Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
This action is in response to the communication filed on 07/03/2025.
Claims 1-20 are under examination.
The Information Disclosure Statements filed on 10/30/2025 and 03/08/2026 have been entered and considered.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 1-8 and 19-20 are rejected under 35 U.S.C. 101 because the claimed invention is not directed to patent eligible subject matter. Claims 1-8 and 19-20 recite a system comprising at least one AI-powered assistant. However, the claim limitation does not indicate the AI-power assistant is a hardware element. Therefore, claims 1-8 and 19-20 are apparatus claims but lack physical structure to support it.
Double Patenting
The nonstatutory double patenting rejection is based on a judicially created doctrine grounded in public policy (a policy reflected in the statute) so as to prevent the unjustified or improper timewise extension of the “right to exclude” granted by a patent and to prevent possible harassment by multiple assignees. A nonstatutory double patenting rejection is appropriate where the claims at issue are not identical, but at least one examined application claim is not patentably distinct from the reference claim(s) because the examined application claim is either anticipated by, or would have been obvious over, the reference claim(s). See, e.g., In re Berg, 140 F.3d 1428, 46 USPQ2d 1226 (Fed. Cir. 1998); In re Goodman, 11 F.3d 1046, 29 USPQ2d 2010 (Fed. Cir. 1993); In re Longi, 759 F.2d 887, 225 USPQ 645 (Fed. Cir. 1985); In re Van Ornum, 686 F.2d 937, 214 USPQ 761 (CCPA 1982); In re Vogel, 422 F.2d 438, 164 USPQ 619 (CCPA 1970); and In re Thorington, 418 F.2d 528, 163 USPQ 644 (CCPA 1969).
A timely filed terminal disclaimer in compliance with 37 CFR 1.321(c) or 1.321(d) may be used to overcome an actual or provisional rejection based on a nonstatutory double patenting ground provided the reference application or patent either is shown to be commonly owned with this application, or claims an invention made as a result of activities undertaken within the scope of a joint research agreement. See MPEP § 717.02 for applications subject to examination under the first inventor to file provisions of the AIA as explained in MPEP § 2159. See MPEP §§ 706.02(l)(1) - 706.02(l)(3) for applications not subject to examination under the first inventor to file provisions of the AIA . A terminal disclaimer must be signed in compliance with 37 CFR 1.321(b).
The USPTO Internet website contains terminal disclaimer forms which may be used. Please visit www.uspto.gov/forms/. The filing date of the application in which the form is filed determines what form (e.g., PTO/SB/25, PTO/SB/26, PTO/AIA /25, or PTO/AIA /26) should be used. A web-based eTerminal Disclaimer may be filled out completely online using web-screens. An eTerminal Disclaimer that meets all requirements is auto-processed and approved immediately upon submission. For more information about eTerminal Disclaimers, refer to http://www.uspto.gov/patents/process/file/efs/guidance/eTD-info-I.jsp.
Claims 1-20 are rejected on the ground of nonstatutory double patenting as being unpatentable over claims 1-22 of U.S. Patent No. 12,393,719. Although the claims at issue are not identical, they are not patentably distinct from each other because the subject matter claimed in the instant application is fully disclosed in the patent and is covered by the patent since the patent and the application are claiming common subject matter, as follows: A data security system for protecting private data within a database, the data security system comprising: at least one AI-powered assistant configured to analyze available data, create a contextual framework based on a nature of a query, a persona, and a permission of a user and the at least one AI-powered assistant configured to define and analyze a task associated with a role within an organization; and the at least one AI-powered assistant configured to interact with the user, interpret the query and provide a context-aware, personalized response; and the at least one AI-powered assistant configured to perform behavioral analysis based on the history of the user and user's associated benign or malicious behavior; determine suspicious behavior from outliers in user activity by monitoring sudden changes in the amount and type of data sought by the user; apply probabilistic reasoning to classify suspicious behavior when query patterns change in scope or frequency; maintain a complete audit trail of all data access events; and enable zero trust for data use; at least one data access proxy communicatively coupled with at least one private database, the at least one data access proxy further communicatively coupled with at least one server, the at least one server configured to operate the at least one data access proxy to: a) identify the user and a request from the user to access at least one data item stored in the at least one private database; b) validate the user and the request using behavioral analysis and outlier detection, the validation including inspecting the user's identity, evaluating the user's activity history, evaluating permissions and restrictions associated with the user and the at least one data item and analyzing patterns in user activity for suspicious behaviour including sudden changes in scope or frequency of queries; c) access the private database to retrieve the at least one data item; d) inspect one or more security attributes related to the at least one data item; and e) transform the at least one data item based on one or more privacy rules, the transformation including: redacting information from the at least one data item, deleting information from the at least one data item, substituting information from the at least one private data item with other information, adding information to the at least one data item, providing synthetic data as a private data item, or providing proxy data for the at least one data item.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102 of this title, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1-20 are rejected under 35 U.S.C. 103 as being unpatentable over Wang (US 2023/0245651 A1), Chari et al. (US 2017/0286671 A1), Godefroid et al. (US 12,095796 B1), Srivastava et al. (US 2016/0261621 A1) and Chao et al. (US 9,912,695 B1).
