DETAILED ACTION
This office action is in response to the RCE filed on 01/07/2026.
Claims 33 and 39 are cancelled.
Claims 43-45 have been added.
Claims 1-32, 34-38, 40-45 are presented for examination.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Continued Examination Under 37 CFR 1.114
A request for continued examination under 37 CFR 1.114, including the fee set forth in 37 CFR 1.17(e), was filed in this application after final rejection. Since this application is eligible for continued examination under 37 CFR 1.114, and the fee set forth in 37 CFR 1.17(e) has been timely paid, the finality of the previous Office action has been withdrawn pursuant to 37 CFR 1.114. Applicant's submission filed on 01/07/2026 has been entered.
Claim Interpretation
Examiner notes that upon review of the provisional application, there is no recitation of the Nitrogen-Vacancy Diamond sensor. Therefore each claim that recites the NVD sensor, Claims 3-5, 7-8, 27-34, and 40, do not have the benefit of the priority date of the provisional application 07/19/2021, and instead have a the priority date of 07/15/2022.
Response to Arguments
Applicant's arguments filed 01/07/2026 regarding the 35 USC 103 rejections to the claims in Remarks pg. 11-29 have been fully considered but they are not persuasive.
Applicant argues in essence:
[a] “Bahgat is directed to "developing electromagnetic emission and power models for a target device using photonic emissions thereof." Abstract of Bahgat. As indicated in the Office Action, "Bahgat does not first induce the distortion that is detected as anomalous." Office Action, p. 6. Nothing in Bahgat teaches, suggests, describes, or discloses at least "applying, by a testing computing device, a distortion to a computing device under test, wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence," (emphasis added), as recited in amended claim 1.
Keller is directed to "[a]n apparatus for detecting a condition or authenticity of one or more electronic devices.. Abstract of Keller. To the extent Keller describes "electronic devices which have been deliberately modified to pose a security threat, and electronic devices which have been deliberately and/or intentionally modified for a malicious purpose with the intent to deceive as to the intended function," nothing in Keller teaches, suggests, describes, or discloses at least "applying, by a testing computing device, a distortion to a computing device under test, wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence," (emphasis added), as recited in amended claim 1. Accordingly, Applicant submits that amended claim 1 is allowable.
Claims 27 and 35 have been amended in a manner similar to claim 1 and are allowable at least for the same reasons.” Pg. 15 of Remarks.
In response to [a], examiner respectfully disagrees.
While Bahgat is not relied upon for the argued limitation, Keller teaches the concept of "applying, by a testing computing device, a distortion to a computing device under test, wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence,"
Keller: para.0119 “Enhanced modulation techniques envisioned herein include but are not limited to modulating multiple inputs or outputs substantially simultaneously with the same or different signal, modulating multiple such pins with a phase shifted signal relative to each other, using the results of the modulation to change modulation in a multi-step approach, applying a series of different modulation patterns to the device under test, applying a randomized modulation pattern to seek new useful discriminating emission results, briefly applying modulation which briefly exceeds the specified voltage, current or frequency limits of the component under test,”
para.0073 “It is to be understood that the definition of a counterfeit or substandard electronic device applies to but is not limited to … electronic devices which have been deliberately or unintentionally modified, electronic devices which have been deliberately modified to pose a security threat, and electronic devices which have been deliberately and/or intentionally modified for a malicious purpose with the intent to deceive as to the intended function.”
Para.0130 “The received RF emissions are digitized in step 625 with the digital signal processed in step 627. Further, in step 631, the logic algorithms executed by the processing device 574 characterize the RF emission signature and the device 2 is either found as meeting a predetermined performance criteria or a predetermined emission signature in step 633 or is found as counterfeited or substandard in step 635. When required, the results are displayed on a display 576 in step 641”
Para.0136 “These added I/O signals may exercise the electronic device 2 under test in a new and/or complex manner, possibly causing a state change or causing additional processing to be performed, resulting in additional or different internal circuitry being exercised. An example of this would be exercising an address bus used for DMA transfers or turning on/off a chip select pin. In a further test, there is provided a separate clock signal to a SPI serial bus which typically requires its own clock and separate clock frequency to transfer data.”
The above process described in Keller causes distortions to be applied to the hostile element, i.e. the IC/component/device under test, and based on the emissions differing from expected levels, i.e. the emissions representing the change in the preconfigured functionality of the hostile element, a counterfeit component modified for malicious purpose may be identified based on the different emissions, i.e. a change in preconfigured functionality. Further, testing may be performed via a different input than modulation, by introducing input to pins in para.0136, which would cause different behavior and state changes of the component, further showing a violation of preconfigured functionality.
Therefore the process in Keller teaches this new limitation for Claims 1, 27 and 35.
[b] Claims 4 and 29, “To the extent Turner discloses use of NVD sensors so that "the multimodal information from the magnetic field maps, linewidth, contrast, and temperature may be used to create a more detailed fingerprint of IC activity" nothing in Turner teaches, suggests, describes, or discloses at least "wherein the comparing of the one or more digital signals to the one or more baseline digital signals comprises detecting a change in a thermal measurement by detecting, by the NVD sensor and in response to the distortion [wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence], a shift in a photoluminescence central frequency toward a lower frequency, wherein the shift is indicative of a change in the thermal measurement to a higher temperature," as recited in amended claims 4 and 29.” Pg. 17-18
In response to [b], Examiner respectfully disagrees. Applicant argues that with the addition of the new limitation in the independent claim, Turner does not teach this limitation. However the new limitation of “wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence”, this is taught by Keller as explained in more detail above in [a].
Regarding the remaining limitations of the claim, Turner discloses in para.0120, and para.0243-0244 measuring temperature changes emitted from the device that is being tested from nitrogen vacancy diamond, and Nowroz teaches applying a distortion and measuring the thermal maps depicting shifts and patterns of thermal readings from the emissions in pg. 3-4 of the document. Therefore in Turner and Nowroz in combination teach the remaining limitations of the claim.
[c] Claims 4 and 29, “To the extent Nowroz describes "use [of] HotSpot [27] thermal simulation tools to create the steady state thermal maps of various test bench circuits thermal maps under tests T1,T2, for Trojan detection," nothing in Nowroz teaches, suggests, describes, or discloses at least "wherein the comparing of the one or more digital signals to the one or more baseline digital signals comprises detecting a change in a thermal measurement by detecting, by the NVD sensor and in response to the distortion [wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence], a shift in a photoluminescence central frequency toward a lower frequency, wherein the shift is indicative of a change in the thermal measurement to a higher temperature," as recited in amended claims 4 and 29.” Pg. 19 of Remarks.
In response to [c], Examiner respectfully disagrees. Applicant argues that with the addition of the new limitation in the independent claim, Turner does not teach this limitation. However the new limitation of “wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence”, this is taught by Keller as explained in more detail above in [a].
Regarding the remaining limitations of the claim, Turner discloses in para.0120, and para.0243-0244 measuring temperature changes emitted from the device that is being tested from nitrogen vacancy diamond, and Nowroz teaches applying a distortion and measuring the thermal maps depicting shifts and patterns of thermal readings from the emissions in pg. 3-4 of the document. Therefore in Turner and Nowroz in combination teach the remaining limitations of the claim.
[d] Claim 11 “To the extent Rag describes "injecting a selected fault against a selected number of components or instances and then steadily increasing the scope of the fault (e.g., increasing the number of components, number of roles, amount of pressure, amount of delay, etc.) until failure is detected In such guided or deterministic fault injection, the number of affected roles or machines, amount of pressure, or other parameter is steadily increased until a breaking point for the targeted service or role is identified. Furthermore, as the breaking point is approached and finally met, the service's reaction to the fault can be observed (i.e., how the fault is identified, and mitigated," nothing in Rag teaches, suggests, describes, or discloses at least "wherein the applying of the distortion comprises operating the computing device under test at or above a maximum of a performance capacity of a computational resource, wherein the computational resource is a memory resource, and wherein the operating of the computing device under test at or above the maximum of the performance capacity comprises exhausting an available memory resource of the computing device under test [wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence]," as recited in claim 11.” Pg. 20-21 Remarks.
In response to [d], Examiner respectfully disagrees. Applicant argues that with the addition of the new limitation in the independent claim, Turner does not teach this limitation. However the new limitation of “wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence”, this is taught by Keller as explained in more detail above in [a].
Regarding the remaining limitations of the claim, Keller is relied upon for the concept of “wherein the applying of the distortion comprises operating the computing device under test at or above a maximum of a performance capacity of a computational resource wherein the computational resource is a memory resource” in para.0119 “applying a randomized modulation pattern to seek new useful discriminating emission results, briefly applying modulation which briefly exceeds the specified voltage, current or frequency limits of the component under test,” and para.0031 “Another object of the invention is detecting counterfeit microcontroller, microprocessor, Field Programmable Gate Array (FPGA), Digital Signal Processor (DSP) and memory parts.” Showing memory parts are modulated to increase the performance capacity of the computational resource.
Secondly, Rag discloses in para.0029-0031, “FIG. 3 is a block diagram illustrating fault injection according to one embodiment. System faults are applied by fault injection service 301…. For example, memory pressure may be applied to role instances to remove 80% of memory for 50% of the role instances. ” and para.0035 shows continuously exhausting resources until failure is achieved, wherein exhausting memory is performed to test devices. Therefore Keller and Rag are relied upon for the limitations of Claim 11.
[e] Claim 13 “To the extent Xia describes that "the test control API 134 can be used to change a server node boot sequence, or re-direct BMC (baseboard management control) traffic to a shared or separate NIC (network interface card)," nothing in Xia teaches, suggests, describes, or discloses at least "wherein applying of the distortion [comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence and] comprises applying the distortion to a network interface card (NIC), wherein the NIC supports a control channel for the BMC via a network controller sideband interface (NC-SI) protocol," as recited in claim 13.
Nabeesa fails to remedy the deficiencies of Bahgat, Keller, and Xia. For example, although Nabeesa discloses a "Network Controller-Sideband Interface (NC-SI), NC-SI interface between the BMC and a network interface card (NIC) or host bust adapter (HBA) of information handling system 200," nothing in Nabeesa teaches, suggests, describes, or discloses at least "wherein applying of the distortion [comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence and] comprises applying the distortion to a network interface card (NIC), wherein the NIC supports a control channel for the BMC via a network controller sideband interface (NC-SI) protocol," as recited in claim 13.” Pg.22-23 Remarks.
In response to [e], Examiner respectfully disagrees. Applicant argues that with the addition of the new limitation in the independent claim, Turner does not teach this limitation. However the new limitation of “wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence”, this is taught by Keller as explained in more detail above in [a].
Regarding the remaining limitations of the claim, Xia teaches in col. 9 lines 19-36 “For example, the test control API 134 can be used to change a server node boot sequence, or re-direct BMC (baseboard management control) traffic to a shared or separate NIC (network interface card).”” a process of injecting errors in to a computing system on a NIC card to its BMC, and Nabeesa discloses the NC-SI protocol para.0019 “In a particular embodiment, BMC agent 220 communicates with BMC 230 via a Network Controller-Sideband Interface (NC-SI), NC-SI interface between the BMC and a network interface card (NIC) or host bust adapter (HBA) of information handling system 200.”. Therefore Xia-Nabeesa is relied upon for the rejection of Claim 13.
[f] Claim 14, “To the extent Soer describes that "[t]he watchdog disable input receives an emulator active signal (driven by the processor core) on a signal line 162. The time out signal is output on a line 164," nothing in Soer teaches, suggests, describes, or discloses at least "wherein the distortion [comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence and] comprises one or more of resetting a memory arbiter, disabling a memory arbiter, modifying one or more parameters of a coalescing engine, fingerprinting a buffer operation of a direct memory access (DMA), or modifying a parameter of a watchdog timer," as recited in claim 14.” Pg. 24 of Remarks.
In response to [f], Examiner respectfully disagrees. Applicant argues that with the addition of the new limitation in the independent claim, Turner does not teach this limitation. However the new limitation of “wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence”, this is taught by Keller as explained in more detail above in [a].
Regarding the remaining limitations of the claim, Soer discloses testing a system by use of a watchdog timer in para.0066-0069 Para.0066-0069 “The watchdog disable input receives an emulator active signal (driven by the processor core) on a signal line 162. The time out signal is output on a line 164.”. Therefore, Soer is relied upon for the rejection of Claim 14.
[g] Claim 26 “To the extent Witt describes "establish[ing] a baseline vector representing nominal traffic flow through the fabric (e.g., routes, data loads, latency, etc.) while other vectors could represent operating health (e.g., temperature, error rates, etc.)" or that Butler describes a "a Byzantine resilient system [that] can tolerate the loss of fault containment regions under the following conditions: (1)if (3F-1) FCRs are utilized, (2) if each FCR is connected to at least (2F-1) other FCRs by disjoint communication links or paths, (3) if (F-1) rounds of data exchange are used to distribute single-source data, and (4) if the operations of functioning FCRs of the system are time synchronized to within a known and specified time skew. T," nothing in Witt or Butler teaches, suggests, describes, or discloses at least "the computing device under test [wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence and] having been configured with a Byzantine circuit comprising a predetermined distortion pattern to cause a synchronization skew, and wherein the detecting of the presence of the at least one anomalous element comprises one or more of detecting a malfunction of the computational resource or an error in a processing task performed by the computational resource," as recited in claim 26.” Pg. 26 of Remarks.
In response to [g], Examiner respectfully disagrees. Applicant argues that with the addition of the new limitation in the independent claim, Turner does not teach this limitation. However the new limitation of “wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence”, this is taught by Keller as explained in more detail above in [a].
Regarding the remaining limitations of the claim, Witt is relied up on for the limitations of wherein the detecting of the presence of the at least one anomalous element comprises one or more of detecting a malfunction of the computational resource or an error in a processing task performed by the computational resource, taught by Witt in para.0030 “Baseline vectors can take on many different forms. A baseline vector can represent an overall nominal behavior of a fabric as well as different types of nominal behavior. For example, multiple baseline vectors can be established to represent aspects of the fabric. One could establish a baseline vector representing nominal traffic flow through the fabric (e.g., routes, data loads, latency, etc.) while other vectors could represent operating health (e.g., temperature, error rates, etc.).” para.0039 “Step 350 includes having each node calculate a criterion status for each criterion for which it is responsible. As mentioned previously, each criterion can comprise a function, or algorithm, applied to measured vector of behavior metrics” error rates are measured and recorded into the vectors and used in step 350 to detect the anomalous element, and the limitation of the computing device under test having been configured with a Byzantine circuit comprising a predetermined distortion pattern to cause a synchronization skew, is taught by Butler in col.1 lines 45-55 “It has been found that such a Byzantine resilient system can tolerate the loss of Ffault containment regions under the following conditions: (1)if (3F-1) FCRs are utilized, (2) if each FCR is connected to at least (2F-1) other FCRs by disjoint communication links or paths, (3) if (F-1) rounds of data exchange are used to distribute single-source data, and (4) if the operations of functioning FCRs of the system are time synchronized to within a known and specified time skew. T” the device is equipped with a byzantine circuit, comprising a particular distortion pattern, i.e. the orientation of the regions or the amount of time to skew itself is a pattern of +delta time, which causes a synchronization skew. Therefore, Witt and Butler are relied upon for the rejection of Claim 26.
[h] Claim 41 “To the extent Huang describes "malware detection using a generative adversarial network improve the efficiency of using a computing device by utilizing an autoencoder and GAN network to classify an input sample as malicious or safe," or that Han describes "calculat[ing] the probabilistic logarithm probability P.sub.H of all normal virtual machine's observation sequence corresponding to the HsMM," see Office Action at pp. 61-63, nothing in Huang or Han teaches, suggests, describes, or discloses at least "generating a statistical distribution of behavioral characteristics of the computing device under test [wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence] and wherein the comparing of the one or more digital signals to the one or more baseline digital signals comprises comparing the one or more digital signals to the generated statistical distribution using a log-probability distance measure," as recited in claim 41.” Pg. 27 Remarks.
