DETAILED ACTION
Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
Claim Interpretation
The following is a quotation of 35 U.S.C. 112(f):
(f) Element in Claim for a Combination. – An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The following is a quotation of pre-AIA 35 U.S.C. 112, sixth paragraph:
An element in a claim for a combination may be expressed as a means or step for performing a specified function without the recital of structure, material, or acts in support thereof, and such claim shall be construed to cover the corresponding structure, material, or acts described in the specification and equivalents thereof.
The claims in this application are given their broadest reasonable interpretation using the plain meaning of the claim language in light of the specification as it would be understood by one of ordinary skill in the art. The broadest reasonable interpretation of a claim element (also commonly referred to as a claim limitation) is limited by the description in the specification when 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is invoked.
As explained in MPEP § 2181, subsection I, claim limitations that meet the following three-prong test will be interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph:
(A) the claim limitation uses the term “means” or “step” or a term used as a substitute for “means” that is a generic placeholder (also called a nonce term or a non-structural term having no specific structural meaning) for performing the claimed function;
(B) the term “means” or “step” or the generic placeholder is modified by functional language, typically, but not always linked by the transition word “for” (e.g., “means for”) or another linking word or phrase, such as “configured to” or “so that”; and
(C) the term “means” or “step” or the generic placeholder is not modified by sufficient structure, material, or acts for performing the claimed function.
Use of the word “means” (or “step”) in a claim with functional language creates a rebuttable presumption that the claim limitation is to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites sufficient structure, material, or acts to entirely perform the recited function.
Absence of the word “means” (or “step”) in a claim creates a rebuttable presumption that the claim limitation is not to be treated in accordance with 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. The presumption that the claim limitation is not interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, is rebutted when the claim limitation recites function without reciting sufficient structure, material or acts to entirely perform the recited function.
Claim limitations in this application that use the word “means” (or “step”) are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action. Conversely, claim limitations in this application that do not use the word “means” (or “step”) are not being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, except as otherwise indicated in an Office action.
This application includes one or more claim limitations that do not use the word “means,” but are nonetheless being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, because the claim limitation(s) uses a generic placeholder that is coupled with functional language without reciting sufficient structure to perform the recited function and the generic placeholder is not preceded by a structural modifier. Such claim limitation(s) is/are: “a probing module” and “a transmission module to send” in claim 7.
Because this/these claim limitation(s) is/are being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, it/they is/are being interpreted to cover the corresponding structure described in the specification as performing the claimed function, and equivalents thereof.
If applicant does not intend to have this/these limitation(s) interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph, applicant may: (1) amend the claim limitation(s) to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph (e.g., by reciting sufficient structure to perform the claimed function); or (2) present a sufficient showing that the claim limitation(s) recite(s) sufficient structure to perform the claimed function so as to avoid it/them being interpreted under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph.
Claim Rejections - 35 USC § 112
The following is a quotation of 35 U.S.C. 112(b):
(b) CONCLUSION.—The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the inventor or a joint inventor regards as the invention.
The following is a quotation of 35 U.S.C. 112 (pre-AIA ), second paragraph:
The specification shall conclude with one or more claims particularly pointing out and distinctly claiming the subject matter which the applicant regards as his invention.
Claim limitations “a probing module” and “a transmission module to send” invoke 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph. However, the written description fails to disclose the corresponding structure, material, or acts for performing the entire claimed functions and to clearly link the structure, material, or acts to the functions. Searching of Applicant’s originally-filed specification did not uncover any hardware/structure to implement said modules (see [029], which states, “[c]omponents can be implemented in software and/or software”). Therefore, the claim is indefinite and is rejected under 35 U.S.C. 112(b) or pre-AIA 35 U.S.C. 112, second paragraph.
Applicant may:
(a) Amend the claim so that the claim limitation will no longer be interpreted as a limitation under 35 U.S.C. 112(f) or pre-AIA 35 U.S.C. 112, sixth paragraph;
(b) Amend the written description of the specification such that it expressly recites what structure, material, or acts perform the entire claimed function, without introducing any new matter (35 U.S.C. 132(a)); or
(c) Amend the written description of the specification such that it clearly links the structure, material, or acts disclosed therein to the function recited in the claim, without introducing any new matter (35 U.S.C. 132(a)).
If applicant is of the opinion that the written description of the specification already implicitly or inherently discloses the corresponding structure, material, or acts and clearly links them to the function so that one of ordinary skill in the art would recognize what structure, material, or acts perform the claimed function, applicant should clarify the record by either:
(a) Amending the written description of the specification such that it expressly recites the corresponding structure, material, or acts for performing the claimed function and clearly links or associates the structure, material, or acts to the claimed function, without introducing any new matter (35 U.S.C. 132(a)); or
(b) Stating on the record what the corresponding structure, material, or acts, which are implicitly or inherently set forth in the written description of the specification, perform the claimed function. For more information, see 37 CFR 1.75(d) and MPEP §§ 608.01(o) and 2181.
