DETAILED ACTION
This action is made in response to the communication filed on January 28, 2025. This action is made non-final. Claims 1 and 32 are independent claims. Claims 4, 7, 8, 10, 14-16, 18, 25, 28, 30, 31 and 33 were cancelled. Claims 1-3, 5, 6, 9, 11-13, 17, 19-24, 26, 27, 29 and 32 are pending.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Priority
This application is the national stage entry of PCT/EP2023/069971, filed on July 18, 2023, which claims priority to Application No. 2211003.5, filed on July 28, 2022, in the United Kingdom.
Information Disclosure Statement
The information disclosure statement (IDS) submitted on January 28, 2025 is in compliance with the provisions of 37 CFR 1.97 and has been considered by the examiner.
Claim Objections
5. Claims 2, 6, 9, 11, 26 and 32 are objected to because of the following informalities:
Claim 2 recites “removing the respective content element from the response content.” Claim 1 establishes “content.” The limitation should read “said content” for consistency with claim 1.
Claim 6 recites “identifying a respective attributes of said the, or each, user.” The phrase “said the” is grammatically incorrect. The intended phrase appears to be “of the, or each, user” or “of said user.” Claim 6 further recites “said one or more user-related identifiers optionally comprises.” Claim 6 establishes “one or more user-related identifier”. The back reference should read “said one or more user-related identifier” for consistency with the earlier recitation.
Claim 9 recites “wherein the user identifier and/or said one or more user-related identifier is associated with a session,” and claim 11 recites “depending on said user identifier”. Claim 6 establishes “one or more user identifier.” The singular references “the user identifier” in claim 9 and “said user identifier” in claim 11 do not match the number of the established element, and the two claims use different articles for the same reference. For consistency, the references should read “said one or more user identifier.”
Claim 26 recites “receiving sad request at said gateway.” The limitation should read “receiving said request at said gateway.”
Claim 32 recites “a request from any one of said at least at least one client.” The limitation should read “a request from any one of said at least one client.” Claim 32 further recites “the gateway being configured to receive, a response from said server.” The comma after “receive” is extraneous and should be deleted.
Appropriate correction is required.
Claim Interpretation
6. The claims recite the phrase “the, or each,” (claims 1, 2, 3, 6, 27 and 32; claim 27 also recites “the or each”). The examiner interprets this phrase under the broadest reasonable interpretation as “at least one of” the previously recited elements. The rejections below apply this interpretation.
Claim Rejections - 35 USC § 112
7. The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
8. Claims 2, 3, 5, 6, 9, 11, 12, 17, 21-24, 27 and 29 are rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention. Claims 3, 11 and 22 are rejected for depending from claims 2 and 6.
9. Optional and exemplary language. Claim 2, 3, 6, 9, 12, 17, 24, 27 and 29 recite features introduced by “optionally.” “typically,” “preferably,” “may,” “may be,” “may comprise,” “e.g.,” or “for example.” These recitations leave the claim boundaries unclear because one of ordinary skill in the art cannot determine whether the qualified features are required. For purpose of the art rejections, the examiner treat these recitations as failing to limit the claims. The applicant should delete the qualifiers or recite the features as required limitations.
10. Repeated recitations without antecedent references. Claim 5 recites “wherein at least one content identifier is included in, or associated with , said content.” Claim 1 already establishes “at least one content identifier,” and the claim does not state whether claim 5 refers to the identifier or introduces additional one. Claim 23 recites the rule phrase “at least one reduction rule that is not associated with said at least one content identifier” four times. The first three recitations introduces the rule phrase without a back reference; only the fourth prefixes the rule phrase with “said.” The “said” within the phrase modifies the content identifier, properly back-reference claim 1, and is not at issue. Oen cannot determine whether the four recitations of the rule phrase refer to one rule or to several. Claim 24 recites the attribute-associated rule phrase three times in the same pattern: the first two recitations introduce without a back reference, and only the third prefixes it with “said.” The art rejections apply under either reading.
11. Claim 3 recites two groups of alternatives. The connector “and/or” joins the alternative within the first group and also joins the two groups, and only the “wherein” following the second “and/or” distinguishes the group boundary; no comma precedes the group-level “and/or”. Alone, this drafting would not render claim 3 indefinite, and claim 3 stands rejected for depending from claim 2.The applicant should add the comma in any amendment.
12. Claim 9 recites obtaining the identifier “from one or more aspect of said session,” and then recites that the aspect “may comprise any one or more of: one or more server side cookie; one or more client-side cookie, a session ID, or a request URL and/or from overhead associated with the response.” An aspect may comprise a cookie, a session ID or a request URL, but it cannot comprise “from overhead”. The list conflates the aspects of the session with the source of the obtaining step, and one of ordinary skill in the art cannot determine whether overhead is a recited aspect or an alternative source.
