Notice of Pre-AIA or AIA Status
The present application, filed on or after March 16, 2013, is being examined under the first inventor to file provisions of the AIA .
DETAILED ACTION
Response to Arguments
Applicant's arguments filed 3/23/2026 have been fully considered. The arguments directed to the IPC communication are persuasive. The rejections made under 35 USC 102 directed to claims 1 and 15 view of Storms have responsively been withdrawn. After further search and consideration, a new grounds of rejection is presently presented further in view of Ke (Ke, Xiaodi. "Interprocess communication mechanisms with Inter-Virtual machine shared memory." (Year: 2011)). The Examiner notes that the rejection of claim 8 continues to be mapped to Storms and based under 35 USC 102 given the use of the broader “based on at least one of” language in claim 8.
Claim Rejections - 35 USC § 102
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis (i.e., changing from AIA to pre-AIA ) for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of the appropriate paragraphs of 35 U.S.C. 102 that form the basis for the rejections under this section made in this Office action:
A person shall be entitled to a patent unless –
(a)(1) the claimed invention was patented, described in a printed publication, or in public use, on sale, or otherwise available to the public before the effective filing date of the claimed invention.
Clam 8 is rejected under 35 U.S.C. 102(a)(1) as being anticipated by Storms (US-20190104138-A1).
Regarding claim 8, Storms shows a non-transitory computer-readable storage medium comprising instructions to cause processing circuitry of a virtual system for preventing security attacks of a power substation network, upon execution of the instructions by the processing circuitry, to: identify, by a virtual ([60] discussing a VM-based implantation) system comprising a first virtual machine connected to an information technology (IT) environment of a power substation network and further comprising a second virtual machine connected to an operational technology (OT) environment of the power substation network, an alert indicative of a potential security attack ([17-19] discussing a (virtualized; see [60]) threat monitoring edge devices communicating with both OT and IT systems); retrieve, by the virtual system, based on at least one of a memory access shared by the first virtual machine and the second virtual machine or Inter-Process Communication (IPC) between the first virtual machine and the second virtual machine, IT analytics data and OT analytics data associated with a device indicated in the alert ([32,35,41]); perform a cyber-physical ([31] discussing use of IT and OT analytic information) analysis ([29] discussing responsiveness to analyzed data from monitored components) of power substation physical components (Fig. 1 showing components 104 which, as [25] notes, “include subsystems for generating and/or distributing the power”) based on the IT analytics data and the OT analytics data ([31-32] discussing monitoring and correlation steps performed using gathered IT and OT data, including application of machine learning algorithms on collected data); and prevent, by the virtual system, communication with the device based on the cyber-physical analysis (Fig. 2, [16,31-33, 42]).
Claim Rejections - 35 USC § 103
In the event the determination of the status of the application as subject to AIA 35 U.S.C. 102 and 103 (or as subject to pre-AIA 35 U.S.C. 102 and 103) is incorrect, any correction of the statutory basis for the rejection will not be considered a new ground of rejection if the prior art relied upon, and the rationale supporting the rejection, would be the same under either status.
The following is a quotation of 35 U.S.C. 103 which forms the basis for all obviousness rejections set forth in this Office action:
A patent for a claimed invention may not be obtained, notwithstanding that the claimed invention is not identically disclosed as set forth in section 102, if the differences between the claimed invention and the prior art are such that the claimed invention as a whole would have been obvious before the effective filing date of the claimed invention to a person having ordinary skill in the art to which the claimed invention pertains. Patentability shall not be negated by the manner in which the invention was made.
Claims 1 and 15 are rejected under 35 U.S.C. 103 as being unpatentable over Storms (US-20190104138-A1) in view of Ke (Ke, Xiaodi. "Interprocess communication mechanisms with Inter-Virtual machine shared memory." (Year: 2011)).
