DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-20 are pending in this application.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 10/30/202. The submission is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1,2,4-6,8,10-12,14-16,18 and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Barday et al. (US 10,282,559 B2) (hereinafter, “Barday”) in view of Abramson et al. (US 10,853,717 B2) (hereinafter, “Abramson”).
As to claim 1, Barday discloses a method, comprising:
identifying, by a device, an intended action that a user wishes to perform with respect to a service (“… the system may be configured to modify the questionnaire based at least in part on the one or more responses. The system may, for example, substantially dynamically add and/or remove one or more questions to/from the questionnaire based at least in part on the one or more responses (e.g., one or more response received by a user completing the questionnaire). For example, the system may, in response to the user providing a particular inventory attribute or new asset, generates additional questions that relate to that particular inventory attribute or asset. The system may, as the system adds additional questions, substantially automatically map one or more responses to one or more other inventory attributes or assets. For example, in response to the user indicating that personal data for a particular asset is stored in a particular location, the system may substantially automatically generate one or more additional questions related to, for example, an encryption level of the storage, who has access to the storage location, etc.” -e.g., see, col. 23, lines 4-22; herein, the system (i.e., the device) identifies the user’s intended processing activity/action with respect to the data assets/service by automatically generating questions about the activity; see also: co;. 21, lines 47-58; herein, he system is configured to generate the questionnaire (e.g., a questionnaire template) based at least in part on one or more processing activity attributes);
making, by the device, a first determination as to whether the user is authorized to access the service (“The system may then be configured to modify the processing activity inventory 1310A to include the one or more responses, and store the modified inventory in computer memory. In various embodiments, the system may be configured to approve a processing activity assessment 1340A (e.g., receive approval of the assessment) prior to feeding the processing activity inventory attribute values into one or more fields and/or cells of the inventory.” -e.g., see, col. 24, lines 10-17; herein, the device/system performs the first determination of whether the user/action is authorized by requiring approval of the processing activity assessment before allowing the workflow to proceed);
…
making, by the device and based on the information from the ... [questionnaires], a second determination as to whether the intended action would violate an access control policy (“… the system may modify the data model to include one or more additional assets, data attributes, inventory attributes, etc. in response to one or more questionnaire responses. For example, the system may modify a data inventory for a particular asset to include a storage encryption data element (which specifies whether the particular asset stores particular data in an encrypted format) in response to receiving such data from a questionnaire.” -e.g., see, col. 23, lines 23-32; see also: “The system may, for example: (1) identify and/or detect one or more potential risk triggers; (2) assess and analyze the potential risk triggers to determine a relevance of the risk posed by the risk triggers; (3) use data modelling techniques to identify particular processing activities and/or data assets that may be affected by the risk; (4) determine based on a relevance of the risk and the affected systems/processes whether to take one or more actions; and (5) take a suitable action in response to the risk triggers, if necessary.” -e.g., see, col. 6, lines 50-58; see also, abstract; herein, The system/device makes a second determination based on the information from the questionnaires responses, whether the intended action would violate an access control/privacy policy by assessing risk triggers and determining a risk level or compliance status); and
preventing, by the device, performance of the intended action based on the first determination and on the second determination (“… a Data Model Adaptive Execution System may be configured to take one or more suitable actions to remediate an identified risk in view of one or more regulations (e.g., one or more legal regulations, one or more binding corporate rules, etc.). For example, in order to ensure compliance with one or more standards related to the collection and/or storage of personal data, an entity may be required to modify one or more aspects of a way in which the entity collects, stores, and/or otherwise processes personal data (e.g., in response to a change in a legal or other requirement). In order to identify whether a particular change or other risk trigger requires remediation, the system may be configured to assess a relevance of the risk posed by the risk and identify one or more processing activities or data assets that may be affected by the risk.” -e.g., see, abstract; see also: “… determining, based at least in part on the one or more identified data assets and the relevance of the risk, whether to take one or more actions in response to the one or more potential risk triggers; and (5) taking a suitable action to remediate the risk …” -e.g., see, col. 2, lines 26-31; herein, Barday teaches a questionnaires-based system for identifying processing activities, requiring approval (e.g., first determination), assessing privacy risks (e.g., second determination) and remediating/blocking non-compliant actions).
Although Barday discloses generating and presenting questions in a guided questionnaire format, Barday doesn’t explicitly disclose causing, by the device, a chat session with the user to obtain information indicative of a data set, an intended use of the data set, and a data processor to perform the intended action;
However, in an analogous art, Abramson discloses causing, by the device, a chat session with the user to obtain information indicative of a data set, an intended use of the data set, and a data processor to perform the intended action (“The social data may be used to create or modify a special index in the theme of the specific person's personality. The special index may be used to train a chat bot to converse and interact in the personality of the specific person. During such conversations, one or more conversational data stores and/or APIs may be used to reply to user dialogue and/or questions for which the social data does not provide data.” -e.g., see, col. 1, lines 32-39);
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the invention to modify the teaching of Barday by incorporating the teaching of Abramson in order to improve user experience, increase completion rates of compliance assessments and enable real-time follow-up questions.
