DETAILED ACTION
This office action is in response to the application filed on 08/14/2025. Claims 1-20 are pending and are examined.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Information Disclosure Statement
The information disclosure statements (IDS) submitted 08/14/2025 and 01/30/2026 were filed. The submission is in compliance with the provisions of 37 CFR 1.97. Accordingly, the information disclosure statements are being considered by the examiner.
Priority
Applicant’s benefit claim is hereby acknowledged the U.S patent application No. 18/615,983 filed on 03/25/2024, which is a continuation of the U.S patent application No. 18/204,250, filed on 05/31/2023, which claims benefit of both provisional application No. 63/457,671, filed on 04/06/2023 and application No. 63/347,389, filed on 05/31/2022, which papers have been placed on record in the file.
Claim Objections
Claim 1 is objected to because of the following informalities:
Claim 1 recites, “generate at least one digital representation by extracting content of the portion of the entity data, wherein the extracted content of the portion of the entity data corresponds to at least one of a security posture, risk assessment, or compliance status; populate, from the at least one digital representation, at least one field of a data object based on the extracted content of the portion of the entity data stored in the at least one digital representation.”.
Should be, “generate at least one digital representation by extracting content of the portion of the entity data, wherein the extracted content of the portion of the entity data corresponds to at least one of a security posture, risk assessment, or compliance status; and populate, from the at least one digital representation, at least one field of a data object based on the extracted content of the portion of the entity data stored in the at least one digital representation.”.
Appropriate correction is required.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefore, subject to the conditions and requirements of this title.
Claims 1-20 are rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Independent claim 1 recite, “receive, via an application or communication interface using an interactive input feature, a portion of entity data from a user device; generate at least one digital representation by extracting content of the portion of the entity data, wherein the extracted content of the portion of the entity data corresponds to at least one of a security posture, risk assessment, or compliance status; populate, from the at least one digital representation, at least one field of a data object based on the extracted content of the portion of the entity data stored in the at least one digital representation.” This is a process under its broadest reasonable interpretation which represents receiving an entity data, generating a digital representation by partially using the received data and populating from the digital representation at least one field of a data object.
The underlying process would be performed exactly the same with the human mind or with pencil and paper. Thus, all of the limitations are in fact a mental process and certain methods of organizing human activity; See MPEP §§ 2106.04(a)(2)(II)-(III). While the claims do recite some functional steps, the underlying operations recited in the claim are acts that could be performed mentally and by pen & paper without the use of a computer. Our reviewing court has concluded that mental processes include similar concepts of collecting, manipulating and providing data. See Intellectual Ventures I LLC v. Capital One Fin. Corp., 850 F.3d 1332, 1340 (Fed. Cir. 2017) (the Federal Circuit held “the concept of . . . collecting data, . . . recognizing certain data within the collected data set,” ineligible); and Electric Power Grp., LLC v. Alstom S.A., 830 F.3d 1350, 1353 (Fed. Cir. 2016) (merely selecting information, by content or source, for collection, analysis, and display does nothing significant to differentiate a process from ordinary mental processes). However, mental processes remain unpatentable even when automated to reduce the burden on the user of what once could have been done with pen and paper. See CyberSource Corp. v. Retail Decisions, Inc., 654 F.3d 1366, 1375 (Fed. Cir. 2011) (“That purely mental processes can be unpatentable, even when performed by a computer, was precisely the holding of the Supreme Court in Gottschalk v. Benson.”). We now turn to USPTO Step 2A, Prong 2, of the Revised Guidance to determine whether the abstract idea is integrated into a practical application. See Revised Guidance, 84 Fed. Reg. at 54–55.
Accordingly, the claim recites an abstract idea. This judicial exception is not integrated into a practical application because the claim does not recite how the system is being used to make the claimed invention qualify as a practical application, such as an application to improve network security. Accordingly, the claim is directed to an abstract idea. The claim does not include additional elements that are sufficient to amount to significantly more than the judicial exception because the claim does not recite any additional elements to make the claim an inventive concept. Accordingly, the claim is not patent eligible.
The same reasoning applies to independent claims 11 and 20.
Claims 2-10 depend on claim 1 and claims 12-19 depend on claim 11 and are of consequence rejected under 35 U.S.C. 101.
Claim Rejections - 35 USC § 102
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale or otherwise available to the public before the effective filing date of the claimed invention.
(a)(2) the claimed invention was described in a patent issued under section 151, or in an application for patent published or deemed published under section 122(b), in which the patent or application, as the case may be, names another inventor and was effectively filed before the effective filing date of the claimed invention.