Regarding claim 1, Storms shows a method for preventing security attacks ([24,29]) with a virtualization of power substation physical components into an information technology-operational technology architecture ([15-18]), the method comprising: identifying, by a virtual ([60] discussing a VM-based implantation) system comprising a first virtual machine connected to an information technology (IT) environment of a power substation network and further comprising a second virtual machine connected to an operational technology (OT) environment of the power substation network, an alert indicative of a potential security attack ([17-19] discussing a (virtualized; see [60]) threat monitoring edge devices communicating with both OT and IT systems); retrieving, by the virtual system based on communication between the first virtual machine and the second virtual machine, IT and OT analytics data associated with a device indicated in the alert ([32,35,41]); performing a cyber-physical ([31] discussing use of IT and OT analytic information) analysis ([29] discussing responsiveness to analyzed data from monitored components) of power substation physical components (Fig. 1 showing components 104 which, as [25] notes, “include subsystems for generating and/or distributing the power”) based on the IT analytics data and the OT analytics data ([31-32] discussing monitoring and correlation steps performed using gathered IT and OT data, including application of machine learning algorithms on collected data); and preventing, by the virtual system, communication with the device based on the cyber-physical analysis (Fig. 2, [16,31-33, 42]). Storms does not show where the VM communication is inter-process communication (IPC). Ke discloses mechanism for VM to VM communication performed via IPC (Abstract, pgs. 2, 10-11, and 14).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the networking and monitoring techniques of Storms, including the VM use and VM communication, with the VM-to-VM communication techniques disclosed by Ke in order to ensure fast and reliable communication between the cooperating processes (Ke, pg. 14).
Regarding claim 15, Storms shows a system for preventing security attacks with a virtualization of power substation physical components into an information technology-operational technology architecture, the system comprising: a virtual system ([60] discussing a VM-based implantation) comprising a first virtual machine connected to an information technology (IT) environment of a power substation network and further comprising a second virtual machine connected to an operational technology (OT) environment of the power substation network ([17-19] discussing a (virtualized; see [60]) threat monitoring edge devices communicating with both OT and IT systems); and memory coupled to processing circuitry, wherein the processing circuitry is configured to: identify, an alert indicative of a potential security attack ([17-19]); retrieve, by the virtual system, using a memory access shared by the first virtual machine and the second virtual machine, IT analytics data and OP analytics data associated with a device indicated in the alert ([32,35,41]); perform a cyber-physical ([31] discussing use of IT and OT analytic information) analysis ([29] discussing responsiveness to analyzed data from monitored components) of power substation physical components (Fig. 1 showing components 104 which, as [25] notes, “include subsystems for generating and/or distributing the power”) based on the IT analytics data and the OT analytics data ([31-32] discussing monitoring and correlation steps performed using gathered IT and OT data, including application of machine learning algorithms on collected data); and prevent, by the virtual system, communication with the device based on the cyber-physical analysis (Fig. 2, [16,31-33, 42]). Storms does not show where the VM communication is inter-process communication (IPC). Ke discloses mechanism for VM to VM communication performed via IPC (Abstract, pgs. 2, 10-11, and 14).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the networking and monitoring techniques of Storms, including the VM use and VM communication, with the VM-to-VM communication techniques disclosed by Ke in order to ensure fast and reliable communication between the cooperating processes (Ke, pg. 14).
Claims 2, 3, 16, and 17 are rejected under 35 U.S.C. 103 as being unpatentable over Storms in view of Ke as applied to claims 1 and 15 above, further in view of Kudo (US-20030126243-A1).
Regarding claim 2, Storms in view of Ke shows the power substation network (Storms, Fig. 1, [15]). The above combination does not show: wherein the alert is a new node alert indicating that the device is new to the network or was previously unidentified in the network. Kudo shows wherein the alert is a new node alert indicating that the device is new to the network or was previously unidentified in the network ([31,38]).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the networking and monitoring techniques of the above combination with the new device alerts of Kudo in order to prevent unintended changes to the network topology (Kudo, [38]).
Regarding claim 3, Storms in view of Ke shows claim 1. The above combination does not show wherein the alert is a new communication link alert indicating that the device has requested a new communication link. Kudo shows wherein the alert is a new communication link alert indicating that the device has requested a new communication link ([18,26]).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the networking and monitoring techniques of the above combination with the new device alerts of Kudo in order to prevent unintended changes to the network topology (Kudo, [38]).
Regarding claim 16, the limitations of said claims are addressed in the analysis of claim 2.
Regarding claim 17, the limitations of said claims are addressed in the analysis of claim 3.
Claims 9 and 10 are rejected under 35 U.S.C. 103 as being unpatentable over Storms in view of Kudo.