As to claims 11 and 20, these are rejected using the similar rationale as for the rejection of claim 1.
As to claim 2, Barday in view of Abramson discloses the method as in claim 1, Barday further discloses wherein the intended action comprises training a machine learning model using the data set and by the data processor (“Continuing to Step 2640, the system is configured to use one or more machine learning techniques to categorize one or more data elements from the generated catalog, analyze a flow of the data among the one or more data repositories, and/or classify the one or more data elements …” -e.g., see, col. 30, lines 57-62; see also: col. 12, lines 38-45; herein, generate a data model).
As to claim 12, it is rejected using the similar rationale as for the rejection of claim 2.
As to claim 4, Barday in view of Abramson discloses the method as in claim 1, Barday further discloses wherein the access control policy comprises at least one of: an industry regulation or a legal regulation (“… the data model generation and population system may be implemented in the context of any suitable privacy management system that is configured to ensure compliance with one or more legal or industry standards related to the collection and/or storage of private information. In various embodiments, a particular organization, sub-group, or other entity may initiate a privacy campaign or other activity (e.g., processing activity) as part of its business activities. In such embodiments, the privacy campaign may include any undertaking by a particular organization (e.g., such as a project or other activity) that includes the collection, entry, and/or storage (e.g., in memory) of any personal data associated with one or more individuals.” -e.g., see, col. 4, lines 54-67; herein, privacy management system constitutes access control policy ensures compliance with one or more industry standards).
As to claim 14, it is rejected using the similar rationale as for the rejection of claim 4.
As to claim 5, Barday in view of Abramson discloses the method as in claim 1, Barday further discloses wherein the chat session asks the user to specify the data set, the intended use of the data set, and the data processor to perform the intended action (“… in response to the user indicating that personal data for a particular asset is stored in a particular location, the system may substantially automatically generate one or more additional questions related to, for example, an encryption level of the storage, who has access to the storage location, etc.” -e.g., see, col. 23, lines 4-22). Abramson further discloses the chat session asks the user to specify the data set (“The social data may be used to create or modify a special index in the theme of the specific person's personality. The special index may be used to train a chat bot to converse and interact in the personality of the specific person. During such conversations, one or more conversational data stores and/or APIs may be used to reply to user dialogue and/or questions for which the social data does not provide data.” -e.g., see, Abramson: col. 1, lines 32-39);
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the invention to modify the teaching of Barday by incorporating the teaching of Abramson in order to improve user experience, increase completion rates of compliance assessments and enable real-time follow-up questions.
As to claim 15, it is rejected using the similar rationale as for the rejection of claim 5.
As to claim 6, Barday in view of Abramson discloses the method as in claim 5, Abramson further discloses wherein the device causes the chat session via a different endpoint associated with the user than that used by the user to indicate the intended action (“Data/information generated or captured by the mobile computing device 500 and stored via the system 502 may be stored locally on the mobile computing device 500, as described above, or the data may be stored on any number of storage media that may be accessed by the device via the radio interface layer 552 or via a wired connection between the mobile computing device 500 and a separate computing device associated with the mobile computing device 500, for example, a server computer in a distributed computing network, such as the Internet. As should be appreciated such data/information may be accessed via the mobile computing device 500 via the radio interface layer 552 or via a distributed computing network. Similarly, such data/information may be readily transferred between computing devices for storage and use according to well-known data/information transfer and storage means, including electronic mail and collaborative data/information sharing systems.” -e.g., see, Abramson: col. 15, lines 24-40).
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the invention to modify the teaching of Barday by incorporating the teaching of Abramson in order to improve user experience, increase completion rates of compliance assessments and enable real-time follow-up questions.
As to claim 16, it is rejected using the similar rationale as for the rejection of claim 6.
As to claim 8, Barday in view of Abramson discloses the method as in claim 1, Barday further discloses wherein the access control policy restricts performance of the intended action based on a geolocation of one of: the user, the data set, or the data processor (“… the one or more similarly-situated entities may include, for example: (1) one or more other entities in a geographic location similar to a geographic location of the entity that has identified the one or more potential risk triggers (e.g., a similar country, jurisdiction, physical location, etc.); (2) one or more other entities in a similar industry (e.g., banking, manufacturing, electronics, etc.); (3); one or more entities of a similar size (e.g., market capitalization, number of employees, etc.); (4) one or more entities that are governed by one or more similar regulations (e.g., such as any suitable regulation discussed herein); and/or (5) any other suitably similarly situated entity.” -e.g., see, Barday: col. 47, lines 19-31).
As to claim 18, it is rejected using the similar rationale as for the rejection of claim 8.
