DETAILED ACTION
713.09 Interviews Between Final Rejection and Notice of Appeal [R-08.2017]
Normally, one interview after final rejection is permitted in order to place the application in condition for allowance or to resolve issues prior to appeal. However, prior to the interview, the intended purpose and content of the interview should be presented briefly, preferably in writing. Such an interview may be granted if the examiner is convinced that disposal or clarification for appeal may be accomplished with only nominal further consideration. Interviews merely to restate arguments of record or to discuss new limitations which would require more than nominal reconsideration or new search should be denied. See MPEP § 714.13.
Interviews may be held after the expiration of the shortened statutory period and prior to the maximum permitted statutory period of 6 months without an extension of time. See MPEP § 706.07(f).
A second or further interview after a final rejection may be held if the examiner is convinced that it will expedite the issues for appeal or disposal of the application.
For interviews after notice of appeal, see MPEP § 1204.03.
Interview time will be revised to a limit of 1 hour per new application or RCE (utility)/CPA (design), when during prosecution, the examiner conducts an interview. When more than one interview is needed in an application supervisors will have the flexibility to approve additional time and ensure that the interviews are being used to advance prosecution.
Authorization for Internet Communications
The examiner encourages Applicant to submit an authorization to communicate with the examiner via the Internet by making the following statement (from MPEP 502.03):
“Recognizing that Internet communications are not secure, I hereby authorize the USPTO to communicate with the undersigned and practitioners in accordance with 37 CFR 1.33 and 37 CFR 1.34 concerning any subject matter of this application by video conferencing, instant messaging, or electronic mail. I understand that a copy of these communications will be made of record in the application file.”
Please note that the above statement can only be submitted via Central Fax (not Examiner's Fax), Regular postal mail, or EFS Web using PTO/SB/439.
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Response to Amendment
In response to the claim amendment in view of the Remarks filed 07/27/2026, the claim objection has been withdrawn.
In response to the claim amendment in view of the Remark, the 112 rejection have been withdrawn.
Claim Objections
Claims 1 – 3, and 5 – 17 are objected to because of the following informalities:
Regarding claim 1; the punctations “,” at end of each process step should be replace with a -- ; --. Further, the “and” at (line 4, claim 1) should be deleted and there should be an -- and -- added at the end of (line 5, claim 1). Further, the limitation “further comprising processing the extracted data” should apparently be -- processing the extracted data --.
Claims 2 – 3, 5 – 13 are dependent claims and thus also objected.
Regarding claims 7 and 13; the limitations “the process”, and “the integrity of the controller configuration” lack proper antecedent basis.
Appropriate correction is required.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Claim(s) 1 – 3, 5 – 15 and 17 are rejected under 35 U.S.C. 102(a)(1) as being anticipated by the prior art of record, Byres et al., (US 2012/0151558 A1) (hereinafter “Byres”).
Byres discloses;
Regarding claim 1, a method for monitoring and securing a network connected controller [i.e., a method is provided for securing industrial devices i.e., devices 104 and 106 in a networked environment i.e., network 10 using a security appliance i.e., nodes 103 and 105 (page 1, para 0009), (page 2, para 0011), (see figure 1) i.e., the endpoint device includes PLCs (programmable logic controller) (page 2, para 0035)], comprising the steps of:
providing a data acquisition device interconnected inline between the controller and a network [i.e., the security appliance i.e., security nodes 103 and 105 serially associated in the communication path (emphasis added) Note: “interconnected inline” between the network industrial device i.e., devices 104 and 106 to a data network i.e., network 10 (page 1, para 0009), (page 2, para 0011 and 0013), (page 3, para 0043), (see figures 1 and 5), (page 4, para 0048)], and
extracting data from the controller, using the data acquisition device [i.e., the security node passively collects (emphasis added) Note: “extracting” information on the traffic transiting between the endpoint device and other devices in the network (page 4, para 0039), (page 2, para 0012) i.e., the security appliance intercepts packets and determines if the packet should be forwarded from the endpoint device (page 1, para 10), (see figure 1) i.e., received traffic at the device interface 502 (see figures 5 and 13), (page 6, para 0064) i.e., monitoring, in the security appliance, data traffic originating from the industrial device…. (page 2, para 0011)],
further comprising processing the extracted data [i.e., learning characteristics; tailoring rules (para 0010) i.e., traffic is inspected and that non-CMP packets are managed using security modules 512, 514 and 516. The modules determines whether an anomalous condition exists with a packet (page 6, para 0064) i.e., packet payload decrypted and processed (para 0067) Note; Byres does not merely collect the controller traffic. The security node subsequently inspect/analyzes that traffic using its security modules, thereby processing the extracted data], wherein processing the extracted data comprises at least one of comparing the extracted data with pre-specified data [Note; to determine whether intercepted packet data satisfies these previously defined rule criteria i.e., defined management rule (page 6, para 0064) i.e., “Deny MODBUS diagnostic message with option code of 4”, allowing MODBUS firmware-load messages from a PLC programmable station while denying them from other address…the security node necessarily evaluates information in the extracted packet against the predetermined criterion specified by the applicable security rule].
