Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Status of Claims
2. This Office Action is issued in response to the claims filed on 10/23/2024.
Claims 1-20 are pending in this Office Action.
Priority
3. Acknowledgement is made of applicant’s priority claim of U.S. Provisional Patent Application No. 63/654,826, filed May 31, 2024.
Claim Rejections - 35 USC § 101
4. 35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
5. Claims 1-20 are rejected under 35 U.S.C. 101.
Claim 8 is rejected under 35 U.S.C. 101 because the claimed invention is directed to abstract ideas without significantly more.
Step 2A, Prong 1: The claim recites “generate a graph representation of trust relationships between roles…; determine whether the second set of privileges includes a permission not available in the first set of privileges; and generate an indicator ...” These limitations, as drafted, under their broadest reasonable interpretations cover performance of the limitations in the mind or on paper. For example, the limitation “generate a graph representation of trust relationships between roles” under its broadest reasonable interpretation, covers performance of the limitation in the mind or on paper. If a claim limitation, under its broadest reasonable interpretation, covers performance of the limitation in the mind or on paper, then it falls within the “Mental Processes” grouping of abstract ideas. Accordingly, the claim recites abstract ideas.
Step 2A, Prong 2: This judicial exception is not integrated into a practical application because the claim does not recite any application of the limitations besides abstract ideas. Therefore, the claim is directed to abstract ideas.
Step 2B: The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception because besides the abstract ideas, additional elements ‘a system’ and ‘IAM policy analysis system’ are recited at a high level of generality with no more than mere instructions to apply the exception using generic computer components. Therefore, the claim is not patent eligible.
Claims 9-14 depend on claim 8 and they do not limit independent claim 8 or themselves to a practical application or amount to significantly more than the judicial exception; therefore, claims 9-14 are also not patent eligible.
Similarly, claims 1-7 and 15-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to abstract ideas without significantly more.
35 U.S.C. § 112(f)
6. The following is a quotation of 35 U.S.C. 112(f):
(f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph:
An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
7. The claims in this application are given their broadest reasonable interpretation using the plain meaning of the claim language in light of the specification as it would be understood by one of ordinary skill in the art. The broadest reasonable interpretation of a claim element (also commonly referred to as a claim limitation) is limited by the description in the specification when 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is invoked.
As explained in MPEP § 2181, subsection I, claim limitations that meet the following three-prong test will be interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph:
(A) the claim limitation uses the term “means” or “step” or a term used as a substitute for “means” that is a generic placeholder (also called a nonce term or a non-structural term having no specific structural meaning) for performing the claimed function;
(B) the term “means” or “step” or the generic placeholder is modified by functional language, typically, but not always linked by the transition word “for” (e.g., “means for”) or another linking word or phrase, such as “configured to” or “so that”; and
(C) the term “means” or “step” or the generic placeholder is not modified by sufficient structure, material, or acts for performing the claimed function.
Use of the word “means” (or “step”) in a claim with functional language creates a rebuttable presumption that the claim limitation is to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites sufficient structure, material, or acts to entirely perform the recited function.
Absence of the word “means” (or “step”) in a claim creates a rebuttable presumption that the claim limitation is not to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is not interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites function without reciting sufficient structure, material or acts to entirely perform the recited function.
Claim limitations in this application that use the word “means” (or “step”) are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action. Conversely, claim limitations in this application that do not use the word “means” (or “step”) are not being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action.
8. This application includes one or more claim limitations that do not use the word “means,” but are nonetheless being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because the claim limitation(s) uses a generic placeholder that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. Such claim limitations are: “an identity and access management (IAM) policy analysis system configured to…” (claim 8) and “the IAM policy analysis system further configured to…” (claims 9-14).
Because these claim limitations are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, they are being interpreted to cover the corresponding structure described in the specification as performing the claimed function, and equivalents thereof.
A review of the specification shows that the following appears to be the corresponding structure described in the specification for the 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph limitations: an/the IAM policy analysis system is an electronic circuitry (paragraph [0046]).
If applicant does not intend to have these limitations interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, applicant may: (1) amend the claim limitations to avoid them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph (e.g., by reciting sufficient structure to perform the claimed function); or (2) present a sufficient showing that the claim limitations recite sufficient structure to perform the claimed function so as to avoid them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph.
Claim Rejections - 35 USC § 112
9. The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
10. Claim 2-7 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claim 2 recites: “The method of claim 1 further comprising: a path includes…” which make the claim ambiguous because claims 1 and 2 are method claims which should include steps or actions. Therefore, claim 2 is rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph. For purpose of examination, the Examiner assumes the limitation as: “The method of claim 1 further comprising: determining a path in the graph representation, the path including…”
Claims 3-7 depend on claim 2; therefore, they are also rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph.
Allowable Subject Matter
11. Claims 1-20 are allowable over prior art if rewritten to overcome rejections under 35 USC § 101 and 35 USC § 112(b) set forth in this Office action.
The following is an examiner’s statement of reasons for allowance:
Regarding independent claims 1, 8, and 15:
a. Chen et al. (US 20240154972 A1) discloses a method for permission management includes: generating a plurality of job roles with different permissions according to organization permission table; generating first permission structure directed graph according to the job roles; selecting one of the job roles in first permission structure directed graph as target job role; generating minimum directed spanning graph in first permission structure directed graph according to target job role; determining whether permission of each of the job roles in first permission structure directed graph matches job of each of the job roles in first permission structure directed graph; and adjusting permission and job of each of the job roles to generate second permission structure directed graph if it is determined that permission of each of the job roles in first permission structure directed graph does not match job of each of the job roles in first permission structure directed graph (Figs. 1-3 with associated text).
b. Gilad et al. (US 20230388325 A1) discloses a system and method for detecting privilege escalation on a resource deployed in a computing environment is disclosed. The method includes: configuring the resource to deploy thereon a sensor, the sensor configured to listen on a data link layer of the resource for an event; receiving from the sensor a permission-based event based on a first actor, the permission-based event indicating a first permission set of the first actor; querying a database to detect a second permission set of the first actor; detecting that the first permission set includes a permission which is not in the second permission set; determining that the resource is involved in a privilege escalation event in response to detecting that the first permission set includes a permission which is not in the second permission set; and initiating a mitigation action in response to the determined privilege escalation event (paragraphs [0010]-[0014]).
The prior arts of record fail to either disclose or sufficiently suggest the combination features as claimed and arranged by applicant. Although the above references teach similar aspects of the independent claims 1, 8, and 15, none of these references individually or in reasonable combination discloses all the limitations as claimed in the independent claims and each of these independent claims as a whole is not obvious over these prior arts. Therefore, independent claims 1, 8, and 15 are allowable over the prior arts of record and dependent claims are allowable by virtue of their dependence on the independent claims.
Prior Art of Record
12. The prior art made of record and not relied upon is considered pertinent to applicant’s disclosure: see attached PTO-892 Notice of References Cited.
Conclusion
13. Any inquiry concerning this communication or earlier communications from the examiner should be directed to THANH T. LE whose telephone number is (571)270-0279. The examiner can normally be reached on Monday-Friday 8:00 am - 4:30 pm EST.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Farid Homayounmehr can be reached on 571-272-3739. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/THANH T LE/Primary Examiner, Art Unit 2495
Prosecution Insights