13. Claim 12 recites “respective redaction rule set(s) associated with the respective user.” No prior claims establishes a redaction rule set, and the claim does not state the relationship between a rule set and the “at least one redaction rule” of claim 1. Even read as introducing a new element, the claim does not state that relationship. The recitation “one or more respective part or respective elements” also treat its pair nouns inconsistently, reciting “part” in the singular and “element(s)” with a parenthetical plural. The applicant should conform “redaction rule set(s)” to the “at least one redaction rule” established in claim 1 and should recite the pair nouns with consistent number.
14. Claim 21 recites using a default redaction rule “to redact said at least one of said at least one element identifier.” One of ordinary skill in the art cannot determine whether the claim requires redacting the identifier itself or the element that the identifier identifies. The specification uses the same phrase and does not solve this ambiguity (Spec : [0033]). The claim also recites “element identifier” where claim 2 establishes “content element identifier.”
15. Claim 29 recites twice receiving input data at the client in respect of a redacted content and communicating that data to the server, first for a “redacted part ‘ and again for a “redacted element.” One of ordinary skill in the art cannot determine whether the two recitations define different scopes or repeat one. The second recitation also operates on “at least one redacted element” whose only antecedent lies in an optional recitation, so steps phrased as required depend on an element the claim does not require to exist.
The applicant must resolve each item by amendment or by explaining why the claims are definite as written. The examiner has applied the prior art to the claims as best understood.
Claim Rejections - 35 USC § 102
16. In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
17. The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
18. Claims 1-3, 5, 13, 26, 27, 29 and 32 are rejected under 35 U.S.C. § 102 (a)(2) as being anticipated by Singh (US 20220100885 A1), hereafter Singh.
Regarding claim 1, Singh discloses “a method of redacting server responses in a client-server computing system in which a server and a client communicate via a gateway,” Singh describes “a method of adaptive data loss prevention” ([0009]). Singh describes an appliance 200 deployed as an intermediary between a client 120 and a server 106 (Fig. 1b). Requests and web responses flow between the client and the server through the appliance ([0130]). The appliance masks sensitive data in web responses and therefore performs redaction ([0005]).
“the method comprising: receiving, at said gateway, a response from said server, wherein said response includes content associated with at least one content identifier;” The adaptor engine on the appliance receives a web response 610 from a web application hosted on the server (Fig. 7A, step 702; [0102]; [0131]). The web response includes data 615 comprising elements 620. Each element is a programmatically identifiable user interface element ([0101]). The elements are identifiable based on identifier, class attributes, structure and hierarchy ([0006]). These identifiers are content identifiers associated with the content. In addition, Singh further states that “the response handler 515 may parse the web response 610 to identify the address referencing the data 615 included therein” ([0103]). The address references the data and is therefore an additional content identifier associated with the content.
“identifying at least one redaction rule for use in redacting said response,” The response handler determines whether a rule 540 exists for the web response and searches the database 535 to identify it ([0103]). Fig. 7A shows checking the web-DLP store for data for the web response (step 704), obtaining the Web-DLP rule (step 708), determining whether a matching rule is found for the web response (step 710), and fetching the corresponding template (step 712) ([0131], [01032]).
“wherein at least one of said at least one redaction rule is associated with at least one of said at least one content identifier;” The rule 540’ is defined by identifiable elements 620’ and their attributes, including object type, prefix, suffix, label, character length, character type and location values ([0111]). The specifications of each rule correspond to the attributes of the identifiable elements ([0112]). In addition, Singh states that the response handler may “use the address of the web response 610 to search for at least one rule 540 that corresponds to the address” [0103]. The identified rule is therefore associated with the address, which is a content identifier as noted above.
selectively redacting at least part of said content in accordance with the, or each, identified redaction rule associated with the, or each, content identifier; The policy enforcer determines a match between the specifications of the identified rule and the attributes of the corresponding elements in the data 615 ([0119], [0120]). Upon a complete match, the policy enforcer generates a DLP response 645 that redacts a portion of the data as defined by the corresponding template, replacing the identified sensitive information with placeholders ([0124]to ]0126]). The redaction is selective. Matched instances of data are redacted while nonmatching instances are maintained without redaction ([0128], [0129]).
sending a corresponding response to said client, said corresponding response comprising the redacted content. The policy enforcer itself applies the DLP response to the data of the web response and generates a web response 610’ including data 615’. The data 615’ corresponds to the data 615 with sensitive content removed. The policy enforcer provides the web response 610’ including the data 615 to the client 102 ([0127]).
Claim 1 is therefore anticipated by Singh.
Claim 32:
Regarding claim 32, the claim “a client-server computing system comprising a server, at least one client and a gateway, said server and said at least one client being in communication with each other via said gateway.” Singh describes the client 102, the server 106 and the appliance 200 deployed as an intermediary between them (Fig. 1b; [0130]).
the gateway being configured to receive, a response from said server relating to a request from any one of said at least at least one client, The appliance 200 receives the request 605 from client 102 and forwards it to the server 106 as the request 605’ ([0098]). The server generates the web response 610 responsive to the request ([0099]). The appliance receives the web response 610 (Fig. 7A, step 702; [0102]).