Regarding claim 1, Wang discloses A data security system for protecting private data within a database [par. 0084, introducing security and privacy aspects in knowledge acquisition, par. 0234, database, par. 0239, ensure the privacy and security of user data], the data security system comprising: at least one AI-powered assistant configured to analyze available data [par. 0035, 0110-, virtual assistant, par. 0005, An artificial intelligence (AI) system receives and analyzes environment data], create a contextual framework based on a nature of a query, a persona, and a permissions of a user and the at least one AI-powered assistant configured to define and analyze a task associated with a role within an organization [par. 0005, a method for enabling user-centered and contextually relevant conversational interaction… the AI system utilizes the validated the most relevant intent and objective to facilitate user-centered, contextually relevant, and personalized conversational interaction, par. 0230, the AI system determines the appropriate level of access based on the user’s role and permissions 805, par. 0460, persona, par. 0224, Data privacy ensures that sensitive information about individuals or organizations is protected from unauthorized access]; and the at least one AI-powered assistant configured to interact with the user, interpret the query and provide a context-aware, personalized response [par. 0005, the AI system utilizes the validated the most relevant intent and objective to facilitate user-centered, contextually relevant, and personalized conversational interaction]; and the at least one AI-powered assistant configured to perform behavioral analysis based on the history of the user and user's associated benign or malicious behavior [par. 0057, “the AI system may employ ML algorithms to analyze the interaction data and identify patterns and trends in the user’s behavior”, par. 0404, historical behavior, par. 0230, “The AI system continuously monitors user activity to detect any suspicious behavior or potential security breaches”]; at least one data access proxy communicatively coupled with at least one private database [see fig. 1, AI system 101, data storage 106, par. 0234, database], the at least one data access proxy further communicatively coupled with at least one server, the at least one server configured to operate the at least one data access proxy to: a) identify the user and a request from the user to access at least one data item stored in the at least one private database [par. 0005, The cloud-based server 107 manages the processing and storage of data and provides computing power to enable the AI application to function, par. 0049, par. 0228, the AI system verifies the user’s identity before granting access to sensitive data ]; b) validate the user and the request using behavioral analysis, the validation including inspecting the user’s identity [par. 0228, After the user authentication step, the AI system enforces a range of security measures to safeguard sensitive data against unauthorized access], evaluating the user’s activity history [par. 0286, user’s interaction history], evaluating permissions and restrictions associated with the user and the at least one data item [par. 0230, determines the appropriate level of access based on the user’s role and permissions]; c) access the private database to retrieve the at least one data item; d) inspect one or more security attributes related to the at least one data item; and e) transform the at least one data item based on one or more privacy rules [par. 0228, enforces a range of security measures to safeguard sensitive data against unauthorized access, disclosure, or tampering 802. The implemented measures may comprise encryption, access control, data masking, or data anonymization techniques, depending on the sensitivity level and applicable legal or regulatory requirements], the transformation including: redacting information from the at least one data item, deleting information from the at least one data item, substituting information from the at least one private data item with other information, adding information to the at least one data item, providing synthetic data as a private data item, and providing proxy data for the at least one data item [par. 0228, data masking, or data anonymization techniques, par. 0085, privacy methods can add randomness to the data to safeguard confidential information, par. 0239, To prevent the disclosure of sensitive information, the AI system uses filter functions and a transformation module that automatically removes any first-level data from the generated responses… The conversational AI agent then responds to the student’s query without using any personal information].
Wang does not explicitly disclose the at least one AI-powered assistant configured to determine suspicious behavior from outliers in user activity by monitoring sudden changes in the amount and type of data sought by the user, maintain a complete audit trail of all data access events; validate the user and the request using outlier detection, and analyzing patterns in user activity for suspicious behaviour including sudden changes in scope or frequency of queries.
