Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Detail Action
2. This office action is response to the application filed on . Claims 1-20 are pending in this communication.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
3. Claims 1-20 are rejected under AIA 35 U.S.C. 103 as being unpatentable over Roberts et al (US 20190073739 A1) in view of Rodriguez et al. (US 20250258960 A1)
Regarding Claim 1:
Roberts discloses:
a. A method of preserving data privacy in intelligent task performance, (Claim.7, Abstract, Para.0031; “method of …. detecting that the particular trajectory associated with the particular profile data”, “configuring artificial-intelligence (AI) ….. nodes throughout a communication decision …. support successive iteration of AI models …. corresponds to a trajectory”, “Communication decisions ….. based on …..obscure or eliminate fields in individual records according to data-privacy rules …. to comply with data-privacy rules”) comprising:
receiving a request from a user device associated with a specific user account to perform an online task; (Para.0069, Para.0083, Para.60; “receiving a … request for content (e.g., corresponding to a given web site or app) from a user device”, “a user has completed …..particular actions (e.g., … purchased … items from a web site, navigated to …. webpages on a web site, etc.”, “client system … include a web server …. that receives …. HTTP requests for pages on one or more domains and an email server …..that delivers emails to users' email addresses…Client system …. receive …. Requests…. via an application executing on a user device” when a user is completing particular actions (e.g., purchasing items from a web site, navigating to webpages on a web site is construed as the claimed ‘performing an online task’)
b. identifying one or more sensitive items in the request based on access control rules, (Para.0049, Para.0052, Para.0050, Para.0027, Para.0034; “a request includes one or more identifiers”, “Access control … determine whether a requesting device corresponds to the client associated with the identifier and whether any authenticating and/or permission information is valid”, “identify one or more profiles that correspond to the ….. identifiers. An access control …. determine whether the profile(s) include PII”, “profile data corresponding to the user includes information for …. logged as profile data”, “profiles …. include PII, such as a user's name, email address, social security number, etc.” when a user sends HTTP requests for web pages, a request includes one or more identifiers associated with a particular profile and the profile(s) include PII for a particular user, is construed as the claimed ‘identifying one or more sensitive items in the request….’)
each sensitive item of the one or more sensitive items having a specific access restriction (Para.0031, Para.0050; “information gathered from devices …. have been gathered according to a variety of privacy policies and laws that restrict the flow of personally identifiable information (PII)”, “An access control…. component …. determine whether the profile(s) include PII. If so, access control …. filters to obscure or remove the PII (e.g., by removing select field values”) for a specific computer application used to perform the online task; (Para.0060, Para.0090, Para.0028; “application executing on a user device…. requests from one or more user devices 150-1, 150-2 and…. trigger transmission of content to one or more user devices”, “a client-associated application ….have been installed at a user device”, “the user activating a link within the email to access a page on the web site …. corresponds to …. a purchase of an item represented on the web site….. ”)
c. generating, for each sensitive item of the one or more sensitive items, (Para.0169, Para.0186; “for each of the identifiers within the client-specific set of obfuscated profile identifiers, profile information that corresponds to ….. client-associated PII data”, “set of profiles …. include ….for each of the identifiers within the client-specific set of obfuscated profile identifiers, profile information that corresponds to ….. client-associated PII data for the profile”) a specific mapping between an original value and an obfuscated value of the sensitive item based on the online task; (Para.0173, Para.0076, Para.0148; “each of the profile identifiers …. maintained a mapping between individual obfuscated identifier and a de-obfuscated identifier…. mapping the obfuscated identifiers to de-obfuscated identifiers…. correspond to the originally identified obfuscated identifiers”, “obfuscating profile-related information corresponding to personally identifiable information”, “a web site publisher, advertiser, user data consumer…. can be an owner of PII…. to facilitate and/or monitor activities at user device …..including browsing …. such as completion of an online form that requests personally identifiable information (e.g., an email address)”)
d. creating ….data to the specific computer application based on the request, (Para.0060, Para.0090, Para.0028; “HTTP requests for pages on one or more domains and an email server …that delivers emails to users' email addresses…. receive and respond to requests received via an application executing on a user device…..transmission of content to one or more user devices 150-1, 150-2”, “a client-associated application may have been installed at a user device”, “the user activating a link within the email to access a page on the web site and/or the user interacting with the web site …. that corresponds to …. a purchase of an item represented on the web site….”)
