DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statement (IDS) submitted on 1/31/2025 was filed. The submission is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statement is being considered by the examiner.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Patent No.: US 8,141,157 B2 to Farley et al(hereafter referenced as Farley in view of Patent No.: US 8,396,890 B2 to Lim.
Regarding claim 1, Farley discloses “a system comprising: storage configured to maintain a vendor computing system risk profile for a vendor computing system”(detector board [Fig.3/item 28]) , the vendor computing system risk profile determined by analyzing security practices implemented by the vendor computing system(fusion engine which “fuses” or assembles information from multiple data sources and analyzes this information in order to provide an organized, and sometimes ranked, presentation of information to one or more consoles [Col.3/lines 41-48]) ; and an interface configured to send a risk assessment message corresponding to the estimate of information security risk to the client computing system(in decision step 725, it is determined whether the context based risk adjustment processor (CoBRA) 625 is activated. I[Col.17/lines 52-54]) , wherein the risk assessment message is client-specific to the client computing system and depends on information to be transmitted to the vendor computing system (CoBra System [Fig.6/item 625]) ; wherein automated risk analysis is implemented to update the estimate of information security risk upon detecting a change in the security practices at the vendor computing system (i.e. illustrated automated risk analysis system flow chart [Fig.7]), “wherein an updated estimate of information security risk is calculated based on the change in the security practices(i.e. illustrated automated risk analysis system flow chart [Fig.7]), “wherein a plurality of weights for a plurality of dimensional risk factors corresponding to a plurality of dimensions associated with security practices is adjusted based on the change in security practices (classifier 615 can also forward the raw event object to the Context Based Risk Adjustment (CoBRA) processor 625. The CoBRA processor is a risk assessment mechanism that can adjust priority parameters of raw event objects.[Col.14/lines 54-57]).
Farley does not explicitly disclose “wherein security practices include sub vendor security practices implemented by a sub vendor computing system associated with the vendor computing system; a processor configured to analyze computing services interaction information, the computing services interaction information characterizing data for transmission from a client computing system to the vendor computing system, wherein the processor is configured to determine an estimate of information security risk based on the computing services interaction information and the vendor computing system risk profile.”
However, Lim in an analogous art discloses “wherein security practices include sub vendor security practices implemented by a sub vendor computing system associated with the vendor computing system (policy server Lim[Fig.17/item 1601]) ; a processor configured to analyze computing services interaction information, the computing services interaction information characterizing data for transmission from a client computing system to the vendor computing system (policy server comprising policy rules Lim[Fig.4/item 401]) , “wherein the processor is configured to determine an estimate of information security risk based on the computing services interaction information and the vendor computing system risk profile.” (policy server comprising policy rules Lim[Fig.4/item 401]).
Therefore, it would be obvious to one of ordinary skill in the art at the time the invention was filed to modify Farley’s system for managing computer security with Lim’s process to detect behavioral patterns and anomalies within a system in order to provide security. One of ordinary skill in the art would have been motivated to combine because Farley teaches a system that manages computer security, Lim discloses a process which also manages security by detecting behavioral patterns and both are from the same field of endeavor.
Regarding claim 2 in view of claim 1 the references combined disclose “wherein the risk assessment message is transmitted to the client computing system upon determining the updated estimate of information security risk.”(generate and send correlation event update Farley[Fig.7/item 780]).
Regarding claim 3 in view of claim 2 the references combined disclose “ wherein determining the vendor computing system risk profile comprises analyzing a third-party assessment of security practices at the vendor computing system” (policy server comprising policy rules Lim[Fig.4/item 401]).
Regarding claim 4 in view of claim 3 the references combined disclose “wherein the third-party assessment of security practices comprises third-party audit information” (audit systems Farley[Fig.2/item 28]).
Regarding claim 5 in view of claim 4 the references combined disclose “wherein the vendor computing system risk profile is determined by estimating a plurality of dimensional risk factors for a plurality of security dimensions” (policy server comprising policy rules Lim[Fig.4/item 401]).
Regarding claim 6 in view of claim 5 the references combined disclose “wherein a plurality of weights to a plurality of dimensional risk factors corresponding to a plurality of security dimensions are adjusted based on the change in security practices at the vendor computing system” (policy server comprising policy rules Lim[Fig.4/item 401]).
