Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This is in response to the Amendment filed on 7/22/26. Claims 1-25 are presented for examination.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1-4, 6-15 and 17-25 are rejected under 35 U.S.C. 103 as being unpatentable over Belgi et al., US Pub. .20260073028 in view of Angeles, US Pub. No.20260037863.
As to claim 1, Belgi discloses a method comprising:
detecting, by a decentralized identity event agent (123 fig.1) executing in a first
computing system (110 fig.1) of a decentralized identity framework, an identity based
interaction between the first computing system and a second computing system (125
fig. 1) of the decentralized identity framework (Resource Owner or another authorized
user may initiate an Access Review Request 123, with regard to a particular
resource/user/group of users, see abstract, fig. 1, [0049] to [0050]);
automatically generating, by the decentralized identity event agent, a dynamic retrieval
augmented generation (RAG) prompt comprising context information incorporating data
corresponding to the interaction (Prompt Augmentation 126 is performed based on the
insights and data collected/extracted from the Tenant Data 110, and optionally also
based on RAG information 135, see [0050]);
providing the dynamic RAG prompt to a language computer model for processing to
generate a risk assessment output and applying one or more policies to the detected
identity based interaction based on the risk assessment output to accept or reject
performance of the identity based interaction between the first computing system and
the second computing system (detecting Excessive Access Levels, where users have
more access than necessary which poses security risks, see [0051] and [0090]).
Belgi does not specifically disclose the language computer model is a pre-trained large language model (LLM) that is fine-tune trained to perform risk assessments of identities based on input features comprising information about security breaches or cyber-attacks and wherein the fine-tune training of the LLM configuring the LLM to process inputs specifying characteristics of the identity based interaction to identify patterns indicative of a compromised credential and to generate the risk assessment output for the identity based interaction. However, Angeles discloses the language computer model is a pre-trained large language model (LLM) that is fine-tune trained to perform risk assessments of identities based on input features comprising information about security breaches or cyber-attacks and wherein the fine-tune training of the LLM configuring the LLM to process inputs specifying characteristics of the identity based interaction to identify patterns indicative of a compromised credential and to generate the risk assessment output for the identity based interaction ( implementing a digital twin LLM personalized chatbot, ensuring its effectiveness, relevance, and ethical alignment over time. For example, Angeles discloses performance monitoring for Implement tools and frames to monitor the chatbot's performance metrics continuously, such as response time, accuracy, user satisfaction scores, and engagement levels. Use analytics to track how users interact with the chatbot, identifying patterns, preferences, and potential areas for improvement, see [0330] to [0334]). It would have been obvious to one of the ordinary skill in the art before the effective filing date of the invention was made to implement Angeles’ teachings into the computer system of Belgi to monitor network performance because it would have analyzed interaction data and feedback in real-time and adapted the chatbot's responses and behavior based on new information in a communication network (see Angeles’ [0331]).
As to claim 2, Belgi discloses generating a risk score based on the risk assessment
output from the language computer model, wherein the one or more policies are applied
to the identity based interaction on the risk score (defining access policies using a fine-
tuned LLM and generating compliance scores and actionable reports that highlight
areas where access permissions deviate from established policies, see [0100]-[0102]).
As to claim 3, Belgi discloses features from interactions of one or more verifier computing systems or digital identity containers of identity holder computing systems (using LLM-assisted access review process for receiving natural language inputs defining which users should have access to specific resources, see [0098] to [0100]).
As to claim 4, Belgi discloses indicators of compromise from third party computing systems (LLM assessments, see [0098] to [0100] and [0331).
As to claim 6, Belgi discloses the first computing device is an identity holder computing
device and the second computing system is an identity verifier computing system, and
wherein the language computer model generates a risk assessment output that
evaluates a level of risk of the holder computing system to the verifier computing system
(integrating with identity and access management systems, continuously reviewing
permissions against defined access policies using a fine-tuned LLM and generating
compliance scores and actionable reports that highlight areas where access
permissions deviate from established policies, see [0100] to [0102]).