the …..data replacing the original value of a sensitive item of the one or more sensitive items by a corresponding obfuscated value based on the specific mapping generated for the sensitive item; (Para.0035, Para.0078, Para.0076; “generate an obfuscated data set to correspond to the set of profiles”, “PII profile data …. for a single client corresponding to the PII owner….. generate a …. obfuscated ID (e.g., …. obfuscated user identifier)”, “obfuscating profile-related information corresponding to personally identifiable information”)
transmitting the …..data to the specific computer application to obtain output data; (Para.0059, Para.0060; “identifying ….a set of …. content of a marketing email, content of a promotion, and/or the configuration of a web site…relates to a set of corresponding outputs (e.g., an outcome…..for a corresponding marketing email, a corresponding promotion, and/or a corresponding web site configuration)”, “web sites…. one or more apps …. causes emails to be transmitted…… domains and an email server ….. that delivers emails to users' email addresses… an app server …to receive and respond to requests received via an application executing on a user device”)
e. generating a result of performing the task based on the output data, (Para.0116, Para.0072; “a target outcome …. include detecting that a link …. availed to the user device was clicked…. that a communication resulted in a purchase made in association with the user device …. that a chat session was initiated, that a form was completed”, “online purchases of food delivery…. detected that a particular user had looked at a menu for a given restaurant …. indicate that …. the user will make a purchase from the restaurant if an email including a discount code is sent in the evening to the user” online order for purchasing food in association with a user device is construed as the claimed ‘generating a result of performing the task…’, a target outcome include detecting that a link availed to the user device was clicked, [e.g., a particular user had looked at a menu for a given restaurant indicate that the user will make a purchase from the restaurant if an email including a discount code is sent to the user] is construed as the claimed ‘…..based on the output data’)
the result replacing an obfuscated value of a sensitive item of the one or more sensitive items to the corresponding original value based on the specific mapping generated for the sensitive item; (FIG. 15/Para.0178, Para.0076, Para.0035; “profile data corresponding to individual ….stages… ….indicating that a communication was received (first stage), that a link within the communication was clicked (second stage), that an interaction at the linked web site corresponding to adding a product to a cart (third stage), and that an interaction at the linked web site corresponding to purchasing a product (fourth stage)” these four stages present the flow of the claimed ‘result based on the output data’, “obfuscating profile-related information corresponding to personally identifiable information”, “generate an obfuscated data set to correspond to the set of profiles. The obfuscated data set … generated by ….. removing values … from individual profiles”)
transmitting the result to the user device, (Para.0039, Para.0072; “completing a purchase on a website associated with a client”, “…. online purchases of food delivery” after completing a purchase on a website associated with a user, food is delivered, which is construed as the claimed ‘transmitting the result to the user device’)
however, Roberts does not explicitly disclose:
d. creating input data to the …. computer …
…. the input data …. of the ….. corresponding obfuscated value….
transmitting the input data to the …. computer …
In an analogous reference Rodriguez discloses:
d. creating input data to the …. computer … (Para.0053, Para.0051; “AI system 250 … receive inputs”, “AI system 250 runs on …. information handling systems (comprising …. processors and …. memories, and ….. computing device elements …..”)
…. the input data …. of the ….. corresponding obfuscated value….(Para.0052,Para.0062, Para.0054; “input questions to AI system”, “the AI Engine processes the obfuscated request”, “AI Engine 270….is an interconnected ….collection of operations. ….. through a machine learning system….. such as data ingestion….The AI system can then access, analyze, … the data …..”)
transmitting the input data to the …. computer … (Claim.1, Para.0008, Para.0002; “transmitting the obfuscated request to the AI engine”, “identify and obfuscate ….data …. ingested by a ….AI engine”, “The ingestion of data provided by users …. When a user inputs text…..”)
Before the effective filing date of the claimed invention, it would have been obvious to one with ordinary skill in the art to modify Roberts’s method of detecting a particular trajectory associated with the particular profile data by enhancing Roberts’s method to include Rodriguez’s method of obfuscating a request by replacing the sensitive data.
The motivation: by obfuscating sensitive data/data, before it is transmitted to the AI model, enhances privacy as it protects sensitive information from being exposed in AI applications, ensuring compliance with data protection laws. Also, it reduces the risk of unauthorized access or misuse of sensitive data, preserving the value and usability of data while enabling effective AI operations.
With respect to independent claims 13 and 20, a corresponding reasoning was given earlier in this section with respect to claim 1; therefore, claims 13 and 20 rejected, for similar reasons, under the grounds as set forth for claim 1.