Regarding claim 7 in view of claim 6 the references combined disclose “wherein a first dimensional risk factor reflects a reported security practice associated with a first security dimension, the first dimensional risk factor reflecting a level of assurance associated with the reported security practice, and wherein determining the risk profile comprises calculating a weighted average of the plurality of dimensional risk factors” (policy server comprising policy rules Lim[Fig.4/item 401]) also see policy enforcer Lim[Fig.9])
Regarding claim 8 in view of claim 7 the references combined disclose “wherein determining the estimate of the information security risk comprises determining a weighting value for each of the dimensional risk factors based on the computing services interaction information, the weighting reflecting a relative importance of the dimensional risk factor to the estimate of an information security risk” (comparison and determinization process of risk factors Farley[Fig.7]).
Regarding claim 9 in view of claim 8 the references combined disclose “wherein determining the vendor computing system risk profile comprises applying natural language processing to free-form text information to determine a respective dimensional risk level” (policy language inclusive of a specific implementation of the layer description of a policy language system of the invention is the Blue Jungle Compliant Enterprise Active Control System Lim[Col.38/lines 18-20]).
Regarding claim 10 in view of claim 9 the references combined disclose “wherein the computing services interaction information includes a data sensitivity level associated with the transmitted data” (first , second rule sensitivity level Lim [Fig.15/items 1401-1403]).
Regarding claim 11 in view of claim 10 the references combined disclose “wherein determining the vendor computing system risk profile comprises matching the third-party assessment with the free-form text information using natural language processing” (policy language inclusive of a specific implementation of the layer description of a policy language system of the invention is the Blue Jungle Compliant Enterprise Active Control System Lim[Col.38/lines 18-20]).
Regarding claim 12 in view of claim 8 the references combined disclose “wherein the security practices include a user authentication procedure and an encryption algorithm employed at the vendor computing system.”(encrypt and login confidential document Lim[Fig.20/item 1909]).
Regarding claim 13 in view of claim 8 the references combined disclose “wherein the vendor computing system risk profile is determined in part based on automated security analysis performed by transmitting a security practice detection message to a first computing device included in the vendor computing system, the security practice detection message designed to test the security practices at the first computing device” (obligation action includes logging an action or sending a notification message to an administrator. An obligation can depend (or not depend) on the ALLOW and DENY state Lim[Col.28/lines 50-53]).
Regarding claim 14, Farley discloses “a method comprising: storing a vendor computing system risk profile for a vendor computing system(detector board [Fig.3/item 28]), the vendor computing system risk profile determined by analyzing security practices implemented by the vendor computing system(fusion engine which “fuses” or assembles information from multiple data sources and analyzes this information in order to provide an organized, and sometimes ranked, presentation of information to one or more consoles [Col.3/lines 41-48]), wherein a processor is configured to determine an estimate of information security risk based on the computing services interaction information and the vendor computing system risk profile(in decision step 725, it is determined whether the context based risk adjustment processor (CoBRA) 625 is activated. I[Col.17/lines 52-54]); and transmitting a risk assessment message corresponding to the estimate of information security risk to the client computing system(CoBra System [Fig.6/item 625]), wherein the risk assessment message is client-specific to the client computing system and depends on information to be transmitted to the vendor computing system (i.e. illustrated automated risk analysis system flow chart [Fig.7]); and updating the estimate of information security risk by implementing automated risk analysis upon detecting a change in the security practices at the vendor computing system(i.e. illustrated automated risk analysis system flow chart [Fig.7]), wherein an updated estimate of information security risk is calculated based on the change in the security practices, wherein a plurality of weights for a plurality of dimensional risk factors corresponding to a plurality of dimensions associated with security practices is adjusted based on the change in security practices” (classifier 615 can also forward the raw event object to the Context Based Risk Adjustment (CoBRA) processor 625. The CoBRA processor is a risk assessment mechanism that can adjust priority parameters of raw event objects.[Col.14/lines 54-57]).
Farley does not explicitly discloses “wherein security practices include sub vendor security practices implemented by a sub vendor computing system associated with the vendor computing system; analyzing computing services interaction information, the computing services interaction information characterizing data for transmission from a client computing system to the vendor computing system.”
However, Lim in an analogous art discloses “wherein security practices include sub vendor security practices implemented by a sub vendor computing system associated with the vendor computing system (policy server comprising policy rules Lim[Fig.4/item 401]) ; analyzing computing services interaction information, the computing services interaction information characterizing data for transmission from a client computing system to the vendor computing system.” (policy server comprising policy rules Lim[Fig.4/item 401]).