Claim Objections
Claim 7 is objected to because of the following informalities: Claim 7 recites “a probing module an OT device database…” on line 11, which appears to be missing a function. For the purposes of prosecution, the examiner will interpret the aforementioned limitation as “a probing module to populate an OT device database…”. Appropriate correction commensurate with the originally-filed specification is required.
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
This application currently names joint inventors. In considering patentability of the claims the examiner presumes that the subject matter of the various claims was commonly owned as of the effective filing date of the claimed invention(s) absent any evidence to the contrary. Applicant is advised of the obligation under 37 CFR 1.56 to point out the inventor and effective filing dates of each claim that was not commonly owned as of the effective filing date of the later invention in order for the examiner to consider the applicability of 35 U.S.C. 102(b)(2)(C) for any potential 35 U.S.C. 102(a)(2) prior art against the later invention.
Claim(s) 1-3 and 6-7 are rejected under 35 U.S.C. 103 as being unpatentable over Kothari et al. (U.S. Patent Application Publication No. 2023/0164183, hereinafter “Kothari”) in view of Ettema et al. (U.S. Patent No. 9860208, hereinafter “Ettema”).
Claims 1, 6, and 7:
Kothari discloses a deception server on a data communication network (§ 0142, Lines 3-6), for identifying network-based attacks on physical Operational Technology (OT) devices (§ 0075, Lines 10-14) with decoy OT devices (§ 0080, Lines 6-10) (§ 0093, Lines 4-7), the deception server comprising:
a processor (§ 0186, Lines 1-4);
a network communication module, communicatively coupled to the processor and to the data communication network (§ 0186, Lines 6-7); and
a memory, communicatively coupled to the processor (§ 0187, Lines 1-6) and storing:
wherein the specific deception appliance maintains VM machines for running decoy OT devices (§ 0144, Lines 3-6), based on the selected OT device profiles, on the remote private network (§ 0080, Lines 6-10), wherein responsive to detecting data traffic destined for one of the decoy OT devices, the specific deception appliance takes a security action on a source related to the detected data frames (§ 0080, Lines 12-14).
Kothari does not appear to disclose the deception server comprising:
a probing module to populate an OT device database by interrogating physical OT devices over the data communication network, and from responses, generating a profile for each interrogated physical OT device, each profile comprising at least data used to set up decoy OT devices that are virtualized to mirror each interrogated physical OT device;
an OT device profile database to receive a list of local physical OT devices running on a remote private network from a specific deception appliance on the remote private network,
wherein the OT device profile database selects OT device profiles from the OT device database based on the list of local physical OT devices; and
a transmission module to send the selected OT device profiles to the specific deception appliance, at the remote private network.
Ettema discloses a deception server comprising:
a probing module (Column 22, Lines 40-41; Agent 405 executing on target device 404) to populate an OT device database by interrogating physical OT devices over the data communication network, and from responses, generating a profile for each interrogated physical OT device (Column 22, Lines 40-47; Target device 404 includes an agent 405 that executes on target device 404 to collect various device profile data. Agent 405 can communicate various device profile data to data appliance 102 (e.g., upon request, periodically, based on an event, or using various other push and/or pull communications that can be triggered based on various events), each profile comprising at least data used to set up decoy OT devices that are virtualized to mirror each interrogated physical OT device (Column 23, Lines 17-25; A virtual clone of one or more target devices, such as target device 404, can be implemented where a base image is customized based on the device profile data stored in device profile data 440 for target device 404 to provide a virtual clone of that target device);
an OT device profile database to receive a list of local physical OT devices running on a remote private network from a specific deception appliance on the remote private network (Column 22, Lines 52-53; Data appliance 102 can store such device profile data locally),
wherein the OT device profile database selects OT device profiles from the OT device database based on the list of local physical OT devices (Column 44, Lines 20-21; One or more of the plurality of devices is selected as a target device to a clone); and
a transmission (Column 22, Lines 40-41; Agent 405 executing on target device 404) module to send the selected OT device profiles to the specific deception appliance, at the remote private network (Column 23, Lines 17-25; A virtual clone of one or more target devices, such as target device 404, can be implemented where a base image is customized based on the device profile data stored in device profile data 440 for target device 404 to provide a virtual clone of that target device).
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to modify Kothari’s deception server by integrating the teachings of Ettema in order to integrate a honey network with a target network to counter IP and peer-checking evasion techniques (Ettema, Column 9, Lines 24-25).
The method of claim 1 is implemented by the server of claim 7 and is therefore rejected with the same rationale. Further, Kothari discloses the method executing in a Wi-Fi network (§ 0072, Lines 5-6).