However, Chari et al. teaches the at least one AI-powered assistant configured to determine suspicious behavior from outliers in user activity by monitoring sudden changes in the amount and type of data sought by the user [par. 0061, malicious user activity detection, par. 0087, “malicious user activity detector 302 may carry risk over from prior time periods (e.g., where the user has consistently behaved suspiciously) versus a time period where the user exhibited a sudden change behavior”], maintain a complete audit trail of all data access events [par. 0071, “ Malicious user activity detector 302 processes user profile data, as well as, user asset access activity logs corresponding to the user, in a flexible fashion to support analysis of multiple assets and data types”]; validate the user and the request using outlier detection, and analyzing patterns in user activity for suspicious behaviour including sudden changes in scope or frequency of queries [par. 0061, malicious user activity detection, par. 0087, “malicious user activity detector 302 may carry risk over from prior time periods (e.g., where the user has consistently behaved suspiciously) versus a time period where the user exhibited a sudden change behavior”].
Before the effective filing date of the claimed invention, it would have been obvious to a person having ordinary skill in the art to incorporate the teaching of Chari et al. into the teaching of Wang with the motivation to utilize some analytics that produce more accurate results for detecting some types of anomalous user behavior as taught by Chari et al. [Chari et al.: par. 0084].
They do not explicitly disclose enable zero trust for data use.
However, Godefroid et al. teaches enable zero trust for data use [col. 63, lines 13-23, “the systems described herein may be configured to interact with zero trust solutions in a variety of ways. For example, agents that collect input data for the systems described herein (or other components of such systems) may be configured to access various machines, applications, data sources, or other entity through a zero-trust solution… the zero-trust solution itself may be monitored to identify vulnerabilities, anomalies”].
Before the effective filing date of the claimed invention, it would have been obvious to a person having ordinary skill in the art to incorporate the teaching of Godefroid et al. into the teaching of Wang and Chari et al. with the motivation to prevent successful breaches by eliminating the concept of trust from an organization's network architecture as taught by Godefroid et al. [Godefroid et al.: col. 63, lines 5-7].
They do not explicitly disclose apply probabilistic reasoning to classify suspicious behavior when query patterns change in scope or frequency.
However, Srivastava et al. teaches apply probabilistic reasoning to classify suspicious behavior when query patterns change in scope or frequency [par. 0079, “classifier device 240 may use another mathematical and/or probabilistic technique to classify the user's behavior”, par. 0017, “The classifier device may compare User X's behavior to the normal behavior pattern. The classifier device may determine that a difference between User X's behavior and the normal behavior pattern satisfies a threshold. The classifier device may determine that User X's behavior is abnormal based on determining that the threshold is satisfied. The threshold may be satisfied because the normal behavior pattern includes zero requests to trojan.com but User X's behavior includes two requests to trojan.com. In other words, the classifier device, using the model, may determine that there is a high probability that a user that often requests access to “trojan.com” is an abnormal user who poses a network threat”].
Before the effective filing date of the claimed invention, it would have been obvious to a person having ordinary skill in the art to incorporate the teaching of Srivastava et al. into the teaching of Wang, Chari et al. and Godefroid et al. with the motivation to improve network security by detecting and/or neutralizing network threats in a time sensitive manner as taught by Srivastava et al. [Srivastava et al.: par. 0022].
They do not explicitly disclose the transformation including substituting information from the at least one private data item with other information, adding information to the at least one data item.
However Chao et al. teaches the transformation including substituting information from the at least one private data item with other information, adding information to the at least one data item, providing synthetic data as a private data item, and providing proxy data for the at least one data item [col. 11, lines 14-28, “The content generation unit 215 can be configured to sanitize the data to ensure that no sensitive information or fake sensitive information is included in the synthetic content. The fake sensitive information can include information that appears to be sensitive information, but actually comprises no non-publically available information. The fake sensitive information can be algorithmically generated to appear to be sensitive information. The content generation unit 215 can be configured to remove sensitive information, encrypt or otherwise obfuscate the sensitive information, or to replace the sensitive information with randomly generated content or algorithmically generated fake sensitive information”].