In response to [h], Examiner respectfully disagrees. Applicant argues that with the addition of the new limitation in the independent claim, Turner does not teach this limitation. However the new limitation of “wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence”, this is taught by Keller as explained in more detail above in [a].
Regarding the remaining limitations of the claim, Huang teaches the Generative Adversarial network in para.0099 for classifying malicious or safe samples, and Han teaches using a statistical distribution of behavioral characteristics, and comparison of baseline signals to a statistical distribution using a log probability scale in para.0015 “Step 4: The aforementioned HsMM online detection module, which is based on an algorithm obtained from Step 2, can detect the state and behavior of each virtual machine online and calculate its probabilistic logarithm probability and the Mahalanobis distance so as to judge whether the virtual machine is anomalous or not;” and para.0079 “After the initial probabilistic logarithm probability distribution of the normal virtual machine and the probabilistic logarithm probability calculation equation of the online virtual machine are obtained, the distance between them can be measured by a simplified Mahalanobis distance.”. Therefore, Han and Huang are relied upon for the rejection of Claim 41.
Claim Rejections - 35 USC § 103
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 1, 3, 7, 12, 15, 17-18, 21, 35, 42, and 44 is/are rejected under 35 U.S.C. 103 as being unpatentable over Bahgat Shehata et al. (hereinafter Bahgat, US 2018/0027003 A1) in view of Keller, III et al. (hereinafter Keller, US 2015/0137830 A1).
Regarding Claim 1, Bahgat discloses A computer-implemented method, comprising: applying, by a testing computing device (Bahgat: Fig. 3, Fig. 4, apparatus 300), a distortion to a computing device under test (Margalit: para.0038 “At 401, one or more sets of electrical stimuli, as test signals, may be selected by control unit 310 of apparatus 300 for inducing or otherwise causing a variety of electrical activities and/or activate one of more circuit blocks of an integrated circuit of a target device or DUT 410 to perform various operations. At 402, each set of the one or more sets of electrical stimuli may be applied to DUT 410 by control unit 310. As various activities and/or operations in DUT 410 are induced by each set of electrical stimuli, photonic emissions as well as EM emissions by DUT 410 may result. At 403, photonic emissions from DUT 410 may be measured and recorded as photonic emission data by photonic emission measurement unit 330 of apparatus 300.” A set of stimuli, a set of distortions, are applied by the testing device to the device under test. Fig. 3 shows system 300 applying test signals to the device under test 350.),
receiving, by the testing computing device, one or more digital signals from the computing device under test (Bahgat: para.0053-0055 “For illustrative purposes and without limitation, process 1100 is described below in the context of apparatus 300…At 1120, process 1100 may involve EM emission measurement unit 340 of apparatus 300 measuring electromagnetic emissions of the target device in a test context different from the baseline context. ” the testing computing device, 300 Fig. 3, obtains EM emission measurements from the device being tested, 350 in Fig. 3.);
comparing, by the testing computing device, the one or more digital signals to one or more baseline digital signals associated with the computing device under test (Bahgat: para.0054 “At 1110, process 1100 may involve control unit 310 of apparatus 300 developing one or more electromagnetic emission models for a target device based on photonic emissions of the target device in a baseline context.” para.0056 “At 1130, process 1100 may involve control unit 310 identifying an anomaly condition associated with the target device by comparing a result of the measuring to the one or more electromagnetic emission models.” The baseline of the device is determined, such as in Fig. 10, wherein the emission signatures of the device are determined in various modes, and stored as an electromagnetic emission model in step 1110. This baseline is then compared to the current emissions of the target device.); and
detecting, based on the comparing, a presence of at least one anomalous element that could be indicative of the hostile element in the computing device under test (Bahagt: para.0056 “At 1130, process 1100 may involve control unit 310 identifying an anomaly condition associated with the target device by comparing a result of the measuring to the one or more electromagnetic emission models.” Para.0052 “At 1012, detection or identification of EM emission spectra from anomalous circuit operations and/or malware(s) can be recognized by control unit 310 when compared with emission patterns simulated with accurate EM emission models.” Para.0022 “A system according to various embodiments of the present disclosure may be able to remotely detect and classify changes in execution of program(s) by a target device and/or activation of malware(s) (e.g., one or more hardware Trojans, viruses, worms, ransomwares, spywares, adwares, scarewares and/or any other types of malicious programs or intrusive software) on the target device based on a comparison of measured EM emissions of one or more circuit blocks of an integrated circuit within the target device to EM emission models developed using photonic emission data.” The presence of the anomalous element can be indicative of various types of malware based on the emission patterns.).
However Bahgat does not explicitly disclose wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence; receiving, by the testing computing device and in response to the applying of the distortion, one or more digital signals from the computing device under test.
Keller discloses wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence (Keller: para.0119 “Enhanced modulation techniques envisioned herein include but are not limited to modulating multiple inputs or outputs substantially simultaneously with the same or different signal, modulating multiple such pins with a phase shifted signal relative to each other, using the results of the modulation to change modulation in a multi-step approach, applying a series of different modulation patterns to the device under test, applying a randomized modulation pattern to seek new useful discriminating emission results, briefly applying modulation which briefly exceeds the specified voltage, current or frequency limits of the component under test,” para.0073 “It is to be understood that the definition of a counterfeit or substandard electronic device applies to but is not limited to … electronic devices which have been deliberately or unintentionally modified, electronic devices which have been deliberately modified to pose a security threat, and electronic devices which have been deliberately and/or intentionally modified for a malicious purpose with the intent to deceive as to the intended function.” modulations are applied to the device under test, such as device 2 in fig. 1, causing the device to operate outside of the normal range of operation, i.e. violating a preconfigured functionality, by exceeding maximum performance capacity such as voltage current or frequency limits of the device. Testing a device that may be counterfeited, that includes devices that have been deliberately modified to be malicious or a security threat, therefore this process reveals the presence of hostile elements by violating its preconfigured functionality. Para.0136 “These added I/O signals may exercise the electronic device 2 under test in a new and/or complex manner, possibly causing a state change or causing additional processing to be performed, resulting in additional or different internal circuitry being exercised.” Additionally, via different types of testing wherein i/o signals are applied via pins, different behavior may also be observed than expected or state changes, further showing a violation of preconfigured functionality of the part.);
receiving, by the testing computing device and in response to the applying of the distortion, one or more digital signals from the computing device under test (Keller: fig. 20 para.0131, para.0134, para.0128-0130 “Step 615 configures the power, ground, clock source and modulation parameters using circuits/boards 564a, 564h and/or 582 that provide means for modulating an input and/or output pin of the electronic device 2…. When powered, the electronic device 2 emits electromagnetic energy in step 623 that are gathered by the integrated antenna enclosure 500 via the antenna structure 556 in step 639 and is received at the RF receiver 572…. The received RF emissions are digitized in step 625 with the digital signal processed in step 627. Further, in step 631, the logic algorithms executed by the processing device 574 characterize the RF emission signature and the device 2 is either found as meeting a predetermined performance criteria or a predetermined emission signature in step 633 or is found as counterfeited or substandard in step 635. ” The modulations are applied to the device under test, such as device 2 described in Fig. 1, and the output emissions from the device are obtained and compared to emission signatures to identify a counterfeited device).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat with Keller in order to incorporate wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence; receiving, by the testing computing device and in response to the applying of the distortion, one or more digital signals from the computing device under test.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of identification of security threats from devices that may cause issues (Keller: para.0073).
Regarding Claim 3, Bahgat-Keller discloses claim 1 as set forth above.
Bahgat further discloses wherein the receiving of the one or more digital signals comprises receiving the one or more digital signals by one or more of a nitrogen-vacancy diamond (NVD) sensor or an electromagnetic (EM) probe (Bahgat: para.0028 “FIG. 2 is a block diagram of an example system 200 that can measure EM emission from a device under test, consistent with an exemplary embodiment. Referring to FIG. 2, a test unit 201 (possibly the same as 109) may apply electrical stimuli or signals to an integrated circuit 210 of a target device, which is under test, to induce a variety of electrical activities and/or activate one of more circuit blocks of the integrated circuit of integrated circuit 210 to perform various operations. Integrated circuit 210 may be connected to a radio frequency (RF) probe 202 with a predetermined load (not shown). The output of RF probe 202 may be amplified by a pre-amplifier 203 and fed to an EM emission receiver 204, which may be a spectrum analyzer. Time-resolved EM emission waveforms 108 may be derived from the output of EM emission receiver 204.” The elements 202-204 of the RF probe, pre amplifier and EM receiver together are the EM probe, and receive the digital signal emitting from the circuit 210).
Regarding Claim 7, Bahgat-Keller discloses claim 1 as set forth above.
Bahgat further discloses determining the one or more baseline digital signals by utilizing one or more of a nitrogen- vacancy diamond (NVD) sensor or an electromagnetic (EM) probe (Bahgat: para.0054 “At 1110, process 1100 may involve control unit 310 of apparatus 300 developing one or more electromagnetic emission models for a target device based on photonic emissions of the target device in a baseline context.” para.0056 “At 1130, process 1100 may involve control unit 310 identifying an anomaly condition associated with the target device by comparing a result of the measuring to the one or more electromagnetic emission models.” para.0028 “FIG. 2 is a block diagram of an example system 200 that can measure EM emission from a device under test, consistent with an exemplary embodiment. …. Integrated circuit 210 may be connected to a radio frequency (RF) probe 202 with a predetermined load (not shown). The output of RF probe 202 may be amplified by a pre-amplifier 203 and fed to an EM emission receiver 204, which may be a spectrum analyzer. Time-resolved EM emission waveforms 108 may be derived from the output of EM emission receiver 204.” The elements 202-204 of the RF probe, pre amplifier and EM receiver together are the EM probe, and receive the digital signal emitting from the circuit 210. The baseline of the device is determined, such as in Fig. 10, wherein the emission signatures of the device are determined in various modes, and stored as an electromagnetic emission model in step 1110. This baseline is then compared to the current emissions of the target device.).
Regarding Claim 12, Bahgat-Keller discloses claim 1 as set forth above.
However Bahgat does not explicitly disclose wherein the applying of the distortion comprises operating the computing device under test at or above a maximum of a performance capacity of a computational resource, wherein the computational resource is one of an internal network, an internal clock, a bus, a processing unit, a power resource, an operating system, a task manager, a port, an external hardware device communicatively linked to the computing device under test, or a network capability.
Keller further discloses wherein the applying of the distortion comprises operating the computing device under test at or above a maximum of a performance capacity of a computational resource (Keller: para.0119 “Enhanced modulation techniques envisioned herein include but are not limited to modulating multiple inputs or outputs substantially simultaneously with the same or different signal, modulating multiple such pins with a phase shifted signal relative to each other, using the results of the modulation to change modulation in a multi-step approach, applying a series of different modulation patterns to the device under test, applying a randomized modulation pattern to seek new useful discriminating emission results, briefly applying modulation which briefly exceeds the specified voltage, current or frequency limits of the component under test,” the modulation applied to the device causes the performance to exceed a maximum capacity of a resource such as voltage, current or frequency.),
wherein the computational resource is one of an internal network, an internal clock, a bus, a processing unit (Keller: para.0031 “Another object of the invention is detecting counterfeit microcontroller, microprocessor, Field Programmable Gate Array (FPGA), Digital Signal Processor (DSP) and memory parts.” Microprocessor, para.0087 DSP and microprocessor), a power resource, an operating system, a task manager, a port, an external hardware device communicatively linked to the computing device under test, or a network capability.
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat with Keller in order to incorporate wherein the applying of the distortion comprises operating the computing device under test at or above a maximum of a performance capacity of a computational resource, wherein the computational resource is one of an internal network, an internal clock, a bus, a processing unit, a power resource, an operating system, a task manager, a port, an external hardware device communicatively linked to the computing device under test, or a network capability.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of identification of security threats from devices that may cause issues (Keller: para.0073).
Regarding Claim 15, Bahgat-Keller discloses claim 1 as set forth above.
Bahgat further discloses wherein the hostile element is a hardware component (Bahgat: para.0022 “A system according to various embodiments of the present disclosure may be able to remotely detect and classify changes in execution of program(s) by a target device and/or activation of malware(s) (e.g., one or more hardware Trojans” the hostile element can be a hardware trojan).
Regarding Claim 17, Bahgat-Keller discloses claim 1 as set forth above.
However Bahgat does not explicitly disclose subsequent to the detecting of the presence of the at least one anomalous element, generating an alert notification indicating the presence of the at least one anomalous element.
Keller discloses subsequent to the detecting of the presence of the at least one anomalous element, generating an alert notification indicating the presence of the at least one anomalous element (Keller: para.0133 “The user may be notified of the electronic device's counterfeit versus authentic status via user interface 576, such as a computer screen, LED light, and/or buzzer typically located on the sensor and controller assembly 560. ” when counterfeit status is determined, based on the measurements from para.0128-0131, a user is notified of the anomalous element.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat with Keller in order to incorporate subsequent to the detecting of the presence of the at least one anomalous element, generating an alert notification indicating the presence of the at least one anomalous element.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of identification of security threats from devices that may cause issues (Keller: para.0073).
Regarding Claim 18, Bahgat-Keller discloses claim 1 as set forth above.
However Bahgat does not explicitly disclose subsequent to the detecting of the presence of the at least one anomalous element, performing one or more operations on the computing device under test to mitigate the presence of the hostile element.
Keller discloses subsequent to the detecting of the presence of the at least one anomalous element, performing one or more operations on the computing device under test to mitigate the presence of the hostile element (Keller: para.0133 “The apparatus 500 may have a means of marking or permanently disabling a counterfeit electronic device while it is in the fixture 530 and before its removal, such as painting, cutting off electronic device pins, drilling through the electronic device, overloading and/or reverse biasing the electronic device inputs, this again being done before the electronic device 2 is removed from the fixture 530, manually or automatically.” After detecting a counterfeit device, the system may automatically disable the device via various means.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat with Keller in order to incorporate subsequent to the detecting of the presence of the at least one anomalous element, performing one or more operations on the computing device under test to mitigate the presence of the hostile element.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of identification of security threats from devices that may cause issues (Keller: para.0073).
Regarding Claim 21, Bahgat-Keller discloses claim 1 as set forth above.
Bahgat further discloses wherein the testing computing device is a robotic device configured to automatically apply the distortion (Bahgat: para.0037 “FIG. 4 illustrates an example algorithm 400 that can develop EM emission models from correlation of photonic emission and EM emission data, consistent with an exemplary embodiment. Algorithm 400 may include one or more operations, actions, or functions as represented by one or more of blocks 401, 402, 403, 404, 405, 406 and 407. Although illustrated as discrete blocks, various blocks of algorithm 400 may be divided into additional blocks, combined into fewer blocks, or eliminated, depending on the desired implementation. Algorithm 400 may be implemented by apparatus 300 in accordance with the present disclosure. For illustrative purposes and without limitation, algorithm 400 is described below in the context of apparatus 300.” See Fig. 3 300, apparatus 300 is the testing computing device, and it performs algorithm 400 which contains a loop that automatically applies a set of stimuli, the distortions in sequence.).
