Detailed Action
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-20 are pending in the application.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on June 11, 2026 is in compliance with the provisions of 37 CFR 1.97, and accordingly, the IDS has been considered by the examiner.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 1-20 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Regarding claim 1, the claim recites, “revoking the set of access paths, thereby revoking an access permission of the set of named entity in the group to the specific data resource.” The underlined text is stated as a result of revoking the set of access paths. It is not clear whether the step of revoking the access permission is an additional step that is required by the claimed invention. The scope of the invention is not clear. Claims 8 and 15 also recite, “thereby revoking an access permission of the set of named entity” and are rejected under a similar rationale as claim 1.
Regarding claim 3, the claim recites, “the sub-group access permissions.” Claim 2 state, “generate a sub-group access permission for each of the one or more sub-groups.” Claim 2 states, “one or more sub-groups” and does not require a plurality of sub-group access permissions. Therefore, it is not clear whether the claim requires more than one sub-group access permissions and more than one sub-group. Claims 10 and 17 also recite, “the sub-group access permissions” and are rejected under a similar rationale as claim 3.
Allowable Subject Matter
Claims 1-20 would be allowable if rewritten or amended to overcome the rejection(s) under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), 2nd paragraph, set forth in this Office action.
The following is a statement of reasons for the indication of allowable subject matter:
Curtis et al. US Patent No. 11,470,121 discloses generating an access graph comprising graph objects from data access metadata, the graph objects comprising (1) a plurality of named entity nodes and (2) a plurality of resource nodes, wherein each named entity node representing a named entity associated with the domain, and each resource node represents one of the data resources controlled by the data resource system (col. 26, lines 56-65. permissions graph represents users and services as nodes (i.e., vertices), and different types of access are represented by connections visualized as lines between user-resource node pairs); and identifying one or more access paths each traversing a named entity node and a resource node, each access path representing an access permission granted for a named entity represented by the respective named entity node to a data resource represented by the respective resource node (col. 28, lines 11-23. permissions graph 1300 with connections between a group of user nodes 1305-1325 and resource nodes 1330-1345. connections between nodes (also referred to as edges) indicate the permissions, represented in some embodiments as lines between user nodes and resource nodes. col. 32, lines 41-47. express ACLs in terms of a user, action, and resource are converted to a permissions graph by creating nodes for each user and each resource and then connecting a user node and a resource node if there is an ACL granting the user access to that resource).
Caldera et al. US Patent No. 10,250,583 discloses generating an access graph comprising graph objects from data access metadata, the graph objects comprising (1) a plurality of named entity nodes and (2) a plurality of resource nodes, wherein each named entity node representing a named entity associated with the domain, and each resource node represents one of the data resources controlled by the data resource system (col. 14, lines 53-57. receive (301) data identifying accesses made online, using access tokens (e.g., 141, 221,. . , 223), from devices (122, 123, . . . , 125, . . . , 129) to access resources in computer networks (e.g., 231, 233, 235). col. 14, line 63-col. 15, line 3. organizes (303) the data in a graph form linking elements including the access tokens (e.g., 141, 221, . . . , 223, 253, 273, 283, 287, 289), user entities (e.g., 189, 241, 261, 281, 291), device entities (e.g., 185, 257, 277, 285), user attributes (e.g., 150, 251, 271), device attributes (e.g., 187, 259, 279) based on their connections in the data. col. 24, lines 49-53. nodes representing data elements associated with accesses made using an access token (403), and links among the nodes representing connections between the data elements).
Venable US Patent Publication No. 2025/0124147 discloses generating an access graph comprising graph objects from data access metadata, the graph objects comprising (1) a plurality of named entity nodes and (2) a plurality of resource nodes, wherein each named entity node representing a named entity associated with the domain, and each resource node represents one of the data resources controlled by the data resource system (para. [0041] query to determine relationship graph 134 using graph database server 140 graph nodes 136 having objects and connections 138 may correspond to edges in a graph, such as two connected nodes having a connection and a vector); identifying one or more access paths each traversing a named entity node and a resource node, each access path representing an access permission granted for a named entity represented by the respective named entity node to a data resource represented by the respective resource node (para. [0041] using graph nodes 136 having objects and connections 138, access rights 114 may be determined and returned to client device 110. access rights 114 may be used by access control application 130 to configure and/or update access rights and permissions for a user to resources with service provider server 120); revoking the set of access paths, thereby revoking an access permission of the set of named entity in the group to the specific data resource (para. [0021] allow for access rights to be changed and updated through the relationship graphs, such as by adding or deleting connections or edges. para. [0062] by adding, deleting, or changing connections, such as by editing diagram 300e, changes to policies, and therefore relationships and access rights, may be performed).
Goldfarb et al. US Patent Publication No. 2020/0279051 discloses generating an access graph comprising graph objects from data access metadata, the graph objects comprising (1) a plurality of named entity nodes and (2) a plurality of resource nodes, wherein each named entity node representing a named entity associated with the domain, and each resource node represents one of the data resources controlled by the data resource system; identifying one or more access paths (para. [0073] network graph 64 includes a plurality of vertices 66 through 80, each of which may correspond to a computing device. each of these edges may have a variety of attributes, like those described above, that describe permitted or configured attributes of communication between computing devices or computing devices); and revoking the set of access paths, thereby revoking an access permission of the set of named entity in the group to the specific data resource (claim 1. respective pairs of the vertices and specifying permitted network communications between the users or computing devices corresponding to the respective pairs of vertices; and the network controller is operative to effectuate changes to the network graph by enforcing and removing or adding permitted pair-wise connections between users or computing devices)
Maheshwari et al. US Patent Publication No. 2016/0087956 discloses revoking the set of access paths, thereby revoking an access permission of the set of named entity in the group to the specific data resource (para. [0112] examples of a change in access to a resource may include, without limitation, revoking access to a resource and granting access to a new resource. based on the change in access to a resource by an identity, a configuration of an application providing access to the resource may be modified for the remote device registered for the identity. when access to a resource is revoked, a configuration of an application may be modified to delete connection information to enable the application to access the resource).
However, the prior art of record does not teach, individually or in combination, the claimed invention including: establishing connections with a data resource system, the data resource system delegated by a domain to control data resources of the domain; receiving, from the data resource system, a group access permission of a set of data resources to a group of named entities; receiving data access metadata from the data resource system, the data access metadata comprising a history of access of the data resources controlled by the data resource system; generating an access graph comprising graph objects from data access metadata, the graph objects comprising (1) a plurality of named entity nodes and (2) a plurality of resource nodes, wherein each named entity node representing a named entity associated with the domain, and each resource node represents one of the data resources controlled by the data resource system; identifying one or more access paths each traversing a named entity node and a resource node, each access path representing an access permission granted for a named entity represented by the respective named entity node to a data resource represented by the respective resource node; determining a utilization level of a set of access paths, the set of access paths connecting a set of named entity nodes representing a set of named entities in the group with a specific resource node representing a specific data resource; identifying the utilization level not meeting a pre-determined threshold; and revoking the set of access paths, thereby revoking an access permission of the set of named entity in the group to the specific data resource.
Conclusion
A shortened statutory period for reply to this Office action is set to expire THREE MONTHS from the mailing date of this action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to Joshua Joo whose telephone number is (571)272-3966. The examiner can normally be reached Monday-Friday 7am-3pm.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Oscar Louie can be reached at 571-270-1684. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/JOSHUA JOO/Primary Examiner, Art Unit 2445
Prosecution Insights