As to claim 7, Belgi discloses the first computing device is an identity holder computing
system and the second computing system is an identity verifier computing device, and
wherein the language computer model generates a risk assessment output evaluates a
level of risk of the verifier computing system to the holder computing device (ensuring
that users only have the necessary level of access, enhancing security by limiting or the
granting of permissions that are not actually needed, see [0087] to [0088]).
As to claim 8, Belgi discloses generating a graphical user interface on the first
computing device specifying which verifiers and issuers in the decentralized identity
framework have been determined to have a risk assessment indicating they are risky
with which to perform interactions (see [0087]-[0088]).
As to claim 9, Belgi discloses the context information in the RAG prompt comprises
interaction features collected by an identity container of an entity requesting verification
of another entity involved in the identity based interaction (refining the LLM's future
recommendations, via re-training and/or as new context information and/or via
RAG enrichment of prompts, see [0084]).
As to claim 10, Belgi discloses applying one or more policies to the identity based interaction comprises performing a remediation action to minimize risk to at least one of the first computing system or the second computing system (detecting Excessive Access Levels, where users have more access than necessary which poses security risks, see [0051] and [0090]).
As to claim 11, Belgi discloses The method of claim 1, wherein the context information
in the RAG prompt comprises private features identifying specific features of the identity based interaction, and public features obtained from a web of trust registry (refining the LLM's future recommendations, via re-training and/or as new context information and/or via RAG enrichment of prompts, see [0084]-[0086]).
Claims 12-15 and 17-22 are rejected for the same reasons set forth in claims 1-4 and 6-
11 respectively.
Claims 23-25 are rejected for the same reasons set forth in claims 1, 9 and 10
respectively.
Claim(s) 5 and 16 are rejected under 35 U.S.C. 103 as being unpatentable over
Belgi et al., US Pub. No.20260073028 and Angeles, US Pub. No.20260037863 and further in view of Cameron et al., US Pub.No.20250165617,
As to claims 5 and 16, Belgi and Angeles' teachings still applied as in item 4 above. Neither Belgi nor Angeles specifically disclose the third party computing systems comprise one or more of security information and event management (SIEM) computing systems, cybersecurity event logs of third party computing systems, or extended detection and response (XDR) computing systems. However, Cameron discloses an extended detection and response (XDR) computing systems (XDR software, see [0150]). It would have been obvious to one of the ordinary skill in the art before the effective filing date of the invention was made to implement Cameron's teachings into the computer system of Belgi to control data information because it would have configured to automatically take actions when malicious activity is detected in a computer communication network (see Cameron;'s [0150]).
Response to Arguments
Applicant’s arguments, filed 7/22/26, with respect to the rejection(s) of claim(s) 1-25 under 35 USC 102 and 103 have been fully considered and are persuasive. Therefore, the rejection has been withdrawn. However, upon further consideration, a new ground(s) of rejection is made in view of Angeles, US Pub. No.20260037863.
Conclusion
Applicant's amendment necessitated the new ground(s) of rejection presented in this Office action. Accordingly, THIS ACTION IS MADE FINAL. See MPEP § 706.07(a). Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Claims 1-25 are rejected.
Any inquiry concerning this communication or earlier communications from the
examiner should be directed to Khanh Dinh whose telephone number is (571) 272-3936. The examiner can normally be reached on Monday through Friday from 8:00 A.m. to 5:00 P.m.
If attempts to reach the examiner by telephone are unsuccessful, the examiner's
supervisor, Umar Cheema, can be reached on (571) 270-3037. The fax phone number
for this group is (571) 273-8300.
Information regarding the status of an application may be obtained from the
Patent Application Information Retrieval (PAIR) system. Status information for published
applications may be obtained from either Private PAIR or Public PAIR. Status
information for unpublished applications is available through Private PAIR only. For
more information about the PAIR system, see http://pair-direct.uspto.gov. Should you
have questions on access to the Private PAIR system, contact the Electronic Business
Center (EBC) at 866-217-9197 (toll-free).
Any response to this action should be mailed to:
Commissioner for patents
P O Box 1450
Alexandria, VA 22313-1450
/KHANH Q DINH/Primary Examiner, Art Unit 2458
Prosecution Insights