): “Selecting a particular data source or type of data to be manipulated.”
Furthermore, Applicant argues on pg. 11 that the features of “converting” and “analyzing” improve the functioning of a computer system by normalizing the format of the data structures before the analysis. However, the Examiner respectfully disagrees. The steps of “converting” and “analyzing” merely produces a desired outcome (e.g., “one or more permission sets” and “one or more valid permissions”) rather than the idea of the outcome. See MPEP 2106.05(a). Specifically, how are valid permissions selected from the permission sets to generating the listing? If the alleged improvement of the claimed invention relies on the presentation of the listing, then how that listing is obtained and structured should be presented more than conclusory results of converting and analyzing.
The same response provided above are also applicable to the arguments provided for independent claims 17 and 20.
35 U.S.C. § 103
Applicant argues on pg. 13 of the REMARKS that “updating permission data by revoking incompatible permissions is not the same as ‘analyzing, by the DMS the data structures corresponding to the one or more permission sets to select one or more valid permission sets,’ as recited in amended independent claim 1.” However, the Examiner respectfully disagrees. The limitations recite: “analyzing, by the DMS, the data structures corresponding to the one or more permission sets to select one or more valid permission sets”. The scope of what is considered valid, or invalid, is not explicitly defined in the limitations. Furthermore, the “analyzing” process is also not explicitly described in detail more than data structures merely being analyzed. Therefore, the analysis process is applied under broadest reasonable interpretation (BRI), such that the interpretation is open-ended regarding what aspects of the data structures are analyzed and how is validity determined. According to [Philip, ¶0032], the access permission data is converted into a normalized format, which may “remove duplicate data, resolve conflicting data, convert the data into a format that allows for further processing and analysis, and/or consolidate the data into an organized structure.” After the conversion, [Philip, ¶0035, 0039] discloses identifying incompatible access permissions, such that they are revoked. A set of updated access permission data is produced, such that only compatible access permissions are included (“…production protection computing platform 110 may produce updated access permission data that includes only compatible access permissions…” [Philip, ¶0039]). Thus, Philip reads upon the amended limitations of independent claim 1, and likewise for independent claims 17 and 20.
Furthermore, Applicant argues on pp. 13-14 of the REMARKS that “transmitting updated access permission data is not the same as ‘outputting...a listing…wherein the list indicates, for the one or more files, respective sets of principal accounts and associated respective access permissions,’ as recited in amended independent claim 1.” However, the Examiner respectfully disagrees. Philips also discloses generating and sending, via a communication interface, “a graphical representation of the updated permission data,” which is displayed to “help an enterprise user understand and visualize current access permissions.” See [Philip, ¶0037, 0041]. The permissions comprise of entitlements to access for resources, which in view of Botz include files. See [Philip, ¶0033]. Thus, Philip reads upon the amended limitations of independent claim 1, and likewise for independent claims 17 and 20.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
For step 1, a claim is determined whether it falls within one of the four statutory categories. Claims 1-16 are directed to a method, claims 17-19 are directed to an apparatus, and claim 20 is directed to a non-transitory computer-readable medium storing code comprising instructions. Therefore, the claims fall within at least one of the statutory categories of invention and passes step 1.