Regarding Claim 35, Bahgat discloses A computer-implemented method, comprising: applying, by a testing computing device, a distortion to a computing device under test (Bahgat: Fig. 3, Fig. 4, apparatus 300), a distortion to a computing device under test (Margalit: para.0038 “At 401, one or more sets of electrical stimuli, as test signals, may be selected by control unit 310 of apparatus 300 for inducing or otherwise causing a variety of electrical activities and/or activate one of more circuit blocks of an integrated circuit of a target device or DUT 410 to perform various operations. At 402, each set of the one or more sets of electrical stimuli may be applied to DUT 410 by control unit 310. As various activities and/or operations in DUT 410 are induced by each set of electrical stimuli, photonic emissions as well as EM emissions by DUT 410 may result. At 403, photonic emissions from DUT 410 may be measured and recorded as photonic emission data by photonic emission measurement unit 330 of apparatus 300.” A set of stimuli, a set of distortions, are applied by the testing device to the device under test. Fig. 3 shows system 300 applying test signals to the device under test 350.),
measuring, by an electromagnetic (EM) probe, an EM radiation transmitted by a region of the PCB for a presence of at least one anomalous element that could be indicative of a presence of the hostile element in the PCB (Bahgat: para.0053-0055 “For illustrative purposes and without limitation, process 1100 is described below in the context of apparatus 300…At 1120, process 1100 may involve EM emission measurement unit 340 of apparatus 300 measuring electromagnetic emissions of the target device in a test context different from the baseline context. ” the testing computing device, 300 Fig. 3, obtains EM emission measurements from the device being tested, 350 in Fig. 3, using the Electromagnetic Emission Measurement unit, and the photonic emission measurement unit, to detect a hostile element in a portion of an IC. Seen in Fig. 9, and para.0049-0050, 904 and 903, portions of the circuit can be identified for anomalous elements.);
comparing, by the testing computing device, the EM radiation to a device fingerprint associated with the computing device under test (Bahgat: para.0056 “At 1130, process 1100 may involve control unit 310 identifying an anomaly condition associated with the target device by comparing a result of the measuring to the one or more electromagnetic emission models.” The obtained signal is compared to known fingerprints of the circuit para.0057-0059. For example, Fig. 10 shows the steps to generate the fingerprint by measuring em and photon emissions based on stimuli and generating EM models used to detect anomalies and Trojans.); and
detecting, based on the comparing and by the testing computing device, the presence of the at least one anomalous element in the region of the PCB that could be indicative of the presence of the hostile element in the PCB (Bahgat: para.0056 “At 1130, process 1100 may involve control unit 310 identifying an anomaly condition associated with the target device by comparing a result of the measuring to the one or more electromagnetic emission models.” para.0034 “Moreover, data analysis unit 320 may compare the first PICA emission image and the second PICA emission image to provide a comparison result. Control unit 310 may identify a region of interest associated with one or more circuit blocks of an integrated circuit of DUT 350 based on the comparison result. In some embodiments, in correlating the recorded data of the photonic emissions and the recorded data of the electromagnetic emissions based on the analysis result to establish the one or more electromagnetic emission models for DUT 350, control unit 310 may correlate the one or more circuit blocks performing one or more activities in the region of interest during a first period of time to electromagnetic emission signatures recorded during the first period of time.” Para.0022, Using the models, anomalies, trojans and malware can be detected on the circuit. Seen in para.0034, the models contain region specific signatures learned during the training phase for the emission models in step 1110 Fig. 11.).
However Bahgat does not explicitly disclose wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence when a hostile element is present in a printed circuit board (PCB) of the computing device under test; measuring, by an electromagnetic (EM) probe and in response to the applying of the distortion, an EM radiation transmitted by a region of the PCB for a presence of at least one anomalous element that could be indicative of a presence of the hostile element in the PCB.
Keller discloses wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence (Keller: para.0119 “Enhanced modulation techniques envisioned herein include but are not limited to modulating multiple inputs or outputs substantially simultaneously with the same or different signal, modulating multiple such pins with a phase shifted signal relative to each other, using the results of the modulation to change modulation in a multi-step approach, applying a series of different modulation patterns to the device under test, applying a randomized modulation pattern to seek new useful discriminating emission results, briefly applying modulation which briefly exceeds the specified voltage, current or frequency limits of the component under test,” para.0073 “It is to be understood that the definition of a counterfeit or substandard electronic device applies to but is not limited to … electronic devices which have been deliberately or unintentionally modified, electronic devices which have been deliberately modified to pose a security threat, and electronic devices which have been deliberately and/or intentionally modified for a malicious purpose with the intent to deceive as to the intended function.” modulations are applied to the device under test, such as device 2 in fig. 1, causing the device to operate outside of the normal range of operation, i.e. violating a preconfigured functionality, by exceeding maximum performance capacity such as voltage current or frequency limits of the device. Testing a device that may be counterfeited, that includes devices that have been deliberately modified to be malicious or a security threat, therefore this process reveals the presence of hostile elements by violating its preconfigured functionality)
when a hostile element is present in a printed circuit board (PCB) of the computing device (Keller: para.0006 printed circuit board) under test (Keller: para.0073 “It is to be understood that the definition of a counterfeit or substandard electronic device applies to but is not limited to … electronic devices which have been deliberately or unintentionally modified, electronic devices which have been deliberately modified to pose a security threat, and electronic devices which have been deliberately and/or intentionally modified for a malicious purpose with the intent to deceive as to the intended function.” Testing device that may be counterfeited, that includes devices that have been deliberately modified to be malicious or a security threat.);
measuring, by an electromagnetic (EM) probe and in response to the applying of the distortion, an EM radiation (Keller: para.0077 electromagnetic emission) transmitted by a region of the PCB (Keller: para.0006 printed circuit board) for a presence of at least one anomalous element that could be indicative of a presence of the hostile element in the PCB (Keller: fig. 20 para.0131, para.0134, para.0128-0130 “Step 615 configures the power, ground, clock source and modulation parameters using circuits/boards 564a, 564h and/or 582 that provide means for modulating an input and/or output pin of the electronic device 2…. When powered, the electronic device 2 emits electromagnetic energy in step 623 that are gathered by the integrated antenna enclosure 500 via the antenna structure 556 in step 639 and is received at the RF receiver 572…. The received RF emissions are digitized in step 625 with the digital signal processed in step 627. Further, in step 631, the logic algorithms executed by the processing device 574 characterize the RF emission signature and the device 2 is either found as meeting a predetermined performance criteria or a predetermined emission signature in step 633 or is found as counterfeited or substandard in step 635. ” The modulations are applied to the device under test, such as device 2 described in Fig. 1, and the output emissions from the device are obtained and compared to emission signatures to identify a counterfeited device).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat with Keller in order to incorporate wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence when a hostile element is present in a printed circuit board (PCB) of the computing device under test; measuring, by an electromagnetic (EM) probe and in response to the applying of the distortion, an EM radiation transmitted by a region of the PCB for a presence of at least one anomalous element that could be indicative of a presence of the hostile element in the PCB.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of identification of security threats from devices that may cause issues (Keller: para.0073).
Regarding Claim 42, Bahgat-Keller discloses claim 1 as set forth above.
Bahgat further discloses wherein the applying of the distortion comprises applying a plurality of distortions at different times (Bahgat: para.0038 “At 401, one or more sets of electrical stimuli, as test signals, may be selected by control unit 310 of apparatus 300 for inducing or otherwise causing a variety of electrical activities and/or activate one of more circuit blocks of an integrated circuit of a target device or DUT 410 to perform various operations. At 402, each set of the one or more sets of electrical stimuli may be applied to DUT 410 by control unit 310. As various activities and/or operations in DUT 410 are induced by each set of electrical stimuli, photonic emissions as well as EM emissions by DUT 410 may result. …At 407, a check on the selection of electrical stimuli for testing may be performed by control unit 310. If there remains any set of electrical stimuli not yet applied to DUT 410, the above-described process of algorithm 400 may be repeated by control unit 310 until all sets of electrical stimuli have been applied to DUT 410 and resultant emission data measured and recorded.” The distortions are applied, and at step 407 is there are still stimuli yet to be applied, the process repeats, thereby showing applying the distortions are different times.).
Regarding Claim 44, Bahgat-Keller discloses claim 1 as set forth above.
However Bahgat does not explicitly disclose wherein the violating of the preconfigured functionality of the hostile element comprises overwhelming a logic circuit of the hostile element to disrupt a performance parameter of the computing device under test.
Keller discloses wherein the violating of the preconfigured functionality of the hostile element comprises overwhelming a logic circuit of the hostile element to disrupt a performance parameter of the computing device under test (Keller: para.0119 “Enhanced modulation techniques envisioned herein include but are not limited to modulating multiple inputs or outputs substantially simultaneously with the same or different signal, modulating multiple such pins with a phase shifted signal relative to each other, using the results of the modulation to change modulation in a multi-step approach, applying a series of different modulation patterns to the device under test, applying a randomized modulation pattern to seek new useful discriminating emission results, briefly applying modulation which briefly exceeds the specified voltage, current or frequency limits of the component under test,” para.0130 “The received RF emissions are digitized in step 625 with the digital signal processed in step 627. Further, in step 631, the logic algorithms executed by the processing device 574 characterize the RF emission signature and the device 2 is either found as meeting a predetermined performance criteria or a predetermined emission signature in step 633 or is found as counterfeited or substandard in step 635. When required, the results are displayed on a display 576 in step 641.” the modulation overwhelms the IC by increasing the voltage current or frequency past its limits, which causes changes in performance criteria. If performance criteria the component is deemed not counterfeit, i.e. not malicious para.0073, or if the performance criteria is not met, i.e. disrupt performance parameter, then is deem to be counterfeit.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat with Keller in order to incorporatewherein the violating of the preconfigured functionality of the hostile element comprises overwhelming a logic circuit of the hostile element to disrupt a performance parameter of the computing device under test.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of identification of security threats from devices that may cause issues (Keller: para.0073).
Claim(s) 2, 11, is/are rejected under 35 U.S.C. 103 as being unpatentable over Bahgat Shehata et al. (hereinafter Bahgat, US 2018/0027003 A1) in view of Keller, III et al. (hereinafter Keller, US 2015/0137830 A1) in view of Raghavendra et al. (hereinafter Rag, US 2016/0371134 A1).
Regarding Claim 2, Bahgat-Keller discloses claim 1 as set forth above.
However Bahgat does not explicitly disclose wherein the applying of the distortion comprises: operating the computing device under test at or above a maximum of a performance capacity of a computational resource, the method further comprising: determining the performance capacity of the computational resource; and configuring the distortion to achieve the maximum of the performance capacity, and wherein the receiving of the one or more digital signals further comprises detecting a behavior of the computational resource at or above the maximum of the performance capacity.
Keller discloses operating the computing device under test at or above a maximum of a performance capacity of a computational resource (Keller: para.0119 “Enhanced modulation techniques envisioned herein include but are not limited to modulating multiple inputs or outputs substantially simultaneously with the same or different signal, modulating multiple such pins with a phase shifted signal relative to each other, using the results of the modulation to change modulation in a multi-step approach, applying a series of different modulation patterns to the device under test, applying a randomized modulation pattern to seek new useful discriminating emission results, briefly applying modulation which briefly exceeds the specified voltage, current or frequency limits of the component under test,” the modulation applied to the device causes the performance to exceed a maximum capacity of a resource such as voltage, current or frequency.), the method further comprising:
wherein the applying of the distortion comprises: configuring the distortion to achieve the maximum of the performance capacity (Keller: para.0119 “briefly applying modulation which briefly exceeds the specified voltage, current or frequency limits of the component under test,” para.0122 “one or more specifically chosen or configured modulation signals may be applied to one or more of the connected inputs or outputs” para.0128 “Step 615 configures the power, ground, clock source and modulation parameters using circuits/boards 564a, 564h and/or 582 that provide means for modulating an input and/or output pin of the electronic device 2.”modulation is applied to the device under test that achieves the maximum of a performance capacity for voltage, current or frequency), and
wherein the receiving of the one or more digital signals further comprises detecting a behavior of the computational resource at or above the maximum of the performance capacity (Keller: para.0129 “When powered, the electronic device 2 emits electromagnetic energy in step 623 that are gathered by the integrated antenna enclosure 500 via the antenna structure 556 in step 639 and is received at the RF receiver 572. The RF receiver 572 thus receives the intended or unintended emissions 4 from the electronic device 2, which proceed outward from the electronic device 2 where the emissions 4 are gathered by an antenna means and sent typically by a coaxial cable 568a to the RF receiver 572.” Para.0130 “The received RF emissions are digitized in step 625 with the digital signal processed in step 627. Further, in step 631, the logic algorithms executed by the processing device 574 characterize the RF emission signature and the device 2 is either found as meeting a predetermined performance criteria or a predetermined emission signature in step 633 or is found as counterfeited or substandard in step 635. ” the emissions resulting from the modulation are received and the behavior of the device is detected at that modulation, i.e. at or above the performance capacity.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat with Keller in order to incorporate wherein the applying of the distortion comprises: configuring the distortion to achieve the maximum of the performance capacity, and wherein the receiving of the one or more digital signals further comprises detecting a behavior of the computational resource at or above the maximum of the performance capacity.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of identification of security threats from devices that may cause issues (Keller: para.0073).
However Bahgat-Keller does not explicitly disclose determining the performance capacity of the computational resource.
Rag discloses wherein the applying of the distortion comprises: determining a performance capacity of the computational resource (Rag: para.0029-0031 “FIG. 3 is a block diagram illustrating fault injection according to one embodiment. System faults are applied by fault injection service 301…. For example, memory pressure may be applied to role instances to remove 80% of memory for 50% of the role instances. ” a percentage of available memory, a performance capacity, it determined for the computational resource of memory.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat-Keller with Rag in order to incorporate wherein the applying of the distortion comprises: determining a performance capacity of the computational resource.
One of ordinary skill in the art would have bene motivated to combine because of the expected benefit of a improved resilience of a system that comes with fault testing (Rag: para.0028, para.0031).
Regarding Claim 11, Bahgat-Keller discloses claim 1 as set forth above.
However Bahgat does not explicitly disclose wherein the applying of the distortion comprises operating the computing device under test at or above a maximum of a performance capacity of a computational resource, wherein the computational resource is a memory resource, and wherein the operating of the computing device under test at or above the maximum of the performance capacity comprises exhausting an available memory resource of the computing device under test.
Keller further discloses wherein the applying of the distortion comprises operating the computing device under test at or above a maximum of a performance capacity of a computational resource (Keller: para.0119 “Enhanced modulation techniques envisioned herein include but are not limited to modulating multiple inputs or outputs substantially simultaneously with the same or different signal, modulating multiple such pins with a phase shifted signal relative to each other, using the results of the modulation to change modulation in a multi-step approach, applying a series of different modulation patterns to the device under test, applying a randomized modulation pattern to seek new useful discriminating emission results, briefly applying modulation which briefly exceeds the specified voltage, current or frequency limits of the component under test,” the modulation applied to the device causes the performance to exceed a maximum capacity of a resource such as voltage, current or frequency.),
wherein the computational resource is a memory resource (Keller: para.0031 “Another object of the invention is detecting counterfeit microcontroller, microprocessor, Field Programmable Gate Array (FPGA), Digital Signal Processor (DSP) and memory parts.”, para.0087. memory parts of the device are tested for counterfeiting).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat with Keller in order to incorporate wherein the applying of the distortion comprises operating the computing device under test at or above a maximum of a performance capacity of a computational resource, wherein the computational resource is a memory resource.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of identification of security threats from devices that may cause issues (Keller: para.0073).
However Bahgat-Keller does not explicitly disclose wherein the operating of the computing device under test at or above the maximum of the performance capacity comprises exhausting an available memory resource of the computing device under test.
Rag discloses wherein the computational resource is a memory resource (Rag: para.0029-0031 “FIG. 3 is a block diagram illustrating fault injection according to one embodiment. System faults are applied by fault injection service 301…. For example, memory pressure may be applied to role instances to remove 80% of memory for 50% of the role instances. ” a percentage of available memory, a performance capacity, it determined for the computational resource of memory.), and
wherein the operating of the computing device under test at or above the maximum of the performance capacity comprises exhausting an available memory resource of the computing device under test (Rag: para.0029-0031 “FIG. 3 is a block diagram illustrating fault injection according to one embodiment. System faults are applied by fault injection service 301…. For example, memory pressure may be applied to role instances to remove 80% of memory for 50% of the role instances. ” para.0035 “Guided fault injection involves injecting a selected fault against a selected number of components or instances and then steadily increasing the scope of the fault (e.g., increasing the number of components, number of roles, amount of pressure, amount of delay, etc.) until failure is detected. For example, a processor fault may be injected wherein 50% processor pressure is applied to a single machine and then the number of affected machines is steadily increased to 2, 4, 8, . . . machines until failure is detected. In such guided or deterministic fault injection, the number of affected roles or machines, amount of pressure, or other parameter is steadily increased until a breaking point for the targeted service or role is identified. Furthermore, as the breaking point is approached and finally met, the service's reaction to the fault can be observed (i.e., how the fault is identified, and mitigated).” Gradually the fault can be changed to any value to reach a breaking point, and it is possible to exhaust a resource via this method.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat-Keller with Rag in order to incorporate wherein the computational resource is a memory resource, and wherein the operating of the computing device under test at or above the maximum of the performance capacity comprises exhausting an available memory resource of the computing device under test.