The remaining limitations of claim 32 recite the gateway being configured to perform the operations set forth in claim 1. Singh discloses a gateway configured to perform these operations, as set forth in the rejection of claim 1 above. The appliance 200 comprises the adaptor engine 505 with the response handler 515, the rule generator 525, the policy enforcer 530, and the database 535 (Fig. 5).
Claim 32 is therefore anticipated by Singh.
Claim 2:
Regarding claim 2, Singh discloses the limitations of claim 1 as set forth above.
Singh further discloses “wherein said content comprises at least one content element, and said at least one content identifier comprises at least one content element identifier,” The data 615 includes one or more elements 620. Singh states that “[e]ach element 620 may be a programmatically identifiable user interface element” [(0101). The elements are identifiable based on “identifier, class attributes, structure, and hierarchy” ([0006]). These identifiers are content element identifiers.
“wherein at least one of said at least one content element identifier is associated with at least one of said at least one redaction rule,” The rule 540’ is defined by the identifiable elements 620’ and their attributes ([0111]). The specifications of the rule 540’ correspond to the attributes of the identifiable elements 620’ ([0112]). Generated rules re stored as rule 540 in the database 535 ([0103]).
“said redacting involving redacting one or more of said at least one content element in accordance with the, or each, redaction rule associated with the, or each, respective content element identifier,” The policy enforcer compares the specifications of the rule to the attributes of the corresponding elements 620 in the data 615 of the web response 610 ([0119], [0120]). Upon a match, the policy enforcer replaces the sensitive information identified in the element with a placeholder ([0126]).
“and wherein said corresponding response comprises the one or more redacted content element,” The web response 610’ includes the data 615’, which corresponds to the data 615 with the sensitive content removed, and is provided to the client 102 ([0127]).
The recitations of claim 2 introduced by “typically,” “optionally,” and “preferably” make the associated features optional and fail to limit the claim. Singh nevertheless discloses replacing identified data with placeholder data [0126] and removing sensitive content from the data ([0127]). Claim 2 is therefore anticipated by Singh.
Claim 3:
Regarding claim 3, Singh discloses the limitations of claim 2 as set forth above.
Claim 3 recites two groups of limitations joined by “and/or.” Singh discloses both.
Regarding the first group, Singh discloses “wherein said at least one content element identifier comprises at least one unique content element identifier that uniquely identifies the respective content element, and wherein the, or each, respective redaction rule indicates if said respective content element is to be redacted and/or how said respective content element is to be redacted.” The elements 620 are identifiable in the DOM based on the “identifier, class attributes, structure, and hierarchy” ([0006]). A DOM identifier uniquely identifies the respective element. The rule indicates if the element is to be redacted. When there is a complete match with the rule, the identified data is redacted ([0124]-[0126]). When there is an incomplete match, the data is maintained without redaction ([0128]). The rule, together with its corresponding template 545, indicates how the element is to be redacted. The template corresponds to the rule and defines the placeholder replacement. The sensitive information is replaced with a placeholder in accordance with the template corresponding to the rule ([0124], [0126]). Singh generates the rule [0108] and the template [0114]) from the same web response and the DLP output, and indexes both using the address corresponding toe the web response ([0103], [0124]).
Regarding the second group, Singh discloses “and/or wherein said at least one content element identifier comprises at least one data type identifier that identifies a type of data contained in the respective content element, and wherein said redacting involves redacting the respective content element depending on the type of data identified by the, or each, respective data type identifier.” Singh state that “[t]he label may identify a type of content or classification for the sensitive content 630” and that the type pf characters identifies “whether each character in the sensitive content 630 is an alphabetical or numerical” ([0111]). The label and the character type are data type identifiers. The redacting depends on the identified type. The policy enforcer identifies the type of content for the sensitive information from the element 620 and determines whether the type matches the type specified by the label of the rule 540 ([0122]). When the label or the character type does not comply with the rule, the match is incomplete and the data is maintained ([0122], [0123], [0128]). When all attributes, including the type specifications, comply, the match is complete and the data ais redacted ([0123] –[0126]).
Claim 3 is therefore anticipated by Singh.
Claim 5:
Regarding claim 5, Singh discloses the limitations of claim 1 as set forth above.
Singh further discloses “wherein at least one content identifier is included in, or associated with, said content.” Singh states that “the response handler 515 may parse the web response 610 to identify the address referencing the data 615 included therein” ([0103]). The address is a content identifier included in the web response and associated with the data 615. The elements 620 within the data 615 are likewise identifiable based on “identifier, class attributes, structure, and hierarchy” ([0006]), and these identifiers are included in the content.
“and wherein said identifying at least one redaction rule involves identifying said at least one redaction rule depending on said at least one content identifier.” Singh states that the response handler may “use the address of the web response 610 to search for at least one rule 540 that corresponds to the address” ([0103]). The rule is identified depending on the address. When no rule is found for the address, the response handler determines that no rules exist for the web response ([0103]). The identification of the rule therefore depends on the content identifier. Claim 5 is therefore anticipated by Singh.
Claim 13:
Regarding claim 13, Singh discloses the limitations of claim 1 as set forth above.