Regarding claim 9, Storms shows the power substation network (Fig. 1, [15]). Storms does not show: wherein the alert is a new node alert indicating that the device is new to the network or was previously unidentified in the network. Kudo shows wherein the alert is a new node alert indicating that the device is new to the network or was previously unidentified in the network ([31,38]).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the networking and monitoring techniques of the Storms with the new device alerts of Kudo in order to prevent unintended changes to the network topology (Kudo, [38]).
Regarding claim 10, Storms shows claim 1. Storms does not show wherein the alert is a new communication link alert indicating that the device has requested a new communication link. Kudo shows wherein the alert is a new communication link alert indicating that the device has requested a new communication link ([18,26]).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the networking and monitoring techniques of Storms with the new device alerts of Kudo in order to prevent unintended changes to the network topology (Kudo, [38]).
Claims 4 and 18 are rejected under 35 U.S.C. 103 as being unpatentable over Storms in view of Ke, further in view of Abraham (US-5983270-A).
Regarding claim 4, Storms in view of Ke shows device monitoring on the power substation network ([15-18,32,35]). Storms in view of Ke does not show an alert that is a new protocol alert indicating use of a protocol that has not been approved for the network. Abraham shows an alert that is a new protocol alert indicating use of a protocol that has not been approved for the network (col. 35 line 55 – col. 36 line 11, col. 36 line 64 – col. 37 line 4).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the networking and monitoring techniques of Storms in view of Ke with the protocol monitoring of Abraham in order to maintain the desired operational state of the monitored network.
Regarding claim 18, the limitations of said claims are addressed in the analysis of claim 4.
Claim 11 is rejected under 35 U.S.C. 103 as being unpatentable over Storms in view of Abraham (US-5983270-A).
Regarding claim 11, Storms shows device monitoring on the power substation network ([15-18,32,35]). Storms does not show an alert that is a new protocol alert indicating use of a protocol that has not been approved for the network. Abraham shows an alert that is a new protocol alert indicating use of a protocol that has not been approved for the network (col. 35 line 55 – col. 36 line 11, col. 36 line 64 – col. 37 line 4).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the networking and monitoring techniques of Storms with the protocol monitoring of Abraham in order to maintain the desired operational state of the monitored network.
Claims 5 and 19 are rejected under 35 U.S.C. 103 as being unpatentable over Storms in view of Ke, further in view of Ingram (Ingram, David, and Brian Smellie. "Solving Electrical Substation Timing Problems." Tekron Whitepaper, October. (Year: 2014)).
Regarding claim 5, Storms in view of Ke shows claim 1. Storms in view of Ke does not show: wherein the alert is a wrong time alert indicating that the device has reported an incorrect time. Ingram shows wherein the alert is a wrong time alert indicating that the device has reported an incorrect time (pgs. 6 – 7 and pg. 10 lines 52-59).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the networking and monitoring techniques of Storms in view of Ke with the time monitoring and alerting mechanisms of Ingram in order to better ensure system reliability and consistency via ensuring consistent time is maintained across the network.
Regarding claim 19, the limitations of said claims are addressed in the analysis of claim 5.
Claims 12 is rejected under 35 U.S.C. 103 as being unpatentable over Storms in view of Ingram.
Regarding claim 12, Storms shows claim 8. Storms does not show: wherein the alert is a wrong time alert indicating that the device has reported an incorrect time. Ingram shows wherein the alert is a wrong time alert indicating that the device has reported an incorrect time (pgs. 6 – 7 and pg. 10 lines 52-59).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the networking and monitoring techniques of Storms with the time monitoring and alerting mechanisms of Ingram in order to better ensure system reliability and consistency via ensuring consistent time is maintained across the network.
Claims 6, 7, and 20 are rejected under 35 U.S.C. 103 as being unpatentable over Storms in view of Ke, further in view of Vasseur (US-20210297442-A1).