Claims 1-3, 5-6, 11-13, 15-16 and 20 are rejected under AIA 35 U.S.C. 102(a) (1) as being unpatentable over Crokett-Grabus et al. (International Pub. No. WO 2023/163960 A1, referred to as Grabus).
Regarding claims 1, 11 and 20, Grabus teaches:
A system, comprising: one or more processing circuits comprising memory and one or more processors (Grabus: Fig. 2, system 200; Page 23, “With reference to FIG. 2, a system consistent with an embodiment of the disclosure may include a computing device or cloud service, such as computing device 200. In a basic configuration, computing device 200 may include at least one processing unit 202 and a system memory 204.”; Fig. 14; pages 47-48 ,” Fig. 14 is a flow diagram of a method 1400 for facilitating controlling access to data, in accordance with some embodiments. Accordingly, the method 1400 may include using a business (system) database 1401 that may be SQL, MS Access, AS400, or even a more modern column store data storage container that a business desires to make more secure”), configured to:
receive, via an application or communication interface using an interactive input feature, a portion of entity data from a user device (Grabus: Fig. 14, Items 1401, 1402 and 1404; Page 48, “at 1402, the method 1400 may include a secure application programming interface (API) connecting the business database 1401 to the tokenizing application is used to send and receive records between the database and the tokenization application”);
generate at least one digital representation by extracting content of the portion of the entity data, wherein the extracted content of the portion of the entity data corresponds to at least one of a security posture, risk assessment, or compliance status (Grabus: Fig. 14; page 48,” a tokenization engine selects designated personal information (PI) data fields and assigns a “token” according to tokenization rules as data is created or updated. Further, PI data may be replaced with their tokenized version, so that the business database now contains both non-PI original data and tokenized PI data”; Fig. 17, column 1704, tokenized Data; Page 52, “at 1702, the tabular representation 1700 may include an example of a configurable tokenization rule. Further, at 1704, the tabular representation 1700 may include tokenized data according to proprietary configurable algorithmic tokenization rules.”; Page 20, “Further, the disclosed system may use artificial intelligence (Al) to monitor and flag discrepancies in permission levels across the enterprise, looking for improvements in role parity and possible nefarious actions. Further, the disclosed system may reduce the time and cost of data access compliance and documentation by automating the majority of processing for data aggregated repositories. Further, the disclosed system may significantly reduce the risk of data breach exposure by allowing data to remain tokenized/encrypted/unreadable unless the dynamic near-real-time access permission is resolved favorably.”);
populate, from the at least one digital representation, at least one field of a data object based on the extracted content of the portion of the entity data stored in the at least one digital representation (Grabus: Fig. 14; Fig. 15; Fig. 16; pages 48- 52, “To add additional protections, the real data may be dispersed across multiple locations and further disassociated to reduce the ability to read and derive any meaningful value from the real data until it is later "reconstituted" with the tokenization process. No external applications may be attached directly to this database. An intruder may not be able to exfiltrate any meaningful data since the data is not stored contiguously. Further, designated encrypted alternative storage locations (Real data) may be dispersed & disassociated. Further, as the tokenization process is triggered and the "real" data is sent to the alternative storage, at 1408, the method 1400 may include sending a portion of the data (constructed as per pre-defined configurable rules) to the Secure Search Black Box process.”; Fig. 17; Fig. 18; pages 52-53, “at 1702, the tabular representation 1700 may include an example of a configurable tokenization rule. Further, at 1704, the tabular representation 1700 may include tokenized data according to proprietary configurable algorithmic tokenization rules. Further, at 1706, the tabular representation 1700 may include token ID. Further, at 1708, the tabular representation 1700 may include SSBB parse string process. Further, based on the Configurable SSBB synchronous Rules, selected elements of the real data are parsed and placed into pre-Assembled SSBB Strings. Further, at 1710, the tabular representation 1700 may include assembled SSBB string comprising a depiction of a quick search string assembly. ”).
Regarding claims 2 and 12, Grabus teaches all the features of claim 1 and 11, as outlined above.
Grabus further teaches:
wherein the at least one field of the data object corresponds to at least one field of a third party application or compliance platform (Grabus: Fig. 17; Fig. 18; pages 52-53; page 13, “The one or more external devices may include, for example, but are not limited to, a client device, a third-party database, a public database, a private database, and so on.”).
Regarding claims 3 and 13, Grabus teaches all the features of claim 1 and 11, as outlined above.
Grabus further teaches:
wherein the extracted content is sensitive information, and wherein the interactive input feature is activated on the user device based on a gesture (Grabus: page 48, “a tokenization engine selects designated personal information (PI) data fields and assigns a “token” according to tokenization rules as data is created or updated”).
Regarding claims 5 and 15, Grabus teaches all the features of claim 1 and 11, as outlined above.