Singh further discloses “wherein said redacting involves removing said at least part of said content, or replacing said at least part of said content with alternative content.” Claim 13 requires either removing or replacing, and Singh discloses both. For replacing, Singh states that “policy enforcer 530 may insert or replace the sensitive information identified from the data 615 with the placeholder 630’ in the template 545” ([0126]). The placeholder is alternative content. For removing, Singh states that “[t]he data 615’ may correspond to the data with the sensitive content 630’ removed” ([01027]). Claim 13 is therefore anticipated by Singh.
Claim 26:
Regarding claim 26, Singh discloses the limitations of claim 1 as set forth above.
Singh further discloses “wherein said response relates to a request sent by said client to said gateway, the method including, receiving sad request at said gateway, forwarding said request from said gateway to said server, and receiving said response at said gateway.” Singh states that “the appliance 200 may receive the request 605, and may forward to the server as at least one request 605’” ([0098]). The request 605 is sent by the client 102. Upon receipt, the server parses the request 605’, identifies the resource to be provided to the client 102, and generates the web response 610 to include the identified resource ([0099]). The response therefore relates to the request sent by the client. The appliance receives the web response 610 from the server (Fig. 7A, step 702, [0131]; [0102]). Claim 26 is therefore anticipated by Singh.
Claim 27:
Regarding claim 27, Singh teaches the limitations of claim 1 as set forth above.
The term “content item: is given its broadest reasonable interpretation. A web page is a content item, as demonstrated by Walsh, which describes removing or replacing “offending elements of a content item such as a web page” ([0003]). This interpretation is consistent with the specification, which describes a content item ID that identifies an attribute of the “content 30 as a whole or part of the content 30” (Spec: p. 15, [0076]). The optional recitation of claim 27 that a content item relates to a respective person confirms that a content item is not limited to content relating to a person.
Singh discloses “wherein said content comprises at least one content item, each content item comprising at least one content element.” The data 615 of the web response corresponds to a webpage, and the elements 620 are DOM objects of the webpage ([0101]). The webpage is a content item comprising the content elements.
“wherein said at least one content identifier comprises at least one content item identifier, wherein at least one of said at least one content item identifier is associated with at least one of said at least one redaction rule,” The address references the data 615 and identifies the webpage ([0103]). The address is therefore a content item identifier. The rules 540 are indexed by the address, and the response handler uses “address of the web response 610 to search for at least one rule 540 that corresponds to the address” ([0103]).
“said redacting involving redacting one or more of said at least one content item in accordance with the, or each, redaction rule associated with the, or each, respective content item identifier, and wherein said corresponding response comprises the one or more redacted content item,” The rule retrieved for the address governs the redaction of the webpage ([0103]). For “rules 540 identified from the database 535,” Singh determines “a match of the web response 610 in accordance with the rule 540” ([0119]), and uses the location values specified by the rule to identify the sensitive information within the page” ([0120]). The policy enforcer redacts the sensitive content within the page and generates the web response 610’ including the data 615’, which is the page with the sensitive item removed ([0126], [0127]). The redacted webpage is the redacted content item, and it is provided to the client 102 ([0127]).
The recitation of claim 27 introduced by “typically,” “optionally,” and may be” describe optional features and fail to limit the claim. Claim 27 is therefore anticipated by Singh.
Claim 29:
Regarding claim 29, Singh discloses the limitations of claim 1 as set forth above.
Singh further discloses “rendering a web page or other user interface at said client, said web page or other user interface including said redacted content.” The data 615 of the web response corresponds to a web application or a webpage, and the elements 620 are DOM objects of the webpage ([0101]). The policy enforcer provides the web response 610’ including the redacted data 615’ to the client 102 ([0127]). Singh states that the response from the server hosting the web application is received “to display a page of content” and that the generated masking element is applied “for display of a second page,” preventing loss of sensitive data “from display of the second page” ([0010]). The page rendered at the client includes the redacted content.
The remaining recitations of claim 29 are introduced by “optionally” and describes optional features. The optional recitations fail to limit the claim.
Claim 29 is therefore anticipated by Singh.
Claim Rejections - 35 USC § 103
19. The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
20. The factual inquiries for establishing a background for determining obviousness under 35 U.S.C. 103 are summarized as follows:
1. Determining the scope and contents of the prior art.
2. Ascertaining the differences between the prior art and the claims at issue.
3. Resolving the level of ordinary skill in the pertinent art.
4. Considering objective evidence present in the application indicating obviousness or nonobviousness.
21. Claims 6, 11, 17 and 19-22 are rejected under 35 U.S.C. § 103 as being unpatentable over Singh as applied to claim 1, and further in view of Walsh et al. (US 2012/0179787 A1), hereafter Walsh.
Regarding claim 6, Singh teaches the limitations of claim 1 as set forth above.
However, Singh does not teach “wherein said response includes or is associated with one or more user identifier identifying a user of said client and/or one or more user in respect of which the content relates, and/or one or more user-related identifier identifying a respective attribute of said the, or each, user.” The rules of Singh are identified using the address of the web response and the attributes of the elements, not a user identifier or a user-related identifier.