Regarding claim 2, the method according to claim 1, wherein data is extracted during operation of the controller [i.e., monitoring transiting traffic (para 0010) i.e., all devices traffic is transparently bridged…the node monitors traffic originating from the device side (para 0055) i.e., operational phase continues inspection and forwarding of live traffic (para 0064 – 0066)].
Regarding claim 3, the method according to claim 1, wherein the data acquisition device enables operational data exchange between the controller and the network [i.e., transparently bridges traffic (para 0009) i.e., operating as a bridge from the device to the network (para 0043) i.e., packets forwarded between interfaces (para 0055 – 0057)].
Regarding claim 5. the method according to claim 1, wherein processing the extracted data comprises decrypting the extracted data [i.e., the security node collects information from traffic transitioning between the protected endpoint device and other network devices and expressly identifies such traffic as employing application/control protocols including Ethernet/IP, MODBUS, DNP3, ICCP, and OPC (page 3, para 0039) i.e., the device and network interfaces perform standard protocol and physical level processing on traffic passing through the interfaces and the processor 506 processes such traffic (page 4, para 0048), (see figure 5) i.e., the processed traffic is inspected to determine characteristics of the packet including whether the packet contains a malicious command (page 6, para 0064) i.e., device specific processing based upon particular protocol content, including identifying MODBUS diagnostic message having a specified option code and distinguishing MODBUS firmware-load and read messages (page 7, para 70 – 81) Note; Byres protocol processing of the intercepted controller traffic to interpret protocol specific packet content teaches decoding the extracted data].
Regarding claim 6, the method according to claim 1, further comprising, based on the processing step at least one of:
transmitting an alert message [i.e., heartbeat reports anomalous events (para 0010) i.e., report by exception (para 0042) i.e., exception heartbeat sent (para 0064 – 0066)].
Regarding claim 7, Byres disclose; the method according to claim 5, wherein at least one of controlling the process running on the controller comprises intervening in a process, interrupting the process, initiating another process on the controller [i.e., communication module decrypting data embedded in the packets (para 0012) i.e., MCR decryption (para 0060 – 0061) i.e., CMP packet decrypted (para 0067)].
Regarding claim 8, the method according to claim 1, wherein the data acquisition device is interconnected between the controller and a network switch [i.e., figurer 2 depicts multiple security appliances integrated in a network switch (para 0017 i.e., devices interconnected by a network switch hosting security nodes (para 0045)].
Regarding claim 9, the method according to claim 1, wherein the extracted data comprises at least one of sensor data. or actuator data [i.e., PLC is connected to sensors/actuators (para 0035 – 0036)].
Regarding claim 10, the method according to claim 1, wherein the controller is arranged for controlling a controlled process in at least one of an actuator or a sensor system [i.e., PLCs in SCADA systems controlling industrial processes with sensors/actuators (para 0035 – 0036)].
Regarding claim 11, the method according to claim 1, wherein the network is an industrial ethernet protocol type network [i.e., ethernet/IP, MODBUS, DNP3, OPC (para 0039) i.e., network 10 may be control network, internet, or internet (para 0043)].
Regarding claim 12, the method according to claim 1, wherein the controller is a programmable logic controller [i.e., industrial control equipment (such as PLCs) (para 0035)].
Regarding claim 13, Byres discloses; the method according to claim 6, wherein at least one of extracting the data from the controller, controlling the process running on the controller verifying integrity of the controller configuration, or ensuring the integrity of the controller configuration can be at least one of non-intrusive, independent on technology, independent on protocol, or independent on a supplier of at least one of the network or the controller [i.e., learning characteristics; tailoring rules (para 0010) i.e., traffic is inspected (para 0064) i.e., packet payload decrypted and processed (para 0067)].