Regarding Claim 2:
Roberts in view of Rodriguez discloses:
The method of claim 1, further comprising:
obtaining context data based on the request; (Roberts, Para.0050, Para.0047; “a profile data set to include …. profile data. The profile data set can include individual records that correspond to a set of field values of an individual profile”, “a field value is characterized as PII data … included in a profile-specific record”)
identifying a set of sensitive items in the context data based on the access control rules, (disclosed in claim 1)
each sensitive item of the set of sensitive items having a certain access restriction for the specific computer application, (disclosed in claim 1)
generating, for each sensitive item of the set of sensitive items, a certain mapping between an original value and an obfuscated value of the sensitive item based on the online task, (disclosed in claim 1)
the input data further replacing the original value of a sensitive item of the set of sensitive items by a corresponding obfuscated value based on the certain mapping generated for the sensitive item. (disclosed in claim 1)
Regarding Claim 3:
Roberts in view of Rodriguez discloses:
The method of claim 1, further comprising
obtaining an access control rule of the access control rules from a local database or based on the request, (Roberts, Para.0050; “at data management system …. identify one or more profiles ….. An access control 127 component …. determine whether the profile(s) include PII. If so, access control ….. obscure or remove the PII (e.g., by removing select field values”)
the access control rule being applicable to one or more of a user account, (Para.0148; “web server ….is associated with a particular client …who can be an owner of PII…. to facilitate and/or monitor activities at user device ….. including browsing …. such as completion of an online form that requests personally identifiable information (e.g., an email address)”) a group user account, an organization account, a data item, a document, a computer application, or a computer device.
With respect to dependent claim 14, a corresponding reasoning was given earlier in this section with respect to claim 3; therefore, claim 14 rejected, for similar reasons, under the grounds as set forth for claim 3.
Regarding Claim 4:
Roberts in view of Rodriguez discloses:
The method of claim 1, the obfuscated value of the sensitive item of the one or more sensitive items including random data, (Roberts, Para.0053, Para.0173; “mapping may occur using …. a pseudo-random user identifier”, “a mapping between individual obfuscated identifier and a de-obfuscated identifier”) default data, approximate data, or corresponding metadata.
Regarding Claim 5:
Roberts in view of Rodriguez discloses:
The method of claim 1, generating the specific mapping comprising ranking obfuscation techniques by degree of obfuscation, (Roberts, Para.0051, Para.0173; “mapper …. assign a client-specific obfuscated identifier …. then associate each client-specific obfuscated identifier with ….an indication of a degree and/or type of obfuscation”, “a mapping between individual obfuscated identifier and a de-obfuscated identifier”) speed of implementation, or nature of the online task.
With respect to dependent claim 15, a corresponding reasoning was given earlier in this section with respect to claim 5; therefore, claim 15 rejected, for similar reasons, under the grounds as set forth for claim 5.
Regarding Claim 6:
Roberts in view of Rodriguez discloses:
The method of claim 1, generating the specific mapping comprising:
determining that the online task can be performed using metadata of each sensitive item; (Roberts, Para.0083, Para.0085, Para.0148; “a user has completed …..particular actions (e.g., … purchased …..items from a web site, navigated to …. webpages on a web site, etc.”, “a …. action …. that represents an email communication”, “facilitate and/or monitor activities at user device …. including browsing ….such as completion of an online form that requests personally identifiable information (e.g., an email address)”)
setting the obfuscated value of the sensitive item based on the metadata. (Roberts, Para.0076, Para.0047, Para.0156; “obfuscating profile-related information corresponding to personally identifiable information”, “a field value is characterized as PII data …. included in a profile-specific record”, “PII (e.g., an email address during …. registration)”)
With respect to dependent claim 16, a corresponding reasoning was given earlier in this section with respect to claim 6; therefore, claim 16 rejected, for similar reasons, under the grounds as set forth for claim 6.
Regarding Claim 7:
Roberts in view of Rodriguez discloses:
The method of claim 1, generating the specific mapping comprising:
determining that the online task relies on the one or more original values of the one or more sensitive items; (Roberts, Para.0083, Para.0085, Para.0148; “a user has completed …..particular actions (e.g., … purchased …items from a web site, navigated to …. webpages on a web site, etc.”, “a …. action …. that represents an email communication”, “facilitate and/or monitor activities at user device …. including browsing ….such as completion of an online form that requests personally identifiable information (e.g., an email address)”)
…. the obfuscated value of each sensitive item…. (Roberts, disclosed in claim 6)
setting the obfuscated value of each …. item to be an encompassing range of the original value of the ….. item. (Rodriguez, Para.0015, Para.0061; “encompasses a specific obfuscation technique where the ….. data within the request is replaced by ….”, “For instance, a real individual's name such as “Robert Williams” could be replaced with a generic placeholder like “John Doe,” and a genuine social security number could be substituted with a dummy number such as ‘999-99-9999’”)
With respect to dependent claim 17, a corresponding reasoning was given earlier in this section with respect to claim 7; therefore, claim 17 rejected, for similar reasons, under the grounds as set forth for claim 7.