Walsh cures this deficiency. Walsh states that “the content request may also include identification of the requesting user or device” and that “[t]he proxy server may further store the content request to be able to later identifying the requesting device and/or user when a response to the request is received” ([0025]). The response is therefore associated with a user identifier identifying the user of the client. Walsh further states that “content restriction rules may be different for different users, departments within an organization, devices, pay levels, job titles and the like” ([0026]). To apply rules that differ by department, pay level and job title, the proxy identifies those attributes for the requesting user. Walsh therefore discloses user-related identifiers identifying respective attributes of the user.
Walsh is analogous art. Walsh is direct to selective filtering of requested content at a proxy server between a user and a content server according to content restriction rules, the same field of endeavor as Singh and the claimed invention.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Singh such that the web response received at the appliance 200 is associated with the identification of the requesting user, as taught by Walsh ([0025). The motivation is to filter content according to individual user access privileges (Walsh: [0005]), which “allows the requesting user to receive at least some of the requested content while maintaining the organization restrictions” ([0002]). Storing the request to identify the user of the corresponding response was a known technique, as demonstrated by Walsh ([0025]). Applying it to the appliance of Singh yields the predictable result that the web response received at the gateway is associated with a user identifier identifying the user of the client. One of ordinary skill would have had a reasonable expectation of success because the appliance if Singh already receives both the request 605 and the corresponding web responses 610 ([0098], (0102]).
The recitations of claim 6 introduced by “optionally” describes optional features and fail to limit the claim. Walsh nevertheless teaches identifiers within the enumerated list. The department is an identifier of an organisation or group with which the user is associated, the job title is an identifier of the type of user, and the pay level is an identifier of another attribute relating to the user ([0026]). Walsh also teaches obtaining the identification from the request sent by the client ([0025]).
Claim 11:
Regarding claim 11, Singh in view of Walsh teaches the limitations of claim 6 as set forth above. Walsh further teaches “wherein said identifying at least one redaction rule involves identifying said at least one redaction rule depending on said user identifier and/or said one or more user-related identifier.” Walsh states that “the proxy server may consult a privilege database to determine the types of filtering required for a particular requesting user or device” ([0005]). Walsh further states that “modifications made to a content item may be different depending on the requesting user or device” ([0027]). It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to further modify Singh such that the rules 540 are identified depending on the identification of the requesting user, as taught by Walsh ([0005]). In the combination, the adaptor engine of Singh identifies the rule 540 depending on the user identifier associated with the web response. The rationale and motivation for the combination are the same as set forth for claim 6.
Claim 17:
Regarding claim 17, Singh teaches the limitations of claim 2 as set forth above, and the elements of 620 of Singh include a link element ([0101]). Claim 17 recites two groups of limitations joined by “and/or.” Walsh teaches both.
Regarding the first group, Walsh teaches “wherein said at least one content element comprises a link to a resource, a unique resource identifier and/or a unique resource locator, and wherein said redacting involves removing said link, said unique resource identifier and/or said unique resource locator.” Walsh state that “active hyperlinks may be removed and replaced with mere text corresponding to the address of those hyperlinks” ([0027]). The active hyperlink is removed; the remaining text is not a link.
Regarding the second group, Walsh teaches “wherein said at least one content element comprises a link to a resource, a unique resource identifier and/or a unique resource locator that identifies or otherwise relates to said server, the method further including replacing or modifying said link, said unique resource identifier and/or said unique resource locator to identify or otherwise relate to said gateway.” Walsh states that that the proxy server may “replace remaining links in the requested content with links configured to initially direct content requests through proxy server” ([0028]). The remaining links in the requested content include links to the server providing that content. Walsh further explains that “links in a webpage maybe rewritten or replaced with links that invoke a particular proxy server configured to provide filtered access to external networks” ([0004]).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to further modify Singh to remove link elements identified for redaction and to rewrite remaining links to direct requests through the appliance, as taught by Walsh ([0004], [0027], [0028]). The motivation is to prevent access to restricted resources through links in the delivered content and to keep subsequent requests flowing through the filtering gateway. Walsh explains that without the link replacement, subsequent content requests “may be blocked or denied by the general network gateway or proxy server” ([0028]). Applying these known links handling techniques to the appliance of Singh yields the predictable result that the redacting removes a link and that a link identifying the server is modified to identify the gateway. One of ordinary skill in the art would have a reasonable expectation of success because the appliance of Singh already modifies the source identifier by the request 605’ so that it identifies the appliance 200 rather than the client ([0098]), and generates modified web responses ([0127]).
Claim 19:
Regarding claim 19, Singh teaches the limitations of claim 1 as set forth above. Singh does not teach “wherein said identifying involves identifying at least one default redaction rule for use in redacting said response.” Walsh cures this deficiency. Walsh teaches that the content allowability rules “may be defined by organization, by a default setting, by a user, by a parent or guardian and the like” ([0026]). By its ordinary meaning, a default setting applies when no specific selection is made. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to include the default rules of Walsh among the rules identified by the appliance of Singh, yielding the predictable result that at least one default redaction rule is identified for use in redacting the response. The motivation is to maintain the content restrictions when no more specific rule applies, which “allows the requesting user to receive at least some of the requested content while maintaining the organization restrictions” (Walsh: [0002]). One of ordinary skill would have had a reasonable expectation of success because Singh’s policy enforcer already selects among stored rules upon receiving each web response ([0103]).