Before the effective filing date of the claimed invention, it would have been obvious to a person having ordinary skill in the art to incorporate the teaching of Chao et al. into the teaching of Wang, Chari et al., Godefroid et al. and Srivastava et al. with the motivation of operating a security system for protecting a server as taught by Chao et al. [Chao et al.: col. 3, lines 40-47].
Regarding claim 2, the rejection of claim 1 is incorporated.
Wang further disclose wherein the at least one server is further configured to provide a response to the user, the response comprising a transformed version of the requested data item, the transformed version being accessible to the user by way of the data access proxy [par. 0239, To prevent the disclosure of sensitive information, the AI system uses filter functions and a transformation module that automatically removes any first-level data from the generated responses… The conversational AI agent then responds to the student’s query without using any personal information].
Regarding claim 3, the rejection of claim 1 is incorporated.
Chao et al. further teaches wherein the server is further configured to operate the data access proxy to provide schemas of introducing misinformation as part of the response, the misinformation functioning as a tracker for tracing a flow of information and identifying a malicious user [col. 2, lines 11-21, “Analyzing activities of the unauthorized party with the duplicate user session to identify one or more types of attack, generating configuration information for the network device based on the one or more types of attempted attack on the server, and sending a configuration message to the network device to change one or more configuration settings based on the configuration information. The configuration information comprises at least one of a rule for determining whether to block a particular activity performed by a user and a signature for identifying that an attack on the server is being undertaken”, col. 11, lines 14-15, “The content generation unit 215 can be configured to sanitize the data to ensure that no sensitive information or fake sensitive information is included in the synthetic content”].
Before the effective filing date of the claimed invention, it would have been obvious to a person having ordinary skill in the art to incorporate the teaching of Chao et al. into the teaching of Wang, Chari et al., Godefroid et al. and Srivastava et al. with the motivation of operating a security system for protecting a server as taught by Chao et al. [Chao et al.: col. 3, lines 40-47].
Regarding claim 4, the rejection of claim 1 is incorporated.
Wang further disclose the user is identified by comparing the user’s identity with information from a user database [par. 0154, identify key entities in the user’s query, such as the names of people or places. The system may then use this information to generate a response that is personalized and contextually relevant to the user’s query, par. 0237, Users should identify themselves to the AI system, typically through a username or unique identifier, par. 0499, database].
Regarding claim 5, the rejection of claim 4 is incorporated.
Wang further disclose the user is identified by comparing the user’s identity with information from a user database [par. 0499, accessing the user’s preferences and history from the database].
Regarding claim 6, the rejection of claim 1 is incorporated.
Wang further disclose the data access proxy further functioning as a single front end between and communicatively coupled with one or more data consumers and one or more data side silos in an organization [see fig. 19, par. 0041, The intelligent system 100 also includes data storage 106, cloud-based server 107, application programming interfaces (APIs) 108, and network 109. The data storage 106 stores and manages the vast amounts of data generated by the AI system 101. The cloud-based server 107 manages the processing and storage of data and provides computing power to enable the AI application to function. The network 109 connects the various components and allows for communication between them].
Regarding claim 7, the rejection of claim 6 is incorporated.
Wang further discloses the server further configured to operate the data access proxy to integrate a plurality of new data consumers and new data silos [see fig. 19, par. 0041, The intelligent system 100 also includes data storage 106, cloud-based server 107, application programming interfaces (APIs) 108, and network 109. The data storage 106 stores and manages the vast amounts of data generated by the AI system 101. The cloud-based server 107 manages the processing and storage of data and provides computing power to enable the AI application to function. The network 109 connects the various components and allows for communication between them, par. 0067, new data, new entities].
Regarding claim 8, the rejection of claim 6 is incorporated.
Wang further discloses the server further configured to operate the data access proxy to query the data security system with a common query language or a native protocol of the user [par. 0195, The knowledge graph engine provides a query language and interface for users to search, filter, and retrieve information from the knowledge graph. Users can perform complex queries that involve traversing multiple relationships or aggregating information across different entities.].
Regarding claim 9, it recites limitations like claim 1. The reason for the rejection of claim 1 is incorporated herein.
Regarding claim 10, it recites limitations like claim 2. The reason for the rejection of claim 2 is incorporated herein.
Regarding claim 11, it recites limitations like claim 3. The reason for the rejection of claim 3 is incorporated herein.
Regarding claim 12, the rejection of claim 9 is incorporated.