Regarding claim 6, Storms in view of Ke shows wherein performing the cyber-physical analysis of the power substation physical components comprises:
generating the baseline IT-OT model (Storms, [18] discussing recording “configuration information” over “certain time based intervals” which [20] notes includes a “normal or typical range of values”) using IT area network interfaces (Storms, [28,58]) and information shared between the first virtual machine and the second virtual machine (Storms, [15-19,31, 60] discussing a virtualized implementation of the networking architecture, including data shared via the shared data storage) based on the IPC (Ke, Abstract, pgs. 2, 10-11, and 14); generating an IT-OT operational analytics model based on the IT analytics data and the OT analytics data (Storms, [20] discussing “OTE operational characteristics” including as noted in [22] the “current status (e.g., posture) of the OTE being monitored” with further discussion in [35,47]), comparing the IT-OT operational analytics model to the baseline IT-OT model (Storms, [20,35,47,49] discussing comparing real time operational data to typical data). Storms in view of Ke does not show consideration of communication protocols, accessed ports, network traffic flows, device functionality, and device profiles. Vasseur shows consideration of communication protocols ([41-42]), accessed ports ([42]), network traffic flows ([41-43]), device functionality ([47]), and device profiles ([49-59]).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the networking and monitoring techniques of Storms in view of Ke with the additional data collected and tracked, as suggested by Vasseur, in order to utilize a more complete understanding of the monitored network and thus better detect deviations from normal/expected values.
Regarding claim 7, the above combination further shows detecting a deviation of the IT-OT operational analytics model from the baseline IT-OT model (Storms, [35,47]).
Regarding claim 20, the limitations of said claims are addressed in the analysis of claim 6.
Claims 13 and 14 are rejected under 35 U.S.C. 103 as being unpatentable over Storms in view of Vasseur (US-20210297442-A1).
Regarding claim 13, Storms shows wherein execution of the instructions further causes the processing circuitry to:
generate the baseline IT-OT model ([18] discussing recording “configuration information” over “certain time based intervals” which [20] notes includes a “normal or typical range of values”) using IT area network interfaces ([28,58]) and information shared between the first virtual machine and the second virtual machine ([15-19,31, 60] discussing a virtualized implementation of the networking architecture, including data shared via the shared data storage) based on the IPC (Ke, Abstract, pgs. 2, 10-11, and 14); generate an IT-OT operational analytics model based on the IT analytics data and the OT analytics data ([20] discussing “OTE operational characteristics” including as noted in [22] the “current status (e.g., posture) of the OTE being monitored” with further discussion in [35,47]), compare the IT-OT operational analytics model to the baseline IT-OT model ([20,35,47,49] discussing comparing real time operational data to typical data). Storms does not show consideration of communication protocols, accessed ports, network traffic flows, device functionality, and device profiles. Vasseur shows consideration of communication protocols ([41-42]), accessed ports ([42]), network traffic flows ([41-43]), device functionality ([47]), and device profiles ([49-59]).
It would have been obvious to one of ordinary skill in the art before the effective filing date of the invention to modify the networking and monitoring techniques of Storms with the additional data collected and tracked, as suggested by Vasseur, in order to utilize a more complete understanding of the monitored network and thus better detect deviations from normal/expected values.
Regarding claim 7, the above combination further shows to: detect a deviation of the IT-OT operational analytics model from the baseline IT-OT model (Storms, [35,47]).
Conclusion
The prior art made of record and not relied upon is considered pertinent to applicant's disclosure. This includes:
Hassanzadeh (US-20200137104-A1) and Soliman (US-20210084058-A1).
Any inquiry concerning this communication or earlier communications from the examiner should be directed to JOHN M MACILWINEN whose telephone number is (571)272-9686. The examiner can normally be reached Monday - Friday, 9:00 - 5:00.
Examiner interviews are available via telephone, in-person, and video conferencing using a USPTO supplied web-based collaboration tool. To schedule an interview, applicant is encouraged to use the USPTO Automated Interview Request (AIR) at http://www.uspto.gov/interviewpractice.
If attempts to reach the examiner by telephone are unsuccessful, the examiner’s supervisor, Glenton B Burgess can be reached at (571) 272 - 3949. The fax phone number for the organization where this application or proceeding is assigned is 571-273-8300.
Information regarding the status of published or unpublished applications may be obtained from Patent Center. Unpublished application information in Patent Center is available to registered users. To file and manage patent submissions in Patent Center, visit: https://patentcenter.uspto.gov. Visit https://www.uspto.gov/patents/apply/patent-center for more information about Patent Center and https://www.uspto.gov/patents/docx for information about filing in DOCX format. For additional questions, contact the Electronic Business Center (EBC) at 866-217-9197 (toll-free). If you would like assistance from a USPTO Customer Service Representative, call 800-786-9199 (IN USA OR CANADA) or 571-272-1000.
JOHN MACILWINEN
Primary Examiner
Art Unit 2442
/JOHN M MACILWINEN/Primary Examiner, Art Unit 2454
Prosecution Insights