Claim 20:
Regarding claim 20, Singh teaches the limitations of claim 1 as set forth above. Singh in view of Walsh teaches “wherein said identifying involves, in response to failing to identify at least one redaction rule associated with said response or said content, using at least one default redaction rule to redact said response or content.” Singh teaches the failure condition. When no rule 540 is found for the web response, the policy enforcer determines whether the DLP service is available, and otherwise continues processing with the incomplete match ([0123]). Walsh teaches default redaction rules. Walsh states that the content allowability rules “may be defined by an organization, by a default setting, by a user,..” ([0026]). A rule defined by a default setting is a default rule that applies in the absence of a specific rule.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to further modify Singh to use the default rules of Walsh when no rule 540 is found ([0123]). In the combination, the predictable result is that a default redaction rule is used to redact the response when no rule associated with the response or the content is identified. The motivation and rationale for the combination are the same as set forth for claim 19.
Claim 21:
Regarding claim 21, Singh teaches the limitations of claim 2 as set forth above. Singh in view of Walsh teaches “wherein said identifying involves, in response to failing to identify at least one redaction rule for at least one of said at least one element identifier, using at least one default redaction rule to redact said at least one of said at least one element identifier.” Singh’s policy enforcer matches the rules against the attributes of individual elements and determines compliance per element ([0119], [0123]). Walsh teaches default redaction rules. Walsh states that the content allowability rules “may be defined by an organization, by a default setting, by a user,..” ([0026]). A rule defined by a default setting is a default rule that applies in the absence of a specific rule.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to further modify Singh to use the default rules of Walsh when no rule is identified for at least one element identifier. In the combination, the predictable result is that a default redaction rule is used to redact the respective element when no rule is identified for at least one element identifier. The motivation and rationale for the combination are the same as set forth for claim 19.
Claim 22:
Regarding claim 22, Singh in view of Walsh teaches the limitations of claim 6 as set forth above. Singh does not teach “wherein said identifying involves, in response to failing to identify said at least one redaction rule depending on said user identifier and/or said one or more user-related identifier, using at least one default redaction rule to redact said response or content.” Singh teaches the failure condition itself. When no rule 540 is found for the web response, the policy enforcer determines whether the DLP service is available, and otherwise continues processing with the incomplete match ([0123]). Singh does not teach using a default redaction rule upon that failure.
Walsh teaches default redaction rules. Walsh states that the content allowability rules “may be defined by an organization, by a default setting, by a user, by a parent or guardian and the like” ([0026]). A rule defined by a default setting is a default rule that applies in the absence of a specific rule.
It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to further modify Singh such that the rules defined by a default setting in Walsh are applied when no rule is identified for the user identifier or the user-related identifier. One of ordinary skill would have been motivated to maintain the content restrictions even when no rules exists for the particular user, the same benefits stated for claim 6 (Walsh: [0002]). By its ordinary meaning, a default setting applies when no specific selection is made. Using the default rule when no rule 540 is found in Singh [(0123]) yields the predictable result that a default redaction rule is used to redact the response when no rule is identified depending on the user identifier. One of ordinary skill would have had a reasonable expectation of success because Singh’s policy enforcer already selects among stored rules upon receiving each web response ([0103], [0123]).
22. Claim 9 is rejected under 35 U.S.C. § 103 as being unpatentable over Singh and Walsh as applied to claims 1 and 6, and further in view of Hussain et al. (US 2010/0241844 A1), hereafter Hussain.
Regarding claim 9, Singh in view of Walsh teach the limitations of claim 6 as set forth above. The combination does not teach “wherein the user identifier and/or said one or more user- related identifier is associated with a session, for example a login session, established between the client and the server via the gateway.” Walsh identifies the requesting user from the stored request ([0025]), but does not associate the identification with a session.
Hussain cures this deficiency. Hussain discloses a redaction appliance that intercepts message between an information source and an information destination and modifies the message contents based on redaction rules (Abstract). Hussains states that the appliance “identifies the client making the request using the authentication information embedded within the request,” and “the client's role is retrieved from the role database (106)” ([0020]). Hussain further states that the redaction rules associated with the role “are retrieved from the redaction rules database (105) and associated with this client's session” ([0020]). The rules are “stored within the appliance for the remainder of the session” ([0017]). The client identity and role are a user identifier and a user-related identifier associated with a session. The session is established between the client and the application server through the appliance. Server responses within the session are parsed “by the protocol parser for the application protocol in use for that session (303)” ([0020]).