One of ordinary skill in the art would have bene motivated to combine because of the expected benefit of a improved resilience of a system that comes with fault testing (Rag: para.0028, para.0031).
Claim(s) 4 is/are rejected under 35 U.S.C. 103 as being unpatentable over Bahgat Shehata et al. (hereinafter Bahgat, US 2018/0027003 A1) in view of Keller, III et al. (hereinafter Keller, US 2015/0137830 A1) in view of Turner et al. (hereinafter Turner, US 2021/0239779 A1) further in view of Nowroz et al. (hereinafter Nowroz, “Novel Techniques for High-Sensitivity Hardware Trojan Detection Using Thermal and Power Maps” NPL 2014 attached.).
Regarding Claim 4, Bahgat-Keller discloses claim 3 as set forth above.
However, While Keller discloses applying the distortion and measuring changes, Bahgat-Keller does not explicitly disclose wherein the comparing of the one or more digital signals to the one or more baseline digital signals comprises detecting a change in a thermal measurement by detecting, by the NVD sensor, a shift in a photoluminescence central frequency toward a lower frequency and in response to the distortion, wherein the shift is indicative of a change in the thermal measurement to a higher temperature.
Turner discloses wherein the comparing of the one or more digital signals to the one or more baseline digital signals comprises detecting a change in a thermal measurement by detecting, by the NVD sensor, a shift in a photoluminescence central temperature (Turner: para.0120 “In various embodiments, a magnetometer apparatus employs an ensemble of nitrogen vacancy (NV) centers in a diamond chip to achieve wide-field magnetic field measurement and mapping. NV centers in diamond are a modality for sensitive, high-spatial resolution, wide field of view imaging of microscopic magnetic fields, and may be employed to measure magnetic fields of magnetotactic bacteria, paleomagnetism in rocks, and magnetic fields emanated by propagating action potentials in neurons. The apparatus for measuring magnetic fields from integrated circuits (ICs) consists of an optical microscope and a photodetector (such as a photo-diode or a camera) to measure the fluorescence emitted by a thin ensemble NV layer at the surface of the diamond sensor chip, with the IC placed near to or in contact with the diamond.” para.0186 “the classifier algorithm may accept as input additional data pertaining to how the article and the crystal diamond interact, such as temperature data (e.g., a local temperature map)” para.0206 “The desired FPGA state-dependent magnetic field projection on each NV axis, ΔBz,i, and the change in local temperature, ΔT, are given by…” para.0243-0244 “Temperature changes in the diamond are determined from common mode shifts of NV resonance line centers….Ultimately, the multimodal information from the magnetic field maps, linewidth, contrast, and temperature may be used to create a more detailed fingerprint of IC activity. These physical parameters provide a rich data set of features that afford further dimensionality for characterization and classification.” One of the factors for finger printing the IC circuits state for classification of the state, e.g. for trojan detection in para.01988-0190, is central temperature changes of the NV diamond while reading the circuit board. The delta T being the change from some state, i.e a baseline, to the current temperature.)
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat-Keller with Turner in order to incorporate wherein the comparing of the one or more digital signals to the one or more baseline digital signals comprises detecting a change in a thermal measurement by detecting, by the NVD sensor, a shift in a photoluminescence central temperature.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved detection of malicious circuitry (Turner: para.0188-0189).
However, Bahgat-Keller-Turner does not explicitly disclose a shift in a photoluminescence central frequency toward a lower frequency and in response to the distortion, wherein the shift is indicative of a change in the thermal measurement to a higher temperature.
Nowroz discloses a shift in a photoluminescence central frequency toward a lower frequency and in response to the distortion, wherein the shift is indicative of a change in the thermal measurement to a higher temperature (Nowroz: pg. 4 “For the purpose of this paper, we first apply random vectors to the ICs and get the estimated power trace of each block by Primetime-PX. We then use HotSpot [27] thermal simulation tools to create the steady state thermal maps of various test bench circuits as described in Section VI-A1. We denote the steady-state thermal maps obtained using design-time simulations of the original authentic chip by A1, A2,... for each benchmark. We perform Monte Carlo simulations of the original chip at various PV corners to get power consumption under various PV scenarios. The thermal maps from chips under test by using infrared imaging is represented by T1,T2,... for each benchmark. It is possible to use the thermal maps for Trojan detection, but the sensitivity is less than the Trojan detection using power maps. If power mapping of the thermal maps is not available, these thermal maps can be used for Trojan detection as described in Section III-C. We use authentic thermal maps A1, A2,... as the training set and perform our Trojan detection methods of 2DPCA on the thermal maps under tests T1,T2,... for Trojan detection as described in Section III-C.” thermal maps are used for trojan detection. Seen in pg. 6 Fig. 3 a “(a) Thermal map with Trojan”, it can be seen that the maps (a) and (b) are both showing thermal shifts and patterns, with higher temperatures depicted with lower frequency, i.e. red, in response to a distortion, random vectors, applied to the ICs.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat-Keller-Turner with Nowroz in order to incorporate a shift in a photoluminescence central frequency toward a lower frequency and in response to the distortion, wherein the shift is indicative of a change in the thermal measurement to a higher temperature.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved trojan detection (Nowroz: pg. 1 abstract.).
Claim(s) 5 is/are rejected under 35 U.S.C. 103 as being unpatentable over Bahgat Shehata et al. (hereinafter Bahgat, US 2018/0027003 A1) in view of Keller, III et al. (hereinafter Keller, US 2015/0137830 A1) in view of Turner et al. (hereinafter Turner, US 2021/0239779 A1) further in view of Nowroz et al. (hereinafter Nowroz, “Novel Techniques for High-Sensitivity Hardware Trojan Detection Using Thermal and Power Maps” NPL 2014 attached.) in view of Jacob et al. (hereinafter Jacob, US 2023/0176111 A1).
Regarding Claim 5, Bahgat-Keller-Turner-Nowroz discloses claim 4 as set forth above.
However Bahgat-Keller does not explicitly disclose generating, by the NVD sensor, a temperature map of a printed circuit board (PCB), and wherein the detecting of the presence of the at least one anomalous element comprises comparing the generated map with a density map for a flow of current in the PCB.
Turner discloses generating, by the NVD sensor, a temperature map of a printed circuit board (PCB) (Turner: para.0216 “The state-dependent temperature of the FPGA was measured and determined using Equation 6. The dependence of current on the RO cluster size leads to state dependent temperature changes. Due to the high thermal conductivity of the monolithic crystal substrate, there is no spatial structure in the resultant temperature maps. However, from temperature measurements over the entire FOV, we are able to determine a scaling of ˜0.0075° C. per active ring oscillator (discussed further below) and for the 200 RO state we saw a temperature increase of ˜1.5° C.”, para.0186 local temperature map, para.0243 thermal signature. The sensor further obtains temperature data and generates a temperature map of the pcb.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat-Keller with Turner in order to incorporate generating, by the NVD sensor, a temperature map of a printed circuit board (PCB).
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved detection of malicious circuitry (Turner: para.0188-0189).
While Nowroz discloses the general usage of a current density map and temperature map to identify trojans, such as in pg. 5-6 III, Bahgat-Keller-Turner-Nowroz does not explicitly disclose wherein the detecting of the presence of the at least one anomalous element comprises comparing the generated map with a density map for a flow of current in the PCB.
Jacob discloses generating, by the sensor, a temperature map of a printed circuit board (PCB) (Jacob: para.0075 “Referring to FIG. 8, a schematic of a detection system for detecting hardware trojans in a target integrated circuit is provided. …In general, sensing circuit 54 includes an array of magnetic tunnel junction circuits MTJCij where i an j are integer labels. Each magnetic tunnel junction circuit MTJCij includes one or more magnetic tunnel junctions. Moreover, each magnetic tunnel junction circuit MTJCij is configured to provide data for and/or determine a temperature map or a current map of the target integrated circuit….Computer processor 56 executes instructions for producing the current and/or the temperature maps. In a refinement, computer processor 56 executes the machine learning algorithms (e.g., a trained neural network) for identifying hardware Trojans from the current and/or the temperature maps or data thereof.” The sensing circuit generates a temperature map and a current map, i.e. a current density map for the circuit.),
and wherein the detecting of the presence of the at least one anomalous element comprises comparing the generated map with a density map for a flow of current in the PCB (Jacob: para.0067 “Specifically, a multi-modal ML trojan detection algorithm that exploits uncorrelated and correlated data between thermal and current maps as well as the relative pixel intensity within each map with respect to other pixels can be employed for high accuracy trojan detection.” Thermal maps and current maps are correlated for high accuracy trojan detection.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Bahgat-Keller-Turner-Nowroz to incorporate Jacob in order to incorporate generating, by the sensor, a temperature map of a printed circuit board (PCB) and wherein the detecting of the presence of the at least one anomalous element comprises comparing the generated map with a density map for a flow of current in the PCB.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved accuracy of trojan detection on circuits (Jacob: para.0067).
Claim(s) 6 is/are rejected under 35 U.S.C. 103 as being unpatentable over Bahgat Shehata et al. (hereinafter Bahgat, US 2018/0027003 A1) in view of Keller, III et al. (hereinafter Keller, US 2015/0137830 A1) in view of Onabajo et al. (hereinafter Onabajo, US 2016/0371485 A1).
Regarding Claim 6, Bahgat-Keller discloses claim 1 as set forth above.
However Bahgat-Keller does not explicitly disclose determining the one or more baseline digital signals by applying the distortion to a control device.
Onabajo discloses determining the one or more baseline digital signals by applying the distortion to a control device (Onabajo: para.0086 “A calibration can be performed to ensure reliable power detection through temperature measurements in the presence of process variations and thermal gradients that result from power dissipations in circuits on the chip that are powered up even if the test signal is not applied. In the absence of electrical mismatches and thermal interference, differential temperature sensors have a differential output equal to zero. A single-point calibration step can be used prior to each measurement to compensate for electrical offsets and thermal gradients by injecting an appropriate current to balance the output. The calibration can be performed prior to applying a test pattern for digital circuits (or an AC test signal for analog circuits).” Para.0075 “In practice, one or several chips free of malicious hardware can be selected after comprehensive testing during the design validation and characterization test phase. The thermal profile that results from the average power dissipation of the circuits on the verified chips will serve as a baseline or “golden signature.” Such a golden signature can be used as a reference during faster testing of chips to detect potentially harmful circuit insertions in the high volume production phase or for recurring detection routines throughout the lifetime of a chip.” A few chips are selected, e.g. control devices, and test signals are applied as well as compensation, both of which are applied distortions, and the results are recorded as a thermal profile of a golden signature. This is then used as a baseline for other chips.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat-Keller with Onabajo in order to incorporate determining the one or more baseline digital signals by applying the distortion to a control device.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved testing of chips for malicious circuitry such as via increased speed (Onabajo: para.0075).
Claim(s) 8-10, 19, 23, 43 is/are rejected under 35 U.S.C. 103 as being unpatentable over Bahgat Shehata et al. (hereinafter Bahgat, US 2018/0027003 A1) in view of Keller, III et al. (hereinafter Keller, US 2015/0137830 A1) in view of Wittenschlaeger (hereinafter Witt, US 2012/0131674 A1).
Regarding Claim 8, Bahgat-Keller discloses claim 7 as set forth above.
However Bahgat-Keller does not explicitly disclose wherein the comparing of the one or more digital signals to the one or more baseline digital signals comprises detecting a change in one or more of a resistance, a capacitance, an integrated circuit (IC) design, a trace impedance, or a thermal measurement.
Witt discloses wherein the comparing of the one or more digital signals to the one or more baseline digital signals comprises detecting a change in one or more of a resistance, a capacitance, an integrated circuit (IC) design, a trace impedance, or a thermal measurement (Witt: para.0030 “Baseline vectors can take on many different forms. A baseline vector can represent an overall nominal behavior of a fabric as well as different types of nominal behavior. For example, multiple baseline vectors can be established to represent aspects of the fabric. One could establish a baseline vector representing nominal traffic flow through the fabric (e.g., routes, data loads, latency, etc.) while other vectors could represent operating health (e.g., temperature, error rates, etc.).” para.0025 “ As desired agent 234 can calculate a status from the metrics with respect to anomaly detection criteria, or anomaly criterion, preferably as a function of a variation from a baseline vector of behavior metrics. ” a plurality of baseline vectors are determined, at least one of which contains a thermal measurement of temperature. This vector is then compared to determine a variation from baseline).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Bahgat-Keller with Witt in order to incorporate wherein the comparing of the one or more digital signals to the one or more baseline digital signals comprises detecting a change in one or more of a resistance, a capacitance, an integrated circuit (IC) design, a trace impedance, or a thermal measurement.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved accuracy of anomaly detection (Witt: para.0033-0035).
Regarding Claim 9, Bahgat-Keller discloses claim 1 as set forth above.
However Bahgat-Keller does not explicitly disclose wherein the detecting of the presence of the at least one anomalous element is performed by a neural network.
Witt discloses wherein the detecting of the presence of the at least one anomalous element is performed by a neural network (Witt: para.0028 “ For example, multi-variate analysis can be performed with respect to metrics to determine if one metric is correlated with another. Other algorithms could also be used to establish baseline vectors or anomalous conditions including genetic algorithms, neural networks, bloom filters, or other known AI techniques. Vectors can be considered a manageable data object that can be stored, moved, updated, removed, or otherwise managed as an independent object from other objects. ” the anomalous conditions are detected via neural network).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Bahgat-Keller with Witt in order to incorporate wherein the detecting of the presence of the at least one anomalous element is performed by a neural network.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved accuracy of anomaly detection (Witt: para.0033-0035).
Regarding Claim 10, Bahgat-Keller -Witt discloses claim 9 as set forth above.
However Bahgat-Keller does not explicitly disclose determining the one or more baseline digital signals by the neural network.
Witt discloses determining the one or more baseline digital signals by the neural network (Witt: para.0028 “ For example, multi-variate analysis can be performed with respect to metrics to determine if one metric is correlated with another. Other algorithms could also be used to establish baseline vectors or anomalous conditions including genetic algorithms, neural networks, bloom filters, or other known AI techniques. Vectors can be considered a manageable data object that can be stored, moved, updated, removed, or otherwise managed as an independent object from other objects. ” the baselines are detected via neural network).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Bahgat-Keller with Witt in order to incorporate determining the one or more baseline digital signals by the neural network.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved accuracy of anomaly detection (Witt: para.0033-0035).
Regarding Claim 19, Bahgat-Keller discloses claim 1 as set forth above.
Bahgat further discloses applying, by the testing computing device, a second distortion to the computing device under test at another time (Bahgat: para.0052 “ At 1007, a check on the selection of electrical stimuli for testing may be performed by control unit 310. If there remains any set of electrical stimuli not yet applied to DUT 1020, the above-described process of algorithm 1000 may be repeated by control unit 310 until all sets of electrical stimuli have been applied to DUT 1020 and resultant emission data measured and recorded.” For the same device, a plurality of stimuli are applied to the device iteratively.)
However Bahgat-Keller hgat does not explicitly determining whether a second hostile element is present in the computing device under test; and detecting that the second hostile element is present in the computing device under test.