Grabus further teaches:
wherein the at least one digital representation corresponds to at least one token comprising a unique identifier, and wherein the at least one token is used to populate the at least one field of the data object tokens (Grabus: Fig. 14; page 48,”for user viewing of single database records, the tokenization may be reversed for selected and view sees real data in a user interface (UI). Further, original real PI data elements may be sent to a designed secure location and may be stored in a non-obvious manner, with token ID reference retained for retrieval. Further, selected data may be sent to Secure Search Black Box (SSBB) with a token ID number. Further, as data is tokenized, at 1406, the method 1400 may include assigning a token ID so the system has a way to connect the real data to the tokenized data. Further, the token ID may be associated and stored with the encrypted data”; Fig. 17, column 1704 (Tokenized Data) and column 1706 (Token ID); page 52, “at 1704, the tabular representation 1700 may include tokenized data according to proprietary configurable algorithmic tokenization rules. Further, at 1706, the tabular representation 1700 may include token ID.”).
Regarding claims 6 and 16, Grabus teaches all the features of claim 1 and 11, as outlined above.
Grabus further teaches:
wherein the security posture corresponds to at least one of an incident readiness, an insurance readiness, a cyber risk profile, or a compliance with one or more underwriting requirements (Grabus: Page 20, “Further, the disclosed system may use artificial intelligence (Al) to monitor and flag discrepancies in permission levels across the enterprise, looking for improvements in role parity and possible nefarious actions. Further, the disclosed system may reduce the time and cost of data access compliance and documentation by automating the majority of processing for data aggregated repositories. Further, the disclosed system may significantly reduce the risk of data breach exposure by allowing data to remain tokenized/encrypted/unreadable unless the dynamic near-real-time access permission is resolved favorably.”).
Allowable Subject Matter
Claims 4, 7-10, 14 and 17-19 would be allowable if they were rewritten in independent form including all the limitations of the base claim and any intervening claims, also should applicant overcome the claim objections and the claim rejections under 35 U.S.C. 101, set forth in this office action.
The following is an examiner’s statement of reasons for identifying allowable subject matter.
The closest prior arts made of records are, Crokett-Grabus et al. (International Pub. No. WO 2023/163960 A1, referred to as Grabus), Dawkins et al. (U.S Pat No. 2017/0,076,281 A1, referred to as Dawkins) and Molinari et al. (U.S Pat No. 2019/0,080,407 A1, referred to as Molinari).
Grabus discloses a method of facilitating controlling access to data. Moreover, by retrieving, using a storage device, an access control information associated with the data based on a provenance key, analyzing, using a processing device, the access control information and one or more permissions and determining, using the processing device, an access allowance associated with the data for an access request based on the analyzing of the access control information and the one or more permissions.
Dawkins discloses methods for tokenizing sensitive information by receiving sensitive information via an input device, the input device being communicatively coupled to a transaction terminal, tokenizing the sensitive information at the input device to generate a token, and associating the token and the sensitive information together in a storage medium associated with the input device.
Molinari discloses a method for generating CUSIP unique identifiers that are embedded in each token of a tokenized asset offering that is blockchain-based. Cryptocurrency wallets associated with managing tokens can also each have a unique identifier. As an alternative trading system manages trades of tokens having unique identifiers with buyers and sellers having wallets with associated unique identifiers, a reporting of transaction data can be made to a transfer agent that is registered with a regulatory agency.
However, regarding claims 4 and 14, the prior art of Grabus, Dawkins and Molinari when taken in the context of the claim as a whole do not disclose nor suggest, “wherein the extracted content is associated with a first framework corresponding to a first set of security objectives, standards, or regulations, and wherein to populate the at least one field of the data object, the one or more processing circuits are further configured to: associate the extracted content with a second framework corresponding to a second set of security objectives, standards, or regulations.”.
Regarding claims 7 and 17, the prior art of Grabus, Dawkins and Molinari when taken in the context of the claim as a whole do not disclose nor suggest, “wherein the one or more processing circuits are further configured to: verify accuracy of the populated at least one field; determine the security posture based on the entity data; and tokenize and broadcast the security posture to a distributed ledger.”
Claims 8-10 depend on claim 7 and claims 18-19 depend on claim 17 and are of consequence identified as allowable.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure: See PTO-892.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to HASSAN SAADOUN whose telephone number is (571)272-8408. The examiner can normally be reached Mon-Fri 9:00-5:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Mehrmanesh Amir can be reached at 571-2703351. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/HASSAN SAADOUN/ Examiner, Art Unit 2435
/AMIR MEHRMANESH/ Supervisory Patent Examiner, Art Unit 2435
Prosecution Insights