Therefore, it would be obvious to one of ordinary skill in the art at the time the invention was filed to modify Farley’s system for managing computer security with Lim’s process to detect behavioral patterns and anomalies within a system in order to provide security. One of ordinary skill in the art would have been motivated to combine because Farley teaches a system that manages computer security, Lim discloses a process which also manages security by detecting behavioral patterns and both are from the same field of endeavor.
Regarding claim 15 in view of claim 14, the references combined disclose “wherein the risk assessment message is transmitted to the client computing system upon determining the updated estimate of information security risk. (generate and send correlation event update Farley[Fig.7/item 780]).
Regarding claim 16 in view of claim 15, the references combined disclose “wherein determining the vendor computing system risk profile comprises analyzing a third-party assessment of security practices at the vendor computing system” (policy server comprising policy rules Lim[Fig.4/item 401]).
Regarding claim 17 in view of claim 16, the references combined disclose “wherein the third-party assessment of security practices comprises third-party audit information” (audit systems Farley[Fig.2/item 28]).
Regarding claim 18 in view of claim 17, the references combined disclose “wherein the vendor computing system risk profile is determined by estimating a plurality of dimensional risk factors for a plurality of security dimensions” (policy server comprising policy rules Lim[Fig.4/item 401]).
Regarding claim 19 in view of claim 18, the references combined disclose “wherein a plurality of weights to a plurality of dimensional risk factors corresponding to a plurality of security dimensions are adjusted based on the change in security practices at the vendor computing system” (policy server comprising policy rules Lim[Fig.4/item 401]).
Regarding claim 20, Farley discloses “a system comprising: means for storing a vendor computing system risk profile for a vendor computing system(detector board [Fig.3/item 28]), the vendor computing system risk profile determined by analyzing security practices implemented by the vendor computing system(fusion engine which “fuses” or assembles information from multiple data sources and analyzes this information in order to provide an organized, and sometimes ranked, presentation of information to one or more consoles [Col.3/lines 41-48]), wherein a processor is configured to determine an estimate of information security risk based on the computing services interaction information and the vendor computing system risk profile(in decision step 725, it is determined whether the context based risk adjustment processor (CoBRA) 625 is activated. I[Col.17/lines 52-54]); and
means for transmitting a risk assessment message corresponding to the estimate
of information security risk to the client computing system(CoBra System [Fig.6/item 625]), wherein the risk assessment message is client-specific to the client computing system and depends on information to be transmitted to the vendor computing system(i.e. illustrated automated risk analysis system flow chart [Fig.7]); and means for updating the estimate of information security risk by implementing automated risk analysis upon detecting a change in the security practices at the vendor computing system illustrated automated risk analysis system flow chart [Fig.7]), wherein an updated estimate of information security risk is calculated based on the change in the security practices, wherein a plurality of weights for a plurality of dimensional risk factors corresponding to a plurality of dimensions associated with security practices is adjusted based on the change in security practices(classifier 615 can also forward the raw event object to the Context Based Risk Adjustment (CoBRA) processor 625. The CoBRA processor is a risk assessment mechanism that can adjust priority parameters of raw event objects.[Col.14/lines 54-57]).
Farley does not explicitly disclose “wherein security practices include sub vendor security practices implemented by a sub vendor computing system associated with the vendor computing system; means for analyzing computing services interaction information(policy server comprising policy rules Lim[Fig.4/item 401]), the computing services interaction information characterizing data for transmission from a client computing system to the vendor computing system” (policy server comprising policy rules Lim[Fig.4/item 401]).
However, Lim in an analogous art discloses “wherein security practices include sub vendor security practices implemented by a sub vendor computing system associated with the vendor computing system; means for analyzing computing services interaction information, the computing services interaction information characterizing data for transmission from a client computing system to the vendor computing system”
Conclusion
Any inquiry concerning this communication or earlier communications from the examiner should be directed to MICHAEL D ANDERSON whose telephone number is (571)270-5159. The examiner can normally be reached Mon-Fri 9am-6pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey Pwu can be reached at (571) 272-6798. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/MICHAEL D ANDERSON/ Examiner, Art Unit 2433
/JEFFREY C PWU/ Supervisory Patent Examiner, Art Unit 2433
Prosecution Insights