Regarding claim 14, a monitoring system for monitoring and securing a network connected controller [i.e., a system is provided for securing industrial devices i.e., devices 104 and 106 in a networked environment i.e., network 10 using a security appliance i.e., nodes 103 and 105 (page 1, para 0009), (page 2, para 0011), (see figure 1) i.e., the endpoint device includes PLCs (programmable logic controller) (page 2, para 0035)], wherein the system comprises a data acquisition device interconnectable inline between the controller and a network [i.e., the security appliance i.e., security nodes 103 and 105 serially associated in the communication path (emphasis added) Note: “interconnected inline” between the network industrial device i.e., devices 104 and 106 to a data network i.e., network 10 (page 1, para 0009), (page 2, para 0011 and 0013), (page 3, para 0043), (see figures 1 and 5), (page 4, para 0048)], wherein the data acquisition device is arranged for extracting data from the controller [i.e., the security node passively collects (emphasis added) Note: “extracting” information on the traffic transiting between the endpoint device and other devices in the network (page 4, para 0039), (page 2, para 0012) i.e., the security appliance intercepts packets and determines if the packet should be forwarded from the endpoint device (page 1, para 10), (see figure 1) i.e., received traffic at the device interface 502 (see figures 5 and 13), (page 6, para 0064) i.e., monitoring, in the security appliance, data traffic originating from the industrial device….receiving encrypted configuration data from the management (page 2, para 0011)], wherein the system is arranged for processing the extracted data [i.e., learning characteristics; tailoring rules (para 0010) i.e., traffic is inspected and that non-CMP packets are managed using security modules 512, 514 and 516. The modules determines whether an anomalous condition exists with a packet (page 6, para 0064) i.e., packet payload decrypted and processed (para 0067) Note; Byres does not merely collect the controller traffic. The security node subsequently inspect/analyzes that traffic using its security modules, thereby processing the extracted data], wherein processing the extracted data comprises at least one of comparing the extracted data with pre-specified data [Note; to determine whether intercepted packet data satisfies these previously defined rule criteria i.e., defined management rule (page 6, para 0064) i.e., “Deny MODBUS diagnostic message with option code of 4”, allowing MODBUS firmware-load messages from a PLC programmable station while denying them from other address…the security node necessarily evaluates information in the extracted packet against the predetermined criterion specified by the applicable security rule].
Regarding claim 15, a non-transitory computer-readable computer program product for monitoring and securing a network connected controller [i.e., an apparatus is provided for securing industrial devices i.e., devices 104 and 106 in a networked environment i.e., network 10 using a security appliance i.e., nodes 103 and 105 (page 1, para 0009), (page 2, para 0011), (see figure 1) i.e., the endpoint device includes PLCs (programmable logic controller) (page 2, para 0035)], the computer program product comprising computer-readable code for causing a data acquisition device interconnected inline between the controller and a network [i.e., the security appliance i.e., security nodes 103 and 105 serially associated in the communication path (emphasis added) Note: “interconnected inline” between the network industrial device i.e., devices 104 and 106 to a data network i.e., network 10 (page 1, para 0009), (page 2, para 0011 and 0013), (page 3, para 0043), (see figures 1 and 5), (page 4, para 0048)] to perform the step of extracting data from the controller [i.e., the security node passively collects (emphasis added) Note: “extracting” information on the traffic transiting between the endpoint device and other devices in the network (page 4, para 0039), (page 2, para 0012) i.e., the security appliance intercepts packets and determines if the packet should be forwarded from the endpoint device (page 1, para 10), (see figure 1) i.e., received traffic at the device interface 502 (see figures 5 and 13), (page 6, para 0064) i.e., monitoring, in the security appliance, data traffic originating from the industrial device….receiving encrypted configuration data from the management (page 2, para 0011)], the step of processing the extracted data [i.e., learning characteristics; tailoring rules (para 0010) i.e., traffic is inspected and that non-CMP packets are managed using security modules 512, 514 and 516. The modules determines whether an anomalous condition exists with a packet (page 6, para 0064) i.e., packet payload decrypted and processed (para 0067) Note; Byres does not merely collect the controller traffic. The security node subsequently inspect/analyzes that traffic using its security modules, thereby processing the extracted data], wherein processing the extracted data comprises at least one of comparing the extracted data with pre-specified data [Note; to determine whether intercepted packet data satisfies these previously defined rule criteria i.e., defined management rule (page 6, para 0064) i.e., “Deny MODBUS diagnostic message with option code of 4”, allowing MODBUS firmware-load messages from a PLC programmable station while denying them from other address…the security node necessarily evaluates information in the extracted packet against the predetermined criterion specified by the applicable security rule].
Regarding claim 17, the system of claim 14, wherein the data acquisition device includes a first network terminal communicably coupled to the network and a second network terminal communicably coupled to the controller [i.e., a network interface 504 connects the security node to the network side…a device interface 502 connects the security node to the endpoint device (para 0048) i.e., show both interface (para 0021), (see figure 5)].