For step 2A (Prong One), a claim is determined whether it recites an abstract idea, law of nature, or natural phenomenon. Independent claims 1, 17, and 19 recite limitations for: "converting..." and "analyzing...". However, there are no elements recited in those limitations that would preclude them from being practically performed in the mind, or with pen/paper, under broadest reasonable interpretation (BRI). But for the "by a data management system", these limitations recite mental steps. Under BRI, “converting” data is directed to mathematical concepts: “organizing information and manipulating information through mathematical correlations, Digitech Image Techs., LLC v. Electronics for Imaging, Inc., 758 F.3d 1344, 1350, 111 USPQ2d 1717, 1721 (Fed. Cir. 2014). The patentee in Digitech claimed methods of generating first and second data by taking existing information, manipulating the data using mathematical functions, and organizing this information into a new form. The court explained that such claims were directed to an abstract idea because they described a process of organizing information through mathematical correlations, like Flook's method of calculating using a mathematical formula. 758 F.3d at 1350, 111 USPQ2d at 1721.” See MPEP 2106.04(a)(2). Under BRI, “analyzing” data is directed to mental processes: “claims do recite a mental process when they contain limitations that can practically be performed in the human mind, including for example, observations, evaluations, judgments, and opinions… a claim to "collecting information, analyzing it, and displaying certain results of the collection and analysis," where the data analysis steps are recited at a high level of generality such that they could practically be performed in the human mind, Electric Power Group v. Alstom, S.A., 830 F.3d 1350, 1353-54, 119 USPQ2d 1739, 1741-42 (Fed. Cir. 2016).” See MPEP 2106(a)(2). Thus, the independent claims present at least one limitation that falls within the “Mathematical Concepts” and "Mental Processes" groupings of abstract ideas. Accordingly, the independent claims recite an abstract idea.
For step 2A (Prong Two), a claim is determined whether it recites additional elements that integrate the judicial exception into a practical application. These additional elements are: “data structures”, “obtaining…a plurality of access information sources…”, "by a data management system (DMS)" and "a storage environment", and “outputting…a listing via an output interface of the DMS…” The DMS is disclosed in one embodiment as a generic computer (see [0109] of the originally filed specifications) for the purpose of executing the abstract idea. The recitation of a storage environment accessible to the DMS only describes a relationship between the storage environment and the DMS. There is no interaction claimed between the storage environment and DMS (e.g., the DMS does not modify or update the storage based on the claimed steps). Hence, this relationship merely links the use of the abstract idea to a technological environment. See MPEP 2106.04(d)(I). Furthermore, the inclusion of the term “data structures” do not automatically preclude the limitations from being performed mental and/or via paper and pen. Herein, specific “data structures” are not explicitly defined, nor are these data structures are manipulated in a manner that excludes possible mental processes. Furthermore, the elements for “obtaining” and “outputting” are insignificant extra-solution activity. The obtaining step is mere data gathering from a particular data source or type of data. Such activities were found by the courts to be insignificant extra-solution activities. Similarly, merely outputting data is also insignificant extra-solution activity. See MPEP 2106.05(g).
For step 2B, a claim is determined whether any elements, or combination of elements, are enough to ensure that the claims amount to significantly more than the judicial exception. As discussed above with respect to integration of the abstract idea into a practical application, the additional elements to perform the steps amounts to no more than mere instructions to apply the exception using a generic computer component. Since these elements are recited at high level of generality, such that they can be represented as ordinary computer systems. Mere instructions to apply an exception using a generic computer component cannot provide an inventive concept. Having an apparatus with a processor to perform such elements does not instantly preclude it from mental activities if the act itself is presented in a generic/abstract manner - it would be mere instructions to apply an exception (see MPEP 2106.05(f)). Hence, the independent claims are not patent eligible. Furthermore, generally linking the use of the judicial exception to a particular technological environment does not integrate the exception into a practical application (see MPEP 2106.04(d) and MPEP 2106.05(h)).
Dependent Claims: The dependent claims recite additional mental steps. Furthermore, the dependent claims further describe the characteristics of the permissions. However, these are nominal limitations that do not provide more than an insignificant relationship to the exception. Furthermore, the dependent claims describe additional steps (e.g., displaying, identifying, converting, selecting, generating, updating) which do not exclude the possibility of mental processes and/or mathematical concepts. Thus, none of the elements in the limitations of the dependent claims would preclude them from being performed mentally nor do they present additional meaningful elements that are more than an abstract idea
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 10 and 11 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 10 recites “wherein generating the listing comprises” and is dependent on claim 1. It is unclear what features claim 10 are further limiting as parent claim 1 does not recite any steps for “generating”. Claim 11 is dependent on claim 1 and similarly rejected.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-3, 6, 10, 15-18, and 20 are rejected under 35 U.S.C. 103 as being unpatentable over US 2021/0406391 to Philip et al. (hereinafter, “Philip”) in view of US 2008/0172720 to Botz et al. (hereinafter, “Botz”).