Regarding the “non-transitory computer readable medium” of claim 6, Kothari discloses some embodiments may include a non-transitory computer-readable storage medium having computer-readable code stored thereon for programming a computer, server, appliance, device, processor, circuit, etc. each of which may include a processor to perform functions as described and claimed herein (§ 0187, Lines 1-6).
Claim 2:
Kothari in view of Ettema further discloses wherein training the OT device database step comprises interrogating physical OT devices over the data communication network comprise device scanning checks for open ports to determine a scope of OT assets and corresponding protocols (Ettema, Column 19, Lines 48-53; Nmap scan report of (a portion of) the target enterprise network, which can include desktops, servers, printers, appliances, mobile devices, etc., which can be associated with certain attributes, including open ports and active services (along with their corresponding protocols)).
Claim 3:
Kothari in view of Ettema further discloses wherein training the OT device database step comprises interrogating physical OT devices over the data communication network comprise active probing (Ettema, Column 19, Lines 48-53; Nmap scan report of (a portion of) the target enterprise network, which can include desktops, servers, printers, appliances, mobile devices, etc., which can be associated with certain attributes, including open ports and active services, etc. Nmap scanning/probing is active probing).
Claim(s) 4 is rejected under 35 U.S.C. 103 as being unpatentable over Kothari et al. (U.S. Patent Application Publication No. 2023/0164183, hereinafter “Kothari”) in view of Ettema et al. (U.S. Patent No. 9860208, hereinafter “Ettema”); further in view of Chari et al. (U.S. Patent Application Publication No. 2015/0326594, hereinafter “Chari”).
Claim 4:
Kothari in view of Ettema discloses the method as recited in claim 1.
Kothari in view of Ettema does not appear to disclose wherein training the OT device database step comprises interrogating physical OT devices over the data communication network comprise passive network traffic monitoring.
Chari discloses interrogating physical OT devices over the data communication network comprise passive network traffic monitoring (Abstract, Lines 4-10; A network data collection and response system tracks network activity of the device and maintains a device inventory recording the device type and configuration information for the device along with a resource utilization profile for the device. The network data collection and response system detects high-risk or unauthorized network activity involving the device through passive monitoring).
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to modify Kothari and Ettema’s interrogating with Chari’s passive monitoring in order to obtain device information and detect high-risk or unauthorized network activity without the use of an agent installed on the device (Chari, Abstract, Lines 8-11).
Claim(s) 5 is rejected under 35 U.S.C. 103 as being unpatentable over Kothari et al. (U.S. Patent Application Publication No. 2023/0164183, hereinafter “Kothari”) in view of Ettema et al. (U.S. Patent No. 9860208, hereinafter “Ettema”); further in view of Park et al. (U.S. Patent Application Publication No. 2020/0125053, hereinafter “Park”).
Claim 5:
Kothari in view of Ettema discloses the method as recited in claim 1.
Kothari in view of Ettema does not appear to disclose wherein training the OT device database step comprises accessing a third-party OT/ICS device detection engine.
Park discloses wherein training the OT device database step comprises accessing a third-party OT/ICS device detection engine (§ 0090, Lines 1-4 and 9-12; The entity service is configured to create and manage smart entities. The smart entities include attributes that describe a corresponding device represented by the smart entities. The entity service can use operational technology (OT) data received from external systems or devices to generate values for the dynamic attributes of the smart entities).
Before the effective filing date of the claimed invention, it would have been obvious to one of ordinary skill in the art to modify Kothari and Ettema’s training by integrating the use of Park’s OT data in order to leverage external systems and data in the training of the OT device database.
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure:
U.S. Patent No. 11050787 (Sharifi Mehr) – Adaptively configuring and deploying honeypots in user compute resources based at least in part on a profile associated with a user account where a virtual machine is launched in connection with a virtual network associated with the user account.
U.S. Patent No. 10972503 (Mohan et al.) – Deception mechanisms in a containerized environment.
U.S. Patent Application Publication No. 2017/0293757 (Rosenman et al.) – Identifying anomalous descriptive characteristics in data communicated in an industrial control system and comparing them against a database of pre-determined normative descriptive characteristics.
U.S. Patent No. 9756075 (Gopalakrishna et al.) – Dynamic hiding of deception mechanisms (e.g., decoys) in an industrial control system.
U.S. Patent No. 9495188 (Ettema et al.) – Techniques for synchronizing a honey network configuration to reflect a target network environment.
Any inquiry concerning this communication or earlier communications from the examiner should be directed to NAM T TRAN whose telephone number is (408)918-7553. The examiner can normally be reached Monday-Friday 7AM-3PM EST.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Emmanuel Moise can be reached on 571-272-3865. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
/NAM T TRAN/Primary Examiner, Art Unit 2455