Witt discloses determining whether a second hostile element is present in the computing device under test (Witt: para.0034-0035 “Another technique for establishing anomaly detection criteria can include step 325. Step 325 includes modeling an anomalous behavior within the fabric while the fabric is operating. Modeling the behavior is considered to include constructing a logical representation of the fabric by using actual nodes that exchange data among each other within boundaries of a baseline vector. An anomalous behavior can be introduced or injected into the modeled fabric, and then the effects can be directly observed in a more accurate real-world environment. In addition to modeling the fabric, step 327 can include running a live drill. Consider a government fabric that requires high security. The managers of the fabric can conduct a live drill by introducing an anomalous behavior on a live, active fabric. The managers are essentially modeling the behavior while directly observing or collecting data reflecting measured vectors of behavior metrics.” Fabric 100 in Fig. 1, or a modeled version of the fabric is injected with the anomaly by the fabric manager, para.0023 0033-0035, causing it to behave different and generate differences in vectors that represent behavior as compared to the baseline vector, para.0031-0032);
and detecting that the second hostile element is present in the computing device under test (Witt: para.0036 “Step 330 can include disaggregating the anomaly detection criteria into one or more anomaly criterion. Each criterion is considered to be function of a measured vector of behavior metrics rather than merely a metric threshold value. The function can result in a continuous set of values representing a status of the criterion. An anomaly criterion, by itself, would likely fail to provide sufficient insight into an anomalous behavior. However, when the statuses of most, if not all, of the anomaly criterion are aggregated, sufficient information might be available to indicate that an anomalous behavior is present.” Para.0043 “Step 370 includes detecting satisfaction of the anomaly detection criteria as a function of the anomaly criterion statuses, where satisfaction appears to indicate an anomalous behavior is present.” Using this learned anomaly criterion by applying the anomalous event to the device and measuring the status, a second hostile element can be determined to be present based on this anomaly criterion in step 370.)
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Bahgat-Keller with Witt in order to incorporate determining whether a second hostile element is present in the computing device under test; and detecting that the second hostile element is present in the computing device under test, and apply this idea to the iterative learning process of Bahgat in which a plurality of stimuli are applies subsequently to measure device state based on each stimuli.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved accuracy of anomaly detection (Witt: para.0033-0035).
Regarding Claim 23, Bahgat-Keller discloses claim 1 as set forth above.
Bahgat further discloses hostile element detected in the computing device under test (Bahgat: para.0056 “At 1130, process 1100 may involve control unit 310 identifying an anomaly condition associated with the target device by comparing a result of the measuring to the one or more electromagnetic emission models.” Para.0022. An anomalous element can be detected, such as malware. )
However Bahgat-Keller does not explicitly disclose determining a confidence level for the computing device under test, wherein the confidence level is indicative of a hostile element detected in the computing device under test.
Witt discloses determining a confidence level for the computing device under test, wherein the confidence level is indicative of a hostile element detected in the computing device under test (Witt: para.0043-0044 “Step 370 includes detecting satisfaction of the anomaly detection criteria as a function of the anomaly criterion statuses, where satisfaction appears to indicate an anomalous behavior is present. Although satisfaction of the anomaly detection criteria can be a binary result (i.e., satisfied or not-satisfied), in more preferred embodiments satisfaction can vary by degrees according the structure of the anomaly detection criteria. Furthermore, the statuses are not required to indicate satisfaction of a condition…. As criterion statuses are aggregated, the anomaly detection criteria can become “more” satisfied, or possibly less satisfied. ” A satisfaction level can be reached for detecting the anomalous event).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat-Keller with Witt in order to incorporate determining a confidence level for the computing device under test, wherein the confidence level is indicative of a hostile element detected in the computing device under test, and apply to the types of hostile elements as described in Bahgat.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved detection of hostile elements (Witt: para.0043-0045).
Regarding Claim 43, Bahgat- Keller discloses claim 1 as set forth above.
However Bahgat-Keller does not explicitly disclose wherein the violating of the preconfigured functionality of the hostile element comprises inducing an unanticipated error in a logic state of the hostile element when the computing device operates outside of a normal range.
Witt discloses wherein the violating of the preconfigured functionality of the hostile element comprises inducing an unanticipated error in a logic state of the hostile element (Witt: para.0030 “One could establish a baseline vector representing nominal traffic flow through the fabric (e.g., routes, data loads, latency, etc.) while other vectors could represent operating health (e.g., temperature, error rates, etc.).” para.0032 “A single set of anomaly detection criteria can be associated with a type of anomaly (e.g., intrusion, attack, error condition, maintenance problem, etc.) or even with a specific anomaly (e.g., denial of service attack).” Para.0034 “ A vector of behavior metrics can be measured and compared to the baseline vector to determine how the measured behavior vector varies from the baseline vector.” para.0035 “In addition to modeling the fabric, step 327 can include running a live drill. Consider a government fabric that requires high security. The managers of the fabric can conduct a live drill by introducing an anomalous behavior on a live, active fabric.” Error rates are monitored when establishing baseline behavior and measured during induced anomalous behavior, therefore when the live drill occurs and anomalous behavior is introduced, unanticipated errors are induced in the hostile element.)
when the computing device operates outside of a normal range (Witt: para.0035 “In addition to modeling the fabric, step 327 can include running a live drill. Consider a government fabric that requires high security. The managers of the fabric can conduct a live drill by introducing an anomalous behavior on a live, active fabric. The managers are essentially modeling the behavior while directly observing or collecting data reflecting measured vectors of behavior metrics.” Anomalous behavior is introduced to the fabric, thereby causing it to operate outside of a normal range, i.e. in anomalous range.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Bahgat-Keller with Witt in order to incorporate wherein the violating of the preconfigured functionality of the hostile element comprises inducing an unanticipated error in a logic state of the hostile element when the computing device operates outside of a normal range, and apply this idea to the iterative learning process of Bahgat in which a plurality of stimuli are applies subsequently to measure device state based on each stimuli.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved accuracy of anomaly detection (Witt: para.0033-0035).
Claim(s) 13 is/are rejected under 35 U.S.C. 103 as being unpatentable over Bahgat Shehata et al. (hereinafter Bahgat, US 2018/0027003 A1) in view of Keller, III et al. (hereinafter Keller, US 2015/0137830 A1) in view of Xia et al. (hereinafter Xia, US 10,796,035 B1) in view of Nabeesa et al. (hereinafter Nabeesa, US 2020/0314115 A1).
Regarding Claim 13, Bahgat-Keller discloses claim 1 as set forth above.
However Bahgat-Keller does not explicitly disclose wherein the applying of the distortion comprises operating the computing device under test at or above a maximum of a performance capacity of a computational resource, wherein the computational resource is a baseboard management controller (BMC), and wherein applying of the distortion comprises applying the distortion to a network interface card (NIC), wherein the NIC supports a control channel for the BMC via a network controller sideband interface (NC-SI) protocol.
Keller further discloses wherein the applying of the distortion comprises operating the computing device under test at or above a maximum of a performance capacity of a computational resource (Keller: para.0119 “Enhanced modulation techniques envisioned herein include but are not limited to modulating multiple inputs or outputs substantially simultaneously with the same or different signal, modulating multiple such pins with a phase shifted signal relative to each other, using the results of the modulation to change modulation in a multi-step approach, applying a series of different modulation patterns to the device under test, applying a randomized modulation pattern to seek new useful discriminating emission results, briefly applying modulation which briefly exceeds the specified voltage, current or frequency limits of the component under test,” the modulation applied to the device causes the performance to exceed a maximum capacity of a resource such as voltage, current or frequency.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat with Keller in order to incorporate wherein the applying of the distortion comprises operating the computing device under test at or above a maximum of a performance capacity of a computational resource.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of identification of security threats from devices that may cause issues (Keller: para.0073).
However Bahgat-Keller does not explicitly disclose wherein the computational resource is a baseboard management controller (BMC), and wherein applying of the distortion comprises applying the distortion to a network interface card (NIC), wherein the NIC supports a control channel for the BMC via a network controller sideband interface (NC-SI) protocol.
Xia discloses wherein the computational resource is a baseboard management controller (BMC), and wherein applying of the distortion comprises applying the distortion to a network interface card (NIC) (Xia: Col. 9 lines 19-36 “In this regard, in one embodiment of the invention, a management and orchestration platform can be deployed to execute on top of the simulated computing system, wherein the test control API 134 allows a user to test a functionality of the management and orchestration platform by, e.g., injecting error into the simulated computing system, and determining how the management and orchestration platform reacts in response to the injected error. For example, the test control API 134 can be utilized to manipulate/change a behavior of one or more of the simulated elements, or simulate a failure of one or more of the simulated elements of the simulated computing system. In particular, the test control API 134 can be utilized to modify system behavior by manipulating FW (firmware) behavior of one or more simulated hardware elements or simulated nodes, or simulating a hardware failure of one or more simulated hardware elements. For example, the test control API 134 can be used to change a server node boot sequence, or re-direct BMC (baseboard management control) traffic to a shared or separate NIC (network interface card).” The computational resource here is the BMC, and the traffic from the BMC is redirected to the NIC, thereby applying the distortion of modified traffic pattern to the NIC that affects the BMC.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat-Keller with Xia in order to incorporate wherein the computational resource is a baseboard management controller (BMC), and wherein applying of the distortion comprises applying the distortion to a network interface card (NIC).
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of testing network components to improve system functionality (Xia: background, Col. 9 lines 19-36).
However Bahgat-Keller -Xia does not explicitly disclose wherein the NIC supports a control channel for the BMC via a network controller sideband interface (NC-SI) protocol.
Nabeesa discloses wherein the NIC supports a control channel for the BMC via a network controller sideband interface (NC-SI) protocol (Nabeesa: para.0019 “In a particular embodiment, BMC agent 220 communicates with BMC 230 via a Network Controller-Sideband Interface (NC-SI), NC-SI interface between the BMC and a network interface card (NIC) or host bust adapter (HBA) of information handling system 200.” The NIC supports the BMC using a NC-SI interface.).
Therefore it would have been obvious to one of ordinary skill in the art to combine Bahgat-Keller -Xia with Nabeesa in order to incorporate wherein the NIC supports a control channel for the BMC via a network controller sideband interface (NC-SI) protocol.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved speed between the NIC and BMC (Nabeesa: para.0015).
Claim(s) 14 is/are rejected under 35 U.S.C. 103 as being unpatentable over Bahgat Shehata et al. (hereinafter Bahgat, US 2018/0027003 A1) in view of Keller, III et al. (hereinafter Keller, US 2015/0137830 A1) in view of Soerensen et al. (hereinafter Soer, US 2004/0204003 A1).
Regarding Claim 14, Bahgat-Keller discloses claim 1 as set forth above.
However Bahgat-Keller does not explicitly disclose wherein the distortion comprises one or more of resetting a memory arbiter, disabling a memory arbiter, modifying one or more parameters of a coalescing engine, fingerprinting a buffer operation of a direct memory access (DMA), or modifying a parameter of a watchdog timer.
Soer discloses wherein the distortion comprises one or more of resetting a memory arbiter, disabling a memory arbiter, modifying one or more parameters of a coalescing engine, fingerprinting a buffer operation of a direct memory access (DMA), or modifying a parameter of a watchdog timer (Soer: para.0051 “Some embodiments disable the security system if an emulator is active. This helps to make it more difficult to use an emulator to discover information that could be used to tamper with and/or defeat the security system 100. It will be apparent that there are many ways to accomplish this. One way is discussed hereinbelow with respect to FIG. 5.” Para.0066-0069 “The watchdog disable input receives an emulator active signal (driven by the processor core) on a signal line 162. The time out signal is output on a line 164.” In order to test the system using the emulator, as part of the distortion the watchdog timer is disabled using the watchdog disable input parameter.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat-Keller with Soer in order to incorporate wherein the distortion comprises one or more of resetting a memory arbiter, disabling a memory arbiter, modifying one or more parameters of a coalescing engine, fingerprinting a buffer operation of a direct memory access (DMA), or modifying a parameter of a watchdog timer.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of being able to test the device using a debugger/emulator without triggering the watchdog timer (Soer: para.0006 Para.0066-0069).
Claim(s) 16 is/are rejected under 35 U.S.C. 103 as being unpatentable over Bahgat Shehata et al. (hereinafter Bahgat, US 2018/0027003 A1) in view of Keller, III et al. (hereinafter Keller, US 2015/0137830 A1) in view of Duan et al. (hereinafter Duan, US 2014/0344935 A1).
Regarding Claim 16, Bahgat-Keller discloses claim 1 as set forth above.
However while Bahgat disclose various types of malware that is to be detected in para.0025 such as trojans and many other that are known to perform the operations of claim 16, Bahgat-Keller does not explicitly disclose wherein the hostile element is configured to perform one or more operations comprising: (i) opening a back door to the one or more computational resources, (ii) misappropriating data from the computing device under test, (iii) revealing system behavior for the computing device under test, (iv) revealing network characteristics associated with the computing device under test, (v) collecting data associated with the computing device under test, (vi) transmitting data associated with the computing device under test to a hostile actor, (vii) establishing a communication channel with a hostile actor, (viii) communicating with a hostile actor, or (ix) disrupting the one or more computational resources.
Duan discloses wherein the hostile element is configured to perform one or more operations comprising: (i) opening a back door to the one or more computational resources, (ii) misappropriating data from the computing device under test, (iii) revealing system behavior for the computing device under test, (iv) revealing network characteristics associated with the computing device under test, (v) collecting data associated with the computing device under test, (vi) transmitting data associated with the computing device under test to a hostile actor, (vii) establishing a communication channel with a hostile actor, (viii) communicating with a hostile actor, or (ix) disrupting the one or more computational resources (Duan: para.0003 “Along with constant popularization of Internet technologies, the issue of network security has become increasingly prominent, and especially the flooding of Trojan program may directly result in illegal embezzlement and corruption of various types of important information. At present the Trojan program has become a common means for a network attacker to make an attack, where the attacker may obtain a control privilege of a target host and embezzle a user account, a user password and other important information by means of the Trojan program. For this reason, how to detect, intercept and protect against Trojan has become an issue highly desirable to be addressed.” By obtaining user name and password, at least (ii), (iv), (v), (ix) are covered by this action as this would obtain and reveal confidential information about a device of a network, and by taking control, it disrupts one or more computational resources, i.e. any of the ones of the controlled device.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat-Keller with Duan in order to incorporate wherein the hostile element is configured to perform one or more operations comprising: (i) opening a back door to the one or more computational resources, (ii) misappropriating data from the computing device under test, (iii) revealing system behavior for the computing device under test, (iv) revealing network characteristics associated with the computing device under test, (v) collecting data associated with the computing device under test, (vi) transmitting data associated with the computing device under test to a hostile actor, (vii) establishing a communication channel with a hostile actor, (viii) communicating with a hostile actor, or (ix) disrupting the one or more computational resources.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of detecting trojans capable of the above, which would result in a more secure device (Duan: para.0003-0005).
Claim(s) 20, 25 is/are rejected under 35 U.S.C. 103 as being unpatentable over Bahgat Shehata et al. (hereinafter Bahgat, US 2018/0027003 A1) in view of Keller, III et al. (hereinafter Keller, US 2015/0137830 A1) in view of Wittenschlaeger (hereinafter Witt, US 2012/0131674 A1) in view of Raghavendra et al. (hereinafter Rag, US 2016/0371134 A1).
Regarding Claim 20, Bahgat-Keller discloses claim 1 as set forth above.
Bahgat discloses applying, by the testing computing device, a second distortion to the computing device under test at a first time (Bahgat: para.0052 “ At 1007, a check on the selection of electrical stimuli for testing may be performed by control unit 310. If there remains any set of electrical stimuli not yet applied to DUT 1020, the above-described process of algorithm 1000 may be repeated by control unit 310 until all sets of electrical stimuli have been applied to DUT 1020 and resultant emission data measured and recorded.” For the same device, a plurality of stimuli are applied to the device iteratively.);
However Bahgat-Keller does not explicitly disclose determining whether a second hostile element is present in the computing device under test at the first time; and upon a determination that the second hostile element is not present in the computing device under test at the first time, repeating, at a second time after the first time, the applying of the second distortion.
