DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claims 1-20 are canceled. Claims 21-40 are pending.
Response to Arguments
In view of applicant’s arguments and amendments with respect to claims 1-20 have been considered but are moot because the new ground of rejection does not rely on any reference applied in the prior rejection of record for any teaching or matter specifically challenged in the argument. The rejection under 35 USC 101 has been updated in view of the amendments.
Claim Rejections - 35 USC § 101
35 U.S.C. 101 reads as follows:
Whoever invents or discovers any new and useful process, machine, manufacture, or composition of matter, or any new and useful improvement thereof, may obtain a patent therefor, subject to the conditions and requirements of this title.
Claims 21-40 rejected under 35 U.S.C. 101 because the claimed invention is directed to an abstract idea without significantly more.
Step 1: Statutory Category. Independent Claim 21 is directed to a "system" (a machine), and Independent Claim 31 is directed to a "method" (a process).
Step 2A, Prong 1: Directed to a Judicial Exception. Independent claims 21 and 31 recite steps/components for: 1. Obtaining geolocation information for a client device accessing a first cloud application. 2. Determining the activity was outside a trusted boundary. 3. Identifying a second activity on a second cloud application with second geolocation information. 4. Determining that the client device satisfies a movement condition based on the geolocations. 5. Initiating a remedial action.
These limitations recite an abstract idea. Specifically, the claims are directed to the concepts of collecting information (obtaining geolocation data), analyzing data (evaluating the data against a trusted boundary and a movement condition), and presenting the results / acting on the data (initiating a remedial action). Furthermore, determining a "movement condition" based on two geolocations and timestamps fundamentally relies on a mathematical concept (calculating distance over time to determine speed) and a mental process (observing that a user cannot physically travel between two points within a given timeframe). These fall within the groupings of abstract ideas (Mental Processes, Mathematical Concepts, and Certain Methods of Organizing Human Activity).
Step 2A, Prong 2: Integration into a Practical Application. The claims recite generic computer components: "one or more processors," "client device," and "cloud application." The use of these generic components to gather data, perform calculations, and trigger an automated response does not improve the functioning of the computer itself or any other technology. The claims merely use a computer as a tool to automate the mental process of verifying physical impossibility of travel (i.e., an "impossible travel event"). Furthermore, "initiating execution of a remedial action" is recited at a high level of generality and constitutes generic post-solution activity. Therefore, the independent claims do not integrate the abstract idea into a practical application and are directed to an abstract idea.
Step 2B: Significantly More (Inventive Concept). The additional elements are limited to generic processors fetching geolocation data, communicating with cloud applications, and executing basic security rules. Monitoring user access based on location and time is a well-understood, routine, and conventional activity in the field of cybersecurity and network administration. Gathering geolocation data (via GPS, IP, etc.) is routine data-gathering activity. The ordered combination simply instructs a generic processor to apply the abstract idea of "impossible travel calculation" in a multi-cloud environment. There is no technical solution to a technical problem, only the application of a mathematical/mental rule using off-the-shelf computer capabilities.
Dependent Claims:
Claims 22, 25, 32, 35 (Speed and Time/Distance Thresholds): These claims simply add details to the mathematical calculation used to determine the movement condition. They do not add an inventive concept, as calculating speed is purely mathematical.
Claims 23, 33 (Trusted Geolocation Clusters): Relying on clusters corresponding to an entity or activity type is a further logical rule (Mental Process) and does not provide a technical improvement to the system hardware or operation.
Claims 24, 34 (Trusted ISP): Checking if an IP address corresponds to a trusted ISP is a routine data-matching step.
Claims 26-29, 36-39 (Specific Remedial Actions): These claims specify logging the user out, requiring additional authentication, transmitting an alert, or restricting access. These are classic examples of well-understood, routine, and conventional post-solution activities in the realm of computer networking and security. They do not transform the nature of the claim into patent-eligible subject matter.
Claims 30, 40 (GPS, IP, Wireless Data): Specifying the type of data used to determine geolocation is mere data gathering. The use of GPS, IP, or Wi-Fi data for location tracking is ubiquitous and conventional.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claims 21-40 rejected under 35 U.S.C. 112(b) or 35 U.S.C. 112 (pre-AIA ), second paragraph, as being indefinite for failing to particularly point out and distinctly claim the subject matter which the inventor or a joint inventor (or for applications subject to pre-AIA 35 U.S.C. 112, the applicant), regards as the invention.
Claims 21 and 31 recite “accessing the first cloud application fails was performed outside of at least one trusted geolocation boundary”. This appears grammatically defective and makes the intended relationship unclear.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 21-40 are rejected under 35 U.S.C. 103 as being unpatentable over Wolff et al, US 2020/0259852 and further in view of Jurgenson et al, US 2018/0124065.
Regarding claims 21-22 and 25, Wolff teaches a system (Paragraph 0005 and abstract: a computer implanted method and system for identification of security related activities based on usage of a plurality of independent cloud-based application platforms), comprising:
one or more processors configured to:
obtain first geolocation information for a client device accessing a first cloud application of a plurality of cloud applications using a member account of a plurality of member accounts of an entity (0005: receiving activity data and state data from multiple independent cloud-base applications for a plurality of users. 0051: enriching this activity data by collecting geolocation information related to IP addresses attributed to authentication sequences);
determine, using the first geolocation information of the client device, that at least one first activity performed via the client device accessing the at least one the first cloud application fails was performed outside of at least one trusted geolocation boundary (0028: establishing baselines of expected and appropriate user behavior. 0052: deploying conditional access policies that block attempts to access a cloud application when the user is attempting to authenticate from an “unauthorized location”. Determining a location is unauthorized inherently requires evaluating it against a trusted location boundary);
identify at least one second activity performed via the client device accessing a second cloud application of the plurality of cloud applications following the at least one first activity, the second cloud application different from the first cloud application, the at least one second activity associated with second geolocation information (0024-0026: entity resolution, where a single user’s activity is tracked and normalized across multiple different cloud applications (e.g. Office365, DropBox, G-Suite). 0030: by consolidating a single user’s continuous event log across different applications with timestamps and geolocation enrichments, 0051. Wolff identifies subsequent activities in different applications with their respective geolocation data. Wolff lacks or fails to expressly disclose satisfies a movement condition.