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claim(s) 16 is rejected under 35 U.S.C. 103 as being unpatentable over Byres in view of the prior art of record, Mulder et al., (US 9,032,522 B1) (hereinafter “Mulder”).
Regarding claim 16, Byres discloses; a method for monitoring and securing a network connected controller [i.e., a method is provided for securing industrial devices i.e., devices 104 and 106 in a networked environment i.e., network 10 using a security appliance i.e., nodes 103 and 105 (page 1, para 0009), (page 2, para 0011), (see figure 1) i.e., the endpoint device includes PLCs (programmable logic controller) (page 2, para 0035)], comprising the steps of:
providing a data acquisition device interconnected inline between the controller and a network [i.e., the security appliance i.e., security nodes 103 and 105 serially associated in the communication path (emphasis added) Note: “interconnected inline” between the network industrial device i.e., devices 104 and 106 to a data network i.e., network 10 (page 1, para 0009), (page 2, para 0011 and 0013), (page 3, para 0043), (see figures 1 and 5), (page 4, para 0048)];
extracting data from the controller by intercepting communications to and from the controller in real time, using the data acquisition device [i.e., the security node passively collects (emphasis added) Note: “extracting” information on the traffic transiting between the endpoint device and other devices in the network (page 4, para 0039), (page 2, para 0012) i.e., the security appliance intercepts packets and determines if the packet should be forwarded from the endpoint device (page 1, para 10), (see figure 1) i.e., received traffic at the device interface 502 (see figures 5 and 13), (page 6, para 0064) i.e., monitoring, in the security appliance, data traffic originating from the industrial device….receiving encrypted configuration data from the management (page 2, para 0011)];
analyzing the intercepted communications for deviations [i.e., analyze traffic for anomalous conditions (see ref. 1306 - 1308 of figure 13), (page 6, para 0064)]; and
based on detecting a deviation data, restoring the controller data [i.e., if it is identified that an anomalous condition exists with packet by one or more the security modules, the traffic is dealt with based on the defined management rules (see ref. 1308 – 1310 of figure 13), (page 6, para 0064)].
Byres does not disclose;
analyzing for deviation from controller configuration data and based on detected a deviation from the controller configuration data, restoring the controller configuration data.
However, Mulder discloses;
analyzing for deviation from controller configuration data [i.e., analyzer component 330 is utilized to facilitate comparison of data comprising an operational state (e.g., command instruction 190B) with baseline data (e.g., baseline data 342C) captured during the initial configuration of controller 110 for a particular operational state (col. 7, lines 59 – 63), (see ref. 620 of figure 6) Note: Mulder’s baseline represents the expected data/content associated with the controller’s configured operational state and therefor reasonably constitutes controller configuration data. Comparing intercepted controller communications with that baseline to identify anomalous content teaches analyzing the communications for deviations from controller configuration data]; and
based on detected a deviation from the controller configuration data, restoring the controller configuration data [i.e., update component 370 which facilitates updating baseline data…updating can comprise replacing a first instance of baseline data pertaining to an operational state with a second instance of baseline data pertaining to the operational state and that update component 370 facilitate storage/use of baseline data associated with an operational configuration (col. 9, lines 36 – 66), (col. 13, lines 62 – 67), (see figure 3), (col. 14, lines 1 – 3), (see ref. 650 of figure 6) Note; with Mulder’s baseline treated s controller-configuration data, replacing/storing the appropriate baseline associated with the controller’s operational configuration provides the basis for restoring limitation].
Before the effective filing date of the claimed invention it would have been obvious to a person of ordinary skill in the art to modify the teachings of Byres by adapting the teachings of Mulder to prevent subverting in STUX-NET attack (See Mulder; col. 1, lines 46 – 48).
Response to Arguments
Applicant's arguments filed 07/27/2026 in the Remarks have been fully considered but they are not persuasive because of the followings;
Regarding claim 1; applicant argued that Byres fails to disclose processing the extracted data by at least one of decompiling the extracted data or comparing the extracted data with pre-specified data. Applicant further argues that Byres’s decryption relates to separate management-server communications and that inspection under firewall/IDS rules does not constitute the claimed comparison.