Regarding Claim 8:
Roberts in view of Rodriguez discloses:
The method of claim 1, the specific mapping for a sensitive item of the one or more sensitive items indicating a function for transformation between the original value and the obfuscated value of the sensitive item or identifying information of the sensitive item. (Roberts, Para.0050, Para.0173; “whether the profile(s) include PII. If so, …. transform ….. to obscure or remove the PII (e.g., by removing select field values….. introducing noise to select field values, …. define a profile data set to include … transformed profile data”, “a mapping between individual obfuscated identifier and a de-obfuscated identifier”)
Regarding Claim 9:
Roberts in view of Rodriguez discloses:
The method of claim 1,
the specific computer application including a ….. model ….. (Roberts, Para.0039, Para.0060, Para.0061; “The machine-learning model … trained to prioritize …a particular user-initiated action (e.g., opening a communication, activating a link within a communication, completing a purchase on a website associated with a client”, “HTTP requests for pages on one or more domains and …. received via an application executing on a user device… trigger transmission of content to one or more user devices”, “requests for content (e.g., a webpage or app page)”)
….. to generate instructions for completing the online task or (Roberts, Claim.16, Para.0039; “the instructions …to cause the …data processors to perform actions”, “a particular user-initiated action (e.g., opening a communication, activating a link within a communication, completing a purchase on a website associated with a client”) to partially complete the online task.
…. the specific …. application including a large language model (LLM), (Rodriguez, Para.0001, Para.0055, Para.0057; “Large Language Models (LLMs) …. The architecture of LLMs facilitates the handling of …. text”, “Models 275 are the result of AI modeling….. AI models 275 provide AI system 250 …. to support advanced intelligence methodologies”, “AI applications 290 …. focused on one or more tasks, operations….”)
…. the input data including a prompt for the LLM… (Rodriguez, Para.0002; “When a user inputs text, the LLM processes this input…. Because of their user inputs, LLMs can retain …. user data ….”)
With respect to dependent claim 18, a corresponding reasoning was given earlier in this section with respect to claim 9; therefore, claim 18 rejected, for similar reasons, under the grounds as set forth for claim 9.
Regarding Claim 10:
Roberts in view of Rodriguez discloses:
The method of claim 1,
the output data including instructions for completing the task,
generating the result comprising following the instructions. (Roberts, Para.0116, Para.0072; “a target outcome …. include detecting that a link …. availed to the user device was clicked…. that a communication resulted in a purchase made in association with the user device …. that a chat session was initiated, that a form was completed”, “online purchases of food delivery…. detected that a particular user had looked at a menu for a given restaurant …. indicate that …. the user will make a purchase from the restaurant if an email including a discount code is sent in the evening to the user”)
Regarding Claim 11:
Roberts in view of Rodriguez discloses:
The method of claim 1,
the result further replacing an original value of a digital item by a specific obfuscated value based on the access control rules, (Roberts, FIG. 15/Para.0178, Para.0076, Para.0035, Para.0050; “profile data corresponding to individual ….stages… ….indicating that a communication was received (first stage), that a link within the communication was clicked (second stage), that an interaction at the linked web site corresponding to adding a product to a cart (third stage), and that an interaction at the linked web site corresponding to purchasing a product (fourth stage)”, “obfuscating profile-related information corresponding to personally identifiable information”, “generate an obfuscated data set to correspond to the set of profiles. The obfuscated data set … generated by ….. removing values … from individual profiles”, “An access control 127 component …. determine whether the profile(s) include PII. If so….. obscure or remove the PII (e.g., by removing select field values”)
the digital item having a particular access restriction for the specific user account. (Roberts, Para.0050, Para.0031, Para.0148; “An access control…. component …. determine whether the profile(s) include PII”, “information gathered from devices …. have been gathered according to a variety of privacy policies and laws that restrict the flow of personally identifiable information (PII)”, “to facilitate and/or monitor activities at user device …..including browsing …. such as completion of an online form that requests personally identifiable information (e.g., an email address)”))
With respect to dependent claim 19, a corresponding reasoning was given earlier in this section with respect to claim 11; therefore, claim 19 rejected, for similar reasons, under the grounds as set forth for claim 11.
Regarding Claim 12:
Roberts in view of Rodriguez discloses:
The method of claim 1, the online task including interacting with a webpage or searching a database. (Roberts, Para.0069, Para.0083; “receiving a … request for content (e.g., corresponding to a given web site or app) from a user device”, “a user has completed …..particular actions (e.g., … purchased ….. items from a web site, navigated to …. webpages on a web site, etc.”)
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SAYEDA SALMA NAHAR whose telephone number is (703)756-4609. The examiner can normally be reached M-F 12:00 PM to 6:00 PM EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Amir Mehrmanesh can be reached on (571) 270-3351. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SAYEDA SALMA NAHAR/Examiner, Art Unit 2435
/BEEMNET W DADA/Primary Examiner, Art Unit 2435
Prosecution Insights