However, Jurgenson discloses
determine, based on (i) the first geolocation information the at least one first activity being performed outside of the at least one trusted geolocation boundary and (ii) the second geolocation information, that the client device satisfies a movement condition (0005: identifying information related to a first connection event and a different connection event comprising location information , time information, and user identification, and using both to detect and impossible travel condition. 0063-0064: calculating the time difference (time delta) and geographical distance (distance delta) between the two locations to determine if travel is faster than a specific threshold.); and
initiate execution of a remedial action associated with the at least one second activity of the client device upon determining that the client device satisfies the movement condition (Wolff teaches facilitating a remedial action to address the indicated deviation, 0005 and 0040-0041. Jurgenson teaches providing an alert indicating an impossible travel condition and blocking the user’s access to network resources);
wherein the movement condition comprises satisfying a speed threshold between the first geolocation information and the second geolocation information within a time interval (0064: identifying a time delta and a distance delta and evaluating if the speed computed from the deltas exceed a speed threshold);
determine that the movement condition is satisfied (i) in response to a time between the at least one first activity and the at least one second activity being less than a predetermined time threshold, and (ii) a distance between the first geolocation information and the second geolocation information is greater than a predetermined distance threshold (0063-0064: calculating the time and distance deltas between two events to trigger the impossible travel alert, which inherently requires a short time and a vast distance to exceed the human speed threshold).
It would have been obvious to one of ordinary skill in the art, before the effective filing date of the claimed invention, to modify the cross cloud security monitoring system of Wolff with the impossible travel (movement condition) logic of Jurgenson in order to yield the predictable, desired result of detecting impossible travel across multiple independent cloud applications and thereby detect compromised accounts.
Regarding claim 23, Wolff, as modified above, further discloses the system of claim 21, wherein the one or more processors are further configured to: determine that the first geolocation information is outside at least one trusted geolocation cluster corresponding to at least one of the entity, a type of the at least one first activity, or the plurality of member accounts (0028, 0036-0038: establishing baselines of expected user behavior and utilizing community detection algorithms and clustering graphs to identify groups/communicates of related nodes/users. Jurgenson teaches automatically identifying subgroups using clustering distribution algorithms, to evaluate locations, 0045).
Regarding claim 24, Wolff, as modified above, further discloses the system of claim 21, wherein the one or more processors are further configured to: determine that an internet protocol (IP) address associated with the at least one first activity does not correspond to a trusted internet service provider (ISP) (0051: evaluating IP addresses, identifying domains associated with the IP address, classifying the IP address into populations, and gathering threat intelligence on the IP address. Checking if an IP belongs to an untrusted domain/ISP is a direct application of this teaching).
Regarding claim 26, Wolff, as modified above, further discloses the system of claim 21, wherein the one or more processors are further configured to: initiate execution of the remedial action at least by causing the member account to log out from at least one of the first cloud application or the second cloud application (0029, 0041: proactively securing cloud services by applying remedial measures such as locking accounts or account disablement).
Regarding claim 27, Wolff, as modified above, further discloses the system of claim 21, wherein the one or more processors are further configured to: initiate execution of the remedial action at least by initiating an additional authentication procedure for the member account (0029: adding additional steps to authentication as a remedial measure).
Regarding claim 28, Wolff, as modified above, further discloses the system of claim 21, wherein the one or more processors are further configured to: initiate execution of the remedial action at least by transmitting an alert to a computing system associated with the entity (0029: initializing an alert via an SMS message to a system administrator. Jurgenson also teaches providing an alert indicating an impossible travel condition, 0005.)
Regarding claim 29, Wolff, as modified above, further discloses the system of claim 21, wherein the one or more processors are further configured to: initiate execution of the remedial action at least by restricting the member account from accessing at least one additional cloud application for a predetermined time period (0029: remedial actions ensure that compromises on one cloud service do not impact other cloud-based applications. 0043: temporarily revoking or suspending access to one or more cloud services).
Regarding claim 30, Wolff, as modified above, further discloses the system of claim 21, wherein the one or more processors are further configured to: determine the first geolocation information and the second geolocation information based on at least one of global positioning system (GPS) data, internet protocol (IP) address data, or wireless access point location data (0051: using IP address data to collect geolocation information. Jurgenson also teaches locating devices using GPS coordinates, Wi-Fi based location technologies, and IP addresses, 0016 and 0028).
As per claims 31-40, this is a method version of the claimed system discussed above in claims 21-30 wherein all claimed limitations have also been addressed and/or cited as set forth above.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to AUBREY H WYSZYNSKI whose telephone number is (571)272-8155. The examiner can normally be reached M-F 9-5.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, ALI SHAYANFAR can be reached at 571-270-1050. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/AUBREY H WYSZYNSKI/Primary Examiner, Art Unit 2434