The Examiner respectfully directs that applicant attention to the fact that claim 1 recites the alternatives of decompiling the extracted data or comparing the extracted data with pre-specified data. Thus, disclosure of the recited comparison is sufficient. Byres need not additionally disclose decompiling the extracted data. Byres teaches that the security node passively collects information from traffic transitioning between the protected endpoint device and other network devices (para 0039). Byres further teaches inspecting such traffic and managing non-CMP packets using security modules according to defined management rules, including determining whether a packet is addresses to a closed port or contains a malicious command (para 0064). Byres further teaches predetermined device-specific rules, including denying a MODBUS diagnostic message having option code 4 and allowing or denying MODBUS firmware-load and read messages based on their source. Application of these predetermined rules necessarily entails comparing information in the intercepted traffic with pre-specified rule criteria. For example, application of the rule denying a MODBUS diagnostic message having option code 4 requires determining whether the option-code information in the received message corresponds to the pre-specified value “4”. Likewise, application of rules permitting messages from specified sources while denying messages from other sources requires comparison of packet information with the pre-specified source criteria. Accordingly, Byres teaches processing the extracted data by comparing the extracted data with pre-specified data as recited claim 1.
In response to applicant's argument that the references fail to show certain features of the invention, it is noted that the features upon which applicant relies (i.e., Byres does not perform the comparison for purposes of controlling integrity verification) is not recited in the rejected claim(s). Although the claims are interpreted in light of the specification, limitations from the specification are not read into the claims. See In re Van Geuns, 988 F.2d 1181, 26 USPQ2d 1057 (Fed. Cir. 1993).
Regarding claim 16; applicant argued that Mulder’s operational-state baseline does not constitute the claimed controller configuration data and that neither Byres nor Mulder teaches based on detecting a deviation from the controller configuration data, restoring the controller configuration data.
The Examiner respectfully disagrees with this argument because under the broadest reasonable interpretation consistent with the specification, controller configuration data is not limited to a software/firmware image or configuration file stored within the controller, but reasonably encompasses data representing a configuration or operational state associated with the controller. Mulder teaches that during initial configuration, controller 110 is operated in various operational state to collect corresponding baseline data. The baseline data identifies communications associated with controller 110 and may include commands, instructions, measurements, setpoints, device addresses, and other data required for operations. Mulder further refers to such information as a “baseline data configuration” and describes baseline data associated with an operational configuration. Mulder further teaches comparing subsequently interpreted controller data with the stored baseline corresponding to the controller’s operation state. Analyzer component 330 compares captured command instruction 190B with baseline data captured during the initial configuration of controller 110, and deviations between the captured data and baseline are identified as anomalies. Accordingly, Mulder’s baseline data reasonably reads on the claimed “controller configuration data” and its anomaly analysis teaches “analyzing the intercepted communications for deviations from controller configuration data”.
Regarding “restoring the controller configuration data”, Mulder additionally teaches update component 370. Mulder explains that baseline data may be updated by replacing a first instance of baseline data pertaining to an operational state with a second instance of baseline data pertaining to that operational state, and that update component 370 facilitate storage and utilization of baseline data associated with a new operational configuration.
Thus, Mulder teaches both detecting deviations from the applicable baseline configuration data and replacing or updating such baseline configuration data. It would have been obvious to one of ordinary skill in the art to utilize Mulder’s disclosed update functionality in response to determining that the applicable configuration baseline data requires correction or replacement, thereby restoring the appropriate configuration data used for subsequent monitoring and anomaly detection. Such modification constitutes use of Mulder’s known update functionality for its known purpose and yields the predictable result of maintaining the appropriate configuration baseline data for the controller’s operational configuration.
Applicant’s argument that Mulder merely generates an alarm or places the process into a safe state does not address Mulder’s additional disclosure of update component 370 and its express functionality for replacing and maintaining baseline data associated with an operational configuration. Accordingly, Applicant’s argument do not overcome the rejection of claim 16.
Conclusion
THIS ACTION IS MADE FINAL. Applicant is reminded of the extension of time policy as set forth in 37 CFR 1.136(a).
A shortened statutory period for reply to this final action is set to expire THREE MONTHS from the mailing date of this action. In the event a first reply is filed within TWO MONTHS of the mailing date of this final action and the advisory action is not mailed until after the end of the THREE-MONTH shortened statutory period, then the shortened statutory period will expire on the date the advisory action is mailed, and any nonprovisional extension fee (37 CFR 1.17(a)) pursuant to 37 CFR 1.136(a) will be calculated from the mailing date of the advisory action. In no event, however, will the statutory period for reply expire later than SIX MONTHS from the mailing date of this final action.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to SYED A RONI whose telephone number is (571)270-7806. The examiner can normally be reached M-F 9:00-5:00 pm (EST).
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Jeffrey L Nickerson can be reached at (469) 295-9235. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/SYED A RONI/Primary Examiner, Art Unit 2432