Witt discloses determining whether a second hostile element is present in the computing device under test at the first time (Witt: para.0034-0035 “Another technique for establishing anomaly detection criteria can include step 325. Step 325 includes modeling an anomalous behavior within the fabric while the fabric is operating. Modeling the behavior is considered to include constructing a logical representation of the fabric by using actual nodes that exchange data among each other within boundaries of a baseline vector. An anomalous behavior can be introduced or injected into the modeled fabric, and then the effects can be directly observed in a more accurate real-world environment. In addition to modeling the fabric, step 327 can include running a live drill. Consider a government fabric that requires high security. The managers of the fabric can conduct a live drill by introducing an anomalous behavior on a live, active fabric. The managers are essentially modeling the behavior while directly observing or collecting data reflecting measured vectors of behavior metrics.” Fabric 100 in Fig. 1, or a modeled version of the fabric is injected with the anomaly by the fabric manager, para.0023 0033-0035, causing it to behave different and generate differences in vectors that represent behavior as compared to the baseline vector, para.0031-0032);
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Bahgat-Keller with Witt in order to incorporate determining whether a second hostile element is present in the computing device under test at the first time, and apply this idea to the iterative learning process of Bahgat in which a plurality of stimuli are applies subsequently to measure device state based on each stimuli, such that multiple hostile elements can be identified.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved accuracy of anomaly detection (Witt: para.0033-0035).
However Bahgat-Keller -Witt does not explicitly disclose and upon a determination that the second hostile element is not present in the computing device under test at the first time, repeating, at a second time after the first time, the applying of the second distortion.
Rag discloses upon a determination that the second failure is not present in the computing device under test at the first time, repeating, at a second time after the first time, the applying of the second distortion (Rag: para.0035 “Guided fault injection involves injecting a selected fault against a selected number of components or instances and then steadily increasing the scope of the fault (e.g., increasing the number of components, number of roles, amount of pressure, amount of delay, etc.) until failure is detected. For example, a processor fault may be injected wherein 50% processor pressure is applied to a single machine and then the number of affected machines is steadily increased to 2, 4, 8, . . . machines until failure is detected. In such guided or deterministic fault injection, the number of affected roles or machines, amount of pressure, or other parameter is steadily increased until a breaking point for the targeted service or role is identified. Furthermore, as the breaking point is approached and finally met, the service's reaction to the fault can be observed (i.e., how the fault is identified, and mitigated).” If failure is not detected, the applied fault is increased until a failsure is detected, thereby repeating at a second time after a first time an application of the second distortion..).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat-Witt with Rag in order to upon a determination that the second failure is not present in the computing device under test at the first time, repeating, at a second time after the first time, the applying of the second distortion, and apply this idea to the application of distortions and identification of anomalous elements. Rag teaches the idea of gradually increasing the distortion, each increasing being a new distortion, until the failure is detected. It would be obvious to apply this same idea to the application of a distortion to identify an anomalous elements as in Bahgat-Witt until an anomalous element is detected and learned.
One of ordinary skill in the art would have bene motivated to combine because of the expected benefit of a improved resilience of a system that comes with fault testing (Rag: para.0028, para.0031).
Regarding Claim 25, Bahgat-Keller-Witt discloses claim 23 as set forth above.
However Bahgat-Keller does not explicitly disclose determining, based on the confidence level for the computing device under test, one or more of a frequency of applying a distortion or a type of distortion to be applied to the computing device under test.
Witt discloses the confidence level for the computing device under test (Witt: para.0043-0044 “Step 370 includes detecting satisfaction of the anomaly detection criteria as a function of the anomaly criterion statuses, where satisfaction appears to indicate an anomalous behavior is present. Although satisfaction of the anomaly detection criteria can be a binary result (i.e., satisfied or not-satisfied), in more preferred embodiments satisfaction can vary by degrees according the structure of the anomaly detection criteria. Furthermore, the statuses are not required to indicate satisfaction of a condition…. As criterion statuses are aggregated, the anomaly detection criteria can become “more” satisfied, or possibly less satisfied. ” A satisfaction level can be reached for detecting the anomalous event).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat-Keller with Witt in order to incorporate the confidence level for the computing device under test.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved detection of hostile elements (Witt: para.0043-0045).
However Bahgat-Keller-Witt does not explicitly disclose determining, based on the confidence level for the computing device under test, one or more of a frequency of applying a distortion or a type of distortion to be applied to the computing device under test.
Rag discloses determining, based on not detecting the failure for the computing device under test, one or more of a frequency of applying a distortion or a type of distortion to be applied to the computing device under test (Rag: para.0035 “Guided fault injection involves injecting a selected fault against a selected number of components or instances and then steadily increasing the scope of the fault (e.g., increasing the number of components, number of roles, amount of pressure, amount of delay, etc.) until failure is detected. For example, a processor fault may be injected wherein 50% processor pressure is applied to a single machine and then the number of affected machines is steadily increased to 2, 4, 8, . . . machines until failure is detected. In such guided or deterministic fault injection, the number of affected roles or machines, amount of pressure, or other parameter is steadily increased until a breaking point for the targeted service or role is identified. Furthermore, as the breaking point is approached and finally met, the service's reaction to the fault can be observed (i.e., how the fault is identified, and mitigated).” If the failure is not detected, a type of distortion to be applied is determined, i.e. increased distortion percentage for memory processor etc, or apply to additional machines. ).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat-Keller-Witt with Rag in order to incorporate determining, based on not detecting the failure for the computing device under test, one or more of a frequency of applying a distortion or a type of distortion to be applied to the computing device under test, and apply this idea to the confidence score of Witt. Witt uses the confidence score to determine if an anomaly is detected, and rag operates off of not detecting the failure. It would be obvious to use a similar confidence score for the trigger to continuously change the distortion in this manner.
One of ordinary skill in the art would have bene motivated to combine because of the expected benefit of a improved resilience of a system that comes with fault testing (Rag: para.0028, para.0031).
Claim(s) 22 is/are rejected under 35 U.S.C. 103 as being unpatentable over Bahgat Shehata et al. (hereinafter Bahgat, US 2018/0027003 A1) in view of Keller, III et al. (hereinafter Keller, US 2015/0137830 A1) in view of Rikitake et al. (hereinafter Rikitake, US 2014/0298082 A1).
Regarding Claim 22, Bahgat-Keller discloses claim 1 as set forth above.
However Bahgat-Keller does not explicitly disclose wherein the computing device under test comprises a plurality of servers.
Rikitake discloses wherein the computing device under test comprises a plurality of servers (Rikitake: para.0011 “The user then makes settings for the failover capability and the service to be implemented by each of the servers (Step S4). The user then uses a jig or software to inject a simulated fault into a server so as to generate an error (Step S5). Afterward, the user checks whether the set failover capability is properly implemented (Step S6).” abstract “The testing unit injects a simulated fault into a server among the servers to which the image file is transmitted and performs a test. The restoring unit, each time the testing unit performs a test, restores a status of the to-be-tested server to a pre-failover status. The judgment unit judges whether the restoring unit properly restores the status. The power control unit, when the judgment unit judges that the status of the to-be-tested server is not properly restored, turns off power of the to-be-tested server and turns on the power again.” A set of servers are tested by injecting a fault into a server of the set of servers).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Bahgat-Keller with Rikitake in order to incorporate wherein the computing device under test comprises a plurality of servers, thereby testing the circuits for a plurality of devices
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of proper operation of each device of a set of devices (Rikitake: abstract, para.0008).
Claim(s) 24 is/are rejected under 35 U.S.C. 103 as being unpatentable over Bahgat Shehata et al. (hereinafter Bahgat, US 2018/0027003 A1) in view of Keller, III et al. (hereinafter Keller, US 2015/0137830 A1) in view of Lukacs et al. (hereinafter Lukac, US 2015/0013008 A1).
Regarding Claim 24, Bahgat-Keller discloses claim 1 as set forth above.
However Bahgat-Keller does not explicitly disclose wherein the determining of the confidence level further comprises: applying respective weights to each of the at least one anomalous element, wherein the respective weights are based on a type of hostile element, and wherein the confidence level is a weighted average of the number of anomalous components.
Lukacs discloses wherein the determining of the confidence level further comprises: applying respective weights to each of the at least one anomalous element, wherein the respective weights are based on a type of hostile element (Lukacs: para.0068 “ Optimization algorithms may receive statistical and/or behavioral data about various processes executing on the plurality of host systems 10a-c, including process evaluation indicators/scores reported to process-scoring module 38 by various process evaluators, and determine optimal values for the parameters.” A plurality of scored are generated for various processes. Para.0069 “In another example, security settings 82 comprise a set of weight values used by process-scoring module 38 to determine an aggregate maliciousness score for an evaluated process according to individual process evaluation indicators received from various process evaluators. In an embodiment wherein the aggregate score is a weighted sum or a weighted average of individual scores, and wherein each score is computed according to a distinct malware detection criterion or method (for instance, when each score indicates whether an evaluated process performs a certain malware-indicative behavior)… By receiving security reports 80 in real time from a plurality of host systems, security server 110 may be kept up to date with the current malware threats, and may promptly deliver optimal security settings 82 to the respective host systems, settings 82 including, for instance, a set of score weights optimized for detecting the current malware threats.” based on the type of hostile event, the current malware criterion, a set of weights are determined and applied.),
and wherein the confidence level is a weighted average of the number of anomalous components (Lukacs: para.0069 “In an embodiment wherein the aggregate score is a weighted sum or a weighted average of individual scores, and wherein each score is computed according to a distinct malware detection criterion or method (for instance, when each score indicates whether an evaluated process performs a certain malware-indicative behavior), changing the weight of an individual score may effectively change the relevance of the respective criterion or method, compared to other criteria/methods.” A weighted average of the scores for the anomalous components in para.0068 is calculated for a final aggregate score for malware detection).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat-Keller with Lukacs in order to incorporate wherein the determining of the confidence level further comprises: applying respective weights to each of the at least one anomalous element, wherein the respective weights are based on a type of hostile element, and wherein the confidence level is a weighted average of the number of anomalous components.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved malware detection (Lukacs: para.0069-0070).
Claim(s) 26 is/are rejected under 35 U.S.C. 103 as being unpatentable over Bahgat Shehata et al. (hereinafter Bahgat, US 2018/0027003 A1) in view of Keller, III et al. (hereinafter Keller, US 2015/0137830 A1) in view of Wittenschlaeger (hereinafter Witt, US 2012/0131674 A1) in view of Butler et al. (hereinafter Butler, 5,269,016).
Regarding Claim 26, Bhagat-Keller discloses claim 1 as set forth above.
However Bhagat-Keller does not explicitly disclose the computing device under test having been configured with a Byzantine circuit comprising a predetermined distortion pattern to cause a synchronization skew, and wherein the detecting of the presence of the at least one anomalous element comprises one or more of detecting a malfunction of the computational resource or an error in a processing task performed by the computational resource.
Witt further discloses wherein the detecting of the presence of the at least one anomalous element comprises one or more of detecting a malfunction of the computational resource or an error in a processing task performed by the computational resource (Witt: para.0030 “Baseline vectors can take on many different forms. A baseline vector can represent an overall nominal behavior of a fabric as well as different types of nominal behavior. For example, multiple baseline vectors can be established to represent aspects of the fabric. One could establish a baseline vector representing nominal traffic flow through the fabric (e.g., routes, data loads, latency, etc.) while other vectors could represent operating health (e.g., temperature, error rates, etc.).” para.0039 “Step 350 includes having each node calculate a criterion status for each criterion for which it is responsible. As mentioned previously, each criterion can comprise a function, or algorithm, applied to measured vector of behavior metrics” error rates are measured and recorded into the vectors and used in step 350 to detect the anomalous element.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Bhagat-Keller with Witt in order to incorporate wherein the detecting of the presence of the at least one anomalous element comprises one or more of detecting a malfunction of the computational resource or an error in a processing task performed by the computational resource.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved accuracy of anomaly detection (Witt: para.0033-0035).
However Bhagat-Keller -Witt does not explicitly disclose the computing device under test having been configured with a Byzantine circuit comprising a predetermined distortion pattern to cause a synchronization skew.
Butler discloses the computing device under test having been configured with a Byzantine circuit comprising a predetermined distortion pattern to cause a synchronization skew (Butler: col.1 lines 45-55 “It has been found that such a Byzantine resilient system can tolerate the loss of Ffault containment regions under the following conditions: (1)if (3F-1) FCRs are utilized, (2) if each FCR is connected to at least (2F-1) other FCRs by disjoint communication links or paths, (3) if (F-1) rounds of data exchange are used to distribute single-source data, and (4) if the operations of functioning FCRs of the system are time synchronized to within a known and specified time skew. T” the device is equipped with a byzantine circuit, comprising a particular distortion pattern, i.e. the orientation of the regions or the amount of time to skew itself is a pattern of +delta time, which causes a synchronization skew.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bhagat-Keller -Witt with Butler in order to incorporate the computing device under test having been configured with a Byzantine circuit comprising a predetermined distortion pattern to cause a synchronization skew.
One of ordinary skill in the art would have ben motivated to combine because of the expected benefit of a more resilient system (Butler: col.1 lines 45-55, 18-32.)
Claim(s) 27-28, 31, 32, 34, 37-38, 40 is/are rejected under 35 U.S.C. 103 as being unpatentable over Bahgat Shehata et al. (hereinafter Bahgat, US 2018/0027003 A1) in view of Keller, III et al. (hereinafter Keller, US 2015/0137830 A1) in view of Turner et al. (hereinafter Turner, US 2021/0239779 A1).
Regarding Claim 27, Bahgat discloses A computer-implemented method, comprising: applying, by a testing computing device (Bahgat: Fig. 3, Fig. 4, apparatus 300), a distortion to a computing device under test (Margalit: para.0038 “At 401, one or more sets of electrical stimuli, as test signals, may be selected by control unit 310 of apparatus 300 for inducing or otherwise causing a variety of electrical activities and/or activate one of more circuit blocks of an integrated circuit of a target device or DUT 410 to perform various operations. At 402, each set of the one or more sets of electrical stimuli may be applied to DUT 410 by control unit 310. As various activities and/or operations in DUT 410 are induced by each set of electrical stimuli, photonic emissions as well as EM emissions by DUT 410 may result. At 403, photonic emissions from DUT 410 may be measured and recorded as photonic emission data by photonic emission measurement unit 330 of apparatus 300.” A set of stimuli, a set of distortions, are applied by the testing device to the device under test. Fig. 3 shows system 300 applying test signals to the device under test 350.),
measuring, by a sensor a digital signal transmitted by a region of the PCB for a presence of at least one anomalous element that could be indicative of a presence of the hostile element in the PCB (Bahgat: para.0053-0055 “For illustrative purposes and without limitation, process 1100 is described below in the context of apparatus 300…At 1120, process 1100 may involve EM emission measurement unit 340 of apparatus 300 measuring electromagnetic emissions of the target device in a test context different from the baseline context. ” the testing computing device, 300 Fig. 3, obtains EM emission measurements from the device being tested, 350 in Fig. 3, using the Electromagnetic Emission Measurement unit, and the photonic emission measurement unit, to detect a hostile element in a portion of an IC. Seen in Fig. 9, and para.0049-0050, 904 and 903, portions of the circuit can be identified for anomalous elements.);
comparing, by the testing computing device, the digital signal to a device fingerprint associated with the computing device under test (Bahgat: para.0056 “At 1130, process 1100 may involve control unit 310 identifying an anomaly condition associated with the target device by comparing a result of the measuring to the one or more electromagnetic emission models.” The obtained signal is compared to known fingerprints of the circuit para.0057-0059. For example, Fig. 10 shows the steps to generate the fingerprint by measuring em and photon emissions based on stimuli and generating EM models used to detect anomalies and Trojans.); and
detecting, based on the comparing and by the testing computing device, the presence of the at least one anomalous element in the region of the PCB that could be indicative of the presence of the hostile element in the PCB (Bahgat: para.0056 “At 1130, process 1100 may involve control unit 310 identifying an anomaly condition associated with the target device by comparing a result of the measuring to the one or more electromagnetic emission models.” para.0034 “Moreover, data analysis unit 320 may compare the first PICA emission image and the second PICA emission image to provide a comparison result. Control unit 310 may identify a region of interest associated with one or more circuit blocks of an integrated circuit of DUT 350 based on the comparison result. In some embodiments, in correlating the recorded data of the photonic emissions and the recorded data of the electromagnetic emissions based on the analysis result to establish the one or more electromagnetic emission models for DUT 350, control unit 310 may correlate the one or more circuit blocks performing one or more activities in the region of interest during a first period of time to electromagnetic emission signatures recorded during the first period of time.” Para.0022, Using the models, anomalies, trojans and malware can be detected on the circuit. Seen in para.0034, the models contain region specific signatures learned during the training phase for the emission models in step 1110 Fig. 11. Para.0022 “detect and classify changes in execution of program(s) by a target device and/or activation of malware(s) (e.g., one or more hardware Trojans, viruses, worms, ransomwares, spywares, adwares, scarewares and/or any other types of malicious programs or intrusive software) on the target device “).