Hussain is analogous art because it is directed to rule based redaction of server responses at an intercepting appliance, the same field of endeavor as Singh, Walsh and the claimed invention. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to further modify the combination such that the user identification of Walsh is associated with a session established between the client and the server via the appliance of Singh, as taught by Hussain. The motivation is efficiency. Hussain states that the retrieval of rule “is carried out only once during a single client session,” with all subsequent server response in the session subjected to those rules ([0020]). Associating the user identification with a session was a known technique, as demonstrated by Hussain ([0017], [0020]). Applying it to the combination yields the predictable result that the user identifier and the user-related identifier are associated with a session established between the client and the server via the gateway. One of ordinary skill would have had a reasonable expectation of success because Hussain associates the identification with the session in the same architecture, an appliance that applies stored redaction rules to intercepted server response.
The remaining recitation of claim 9 introduced by “optionally” and “may comprise” describe optional features and fail to limit the claim. The recitation “for example a login session” is exemplary and does not limit the type of session required.
23. Claim 12 is rejected under 35 U.S.C. § 103 a being unpatentable over Singh and Walsh as applied to claims 1 and 6, and further in view of Gibbons (US 2021/0021603 A1), hereafter Gibbons.
Regarding claim 12, Singh and Walsh teach the limitations of claim 6 as set forth above. The combination does not teach “wherein said content includes one or more respective part or respective element(s) relating to a plurality of users, and wherein the respective part or element is redacted depending on the respective user-related identifier(s) and/or respective redaction rule set(s) associated with the respective user.” The user identification of Walsh differentiates the redaction by the requesting user. It does not differentiate the redaction among parts of the content that related to different users.
Gibbons cures this deficiency. Gibbons is directed to masking personal information in a database, and states that personal information “such as personal information such as customer or client names, addresses, phone numbers, email addresses, and social security numbers must be restricted or masked from unauthorized users” ([0002]). Gibbon’s table includes sensitive columns, and each record is assigned a mask ID indicating protection types “for sensitive data in that record” ([0021]). The stated purpose ([0002]), the regional PI authorization example ([0026]), and the custom mask table keyed by PI mask ([0051]) establish that the sensitive data in each record is personal information of a respective person. The records of the base table therefore relate to a plurality of persons.
Gibbons states that “each record may be assigned a mask ID that indicates applicable protection types for sensitive data in that record” ([0021]). The base table includes “one or more protection type foreign keys (e.g. country number or coverage code)” ([0046], and “a mask ID maybe generated for each record” based on those foreign key values ([0048]). The country number of a record identifies the geographical location of the person to whom the record relates. The country number is therefore a respective user-related identifier associated with the respective user. Records are filtered “by comparing protection type security labels pre-defined on each record to the protection type security label of the user account” ([0051]). The resulting smart table view shows “all rows in the base table 110 with sensitive data masked unless the user belongs to the applicable protection groups” ([0052]). Records relating to different persons are therefore masked differently within the same view, each depending on the respective record’s identifiers.
Gibbons is analogous art. Gibbons is directed to selectively masking sensitive personal data in accordance with record-level protection identifiers, the same field of endeavor as Singh, Walsh and the claimed invention. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to further modify the combination such that parts of the content relating to different persons are redacted depending on record-level identifiers of the respective person, as taught by Gibbons. The motivation is compliance with data privacy requirements that vary depending on the person to whom the data relates ([0002]). Gibbons describes regional protection “in the case where only users in specific regions can view certain sensitive data associated with the region” ([0026]). Assigning per-record protection identifiers was a known technique ([0021], [0048]), and applying it to the combination yields the predictable result that the respective part or element is redacted depending on the respective user-related identifier associated with the respective user. One of ordinary skill would have had a reasonable expectation of success because Singh’s policy enforcer already matches rules against element-level identifiers ([0119], [0102]), and the per-record labels of Gibbons are additional identifiers matched in the same way.
The recitation “each user may be a person, e.g. an employee” is optional and exemplary and fails to limit the claim. As set forth above, the records of Gibbons related to persons ([0002], [0026], [0051]).
24. Claims 23 and 24 are rejected under 35 U.S.C. § 103 a being unpatentable over Singh as applied to claim 1, and further in view of Wu et al. (US 11,178,188 B1), hereafter Wu.
Regarding claim 23, Singh teaches the limitations of claim 1 as set forth above.
Singh does not teach wherein “said at least one redaction rule comprises at least one redaction rule that is not associated with said at least one content identifier,” or the recited “wherein said method includes, in respect of at least one redaction rule that is not associated with said at least one content identifier, obtaining from said server information relating to at least one redaction rule that is not associated with said at least one content identifier, and, depending on said information received from said server, selectively redacting at least part of said response or at least part of said content in accordance with said at least one redaction rule that is not associated with said at least one content identifier.” The rules of Singh are associated with the address of the web response or the attributes of the elements, and when no applicable rule is found, Singh consults the DLP service 510, not the server 106 ([0103], [0104], [0111], [0123]).