As per claim 1: Philip discloses: A method (a method [Philip, ¶0044]), comprising: obtaining, by a data management system (DMS), a plurality of access information sources (a computing platform accesses permission data aggregated from a plurality of data sources [Philip, ¶0044; Fig. 4(405)]; permissions refer to a set of access rights that users can perform on resources [Philip, ¶0033]; the access permission data have different formats based on the subsequent process of normalization/conversion); converting, by the DMS, the plurality of access information sources to one or more permission sets that comprise data structures each having a same format (convert the access permission data into a normalized format [Philip, ¶0044; Fig. 4(410)]; the normalization includes converting data into a format to consolidate the data into an organized structure [Philip, ¶0032]; therefore, the access permission data from the plurality data sources would inherently have different formats); analyzing, by the DMS, the data structures corresponding to the one or more permission sets to select one or more valid permission sets from among the one or more permission sets (user-specific entitlements based on the normalized permission data are identified and user roles classified and tagged, wherein based on the tagging of the normalized permission data, users having one or more toxic permissions are removed – for example, a toxic permission may be an incompatible access permission with conflicting nature [Philip, ¶0039, 0044]; therefore, a set of “valid” permissions is obtained by removing the toxic permissions); and outputting, by the DMS and based at least in part on the one or more valid permission sets, a listing via an output interface of the DMS, wherein the listing indicates, for the one or more files, respective sets of principal accounts and associated respective access permission levels (revoking the toxic permissions to produce an updated access permission data that is provided to a system of record [Philip, ¶0044]; normalized permission data can include user-specific entitlements referring to the association between a user, a resource, and a permission for read, write, or execute access rights (“permission levels”) [Philip, ¶0033]; generating and sending, via a communication interface, a graphical representation of the updated permission data, which is displayed to help an enterprise user understand and visualize current access permissions [Philips, ¶0037, 0041]).
Philip does not explicitly disclose the resources as “files” and having an owner (e.g., “respective owner accounts associated with the one or more files”). However, Botz is directed to analogous art for administering access permissions for computer resources [Botz, ¶0010]. Botz discloses: a storage environment that stores files (users accessing computer data and network resources, wherein resources include files [Botz, ¶0018]); and respective owner accounts associated with the one or more files (a record representing a computer resource includes at least a resource identification field and an owner identification field [Botz, ¶0034]).
Thus, it would have been obvious to a person having ordinary skill in the art before the effective filing date of the claimed invention to include any additional data for the entitlements to any type of resources in Philip, such as the owner identifications to the file data described in Botz. One would have been motivated to try different types of entitlement information with a reasonable expectation of success. This modification would have enabled access control systems to have greater granularity and/or wider scope for defining permissions to the resources in Philip.
As per claim 2: Philip in view of Botz disclose all limitations of claim 1. Furthermore, Philip discloses: further comprising: causing display, via a user interface associated with an administrative user of the DMS and for the one or more files, of the respective sets of principal accounts and the associated respective access permission levels (presenting the normalized permission data via one or more graphical user interface, such as depicted in Fig. 3 [Philip, ¶0037-0038; Fig. 3]).
As per claim 3: Philip in view of Botz disclose all limitations of claim 2. Furthermore, Philip discloses: further comprising: identifying, after displaying the listing, an update to one or more access information sources of the plurality of access information sources (the graphical user interface can include text and/or other information indicating one or more toxic permission, in which can be revoked to produce updated access permission data that can be displayed as a graphical representation [Philip, ¶0038-0041]).
As per claim 6: Philip in view of Botz disclose all limitations of claim 1. Furthermore, Philip discloses: wherein a permission set of the one or more permission sets comprises an indication of a set of files, an indication of a set of users, and an access permission of the set of users for the set of files (user-specific entitlements, where a user may be assigned an entitlement indicating a resource the user is entitled to access and defining a set of permissions regarding such access [Philip, ¶0033]).