However Bahgat does not explicitly disclose wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence when a hostile element is present in a printed circuit board (PCB) of the computing device under test; measuring, by a nitrogen-vacancy diamond (NVD) sensor and in response to the applying of the distortion, a digital signal transmitted by a region of the PCB for a presence of at least one anomalous element that could be indicative of a presence of the hostile element in the PCB.
Keller discloses wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence (Keller: para.0119 “Enhanced modulation techniques envisioned herein include but are not limited to modulating multiple inputs or outputs substantially simultaneously with the same or different signal, modulating multiple such pins with a phase shifted signal relative to each other, using the results of the modulation to change modulation in a multi-step approach, applying a series of different modulation patterns to the device under test, applying a randomized modulation pattern to seek new useful discriminating emission results, briefly applying modulation which briefly exceeds the specified voltage, current or frequency limits of the component under test,” para.0073 “It is to be understood that the definition of a counterfeit or substandard electronic device applies to but is not limited to … electronic devices which have been deliberately or unintentionally modified, electronic devices which have been deliberately modified to pose a security threat, and electronic devices which have been deliberately and/or intentionally modified for a malicious purpose with the intent to deceive as to the intended function.” modulations are applied to the device under test, such as device 2 in fig. 1, causing the device to operate outside of the normal range of operation, i.e. violating a preconfigured functionality, by exceeding maximum performance capacity such as voltage current or frequency limits of the device. Testing a device that may be counterfeited, that includes devices that have been deliberately modified to be malicious or a security threat, therefore this process reveals the presence of hostile elements by violating its preconfigured functionality)
when a hostile element is present in a printed circuit board (PCB) (Keller: para.0006 printed circuit board) of the computing device under test (Keller: para.0073 “It is to be understood that the definition of a counterfeit or substandard electronic device applies to but is not limited to … electronic devices which have been deliberately or unintentionally modified, electronic devices which have been deliberately modified to pose a security threat, and electronic devices which have been deliberately and/or intentionally modified for a malicious purpose with the intent to deceive as to the intended function.” Testing device that may be counterfeited, that includes devices that have been deliberately modified to be malicious or a security threat.);
measuring, by a sensor and in response to the applying of the distortion, a digital signal transmitted by a region of the PCB (Keller: para.0006 printed circuit board) for a presence of at least one anomalous element that could be indicative of a presence of the hostile element in the PCB (Keller: fig. 20 para.0131, para.0134, para.0128-0130 “Step 615 configures the power, ground, clock source and modulation parameters using circuits/boards 564a, 564h and/or 582 that provide means for modulating an input and/or output pin of the electronic device 2…. When powered, the electronic device 2 emits electromagnetic energy in step 623 that are gathered by the integrated antenna enclosure 500 via the antenna structure 556 in step 639 and is received at the RF receiver 572…. The received RF emissions are digitized in step 625 with the digital signal processed in step 627. Further, in step 631, the logic algorithms executed by the processing device 574 characterize the RF emission signature and the device 2 is either found as meeting a predetermined performance criteria or a predetermined emission signature in step 633 or is found as counterfeited or substandard in step 635. ” The modulations are applied to the device under test, such as device 2 described in Fig. 1, and the output emissions from the device are obtained and compared to emission signatures to identify a counterfeited device).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat in order to incorporate wherein the applying of the distortion comprises violating a preconfigured functionality of a hostile element to cause the hostile element to potentially reveal its presence when a hostile element is present in a printed circuit board (PCB) of the computing device under test; measuring, by a sensor and in response to the applying of the distortion, a digital signal transmitted by a region of the PCB for a presence of at least one anomalous element that could be indicative of a presence of the hostile element in the PCB
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of identification of security threats from devices that may cause issues (Keller: para.0073).
However Bahgat-Keller does not explicitly disclose measuring, by a nitrogen-vacancy diamond (NVD) sensor.
Turner discloses measuring, by a nitrogen-vacancy diamond (NVD) sensor, a digital signal transmitted by a region of a printed circuit board (PCB) of a computing device under test for a presence of at least one anomalous element that could be indicative of a hostile element in the PCB (Turner: para.0120 “In various embodiments, a magnetometer apparatus employs an ensemble of nitrogen vacancy (NV) centers in a diamond chip to achieve wide-field magnetic field measurement and mapping. NV centers in diamond are a modality for sensitive, high-spatial resolution, wide field of view imaging of microscopic magnetic fields, and may be employed to measure magnetic fields of magnetotactic bacteria, paleomagnetism in rocks, and magnetic fields emanated by propagating action potentials in neurons. The apparatus for measuring magnetic fields from integrated circuits (ICs) consists of an optical microscope and a photodetector (such as a photo-diode or a camera) to measure the fluorescence emitted by a thin ensemble NV layer at the surface of the diamond sensor chip, with the IC placed near to or in contact with the diamond.” para.0186 “the classifier algorithm may accept as input additional data pertaining to how the article and the crystal diamond interact, such as temperature data (e.g., a local temperature map)” para.0206 “The desired FPGA state-dependent magnetic field projection on each NV axis, ΔBz,i, and the change in local temperature, ΔT, are given by…” para.0243-0244 “Temperature changes in the diamond are determined from common mode shifts of NV resonance line centers….Ultimately, the multimodal information from the magnetic field maps, linewidth, contrast, and temperature may be used to create a more detailed fingerprint of IC activity. These physical parameters provide a rich data set of features that afford further dimensionality for characterization and classification.” One of the factors for finger printing the IC circuits state for classification of the state, e.g. for trojan detection in para.01988-0190, is central temperature changes of the NV diamond while reading the circuit board. The delta T being the change from some state, i.e a baseline, to the current temperature.)
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat-Keller with Turner in order to incorporate measuring, by a nitrogen-vacancy diamond (NVD) sensor, a digital signal transmitted by a region of a printed circuit board (PCB) of a computing device under test for a presence of at least one anomalous element that could be indicative of a hostile element in the PCB.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved detection of malicious circuitry (Turner: para.0188-0189, para.0232).
Regarding Claim 28, Bahgat-Keller-Turner discloses claim 27 as set forth above.
However Bahgat-Keller does not explicitly disclose wherein the comparing of the digital signal to the device fingerprint associated with the computing device under test comprises detecting a change in one or more of a resistance, a capacitance, an integrated circuit (IC) design, a trace impedance, or a thermal measurement.
Turner discloses wherein the comparing of the digital signal to the device fingerprint associated with the computing device under test comprises detecting a change in one or more of a resistance, a capacitance, an integrated circuit (IC) design, a trace impedance, or a thermal measurement (Turner: para.0015 “In some embodiments, determining the state of the integrated circuit further comprises providing linewidth, contrast, and/or temperature of the integrated circuit to the trained classifier.” Para.0061 “In some embodiments of the first device, the computing node is further configured to provide temperature data pertaining to the magnetic field-generating article to the algorithm.” Para.0244 “Temperature changes in the diamond are determined from common mode shifts of NV resonance line centers. The common mode shift for each pixel is calculated and then all the pixels are averaged together to give a single value for the bulk crystal temperature. …Ultimately, the multimodal information from the magnetic field maps, linewidth, contrast, and temperature may be used to create a more detailed fingerprint of IC activity. These physical parameters provide a rich data set of features that afford further dimensionality for characterization and classification.” The temperature changes of the circuit being analyzed is considered for classification.)
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat-Keller with Turner in order to incorporate wherein the comparing of the digital signal to the device fingerprint associated with the computing device under test comprises detecting a change in one or more of a resistance, a capacitance, an integrated circuit (IC) design, a trace impedance, or a thermal measurement.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved detection of malicious circuitry (Turner: para.0188-0189).
Regarding Claim 31, Bahgat-Keller -Turner discloses claim 27 as set forth above.
However Bahgat-Keller does not explicitly disclose wherein the detecting of the presence of the at least one anomalous element is performed by a neural network.
Turner disclose wherein the detecting of the presence of the at least one anomalous element is performed by a neural network (Turner: para.0189 “In general, the resulting IC magnetic fields pass largely unaltered through standard IC materials, and will vary spatially and temporally in ways that correlate with both IC architecture and operational state. Thus, high-resolution mapping of magnetic fields may yield simultaneous structural and functional information, and may be suitable for identification of malicious circuitry or Trojans, counterfeit detection, and fault detection.” Para.0085 “ the classifier algorithm may include one or more of the following: a convolutional neural network, a principal component analysis algorithm, and a support vector machine model. In some embodiments, the classifier algorithm may be trained using a corpus of labeled and/or unlabeled data pertaining to various magnetic field-generating articles (e.g., various integrated circuits) in various states, and the algorithm may thus be configured to determine a state of an article based on information regarding its magnetic vector field and/or other input data regarding the article.” Anomalous elements detected from the circuits can be done via a neural network.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat-Keller with Turner in order to incorporate wherein the detecting of the presence of the at least one anomalous element is performed by a neural network.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved detection of malicious circuitry (Turner: para.0188-0189).
Regarding Claim 32, Bahgat-Keller -Turner discloses claim 31 as set forth above.
However Bahgat-Keller does not explicitly disclose determining the device fingerprint by the neural network.
Turner discloses determining the device fingerprint by the neural network (Turner: para.0241 “ Fitting also extracts the Lorentzian linewidth and contrast, which can contain useful information about the properties of magnetic fields emanating from the circuit, and can be used as additional inputs to machine learning models to fingerprint IC activity.” Para.0085 “ the classifier algorithm may include one or more of the following: a convolutional neural network, a principal component analysis algorithm, and a support vector machine model. In some embodiments, the classifier algorithm may be trained using a corpus of labeled and/or unlabeled data pertaining to various magnetic field-generating articles (e.g., various integrated circuits) in various states, and the algorithm may thus be configured to determine a state of an article based on information regarding its magnetic vector field and/or other input data regarding the article.” The devices are fingerprinted and ).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat-Keller with Turner in order to incorporate determining the device fingerprint by the neural network.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved detection of malicious circuitry (Turner: para.0188-0189).
Regarding Claim 34, Bahgat-Keller -Turner discloses claim 27 as set forth above.
Bahgat further discloses measuring, by an electromagnetic (EM) probe, an EM radiation transmitted by the PCB, and wherein the detecting of the presence of the at least one anomalous element is based on the measured EM radiation (Bahgat: para.0022 “The present disclosure generally relates to EM emission of integrated circuits, and more particularly, to the correlation of EM emission measurements with photonic emission data for developing predictive EM emission models. A system according to various embodiments of the present disclosure may be able to remotely detect and classify changes in execution of program(s) by a target device and/or activation of malware(s) (e.g., one or more hardware Trojans, viruses, worms, ransomwares, spywares, adwares, scarewares and/or any other types of malicious programs or intrusive software) on the target device based on a comparison of measured EM emissions of one or more circuit blocks of an integrated circuit within the target device to EM emission models developed using photonic emission data.” para.0028 “FIG. 2 is a block diagram of an example system 200 that can measure EM emission from a device under test, consistent with an exemplary embodiment. Referring to FIG. 2, a test unit 201 (possibly the same as 109) may apply electrical stimuli or signals to an integrated circuit 210 of a target device, which is under test, to induce a variety of electrical activities and/or activate one of more circuit blocks of the integrated circuit of integrated circuit 210 to perform various operations. Integrated circuit 210 may be connected to a radio frequency (RF) probe 202 with a predetermined load (not shown). The output of RF probe 202 may be amplified by a pre-amplifier 203 and fed to an EM emission receiver 204, which may be a spectrum analyzer. Time-resolved EM emission waveforms 108 may be derived from the output of EM emission receiver 204.” The elements 202-204 of the RF probe, pre amplifier and EM receiver together are the EM probe, and receive the digital signal emitting from the circuit 210. This is then used to identify malicious components of the IC.).
Regarding Claims 37-38, they do not teach nor further define over the limitations of claims 31 and 32, therefore the supporting rationale for the rejections to claims 31 and 32 apply equally as well to that of claims 37 and 38.
Regarding Claim 40, Bahgat-Keller discloses claim 35 as set forth above.
However Bahgat-Keller does not explicitly disclose measuring, by a nitrogen-vacancy diamond (NVD) sensor, a digital signal transmitted by the PCB, and wherein the detecting of the presence of the at least one anomalous element is based on the measured digital signal.
Turner discloses measuring, by a nitrogen-vacancy diamond (NVD) sensor, a digital signal transmitted by the PCB, and wherein the detecting of the presence of the at least one anomalous element is based on the measured digital signal (Turner: para.0120 “In various embodiments, a magnetometer apparatus employs an ensemble of nitrogen vacancy (NV) centers in a diamond chip to achieve wide-field magnetic field measurement and mapping. NV centers in diamond are a modality for sensitive, high-spatial resolution, wide field of view imaging of microscopic magnetic fields, and may be employed to measure magnetic fields of magnetotactic bacteria, paleomagnetism in rocks, and magnetic fields emanated by propagating action potentials in neurons. The apparatus for measuring magnetic fields from integrated circuits (ICs) consists of an optical microscope and a photodetector (such as a photo-diode or a camera) to measure the fluorescence emitted by a thin ensemble NV layer at the surface of the diamond sensor chip, with the IC placed near to or in contact with the diamond.” para.0186 “the classifier algorithm may accept as input additional data pertaining to how the article and the crystal diamond interact, such as temperature data (e.g., a local temperature map)” para.0206 “The desired FPGA state-dependent magnetic field projection on each NV axis, ΔBz,i, and the change in local temperature, ΔT, are given by…” para.0243-0244 “Temperature changes in the diamond are determined from common mode shifts of NV resonance line centers….Ultimately, the multimodal information from the magnetic field maps, linewidth, contrast, and temperature may be used to create a more detailed fingerprint of IC activity. These physical parameters provide a rich data set of features that afford further dimensionality for characterization and classification.” One of the factors for finger printing the IC circuits state for classification of the state, e.g. for trojan detection in para.01988-0190, is central temperature changes of the NV diamond while reading the circuit board. The delta T being the change from some state, i.e a baseline, to the current temperature.)
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat with Turner in order to incorporate measuring, by a nitrogen-vacancy diamond (NVD) sensor, a digital signal transmitted by the PCB, and wherein the detecting of the presence of the at least one anomalous element is based on the measured digital signal.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved detection of malicious circuitry (Turner: para.0188-0189, para.0232).
Claim(s) 29 is/are rejected under 35 U.S.C. 103 as being unpatentable over Bahgat Shehata et al. (hereinafter Bahgat, US 2018/0027003 A1) in view of Keller, III et al. (hereinafter Keller, US 2015/0137830 A1) in view of Turner et al. (hereinafter Turner, US 2021/0239779 A1) further in view of Nowroz et al. (hereinafter Nowroz, “Novel Techniques for High-Sensitivity Hardware Trojan Detection Using Thermal and Power Maps” NPL 2014 attached.).
Regarding Claim 29, Bahgat-Keller-Turner discloses claim 28 as set forth above.
However Bahgat-Keller does not explicitly disclose wherein the detecting of the change in the thermal measurement comprises detecting, by the NVD sensor and in response to the distortion, a shift in a photoluminescence central frequency toward a lower frequency, wherein the shift is indicative of a change in the thermal measurement to a higher temperature.