As to claim 10, Barday in view of Abramson discloses the method as in claim 1, Barday further discloses wherein the data set includes personally identifiable information (“… the system may be configured to utilize one or more credential management techniques to access one or more privileged network portions. The system may, in response to identifying particular assets or personally identifiable information via a scan, be configured to retrieve schema details such as, for example, an asset ID, Schema ID, connection string, credential reference URL, etc. In this way, the system may be configured to identify and store a location of any discovered assets or personal data during a scan.” -e.g., see, Abramson: col. 33, lines 28-37).
Claims 3 and 13 are rejected under 35 U.S.C. 103 as being unpatentable over Barday in view of Abramson as applied to claims 1 and 11 above, and further in view of Hall (US 10,142,338 B2).
As to claim 3, Barday in view of Abramson discloses the method as in claim 1, Barday in view of Abramson doesn’t explicitly discloses wherein making the first determination comprises performing multifactor authentication of the user.
However, in an analogous art, Hall discloses wherein making the first determination comprises performing multifactor authentication of the user (“… determining, by the server, authentication data to be obtained from a user associated with the user account based on the user data of the user account and the credential information to be authenticated; transmitting, by the server over the electronic network to the user, a request for authentication data; determining, by the server, an assurance level associated with the authentication request based on the authentication request and the relying party, wherein a single-factor authentication is required for lower assurance levels and a multi-factor authentication is required for higher assurance levels; receiving, at the server over the electronic network, authentication data associated with the user, wherein the authentication data is associated with a lifetime value” -e.g., see, Hall: claim 1).
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the invention to modify the teaching of Barday and Abramson by incorporating the teaching of Hall in order to create a more secure compliance gatekeeper that first verifies the user’s identity with MFA before collecting contextual data and assessing policy compliance.
As to claim 13, it is rejected using the similar rationale as for the rejection of claim 3.
Claims 7, 9, 17 and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Barday in view of Abramson as applied to claims 1 and 11 above, and further in view of Siebel et al. (US 12,111,859 B2) (hereinafter, “Siebel”).
As to claim 7, Barday in view of Abramson discloses the method as in claim 1, Barday in view of Abramson doesn’t explicitly disclose wherein the access control policy comprises a data minimization rule.
However, in an analogous art, Siebel discloses wherein the access control policy comprises a data minimization rule (“Where the initial results include data for which access by the user is restricted, the enterprise access control module 514 can determine how such restricted data is to be handled, such as to omit the restricted data entirely, omit the restricted data but indicate the results include data for which access by the user is restricted, or provide information related to all of the initial results. In the example where restricted data is omitted entirely, a final set of results may be returned for presentation to the user, where the final set of results does not inform the user that a portion of the initial results have been omitted.” -e.g., see, Siebel: col. 23, lines 21-47).
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the invention to modify the teaching of Barday and Abramson by incorporating the teaching of Siebel in order to help users understand the reason for denial (e.g., regulatory violation, data minimization rule, geolocation restrictions), enabling them to correct the request or seek appropriate approvals, which is a predictable and beneficial improvement.
As to claim 17, it is rejected using the similar rationale as for the rejection of claim 7.
As to claim 9, Barday in view of Abramson discloses the method as in claim 1, Barday in view of Abramson doesn’t explicitly disclose comprising: providing, by the device, an indication to the user as to why performance of the intended action was prevented.
However, in an analogous art, Siebel discloses providing, by the device, an indication to the user as to why performance of the intended action was prevented (“… the enterprise access control module 514 may evaluate (e.g., using access control lists) whether a user is authorized to access all or only a portion of a result (e.g., answer). For example, a user can provide a query associated with a first department or sub-unit of an organization. Members of that department or sub-unit may be restricted from accessing certain pieces of data, types of data, data models, or other aspects of a data domain in which a search is to be performed. Where the initial results include data for which access by the user is restricted, the enterprise access control module 514 can determine how such restricted data is to be handled, such as to omit the restricted data entirely, omit the restricted data but indicate the results include data for which access by the user is restricted, or provide information related to all of the initial results. In the example where restricted data is omitted entirely, a final set of results may be returned for presentation to the user, where the final set of results does not inform the user that a portion of the initial results have been omitted.” -e.g., see, Siebel: col. 23, lines 21-47).
Therefore, it would have been obvious to a person of ordinary skill in the art before the effective filing date of the invention to modify the teaching of Barday and Abramson by incorporating the teaching of Siebel in order to help users understand the reason for denial (e.g., regulatory violation, data minimization rule, geolocation restrictions), enabling them to correct the request or seek appropriate approvals, which is a predictable and beneficial improvement.
As to claim 19, it is rejected using the similar rationale as for the rejection of claim 9.
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SUMAN DEBNATH whose telephone number is (571)270-1256. The examiner can normally be reached Mon-Fri; 9:00am-5:00pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Farid Homayounmehr can be reached at 571-272-3739. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
SUMAN DEBNATH
Patent Examiner
Art Unit 2495
/S.D/Examiner, Art Unit 2495
/JEFFERY L WILLIAMS/Primary Examiner, Art Unit 2495
Prosecution Insights