Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This is in response to the communication filed on 10/31/2024. Claims 1-9 are pending in the application. Claim 1 is independent. Claims 1-9 have been rejected.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
Claims 1-7 are rejected under 35 U.S.C. 103 as being unpatentable over 2014/0228976 A1 (hereinafter K. S. et al.) in view of US 2023/0291742 A1 (hereinafter Kurmi)
Regarding claim 1, K. S. et al. teaches a method for administering access rights to a unit in a renewable power generating system (note Title: power plant control system), the method comprising:
assigning a set of access rights to a user, the set of access rights granting permission for the user to perform a set of predefined actions with regard to the renewable power generating system (note para. [0043], [0080]: the central server managing users and their roles/ access rights),
logging actions performed by the user with regard to the renewable power generating system (note para. [0055]: activity logging file) and (note para. [0058], [0067], [0081]: determining whether to add any additional inventories or tasks to a user role), and
adjusting the set of access rights assigned to the user, by removing at least some access rights related to those predefined actions of the set of predefined actions not being performed (note para. [0059], [0067], [0080] – [0081]: granting additional inventories or tasks based on updated user roles; deleting/ modifying user roles)
K. S. et al. fails to teach expressly comparing the performed actions to the set of predefined actions related to the set of access rights; and in the case that the comparison reveals discrepancies between the performed actions and the set of predefined actions related to the set of access rights, automatically adjusting the set of access rights assigned to the user.
However, Kurmi teaches comparing the performed actions to the set of predefined actions related to the set of access rights (note para. [0004], [0021]: over privileged system identities (e.g., an identity that has access to services that it does not need access to) can lead to system breaches and/or compromise of system functions. A method of dynamically adjusting access privileges of system identities can mitigate consequences in the event of a system malfunction and/or breach … An initial access policy of the system identity is replaced with the restricted access policy); in the case that the comparison reveals discrepancies between the performed actions and the set of predefined actions related to the set of access rights, automatically adjusting the set of access rights assigned to the user (note para. [0004], [0021] - [0022]: determining whether an identity has access to services that it does not need access, or need access to additional services; based on the determination, an initial access policy of the privileged system identity is replaced with the restricted access policy)
Kurmi and K. S. et al. are analogous art because they are from the same field of endeavor of controlling access/ privileges of a user to the services in a network environment. Therefore, before the effective filing of the claimed invention, it would have been obvious to a person of ordinary skill in art to modify K. S. et al. method to further include the features of comparing the performed actions to the set of predefined actions related to the set of access rights; and in the case that the comparison reveals discrepancies between the performed actions and the set of predefined actions related to the set of access rights, automatically adjusting the set of access rights assigned to the user in order to provide an administrator with a dynamic and customized access control policy for each user based on his/her personalized need for a specific service provided by the system (note Kurmi, para. [0004])
Regarding claim 2, K. S. et al. teaches the method according to claim 1, wherein automatically adjusting the set of access rights assigned to the user comprises reducing the set of predefined actions with regard to the renewable power generating system, which the user is permitted to perform (note para. [0080]: some of the existing user roles may be deleted from the plurality of existing user roles)
Regarding claim 3, K. S. et al. teaches the method according to claim 1, further comprising, upon request, temporarily granting the user permission to performing additional actions with regard to the renewable power generating system (note para. [0080] – [0081]: granting additional inventories or tasks based on updated user roles).
Regarding claim 4, K. S. et al. teaches the method according to claim 3, wherein temporarily granting the user permission to performing additional actions with regard to the renewable power generating system is subject to separate authentication of the user (note para. [0050], [0059], [0077]: authentication for each role)
Regarding claim 5, K. S. et al teaches the method according to claim 1, wherein assigning a set of access rights to the user comprises categorizing the user to a predefined user profile, and wherein automatically adjusting the set of access rights assigned to the user comprises categorizing the user to another predefined user profile (note para. [0049] – [0050], [0080] – [0081]: updating user roles by assigning user rights to different set of activities/ tasks)
Regarding claim 6, K. S. et al teaches the method according to claim 5, further comprising:
logging actions performed by users categorized to a certain user profile with regard to the renewable power generating system (note para. [0055]: activity logging file) and comparing the performed actions to the set of predefined actions related to the user profile (note para. [0058], [0067], [0081]: determining whether to add any additional inventories or tasks to a user role), and
in the case that the comparison reveals discrepancies between the performed actions and the set of predefined actions related to the user profile (note para. [0059], [0067], [0081]), automatically adjusting the set of access rights related to the user profile, by removing at least some access rights related to predefined actions not being performed, thereby automatically adjusting the user rights assigned to all users being categorized to the user profile (note para. [0067], [0080] – [0081]: granting additional inventories or tasks based on updated user roles).
Regarding claim 7, K. S. et al teaches the method according to claim 1, wherein the renewable energy generating system is a wind turbine or a wind power plant (note para. [0004], [0031]: wind power plant)
Claims 8-9 are rejected under 35 U.S.C. 103 as being unpatentable over K. S. et al. in view of Kurmi further in view of US 10,754,506 B1 (hereinafter Moyal et al.)
Regarding claim 8, Modified Kurmi-K. S. et al method fails to teach expressly the method according to claim 1, wherein logging actions performed by the user comprises performing artificial intelligence (AI) driven analysis on logged data.
However, Moyal et al. teaches the method wherein logging actions performed by the user comprises performing artificial intelligence (AI) driven analysis on logged data (note column 19, lines 8-28, column 23, line 46 -60: using machine leaning process for classifying/ analyzing patterns, activity data etc.)
Moyal et al. and K. S. et al. are analogous art because they are from the same field of endeavor of controlling access/ privileges of a user role in a network environment. Therefore, before the effective filing of the claimed invention, it would have been obvious to a person of ordinary skill in art to further modify Kurmi-K. S. et al. method to include the features of wherein logging actions performed by the user comprises performing artificial intelligence (AI) driven analysis on logged data in order to provide users with an improved mechanism for accurately classifying logged/ pattern data associated a particular user or role utilizing a machine learning or artificial intelligence model (note Moyal et al., column 18, lines 18-57)
Regarding claim 9, it is rejected applying as same motivation and rationale applied above rejecting claim 8, furthermore, Moyal et al. teaches the method wherein the AI driven analysis comprises identifying patterns in the actions performed by the user, and comparing the identified patterns to expected behaviour of a user requiring the full set of assigned access rights (note column 19, lines 8-28, column 23, line 46 -60: using machine leaning process for classifying/ analyzing patterns, activity data etc. associated with a particular role/ user)
Conclusion
A shortened statutory period for response to this action is set to expire in 3 (Three) months and 0 (Zero) days from the mailing date of this letter. Failure to respond within the period for response will result in ABANDOMENT of the application (see 35 U.S.C 133, M.P.E.P 710.02(b)). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SHANTO ABEDIN whose telephone number is 571-272-3551. The examiner can normally be reached on M-F from 8:30 AM to 6:30 PM. If attempts to reach the examiner by telephone are unsuccessful, the examiner's supervisor, Jung (Jay) Kim, can be reached on 571-272-3804. The RightFax number for faxing directly to the examiner is 571-273-3551.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http:// www.uspto.gov/interviewpractice.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free).
/SHANTO ABEDIN/ Primary Examiner, Art Unit 2494