Turner discloses wherein the detecting of the change in the thermal measurement comprises detecting, by the NVD sensor, a shift in a photoluminescence central temperature (Turner: para.0120 “In various embodiments, a magnetometer apparatus employs an ensemble of nitrogen vacancy (NV) centers in a diamond chip to achieve wide-field magnetic field measurement and mapping. NV centers in diamond are a modality for sensitive, high-spatial resolution, wide field of view imaging of microscopic magnetic fields, and may be employed to measure magnetic fields of magnetotactic bacteria, paleomagnetism in rocks, and magnetic fields emanated by propagating action potentials in neurons. The apparatus for measuring magnetic fields from integrated circuits (ICs) consists of an optical microscope and a photodetector (such as a photo-diode or a camera) to measure the fluorescence emitted by a thin ensemble NV layer at the surface of the diamond sensor chip, with the IC placed near to or in contact with the diamond.” para.0186 “the classifier algorithm may accept as input additional data pertaining to how the article and the crystal diamond interact, such as temperature data (e.g., a local temperature map)” para.0206 “The desired FPGA state-dependent magnetic field projection on each NV axis, ΔBz,i, and the change in local temperature, ΔT, are given by…” para.0243-0244 “Temperature changes in the diamond are determined from common mode shifts of NV resonance line centers….Ultimately, the multimodal information from the magnetic field maps, linewidth, contrast, and temperature may be used to create a more detailed fingerprint of IC activity. These physical parameters provide a rich data set of features that afford further dimensionality for characterization and classification.” One of the factors for finger printing the IC circuits state for classification of the state, e.g. for trojan detection in para.01988-0190, is central temperature changes of the NV diamond while reading the circuit board. The delta T being the change from some state, i.e a baseline, to the current temperature.)
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat-Keller with Turner in order to incorporate wherein the comparing of the one or more digital signals to the one or more baseline digital signals comprises detecting a change in a thermal measurement by detecting, by the NVD sensor, a shift in a photoluminescence central temperature.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved detection of malicious circuitry (Turner: para.0188-0189).
However, Bahgat-Keller -Turner does not explicitly disclose detecting in response to the distortion a shift in a photoluminescence central frequency toward a lower frequency, wherein the shift is indicative of a change in the thermal measurement to a higher temperature.
Nowroz discloses detecting in response to the distortion a shift in a photoluminescence central frequency toward a lower frequency, wherein the shift is indicative of a change in the thermal measurement to a higher temperature. (Nowroz: pg. 3 “For the purpose of this paper, we first apply random vectors to the ICs and get the estimated power trace of each block by Primetime-PX. We then use HotSpot [27] thermal simulation tools to create the steady state thermal maps of various test bench circuits as described in Section VI-A1. We denote the steady-state thermal maps obtained using design-time simulations of the original authentic chip by A1, A2,... for each benchmark. We perform Monte Carlo simulations of the original chip at various PV corners to get power consumption under various PV scenarios. The thermal maps from chips under test by using infrared imaging is represented by T1,T2,... for each benchmark. It is possible to use the thermal maps for Trojan detection, but the sensitivity is less than the Trojan detection using power maps. If power mapping of the thermal maps is not available, these thermal maps can be used for Trojan detection as described in Section III-C. We use authentic thermal maps A1, A2,... as the training set and perform our Trojan detection methods of 2DPCA on the thermal maps under tests T1,T2,... for Trojan detection as described in Section III-C.” thermal maps are used for trojan detection. Seen in pg. 6 Fig. 3 a “(a) Thermal map with Trojan”, it can be seen that the maps (a) and (b) are both showing thermal shifts and patterns, with higher temperatures depicted with lower frequency, i.e. red, in response to the distortion, i.e. random vectors applied to the IC).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat-Keller -Turner with Nowroz in order to incorporate detecting in response to the distortion a shift in a photoluminescence central frequency toward a lower frequency, wherein the shift is indicative of a change in the thermal measurement to a higher temperature.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved trojan detection (Nowroz: pg. 1 abstract.).
Claim(s) 30 is/are rejected under 35 U.S.C. 103 as being unpatentable over Bahgat Shehata et al. (hereinafter Bahgat, US 2018/0027003 A1) in view of Keller, III et al. (hereinafter Keller, US 2015/0137830 A1) in view of Turner et al. (hereinafter Turner, US 2021/0239779 A1) further in view of Nowroz et al. (hereinafter Nowroz, “Novel Techniques for High-Sensitivity Hardware Trojan Detection Using Thermal and Power Maps” NPL 2014 attached.) in view of Jacob et al. (hereinafter Jacob, US 2023/0176111 A1).
Regarding Claim 30, Bahgat-Keller -Turner-Nowroz discloses claim 29 as set forth above.
However Bahgat-Keller does not explicitly disclose generating, by the NVD sensor, a temperature map of the PCB, and wherein the detecting of the presence of the at least one anomalous element comprises comparing the generated map with a density map for a flow of current in the PCB.
Turner discloses generating, by the NVD sensor, a temperature map of a printed circuit board (PCB) (Turner: para.0216 “The state-dependent temperature of the FPGA was measured and determined using Equation 6. The dependence of current on the RO cluster size leads to state dependent temperature changes. Due to the high thermal conductivity of the monolithic crystal substrate, there is no spatial structure in the resultant temperature maps. However, from temperature measurements over the entire FOV, we are able to determine a scaling of ˜0.0075° C. per active ring oscillator (discussed further below) and for the 200 RO state we saw a temperature increase of ˜1.5° C.”, para.0186 local temperature map, para.0243 thermal signature. The sensor further obtains temperature data and generates a temperature map of the pcb.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat-Keller with Turner in order to incorporate generating, by the NVD sensor, a temperature map of a printed circuit board (PCB).
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved detection of malicious circuitry (Turner: para.0188-0189).
While Nowroz discloses the general usage of a current density map and temperature map to identify trojans, such as in pg. 5-6 III, Bahgat-Keller-Turner-Nowroz does not explicitly disclose wherein the detecting of the presence of the at least one anomalous element comprises comparing the generated map with a density map for a flow of current in the PCB.
Jacob discloses generating, by the sensor, a temperature map of a printed circuit board (PCB) (Jacob: para.0075 “Referring to FIG. 8, a schematic of a detection system for detecting hardware trojans in a target integrated circuit is provided. …In general, sensing circuit 54 includes an array of magnetic tunnel junction circuits MTJCij where i an j are integer labels. Each magnetic tunnel junction circuit MTJCij includes one or more magnetic tunnel junctions. Moreover, each magnetic tunnel junction circuit MTJCij is configured to provide data for and/or determine a temperature map or a current map of the target integrated circuit….Computer processor 56 executes instructions for producing the current and/or the temperature maps. In a refinement, computer processor 56 executes the machine learning algorithms (e.g., a trained neural network) for identifying hardware Trojans from the current and/or the temperature maps or data thereof.” The sensing circuit generates a temperature map and a current map, i.e. a current density map for the circuit.),
and wherein the detecting of the presence of the at least one anomalous element comprises comparing the generated map with a density map for a flow of current in the PCB (Jacob: para.0067 “Specifically, a multi-modal ML trojan detection algorithm that exploits uncorrelated and correlated data between thermal and current maps as well as the relative pixel intensity within each map with respect to other pixels can be employed for high accuracy trojan detection.” Thermal maps and current maps are correlated for high accuracy trojan detection.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Bahgat-Keller-Turner-Nowroz to incorporate Jacob in order to incorporate generating, by the sensor, a temperature map of a printed circuit board (PCB) and wherein the detecting of the presence of the at least one anomalous element comprises comparing the generated map with a density map for a flow of current in the PCB.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved accuracy of trojan detection on circuits (Jacob: para.0067).
Claim(s) 36 is/are rejected under 35 U.S.C. 103 as being unpatentable over Bahgat Shehata et al. (hereinafter Bahgat, US 2018/0027003 A1) in view of Keller, III et al. (hereinafter Keller, US 2015/0137830 A1) in view of Pathak et al. (hereinafter Pathak, US 2016/0124041 A1).
Regarding Claim 36, Bahgat-Keller discloses claim 35 as set forth above.
However Bahgat-Keller does not explicitly disclose wherein the comparing of the EM radiation to the device fingerprint associated with the computing device under test comprises detecting a change in one or more of a resistance, a capacitance, an integrated circuit (IC) design, or a trace impedance.
Pathak discloses wherein the comparing of the EM radiation to the device fingerprint associated with the computing device under test comprises detecting a change in one or more of a resistance, a capacitance, an integrated circuit (IC) design, or a trace impedance (Pathak: para.0090 “The design of the total die size of the sensor 10 can be based on included components and the necessary manufacturing process stages. Detection and analysis of the ultra-low power RF fields emitted from electronic devices (characteristic EMI signatures) can be performed for identification, differentiation, diagnostics, and prediction. IC tamper detection capability necessarily involves detection of changing of the internal circuitry of the target IC; even exposing circuits 20 using de-encapsulation techniques changes local trace impedances. These changes manifest as subtle changes to the unintended RF emission signature of the device. Detection of malicious tampering events is accelerated based on signature changes to provide constant protection of critical ICs utilizing a combination of advanced antenna 24, receiver, and signal processing technology driven by signal characterization algorithms for the detection and identification of malicious tampering that could occur in small electronic devices.” Changes to IC design as well as trace impedance changes are detected for malicious tampering).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat-Keller with Yang in order to incorporate wherein the comparing of the EM radiation to the device fingerprint associated with the computing device under test comprises detecting a change in one or more of a resistance, a capacitance, an integrated circuit (IC) design, or a trace impedance.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improved detection of malware and malicious changes to ICs (Pathak: para.0090, para.0118).
Claim(s) 41 is/are rejected under 35 U.S.C. 103 as being unpatentable over Bahgat Shehata et al. (hereinafter Bahgat, US 2018/0027003 A1) in view of Keller, III et al. (hereinafter Keller, US 2015/0137830 A1) in view of Wittenschlaeger (hereinafter Witt, US 2012/0131674 A1) further in view of Huang et al. (hereinafter Huang US 2021/0099474 A1) in view of Han et al. (hereinafter Han US 2018/0309770 A1).
Regarding Claim 41, Bahgat-Keller-Witt discloses claim 9 as set forth above.
However Bahgat-Keller-Witt does not explicitly disclose wherein the neural network is a generative adversarial network (GAN), and further comprising: generating a statistical distribution of behavioral characteristics of the computing device under test, and wherein the comparing of the one or more digital signals to the one or more baseline digital signals comprises comparing the one or more digital signals to the generated statistical distribution using a log-probability distance measure.
Huang discloses wherein the neural network is a generative adversarial network (GAN) (Huang: para.0099 “From the foregoing, it will be appreciated that example methods, apparatus and articles of manufacture have been disclosed that perform malware detection using a generative adversarial network. The disclosed methods, apparatus and articles of manufacture improve the efficiency of using a computing device by utilizing an autoencoder and GAN network to classify an input sample as malicious or safe.” A GAN is used to take an input sample to classify as malicious or safe.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Bahgat-Keller-Witt with that of Huang in order to incorporate wherein the neural network is a generative adversarial network (GAN).
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of improving efficiency in classification of malicious and safe inputs (Huang: para.0099).
However Bahgat-Keller-Witt-Huang does not explicitly disclose generating a statistical distribution of behavioral characteristics of the computing device under test, and wherein the comparing of the one or more digital signals to the one or more baseline digital signals comprises comparing the one or more digital signals to the generated statistical distribution using a log-probability distance measure.
Han discloses generating a statistical distribution of behavioral characteristics of the virtual machine under test (Han: para.0072 “calculate the probabilistic logarithm probability P.sub.H of all normal virtual machine's observation sequence corresponding to the HsMM according to formula (4), where P.sub.H is the initial probabilistic logarithm probability distribution constituted by the probabilistic logarithmic value of the normal virtual machine,” the probability distribution of a normal VM is calculated, i.e. the statical distribution of the behavior the online VM is supposed to exhibit), and
wherein the comparing of the one or more digital signals to the one or more baseline digital signals comprises comparing the one or more digital signals to the generated statistical distribution using a log-probability distance measure (Han: para.0015 “Step 4: The aforementioned HsMM online detection module, which is based on an algorithm obtained from Step 2, can detect the state and behavior of each virtual machine online and calculate its probabilistic logarithm probability and the Mahalanobis distance so as to judge whether the virtual machine is anomalous or not;” para.0079 “After the initial probabilistic logarithm probability distribution of the normal virtual machine and the probabilistic logarithm probability calculation equation of the online virtual machine are obtained, the distance between them can be measured by a simplified Mahalanobis distance.” The measurements from the online VM are compared to the baseline digital signal by comparing the measurements in the form of a probabilistic logarithm probability calculation to the logarithm probability distribution of the normal VMs to obtain a log probability distance.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date to combine Bahgat-Keller-Witt-Huang with Han in order to incorporate generating a statistical distribution of behavioral characteristics of the virtual machine under test and wherein the comparing of the one or more digital signals to the one or more baseline digital signals comprises comparing the one or more digital signals to the generated statistical distribution using a log-probability distance measure, and apply this concept to the computing device under test and its baseline of Bahgat-Keller-Witt Huang, for example in para.0053-0055 of Bahgat.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of identifying entities that are affected by viruses or attacks (Han: para.0003).
Claim(s) 45 is/are rejected under 35 U.S.C. 103 as being unpatentable over Bahgat Shehata et al. (hereinafter Bahgat, US 2018/0027003 A1) in view of Keller, III et al. (hereinafter Keller, US 2015/0137830 A1) in view of Butler et al. (hereinafter Butler, 5,269,016).
Regarding Claim 45, Bahgat-Keller discloses claim 1 as set forth above.
However Bahgat does not explicitly disclose wherein the violating of the preconfigured functionality of the hostile element comprises inducing a malfunction in the hostile element by providing a predetermined distortion pattern to a Byzantine circuit.
Keller discloses wherein the violating of the preconfigured functionality of the hostile element comprises inducing a malfunction in the hostile element by providing a predetermined distortion pattern (Keller: para.0119 “Enhanced modulation techniques envisioned herein include but are not limited to modulating multiple inputs or outputs substantially simultaneously with the same or different signal, modulating multiple such pins with a phase shifted signal relative to each other, using the results of the modulation to change modulation in a multi-step approach, applying a series of different modulation patterns to the device under test, applying a randomized modulation pattern to seek new useful discriminating emission results,” the malfunction introduced to the component include a predetermined distortion pattern of modulation)
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bahgat with Keller in order to incorporate wherein the violating of the preconfigured functionality of the hostile element comprises inducing a malfunction in the hostile element by providing a predetermined distortion pattern.
One of ordinary skill in the art would have been motivated to combine because of the expected benefit of identification of security threats from devices that may cause issues (Keller: para.0073).
However Bahgat-Keller does not explicitly disclose wherein the violating of the preconfigured functionality of the hostile element comprises inducing a malfunction in the hostile element by providing a predetermined distortion pattern to a Byzantine circuit.
Butler discloses a Byzantine circuit (Butler: col.1 lines 45-55 “It has been found that such a Byzantine resilient system can tolerate the loss of Ffault containment regions under the following conditions: (1)if (3F-1) FCRs are utilized, (2) if each FCR is connected to at least (2F-1) other FCRs by disjoint communication links or paths, (3) if (F-1) rounds of data exchange are used to distribute single-source data, and (4) if the operations of functioning FCRs of the system are time synchronized to within a known and specified time skew. T” the device is equipped with a byzantine circuit, comprising a particular distortion pattern, i.e. the orientation of the regions or the amount of time to skew itself is a pattern of +delta time, which causes a synchronization skew.).
Therefore it would have been obvious to one of ordinary skill in the art before the effective filing date of the claimed invention to combine Bhagat-Keller with Butler in order to incorporate a Byzantine circuit, such that testing of Baghat-Keller may be performed on a component with a byzantine circuit.
One of ordinary skill in the art would have ben motivated to combine because of the expected benefit of a more resilient system (Butler: col.1 lines 45-55, 18-32.)
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. Margalit US 2021/0240823 A1, para.0208 and Fig. 3 shows fault injection into IC
Any inquiry concerning this communication or earlier communications from the examiner should be directed to EUI H KIM whose telephone number is (571)272-8133. The examiner can normally be reached 7:30-5 M-R, M-F alternating.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Kamal B Divecha can be reached on 5712725863. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/EUI H KIM/ Examiner, Art Unit 2453
/KAMAL B DIVECHA/ Supervisory Patent Examiner, Art Unit 2453