Wang further disclose recognizing anomalous behavior, tokenizing the anomalous behavior or user associated with the anomalous behavior, and tracking the anomalous behavior or the user associated with the anomalous behavior [par. 0358, The algorithm is also able to detect anomalies or unexpected events in the environment, which can trigger alerts or responses from the AI system, par. 0230, The AI system continuously monitors user activity to detect any suspicious behavior or potential security breaches].
Regarding claim 13, it recites limitations like claim 4. The reason for the rejection of claim 4 is incorporated herein.
Regarding claim 14, it recites limitations like claim 4. The reason for the rejection of claim 4 is incorporated herein.
Regarding claim 15, it recites limitations like claim 6. The reason for the rejection of claim 6 is incorporated herein.
Regarding claim 16, it recites limitations like claim 7. The reason for the rejection of claim 7 is incorporated herein.
Regarding claim 17, it recites limitations like claim 8. The reason for the rejection of claim 8 is incorporated herein.
Regarding claim 18, the rejection of claim 14 is incorporated.
Wang further discloses normalizing a data format for the data across the data consumers and data silos within the network architecture [par. 0379, After the data is classified and categorized, it undergoes a transformation process where it is converted into a textual form that can be easily processed by the AI system 1704. This includes converting the data into a standardized format and normalizing the data].
Regarding claim 19, the rejection of claim 1 is incorporated.
Wang further discloses the AI assistant configured to analyze the available data to create the contextual framework based on the nature of the query, the persona, and the permissions of the user; utilize the contextual framework to interpret a natural language query from the user; and provide a context-aware, personalized response and guidance tailored to the user's permission and role [par. 0005, a method for enabling user-centered and contextually relevant conversational interaction… the AI system utilizes the validated the most relevant intent and objective to facilitate user-centered, contextually relevant, and personalized conversational interaction, par. 0063, The AI system may use natural language processing algorithms to extract relevant information from user inputs, par. 0230, the AI system determines the appropriate level of access based on the user’s role and permissions 805, par. 0460, persona, par. 0224, Data privacy ensures that sensitive information about individuals or organizations is protected from unauthorized access].
Regarding claim 20, the rejection of claim 1 is incorporated.
Wang further discloses the AI assistant configured to analyze a job description within an organization to create a contextual persona for an employee; build a profile that includes a permission, responsibility, and a typical query related to a role; and provide precise and relevant assistance tailored to a specific job function based on the profile [par. 0236, RBAC assigns permissions based on predefined roles, which are tied to specific job functions or responsibilities, par. 0253, The AI system adjusts the interface based on the user’s role, offering different features and functions, par. 0354, In a healthcare setting, the AI system can assume that different user roles have different needs and preferences. For example, it might assume that a doctor needs access to patient records and diagnostic tools, while a patient may require information about their treatment plan and recovery].
Conclusion
The prior art made of record and not relied upon is considered pertinent to Applicant’s disclosure:
US 20240095385 A1 DATASET PRIVACY MANAGEMENT SYSTEM
US 11831965 B1 Identifiable Information Redaction And/or Replacement
US 11275850 B1 Multi-faceted Security Framework For Unstructured Storage Objects
US 11250876 B1 Method And System For Confidential Sentiment Analysis
US 20210256160 A1 METHOD AND SYSTEM FOR AUTOMATED TEXT ANONYMISATION
US 20210124843 A1 SYSTEMS AND METHODS RELATED TO THE UTILIZATION, MAINTENANCE, AND PROTECTION OF PERSONAL DATA BY CUSTOMERS
US 20210064781 A1 DETECTING AND OBFUSCATING SENSITIVE DATA IN UNSTRUCTURED TEXT
US 20200125746 A1 SYSTEMS AND METHODS FOR SECURING DATA BASED ON DISCOVERED RELATIONSHIPS
US 20170344887 A1 HEURISTICALLY PROGRAMMED ARTIFICIAL INTELLIGENCE FOR MAINFRAME OPERATING SYSTEMS
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JASON CHIANG whose telephone number is (571)270-3393. The examiner can normally be reached on 9 AM to 6 PM.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Lynn Feild can be reached on (571) 272-2092. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of an application may be obtained from the Patent Application Information Retrieval (PAIR) system. Status information for published applications may be obtained from either Private PAIR or Public PAIR. Status information for unpublished applications is available through Private PAIR only. For more information about the PAIR system, see http://pair-direct.uspto.gov. Should you have questions on access to the Private PAIR system, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative or access to the automated information system, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/JASON CHIANG/Primary Examiner, Art Unit 2431