As per claim 10: Philip in view of Botz disclose all limitations of claim 1. Furthermore, Philip discloses: wherein generating the listing comprises: omitting a first permission set of the one or more permission sets from the listing based at least in part on the first permission set contradicting a second permission set of the one or more valid permission sets (identifying toxic permissions and revoking incompatible access permissions to produce updated access permission data [Philip, ¶0044]; in identifying at least one enterprise user of the plurality of enterprise users having one or more toxic access permissions, production protection computing platform 110 may establish defined and allowed access permissions for enterprise roles and/or identify common and recurring segregation of duties violations [Philip, ¶0035]), wherein the first permission set grants a principal account of the one or more principal accounts access to a file and the second permission set denies the principal account access to the file (toxic access permissions may refer to an enterprise user tagged as a developer but has cross-access permissions in a production environment and a non-production environment [Philip, ¶0035]; toxic access permissions are those with conflicting nature [Philip, ¶0039]).
As per claim 15: Philip in view of Botz disclose all limitations of claim 1. Furthermore, Philip discloses: wherein the plurality of access information sources comprise resource-based policies, identity-based policies, permission boundaries, organizational policies, access control lists, or any combination thereof (user-specific entitlements that include an association between a user, a resource, and a permission [Philip, ¶0033]; access permissions according to grouped user roles classified based on organizational hierarchy information [Philip, ¶0034]).
As per claim 16: Philip in view of Botz disclose all limitations of claim 1. Furthermore, Philip discloses: wherein: a permission set of the one or more permission sets indicates an access permission level, and the access permission level indicates that the one or more principal accounts or a subset of the one or more principal accounts are allowed read access, are allowed write access, are allowed read access and write access, or are denied access to an associated set of files (entitlements include a user, a resource, and a permission, wherein the permission refers to a set of access rights (e.g., read, write, execute) the user may perform on the resource [Philip, ¶0033]).
As per claim 17: Claim 17 is different in overall scope from claim 1. Claim 17 is directed to an apparatus with functions corresponding to the method of claim 1. Philip discloses implementing their features in an apparatus [Philip, ¶0046]. Thus, the responses provided herein and in claim 1 are applicable to claim 17.
As per claim 18: Claim 18 incorporates all limitations of claim 17. Claim 18 recites an apparatus with functions corresponding to the method of claim 2. Thus, the responses provided for claims 2 and 17 are applicable to claim 18.
As per claim 20: Claim 20 is different in overall scope from claim 1. Claim 20 is directed to a non-transitory computer-readable medium storing code with instructions to the method of claim 1. Philip discloses implementing their features as one or more computer-readable media storing computer-executable instructions [Philip, ¶0046]. Thus, the responses provided herein and in claim 1 are applicable to claim 20.
Claims 7 are rejected under 35 U.S.C. 103 as being unpatentable over Philip in view of Botz and in further view of US 2023/0421609 to Shrivastava et al. (hereinafter, “Shrivastava”).
As per claim 7: Philip in view of Botz disclose all limitations of claim 6. Philip in view of Botz do not explicitly disclose, but Shrivastava discloses: wherein the set of files is based at least in part on each of the set of files matching a regular expression resource pattern of the permission set (access policies define the rights of team members to team resources that can be identified using regular expression [Shrivastava, ¶0049]).
Thus, it would have been obvious to a person having ordinary skill in the art before the effective filing date of the claimed invention to implement any known technique to identify the resources defined in the user entitlements of Philip, such as through regular expressions described in Shrivastava. The application of regular expression would have been efficient by enabling a single entitlement to define permissions for multiple resources based on patterns resource identifiers.
Allowable Subject Matter
Claims 4, 5, 8, 9, 11-14, and 19 are currently not rejected by any prior arts.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to ROBERT B LEUNG whose telephone number is (571)270-1453. The examiner can normally be reached Mon - Thurs: 10am-7pm ET.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, JUNG KIM can be reached at 571-272-3804. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/ROBERT B LEUNG/Primary Examiner, Art Unit 2494
Prosecution Insights