Wu cures this deficiency. Wu teaches a network security system intermediary between client and cloud applications. The system analyzes an incoming request and detects “absence of at least some metadata required to enforce a security policy” (col. 31, ll. 40-43). The system is configured to “hold the incoming request, generate a synthetic request, and inject the synthetic request into the application session,” and the synthetic request “is configured to retrieve otherwise absent metadata from the cloud application (col. 31, ll. 44-49). A response to the synthetic request is received from the cloud application “within the already established application session” (col. 12, ll. 30-33; col. 31, ll. 50-52). The response “supplies the otherwise absent metadata,” and the system uses the metadata “to enforce the security policy on the incoming request” (col. 31, ll. 50-56). The enforcement then depends on the information received from the cloud application. When the metadata specifies that that login instance was from a controlled account, the system releases the request and transmits it. When the metadata specifies an uncontrolled account, the system blocks the request (col. 22, ll. 43-53; col. 28, ll. 54 - col. 29, ll.5; Fig. 7).
The security policy of Wu that requires the metadata is, in the combination, a redaction rule. That policy is not associated with a content identifier; it is associated with the account status of the login instance, which is why the metadata must be retrieved from the cloud application. Wu gives an example of such a policy: “a policy that requires that only corporate user credentials be used to access the cloud applications 108” (col .15, ll. 57-60). The instance metadata retrieved from the cloud application is information relating to that rule, and the enforcement depends on the information received.
Wu is analogous art. Wu is directed to policy enforcement on traffic between clients and cloud application at an intermediary network security system, the same field of endeavor as Singh and the claimed invention. It would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to modify Singh such that, for a rule whose applicability cannot be determined from the response itself, the appliance obtains the needed information from the server 106 and redacts the response depending on the information received, as taught by Wu. The motivation is to enable the appliance of Singh to enforce rules that depend on information the response does not carry. Wu states the benefit: retrieving the missing metadata directly from the cloud applications “makes the proxies self-sufficient and greatly expands their policy enforcement horizon” (col. 16, ll. 35-41). Applying the technique of Wu to the appliance of Singh yields the predictable result that information relating to the rule is obtained from the server and at least part of the response is selectively redacted depending on the information received. One of ordinary skill would have had a reasonable expectation of success because the appliance of Singh already exchanges requests and responses with the server 106 within the session ([0098], [0102]). The modification adds only the obtaining step and leaves the redaction performed by Singh unchanged ([0119], [0126], [0127]).
Claim 24:
Regarding claim 24, Singh teaches the limitations of claim 1 as set forth above.
Singh in view of Wu teaches “wherein said at least one redaction rule comprises at least one redaction rule that is associated with an attribute of said content, and wherein said method includes, in respect of at least one redaction rule that is associated with said attribute, obtaining from said server information relating to said attribute, and, depending on said information received from said server, selectively redacting at least part of said response or at least part of said content in accordance with said at least one redaction rule associated with said attribute.” In Wu, the account from which the content originates, controlled or uncontrolled, is an attribute of the content (col. 22, ll. 45-53). The policy is associated with that attribute: its enforcement is decided by the account status (col. 22, ll. 43-53). The instance metadata retrieved from the cloud application is information relating to that attribute (col. 22, ll. 40-53; col. 31, ll. 54-56, 60 – col. 32, ll. 4). The request is transmitted or block depending on the metadata received (col. 28, ll. 64 - col. 29, ll. 5; Fig. 17). Wu also discloses a policy keyed to an attribute of the content object itself: the synthetic request may retrieve metadata “that identifies whether the object is sensitive or not,” and the object is blocked if it is sensitive (col. 32, ll. 7-13). In the combination, the predictable result is that at least part of the response is selectively redacted in accordance with the rule associated with the attribute, depending on the information received from the server. The motivation and rationale for the combination are the same as set forth for claim 23.
The recitation of claim 24 introduced by “may be” describes exemplary and optional attributes and fails to limit the claim. Wu nevertheless discloses one of the recited examples: the instance metadata identifier whether the content relates to the organization’s account tot to a private account (col. 22, ll. 45-56). The sensitivity of the object further correspond to the recited security level or information type of the content (col. 32, ll.7-13).
Conclusion
25. The prior art made of record and not relied upon is considered pertinent to applicant's disclosure.
Canning et al. (US 2013/0173815 A1), for claim 9: Canning discloses a first user of a web browser that has “established an existing authentication session with backend server 402 using the reverse proxy” ([0043]). The proxy includes a session cache instantiated “on per user session basis” in which cookies provided during the session are stored for the authenticated user ([0043]).
LaFever et al. (US 2015/0128287 A1), for claims 12 and 27: LaFever discloses determining “a privacy/anonymity level for each potential kind of data associated with a Data Subject” ([0146]), and treating data elements relating to different Data subjects in accordance with each subject’s respective privacy/anonymity levels. LaFever further discloses obscuring data value by replacing them with dynamically assigned de-identifiers (0165], [0166]).
26. Any inquiry concerning this communication or earlier communications from the examiner should be directed to BIN QING ZHENG whose telephone number is (703)756-1535. The examiner can normally be reached on M-F 10:00 am - 06:00 pm.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Philip J. Chea can be reached on 571-272-3951. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/BIN QING ZHENG/
Examiner, Art Unit 2499
/PHILIP J CHEA/Supervisory Patent Examiner, Art Unit 2499
